内核无HOOK文件防删除

ゝ一世哀愁。 2022-07-21 01:55 175阅读 0赞

内核无HOOK文件防删除，可以过冰刃，xuetr，easydelete

本来是打算写暴力删除文件的程序的，结果意外发现，只需要在内核发送irp打开一个文件，之后不关闭Object，就拒绝其他程序访问了，easydelete这个工具还是比较强的，不过也不能删除，关键是不挂钩任何函数，不修该系统内核，看属性的时候只能看到一个常规，其它的什么都看不到，当然了360（7.0）版本的文件粉碎机也是搞不定的

打开文件使用炉子的代码：

NTSTATUS  
IoCompletionRoutine(  
IN PDEVICE\_OBJECT DeviceObject,  
IN PIRP Irp,  
IN PVOID Context)  
\{  
\*Irp->UserIosb = Irp->IoStatus;  
if (Irp->UserEvent)  
KeSetEvent(Irp->UserEvent, IO\_NO\_INCREMENT, 0);  
if (Irp->MdlAddress)  
\{  
IoFreeMdl(Irp->MdlAddress);  
Irp->MdlAddress = NULL;  
\}  
IoFreeIrp(Irp);  
return STATUS\_MORE\_PROCESSING\_REQUIRED;  
\}

NTSTATUS  
IrpCreateFile(  
OUT PFILE\_OBJECT \*FileObject,  
IN ACCESS\_MASK DesiredAccess,  
IN PUNICODE\_STRING FilePath,  
OUT PIO\_STATUS\_BLOCK IoStatusBlock,  
IN PLARGE\_INTEGER AllocationSize OPTIONAL,  
IN ULONG FileAttributes,  
IN ULONG ShareAccess,  
IN ULONG CreateDisposition,  
IN ULONG CreateOptions,  
IN PVOID EaBuffer OPTIONAL,  
IN ULONG EaLength)  
\{  
NTSTATUS ntStatus;

HANDLE hFile;  
PFILE\_OBJECT pFile, \_FileObject;  
UNICODE\_STRING UniDeviceNameString;  
OBJECT\_ATTRIBUTES ObjectAttributes;  
PDEVICE\_OBJECT DeviceObject, RealDevice;

PIRP Irp;  
KEVENT kEvent;  
PIO\_STACK\_LOCATION IrpSp;  
ACCESS\_STATE AccessState;  
AUX\_ACCESS\_DATA AuxData;  
IO\_SECURITY\_CONTEXT SecurityContext;

WCHAR DeviceNameString\[\]=L"\\\\DosDevices\\\\\*:\\\\";

if(FilePath->Length < 6)  
return STATUS\_INVALID\_PARAMETER;  
// \\\\??\\c:\\xxxx

DeviceNameString\[12\]=FilePath->Buffer\[0\];

RtlInitUnicodeString( &UniDeviceNameString, DeviceNameString);  
InitializeObjectAttributes(&ObjectAttributes, &UniDeviceNameString, OBJ\_KERNEL\_HANDLE, NULL, NULL);

ntStatus = IoCreateFile(&hFile,  
GENERIC\_READ|SYNCHRONIZE,  
&ObjectAttributes,  
IoStatusBlock,  
NULL,  
FILE\_ATTRIBUTE\_NORMAL,  
FILE\_SHARE\_READ|FILE\_SHARE\_WRITE|FILE\_SHARE\_DELETE,  
FILE\_OPEN,  
FILE\_SYNCHRONOUS\_IO\_NONALERT,  
NULL,  
0,  
CreateFileTypeNone,  
NULL,  
IO\_NO\_PARAMETER\_CHECKING);

if(!NT\_SUCCESS(ntStatus))  
\{  
KdPrint(("IrpCreateFile: IoCreateFile 0x%X.\\n",ntStatus));  
return ntStatus;  
\}  
RecoverOneKernelRoutine("ObReferenceObjectByHandle");  
ntStatus = ObReferenceObjectByHandle(hFile,  
FILE\_READ\_ACCESS, // ACCESS\_MASK  
\*IoFileObjectType,  
KernelMode,  
(PVOID\*)&pFile,  
0);

NtClose(hFile);

if(!NT\_SUCCESS(ntStatus))  
\{  
KdPrint(("IrpCreateFile: ObReferenceObjectByHandle 0x%X.\\n",ntStatus));  
return ntStatus;  
\}

DeviceObject = pFile->Vpb->DeviceObject;  
RealDevice = pFile->Vpb->RealDevice;  
ObDereferenceObject(pFile);

InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ\_CASE\_INSENSITIVE, 0, NULL);

ntStatus = ObCreateObject(KernelMode,  
\*IoFileObjectType,  
&ObjectAttributes,  
KernelMode,  
NULL,  
sizeof(FILE\_OBJECT),  
0,  
0,  
(PVOID\*)&\_FileObject);

if(!NT\_SUCCESS(ntStatus))  
\{  
KdPrint(("IrpCreateFile: ObCreateObject 0x%X.\\n",ntStatus));  
return ntStatus;  
\}

Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);  
if(Irp == NULL)  
\{  
KdPrint(("IrpCreateFile: IoAllocateIrp 0x%X.\\n",ntStatus));  
ObDereferenceObject(\_FileObject);  
return STATUS\_INSUFFICIENT\_RESOURCES;  
\}

KeInitializeEvent(&kEvent, SynchronizationEvent, FALSE);

RtlZeroMemory(\_FileObject, sizeof(FILE\_OBJECT));  
\_FileObject->Type = IO\_TYPE\_FILE;  
\_FileObject->Size = sizeof(FILE\_OBJECT);  
\_FileObject->DeviceObject = RealDevice;  
\_FileObject->Flags = FO\_SYNCHRONOUS\_IO;  
\\\\??\\c:\\xxxxx  
RtlInitUnicodeString( &\_FileObject->FileName, &FilePath->Buffer\[2\]);  
KdPrint(("准备打开文件：%ws\\n",\_FileObject->FileName.Buffer));  
KeInitializeEvent(&\_FileObject->Lock, SynchronizationEvent, FALSE);  
KeInitializeEvent(&\_FileObject->Event, NotificationEvent, FALSE);

RtlZeroMemory(&AuxData, sizeof(AUX\_ACCESS\_DATA));  
ntStatus = SeCreateAccessState( &AccessState,  
&AuxData,  
DesiredAccess,  
IoGetFileObjectGenericMapping());

if (!NT\_SUCCESS(ntStatus))  
\{  
KdPrint((" IrpCreateFile: SeCreateAccessState 0x%X.\\n",ntStatus));  
IoFreeIrp(Irp);  
ObDereferenceObject(\_FileObject);  
return ntStatus;  
\}

SecurityContext.SecurityQos = NULL;  
SecurityContext.AccessState = &AccessState;  
SecurityContext.DesiredAccess = DesiredAccess;  
SecurityContext.FullCreateOptions = 0;

Irp->MdlAddress = NULL;  
Irp->AssociatedIrp.SystemBuffer = EaBuffer;  
Irp->Flags = IRP\_CREATE\_OPERATION|IRP\_SYNCHRONOUS\_API;  
Irp->RequestorMode = KernelMode;  
Irp->UserIosb = IoStatusBlock;  
Irp->UserEvent = &kEvent;  
Irp->PendingReturned = FALSE;  
Irp->Cancel = FALSE;  
Irp->CancelRoutine = NULL;  
Irp->Tail.Overlay.Thread = PsGetCurrentThread();  
Irp->Tail.Overlay.AuxiliaryBuffer = NULL;  
Irp->Tail.Overlay.OriginalFileObject = \_FileObject;

IrpSp = IoGetNextIrpStackLocation(Irp);  
IrpSp->MajorFunction = IRP\_MJ\_CREATE;  
IrpSp->DeviceObject = DeviceObject;  
IrpSp->FileObject = \_FileObject;  
IrpSp->Parameters.Create.SecurityContext = &SecurityContext;  
IrpSp->Parameters.Create.Options = (CreateDisposition << 24) | CreateOptions;  
IrpSp->Parameters.Create.FileAttributes = (USHORT)FileAttributes;  
IrpSp->Parameters.Create.ShareAccess = (USHORT)ShareAccess;  
IrpSp->Parameters.Create.EaLength = EaLength;

IoSetCompletionRoutine(Irp, IoCompletionRoutine, 0, TRUE, TRUE, TRUE);  
//add  
RecoverIopfCompleteRequest();  
ntStatus = IofCallDriverEx(DeviceObject, Irp);  
if(ntStatus == STATUS\_PENDING)  
KeWaitForSingleObject(&kEvent, Executive, KernelMode, TRUE, 0);

ntStatus = IoStatusBlock->Status;

if(!NT\_SUCCESS(ntStatus))  
\{  
KdPrint(("IrpCreateFile: IoCallDriver 0x%X.\\n",ntStatus));  
\_FileObject->DeviceObject = NULL;  
ObDereferenceObject(\_FileObject);  
\}  
else  
\{  
InterlockedIncrement((volatile LONG \*)&\_FileObject->DeviceObject->ReferenceCount);  
if (\_FileObject->Vpb)  
InterlockedIncrement((volatile LONG \*)&\_FileObject->Vpb->ReferenceCount);  
\*FileObject = \_FileObject;  
\}

return ntStatus;  
\}  
//UNICODE\_STRING Name;  
//IO\_STATUS\_BLOCK IoBlock;  
//RtlInitUnicodeString(&Name,L"C:\\\\test1.exe");  
//Status=IrpCreateFile(&FileObj,GENERIC\_READ|DELETE,&Name,&IoBlock,0,FILE\_ATTRIBUTE\_NORMAL,FILE\_SHARE\_READ|FILE\_SHARE\_WRITE|FILE\_SHARE\_DELETE,FILE\_OPEN,0,0,0);

上面是测试代码，打开之后不ObreferenceObject，直接返回，之后文件就被保护起来了