29.模块隐藏

Notes #滴水基础_Win32

模块隐藏之断链

  • TEB(Thread Environment Block),它记录的相关线程的信息，每一个线程都有自己的TEB，FS:[0]即是当前现成的TEB
  • PEB(Process Environment Block),存放进程信息，每个进程都有自己的PEB信息，TEB偏移0x30即当前进程的PEB
  • TEB和PEB都在用户层面
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
#include <stdio.h>
#include <Windows.h>

typedef struct _UNICODE_STRING
{
	USHORT Length;
	USHORT MaximumLength;
	PWSTR Buffer;
}UNICODE_STRING, * PUNICODE_STRING;

typedef struct _PEB_LDR_DATA
{
	ULONG		Length;
	BOOLEAN		Initialized;
	PVOID		SsHandle;
	LIST_ENTRY	InLoadOrderModuleList;
	LIST_ENTRY	InMemoryOrderModuleList;
	LIST_ENTRY	InInitializtionOrderModuleList;
}PED_LDR_DATA, * PPEB_LDR_DATA;

typedef struct _LDR_DATA_TABLE_ENTRY
{
	LIST_ENTRY	InLoadOrderModuleList;				//代表按加载顺序构成的模块链表
	LIST_ENTRY	InMemoryOrderModuleList;			//代表按内存顺序构成的模块链表
	LIST_ENTRY	InInitializtionOrderModuleList;		//代表按初始化顺序构成的模块链表
	void* BaseAddress;								//该模块的基地址
	void* EntryPoint;								//该模块的入口
	ULONG		SizeOfImage;						//该模块的影像大小
	UNICODE_STRING	FullDllName;					//包含路径的模块名
	UNICODE_STRING	BaseDllName;					//不包含路径的模块名
	ULONG		Flags;
	SHORT		LoadCount;							//该模块的引用计数
	SHORT		TlsIndex;
	HANDLE		SectionHandle;
	ULONG		CheckSum;
	ULONG		TimeDateStamp;
}LDR_MODULE, * PLDR_MODULE;

void HideMoudle(char* szModuleName)
{
	HMODULE hModule = GetModuleHandleA(szModuleName);
	PLIST_ENTRY Head, Cur;
	PPEB_LDR_DATA ldr;
	PLDR_MODULE ldm;
	__asm
	{
		mov eax,fs:[0x30]
		mov ecx,[eax+0x0c]
		mov ldr,ecx
	}
	Head = &(ldr->InLoadOrderModuleList);
	Cur = Head->Flink;
	do
	{
		//宏 CONTAINING_RECODE 根据结构体中的某成员的地址来推算出该结构体整体的地址
		ldm = CONTAINING_RECORD(Cur, LDR_MODULE, InLoadOrderModuleList);

		if (hModule == ldm->BaseAddress)
		{
			ldm->InLoadOrderModuleList.Blink->Flink =
				ldm->InLoadOrderModuleList.Flink;
			ldm->InLoadOrderModuleList.Flink->Blink =
				ldm->InLoadOrderModuleList.Blink;
			ldm->InInitializtionOrderModuleList.Blink->Flink =
				ldm->InInitializtionOrderModuleList.Flink;
			ldm->InInitializtionOrderModuleList.Flink->Blink =
				ldm->InInitializtionOrderModuleList.Blink;
			ldm->InMemoryOrderModuleList.Blink->Flink =
				ldm->InMemoryOrderModuleList.Flink;
			ldm->InMemoryOrderModuleList.Flink->Blink =
				ldm->InMemoryOrderModuleList.Blink;
			break;
		}
		Cur = Cur->Flink;
	} while (Head != Cur);
}
int main()
{
	char szName[] = "kernel32.dll";
	printf("按下任意键\n");
	getchar();
	HideMoudle(szName);
	printf("Hide!\n");
	getchar();
	return 0;
}

模块隐藏之VAD树

模块隐藏之PE指纹

最好的隐藏

  • 注入代码！

关于本文

由 GuQing 撰写，采用 CC BY-NC 4.0 许可协议。