/**************************************/* 作者:半斤八兩/* 博客:/* 日期:2013-12-11 00:00/**************************************
只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教! 相信大家都有用过海风前辈写的strongod反反调试插件.用起来是十分方便的. strongod 是属于驱动级别的插件, 如果是我们自己写的应用层软件,如何来对付strongod呢? 在strongod早些版本的时候,我们是可以通过符号链接来做检测的.早些版本符号链接是写死的.名为 fengyue .但是到后来,符号链接,弄成自定义的了,缺省的,还是不变的. 大多数人都会通过strongod的ini配置文件来修改缺省的名字.
它的INI配置是直接写入OD 的 ollydbg.ini 里面. 打开ollydbg.ini 直接搜索 strongod 就能搜到如下内容,
[Plugin StrongOD]CreateProcessMode=0HidePEB=1IsPatchFloat=1IsAdvGoto=1KernelMode=1KillPEBug=1SuperEnumMod=1AdvAttach=1SkipExpection=1HideWindow=1HideProcess=1ProtectProcess=1DriverKey=-82693034DriverName=fengyueOrdFirst=0BreakOnLdr=0BreakOnTls=0RemoveEpOneShot=1ShowBar=17LoadSym=1AutoUpdate=0UpdateURL=http://sod.ibt.name/update.txt其中 DriverName=fengyue 就是我们关心的. 虽然现在符号连接是"随机的" 但是我们还是有办法获取真实的符号链接名~ 具体的看源码吧.
1 DWORD IsEnumProcess() 2 { 3 DWORD dwPidTemp = 0; 4 5 HANDLE procSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 6 if(procSnap == INVALID_HANDLE_VALUE) 7 { 8 return -1; 9 } 10 11 PROCESSENTRY32 procEntry = { 0}; 12 13 procEntry.dwSize = sizeof(PROCESSENTRY32); 14 15 BOOL bRet = Process32First(procSnap,&procEntry); 16 17 while(bRet) 18 { 19 if(0 == strcmp(procEntry.szExeFile, "csrss.exe")) 20 { 21 dwPidTemp = procEntry.th32ProcessID; 22 return TRUE; 23 } 24 25 bRet = Process32Next(procSnap, &procEntry); 26 } 27 28 CloseHandle(procSnap); 29 30 return dwPidTemp; 31 } 32 33 34 BOOL CCheckStrongOD::IsDebugSymbolicLink() 35 { 36 UNICODE_STRING strDirName; 37 OBJECT_ATTRIBUTES oba; 38 NTSTATUS ntStatus; 39 HANDLE hDirectory; 40 41 RtlInitUnicodeString(&strDirName, L"\\global??"); 42 InitializeObjectAttributes(&oba, &strDirName, OBJ_CASE_INSENSITIVE, NULL, NULL); 43 44 ntStatus = ZwOpenDirectoryObject(&hDirectory, DIRECTORY_QUERY, &oba); 45 46 if (ntStatus != STATUS_SUCCESS) 47 { 48 if (hDirectory != NULL) 49 { 50 ZwClose(hDirectory); 51 } 52 53 return NULL; 54 } 55 56 UNICODE_STRING symbolicLink; 57 BYTE buffer[2048] = { 0}; 58 ULONG ulLength = 2048; 59 ULONG ulContext = 0; 60 ULONG ulRet = 0; 61 62 RtlInitUnicodeString(&symbolicLink, L"SymbolicLink"); 63 64 tagSTRONGOD tagStrongOD = { 0}; 65 66 tagStrongOD.m_dwFlag = 123456789; 67 tagStrongOD.m_dwCressPID = IsEnumProcess(); 68 tagStrongOD.m_wMePid = (WORD)GetCurrentProcessId(); 69 70 do{ 71 ntStatus = ZwQueryDirectoryObject(hDirectory, buffer, ulLength, 72 TRUE, FALSE, &ulContext, &ulRet); 73 74 if ((ntStatus != STATUS_SUCCESS) && (ntStatus != STATUS_NO_MORE_ENTRIES)) 75 { 76 if (hDirectory != NULL) 77 { 78 ZwClose(hDirectory); 79 } 80 } 81 else if (STATUS_NO_MORE_ENTRIES == ntStatus) 82 { 83 if (hDirectory != NULL) 84 { 85 ZwClose(hDirectory); 86 } 87 88 return NULL; 89 } 90 91 PDIRECTORY_BASIC_INFORMATION directoryInfo = (PDIRECTORY_BASIC_INFORMATION)buffer; 92 93 WCHAR szSymbolicLink[MAXBYTE] = L"\\\\.\\"; 94 wcscat(szSymbolicLink, directoryInfo->ObjectName.Buffer); 95 96 int nLen = wcslen(szSymbolicLink); 97 98 if(nLen > 0xc) 99 {100 continue;101 }102 103 BYTE szControlCode1[MAXBYTE] = { 0};104 DWORD dwBytesReturned = 0;105 106 HANDLE hFile = 107 CreateFileW(szSymbolicLink, GENERIC_READ|GENERIC_WRITE,108 FILE_SHARE_READ|FILE_SHARE_WRITE,109 NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);110 111 if(hFile != (HANDLE)-1)112 {113 114 }115 else116 {117 continue;118 }119 120 *(PDWORD)&szControlCode1[0] = tagStrongOD.m_dwFlag;121 *(PDWORD)&szControlCode1[4] = tagStrongOD.m_dwCressPID;122 *(PDWORD)&szControlCode1[8] = 1;123 *(PDWORD)&szControlCode1[0xc] = 1;124 *(PDWORD)&szControlCode1[0x10] = 1;125 *(PDWORD)&szControlCode1[0x14] = 1;126 *(PDWORD)&szControlCode1[0x18] = 1;127 *(PDWORD)&szControlCode1[0x1c] = 0;128 *(PWORD)&szControlCode1[0x20] = tagStrongOD.m_wMePid;129 *(PWORD)&szControlCode1[0x22] = 0;130 131 BYTE szControlCode2[0x24] = {132 0x42, 0xa3, 0x53, 0x04, 0x4D, 0x4B, 0xA3, 0xC4, 0xEC, 0xF8, 133 0xE5, 0x41, 0x9D, 0xEF, 0xAE, 0x46, 0x95, 0x59, 0x7D, 0xF3, 134 0x98, 0xBD, 0xDC, 0xD4, 0x1F, 0xE9, 0xC1, 0xD9, 0xFB, 0xF1, 135 0xE9, 0x8D, 0x85, 0x0B, 0x7B, 0x14};136 137 138 BYTE szOutBuffer[0x4] = { 0xff, 0xff, 0xff, 0xff};139 140 for(int i = 0; i < 0x24; i++)141 {142 szControlCode1[i] ^= szControlCode2[i];143 }144 145 146 if(TRUE == DeviceIoControl(hFile, 0x22215c, 147 szControlCode2, 0x24, NULL, 0, &dwBytesReturned, NULL))148 {149 150 }151 else152 {153 CloseHandle(hFile);154 continue;155 }156 157 *(PDWORD)&szControlCode1[0] = tagStrongOD.m_dwFlag;158 *(PDWORD)&szControlCode1[4] = 0;159 *(PDWORD)&szControlCode1[8] = 0;160 *(PDWORD)&szControlCode1[0xc] = 0;161 *(PDWORD)&szControlCode1[0x10] = 0;162 *(PDWORD)&szControlCode1[0x14] = 0;163 *(PDWORD)&szControlCode1[0x18] = 0;164 *(PDWORD)&szControlCode1[0x1c] = 0;165 *(PWORD)&szControlCode1[0x20] = 0;166 *(PWORD)&szControlCode1[0x22] = 0;167 168 169 for(i = 0; i < 0x24; i++)170 {171 szControlCode1[i] ^= szControlCode2[i];172 }173 174 if(0 == DeviceIoControl(hFile, 0x222178, szControlCode1,175 0x24, NULL, 0, &dwBytesReturned, NULL))176 {177 178 }179 else180 {181 CloseHandle(hFile);182 continue;183 }184 185 186 187 *(PDWORD)&szControlCode1[0] = tagStrongOD.m_dwFlag;188 *(PDWORD)&szControlCode1[4] = 0;189 *(PDWORD)&szControlCode1[8] = 0;190 *(PDWORD)&szControlCode1[0xc] = 0;191 *(PDWORD)&szControlCode1[0x10] = 0;192 *(PDWORD)&szControlCode1[0x14] = 0;193 *(PDWORD)&szControlCode1[0x18] = 0;194 *(PDWORD)&szControlCode1[0x1c] = 0;195 *(PWORD)&szControlCode1[0x20] = tagStrongOD.m_wMePid;196 *(PWORD)&szControlCode1[0x22] = 0;197 198 199 for(i = 0; i < 0x24; i++)200 {201 szControlCode1[i] ^= szControlCode2[i];202 }203 204 205 206 if(TRUE == DeviceIoControl(hFile, 0x222160, szControlCode2,207 0x24, szOutBuffer, 0x4, &dwBytesReturned, NULL))208 {209 // MessageBox(0, 0, 0, 0);210 211 _putws(szSymbolicLink);212 213 return TRUE;214 }215 else216 {217 CloseHandle(hFile);218 continue;219 }220 221 }while(TRUE);222 223 224 if (hDirectory != NULL)225 {226 ZwClose(hDirectory);227 }228 229 return FALSE;230 }231 232 233 CCheckStrongOD::CCheckStrongOD()234 {235 system("chcp 936 & cls & color 0a & title 检测StrongOD Kernel Mode");236 }237 238 CCheckStrongOD::~CCheckStrongOD()239 {240 system("pause");241 }
SRC和BIN下载地址: