Rim/t7x
Rim/t7x
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 1 Wiki Activity

Allow certain malicious tools to be running

Browse Source
This commit is contained in:
momo5502 2022-05-23 19:19:28 +02:00
parent d69544ff5a
commit 9a30a63bd1
1 changed files with 134 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

143
src/client/component/arxan.cpp
View File

@ -30,6 +30,7 @@ namespace arxan
}
utils::hook::detour nt_close_hook;
utils::hook::detour nt_query_system_information_hook;
utils::hook::detour nt_query_information_process_hook;
utils::hook::detour create_mutex_ex_a_hook;
@ -44,25 +45,90 @@ namespace arxan
return create_mutex_ex_a_hook.invoke<HANDLE>(attributes, name, flags, access);
}
NTSTATUS WINAPI nt_query_information_process_stub(const HANDLE handle, const PROCESSINFOCLASS info_class,
void remove_evil_keywords_from_path(const UNICODE_STRING& string)
{
static const std::wstring evil_keywords[] =
{
L"IDA",
L"ida",
L"HxD",
L"cheatengine",
L"Cheat Engine",
};
if (!string.Buffer || !string.Length)
{
return;
}
std::wstring_view path(string.Buffer, string.Length / sizeof(string.Buffer[0]));
for (const auto& keyword : evil_keywords)
{
while (true)
{
const auto pos = path.find(keyword);
if (pos == std::wstring::npos)
{
break;
}
OutputDebugStringW(path.data());
for (size_t i = 0; i < keyword.size(); ++i)
{
string.Buffer[pos + i] = L'a';
}
OutputDebugStringW(path.data());
}
}
}
NTSTATUS NTAPI nt_query_system_information_stub(const SYSTEM_INFORMATION_CLASS system_information_class,
const PVOID system_information,
const ULONG system_information_length,
const PULONG return_length)
{
const auto status = nt_query_system_information_hook.invoke<NTSTATUS>(
system_information_class, system_information, system_information_length, return_length);
if (NT_SUCCESS(status))
{
if (system_information_class == SystemProcessInformation)
{
auto addr = static_cast<uint8_t*>(system_information);
while (true)
{
const auto info = reinterpret_cast<SYSTEM_PROCESS_INFORMATION*>(addr);
remove_evil_keywords_from_path(info->ImageName);
if (!info->NextEntryOffset)
{
break;
}
addr = addr + info->NextEntryOffset;
}
}
}
return status;
}
NTSTATUS WINAPI nt_query_information_process_stub(HANDLE handle, const PROCESSINFOCLASS info_class,
const PVOID info,
const ULONG info_length, const PULONG ret_length)
{
auto* orig = static_cast<decltype(NtQueryInformationProcess)*>(nt_query_information_process_hook.
get_original());
const auto status = orig(handle, info_class, info, info_length, ret_length);
if (NT_SUCCESS(status))
{
if (info_class == ProcessBasicInformation)
{
static DWORD explorer_pid = 0;
if (!explorer_pid)
{
auto* const shell_window = GetShellWindow();
GetWindowThreadProcessId(shell_window, &explorer_pid);
}
static_cast<PPROCESS_BASIC_INFORMATION>(info)->Reserved3 = PVOID(DWORD64(get_steam_pid()));
}
else if (info_class == 30) // ProcessDebugObjectHandle
@ -71,6 +137,10 @@ namespace arxan
return 0xC0000353;
}
else if (info_class == ProcessImageFileName || info_class == 43)
{
remove_evil_keywords_from_path(*static_cast<UNICODE_STRING*>(info));
}
else if (info_class == 7) // ProcessDebugPort
{
*static_cast<HANDLE*>(info) = nullptr;
@ -103,6 +173,11 @@ namespace arxan
return EXCEPTION_CONTINUE_EXECUTION;
}
if (info->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION)
{
//MessageBoxA(0, 0, "AV", 0);
}
return EXCEPTION_CONTINUE_SEARCH;
}
@ -112,6 +187,47 @@ namespace arxan
peb->BeingDebugged = false;
*reinterpret_cast<PDWORD>(LPSTR(peb) + 0xBC) &= ~0x70;
}
void restore_debug_functions()
{
static const char* functions[] = {
"DbgBreakPoint",
"DbgUserBreakPoint",
"DbgUiConnectToDbg",
"DbgUiContinue",
"DbgUiConvertStateChangeStructure",
"DbgUiDebugActiveProcess",
"DbgUiGetThreadDebugObject",
"DbgUiIssueRemoteBreakin",
"DbgUiRemoteBreakin",
"DbgUiSetThreadDebugObject",
"DbgUiStopDebugging",
"DbgUiWaitStateChange",
"DbgPrintReturnControlC",
"DbgPrompt",
};
using buffer = uint8_t[15];
static buffer buffers[ARRAYSIZE(functions)] = {};
static bool loaded = false;
const utils::nt::library ntdll("ntdll.dll");
for (int i = 0; i < ARRAYSIZE(functions); ++i)
{
const auto func = ntdll.get_proc<void*>(functions[i]);
if (!loaded)
{
memcpy(buffers[i], func, sizeof(buffer));
}
else
{
utils::hook::copy(func, buffers[i], sizeof(buffer));
}
}
loaded = true;
}
}
class component final : public component_interface
@ -122,12 +238,21 @@ namespace arxan
hide_being_debugged();
scheduler::loop(hide_being_debugged, scheduler::pipeline::async);
//restore_debug_functions();
create_mutex_ex_a_hook.create(CreateMutexExA, create_mutex_ex_a_stub);
const utils::nt::library ntdll("ntdll.dll");
nt_close_hook.create(ntdll.get_proc<void*>("NtClose"), nt_close_stub);
nt_query_information_process_hook.create(ntdll.get_proc<void*>("NtQueryInformationProcess"),
const auto nt_query_information_process = ntdll.get_proc<void*>("NtQueryInformationProcess");
nt_query_information_process_hook.create(nt_query_information_process,
nt_query_information_process_stub);
utils::hook::move_hook(nt_query_information_process);
const auto nt_query_system_information = ntdll.get_proc<void*>("NtQuerySystemInformation");
nt_query_system_information_hook.create(nt_query_system_information, nt_query_system_information_stub);
utils::hook::move_hook(nt_query_system_information); // Satisfy arxan
AddVectoredExceptionHandler(1, exception_filter);
}