一种无差别的anti-anti双机调试的方法

hong5499999

一种无差别的抗-反双击调试的方法，原创不原创不敢说，也许还有很多人也想到过这种方法
无差别，意思是不针对某.sys，完全只需要修改自己的内核即可实现的。。

思路如下，
Hook KdpStub 到一个我们的函数，暂名 beforeKdpTrap

beforeKdpTrap要做的事情如下

1. __declspec(naked) beforeKdpTrap() {
   
2.   __asm {
   
3.     pushad
   
4.     mov eax, KdDebuggerEnabled
   
5.     mov byte ptr [eax],0x1
   
6.     popad
   
7.     jmp KdpTrap
   
8.   }
   
9. }

复制代码

这样做的好处是可以避免通过检测 KiDebugRoutine 来发现调试。

理论上，就算 KdpStub 被校验了，也可以在它的内部找另外一个跳板。

下面是一份win7 32bit 下，针对 Txxsafe.sys 所做的处理。

代码:

1. #include <ntddk.h>
   
2. //#include "..\1.h"
   
3. DRIVER_INITIALIZE DriverEntry;
   
4. DRIVER_UNLOAD nUnload;
   
5. 
   
6. KIRQL Irql;
   
7. PVOID uTesSafeIBase;
   
8. 
   
9. PVOID KdpStub;
   
10. PVOID KdpTrap;
    
11. PVOID KiDebugRoutine;
    
12. PVOID KdpSuspendAllBreakpoints;
    
13. PVOID KdDisableDebuggerWithLock;
    
14. 
    
15. PVOID GetSysRoutineAddress (IN PCWSTR funcName) {
    
16.   UNICODE_STRING us_fn;
    
17.   RtlInitUnicodeString(&us_fn,funcName);
    
18.   return MmGetSystemRoutineAddress(&us_fn);
    
19. }
    
20. 
    
21. VOID WPOFF() {
    
22.   __asm {
    
23.     cli
    
24.     mov eax,cr0
    
25.     and eax,not 10000h
    
26.     mov cr0,eax
    
27.   }
    
28. }
    
29. 
    
30. VOID WPON() {
    
31.   __asm {
    
32.     mov eax,cr0
    
33.     or eax,10000h
    
34.     mov cr0,eax
    
35.     sti
    
36.   }
    
37. }
    
38. 
    
39. __declspec(naked) beforeKdpTrap() {
    
40.   __asm {
    
41.     pushad
    
42.     mov eax, KdDebuggerEnabled
    
43.     mov byte ptr [eax],0x1
    
44.     popad
    
45.     jmp KdpTrap
    
46.   }
    
47. }
    
48. 
    
49. __declspec(naked) nkKdDisableDebuggerWithLock() {
    
50.   __asm {
    
51.     pushad
    
52.     mov eax, KdDebuggerEnabled
    
53.     mov byte ptr [eax],0x0
    
54.     popad
    
55.     mov edi,edi
    
56.     push ebp
    
57.     mov ebp,esp
    
58.     push ecx
    
59.     push KdDisableDebuggerWithLock
    
60.     add dword ptr [esp],0x6
    
61.     retn
    
62.   }
    
63. }
    
64. 
    
65. VOID LoadImageNotifyRoutine( __in_opt PUNICODE_STRING FullImageName, __in HANDLE ProcessId, __in PIMAGE_INFO  ImageInfo ) {
    
66.   if (wcsstr(FullImageName->Buffer, L"TesSafe.sys") && wcsstr(FullImageName->Buffer, L":") ) {
    
67.     uTesSafeIBase=ImageInfo->ImageBase;
    
68.     __asm {
    
69.       int 3
    
70.     }
    
71.   }
    
72. }
    
73. 
    
74. VOID initialize() {
    
75. 
    
76.   PVOID *p1;
    
77.   PVOID f1;
    
78. 
    
79.   p1 = (ULONG)KdEnableDebugger+3;
    
80.   f1 = (ULONG)KdEnableDebugger+7+(ULONG)*p1;
    
81. 
    
82.   p1 = (ULONG)f1+0x7b;
    
83.   f1 = (ULONG)f1+0x7f+(ULONG)*p1;//KdInitSystem
    
84. 
    
85.   p1 = (ULONG)f1+0x4c;
    
86.   KiDebugRoutine=(ULONG)*p1;
    
87. 
    
88.   p1 = (ULONG)f1+0x50;
    
89.   KdpStub=(ULONG)*p1;
    
90. 
    
91.   p1 = (ULONG)f1+0x2ce;
    
92.   KdpTrap=(ULONG)*p1;
    
93. 
    
94. 
    
95.   p1 = (ULONG)KdDisableDebugger+3;
    
96.   f1 = (ULONG)KdDisableDebugger+7+(ULONG)*p1;//KdDisableDebuggerWithLock
    
97.   KdDisableDebuggerWithLock = f1;
    
98.   p1 = (ULONG)f1+0x97;
    
99.   KdpSuspendAllBreakpoints = (ULONG)f1+0x9b+(ULONG)*p1;//KdpSuspendAllBreakpoints
    
100. 
     
101. 
     
102.   WPOFF();
     
103.   Irql=KeRaiseIrqlToDpcLevel();
     
104.   __asm {
     
105.     pushad
     
106. 
     
107.     mov eax, KdpSuspendAllBreakpoints
     
108.     mov byte ptr [eax], 0xc3
     
109. 
     
110.     mov eax, KdpStub
     
111.     mov byte ptr [eax], 0x68
     
112.     mov ebx, beforeKdpTrap
     
113.     mov dword ptr [eax+0x01], ebx
     
114.     mov byte ptr [eax+0x05], 0xC3
     
115. 
     
116.     mov eax, KdDisableDebuggerWithLock
     
117.     mov byte ptr [eax], 0x68
     
118.     mov ebx, nkKdDisableDebuggerWithLock
     
119.     mov dword ptr [eax+0x01], ebx
     
120.     mov byte ptr [eax+0x05], 0xC3
     
121. 
     
122.     popad
     
123.   }
     
124.   KeLowerIrql(Irql);
     
125.   WPON();
     
126. 
     
127.   PsSetLoadImageNotifyRoutine(LoadImageNotifyRoutine);
     
128. }
     
129. 
     
130. VOID nUnload(__in struct _DRIVER_OBJECT *DriverObject) {
     
131.   PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine);
     
132.   WPOFF();
     
133.   Irql=KeRaiseIrqlToDpcLevel();
     
134.   __asm {
     
135.     pushad
     
136.     mov eax, KdpStub
     
137.     mov byte ptr [eax], 0x8b
     
138.     mov byte ptr [eax+0x01], 0xff
     
139.     mov byte ptr [eax+0x02], 0x55
     
140.     mov byte ptr [eax+0x03], 0x8b
     
141.     mov byte ptr [eax+0x04], 0xec
     
142.     mov byte ptr [eax+0x05], 0x53
     
143. 
     
144.     mov eax, KdDisableDebuggerWithLock
     
145.     mov byte ptr [eax], 0x8b
     
146.     mov byte ptr [eax+0x01], 0xff
     
147.     mov byte ptr [eax+0x02], 0x55
     
148.     mov byte ptr [eax+0x03], 0x8b
     
149.     mov byte ptr [eax+0x04], 0xec
     
150.     mov byte ptr [eax+0x05], 0x51
     
151.     popad
     
152.   }
     
153.   KeLowerIrql(Irql);
     
154.   WPON();
     
155. }
     
156. 
     
157. NTSTATUS DriverEntry (__in struct _DRIVER_OBJECT *DriverObject, __in PUNICODE_STRING RegistryPath) {
     
158.   initialize();
     
159.   DriverObject->DriverUnload = nUnload;
     
160.   return STATUS_SUCCESS;
     
161. }
     

复制代码

最后我就说一句，本人所分析的内容完全属于本人自己电脑上cpu、内存中的内容，没有修改任何第三方程序本身的代码（）。。。以上提到的某Txxsafe.sys仅用来运行测试。