Win7 Kernel Reload Peloader kernel version

Heavy-duty focus, in fact, is to implement a cottage version of Windows Peloader, overloading is actually a module to re-load a copy of the other memory, run it.

The so-called kernel overload, is the kernel file that is: Ntkrnlpa.exe to load a copy to the memory, and run it, such a benefit can avoid all hooks, such as SSDT, Inlinehook, etc., the principle is the hook continue

Hook the main original kernel, but actually windows is going to be our own kernel.

Not much to say, start to dry up, first look for kernel modules, the way to traverse the kernel module many kinds of, here I use is through the LDR linked list:

Find kernel modules pldr_data_table_entry searchdriver (pdriver_object pdriverobject, wchar_t *strdrivername) {LDR_DATA_TABLE_ Entry*pdatatableentry, *ptempdatatableentry; Plist_entryplist; Unicode_stringusmodulename; Rtlinitunicodestring (&usmodulename, strdrivername);pD atatableentry = (ldr_data_table_entry*) pDriverObject- >driversection;if (!pdatatableentry) {return 0;} PList = Pdatatableentry->inloadorderlinks.flink;while (pList! = &pdatatableentry->inloadorderlinks) { Ptempdatatableentry = (Ldr_data_table_entry *) plist;if (0 = = rtlcompareunicodestring (&pTempDataTableEntry-> Basedllname, &usmodulename, FALSE) {return ptempdatatableentry;} PList = Plist->flink;} return 0;}

When the kernel module is found, it begins to read the file to memory ~

NTSTATUS readfiletomemory (LPWStr lpfilename, pvoid* lpvirtualpoint, PVOID poriimage) {ntstatusstatus; handlehfile;object_attributesobjattr; Unicode_stringusfilename;io_status_blockiostatusblock; Large_integerfileoffset; pvoidpvirtualaddress; Ulonguindex; Ulongusizeofsection; Ulongusectionaddress;image_dos_headerimagedosheader;image_nt_headersimagentheader; Pimage_section_headerpimagesectionheader; Rtlinitunicodestring (&usfilename, lpFileName); Initializeobjectattributes (&objattr,&usfilename,obj_ Case_insensitive,null,null); Status = ZwCreateFile (&hfile,file_all_access,&objattr,&iostatusblock,null,file_attribute_normal,file _share_read,file_open,file_non_directory_file,null,0); if (! Nt_success (status) {Dbgprint ("ZwCreateFile faild\n"); return status;} Fileoffset.quadpart = 0; Status = Zwreadfile (hfile,null,null,null,&iostatusblock,&imagedosheader,sizeof (IMAGE_DOS_HEADER),& Fileoffset,null); if (! Nt_success (Status)) {dbgprint ("Zwreadfile imagedosheader faild\n"); Zwclose (HFile); return Status;} Fileoffset.quadpart = imagedosheader.e_lfanew; Status = Zwreadfile (hfile,null,null,null,&iostatusblock,&imagentheader,sizeof (IMAGE_NT_HEADERS),& Fileoffset,null); if (! Nt_success (Status)) {dbgprint ("Zwreadfile imagentheader faild\n"); Zwclose (hfile); return Status;} Read segment Pimagesectionheader = (pimage_section_header) exallocatepool (nonpagedpool,sizeof (image_section_header) * ImageNtHeader.FileHeader.NumberOfSections), if (NULL = = Pimagesectionheader) {dbgprint ("ExAllocatePool Pimagesectionheader faild\n "); Zwclose (hfile); return status_unsuccessful;} Fileoffset.quadpart + = sizeof (image_nt_headers); Status = Zwreadfile (hfile,null,null,null,&iostatusblock,pimagesectionheader,sizeof (IMAGE_SECTION_HEADER) * Imagentheader.fileheader.numberofsections,&fileoffset,null); if (! Nt_success (Status)) {dbgprint ("Zwreadfile pimagesectionheader faild\n"); Exfreepool (Pimagesectionheader); Zwclose (hfile); return Status;} Replication Memory Pvirtualaddress = ExAllocatePool (NonPagedPool, Imagentheader. Optionalheader.sizeofimage); if (NULL = = pvirtualaddress) {dbgprint ("ExAllocatePool pvirtualaddress faild\n"); Exfreepool (Pimagesectionheader); Zwclose (hfile); return status_unsuccessful;} RtlZeroMemory (pvirtualaddress, ImageNtHeader.OptionalHeader.SizeOfImage); Rtlcopymemory (pvirtualaddress, &imagedosheader, sizeof (Image_dos_header)); Rtlcopymemory ((PVOID) ((ULONG) pvirtualaddress + imagedosheader.e_lfanew), &imagentheader, sizeof (Image_nt_ HEADERS)); Rtlcopymemory ((PVOID) ((ULONG) pvirtualaddress + imagedosheader.e_lfanew + sizeof (image_nt_headers)), Pimagesectionheader,sizeof (Image_section_header) *imagentheader.fileheader.numberofsections); for (uIndex = 0; UIndex < ImageNtHeader.FileHeader.NumberOfSections; uindex++) {usectionaddress = Pimagesectionheader[uindex]. Virtualaddress;if (Pimagesectionheader[uindex]. Misc.virtualsize > Pimagesectionheader[uindex]. Sizeofrawdata) usizeofsection = Pimagesectionheader[uindex]. Misc.virtualsize;elseusizeofsection = Pimagesectionheader[uindex]. SizeoFrawdata; Fileoffset.quadpart = Pimagesectionheader[uindex]. Pointertorawdata; Status = Zwreadfile (Hfile,null,null,null,&iostatusblock, (PVOID) ((ULONG) pvirtualaddress + usectionaddress), Usizeofsection,&fileoffset,null); if (! Nt_success (Status)) {dbgprint ("Zwreadfile imagesectionheader faild\n"); Exfreepool (Pimagesectionheader); Exfreepool (pvirtualaddress); Zwclose (hfile); return Status;}} Fixreloctable (pvirtualaddress, Poriimage);D bgprint ("ok\n"); Exfreepool (pimagesectionheader); *lpvirtualpoint = pvirtualaddress; Zwclose (hfile); return Status;}

This next step is also the most critical step in repairing the relocation table:

void Fixreloctable (PVOID pnewimage, PVOID poriimage) {pimage_dos_headerpimagedosheader; Pimage_nt_headerspimagentheadaers;image_data_directoryimagedatadirectory; Pimage_base_relocationpimagebaserelocation; Ulongureloctablesize; Ulongucount; Ulonguindex; ushort*pwoffsetaddress; Ushortutypevalue; Ulongurelocoffset; Ulongurelocaddress;pimagedosheader = (pimage_dos_header) pnewimage;pimagentheadaers = (PIMAGE_NT_HEADERS) ( Pimagedosheader->e_lfanew + (ULONG) pnewimage); Urelocoffset = (ULONG) poriimage-pimagentheadaers-> Optionalheader.imagebase;imagedatadirectory = Pimagentheadaers->optionalheader.datadirectory[image_directory_ Entry_basereloc];p imagebaserelocation = (pimage_base_relocation) (imagedatadirectory.virtualaddress + (ULONG) Pnewimage); ureloctablesize = Imagedatadirectory.size;while (ureloctablesize) {ucount = (pimagebaserelocation-> Sizeofblock-sizeof (ULONG) * 2)/sizeof (USHORT);p woffsetaddress = pimagebaserelocation->typeoffset;for (uIndex = 0; u Index < Ucount; uindex++) {UtypEvalue = Pwoffsetaddress[uindex];if ((utypevalue >>) = = Image_rel_based_highlow) {urelocaddress = (UTypeValue & Amp 0XFFF) + pimagebaserelocation->virtualaddress + (ULONG) pnewimage;if (! Mmisaddressvalid ((PVOID) urelocaddress)) {continue;} * (pulong) urelocaddress + = Urelocoffset;}} Ureloctablesize-= Pimagebaserelocation->sizeofblock;pimagebaserelocation = (pimage_base_relocation) ((ULONG) Pimagebaserelocation + Pimagebaserelocation->sizeofblock);}}

With the above steps, we successfully copied the kernel files completely.

Then is how to let the relevant black technology to go our core, and continue tomorrow!

Win7 Kernel Reload Peloader kernel version