List hidden processes by reading kiwaitinlisthead

List hidden processes by reading kiwaitinlisthead
/*
Some rootkit hides the process by changing the psactiveprocess linked list or related native APIs. The following program directly reads
Kiwaitinlisthead and kiwaitoutlisthead are used to list hidden processes.
For technical details, refer to the original document of Jan K. rutkoski.
Http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-rutkowski/rutkowski-antirootkit.zip.
The original DEMO code is implemented using a driver. The/device/physicalmemory is used here. The code is messy and can barely work. Thanks to the pjf code.
If there is something wrong, please make an ax. If you have a better idea, share it with me? Thank you!
*/

 

/* Code token from Jan K. rutkoski (jkrutkoski <A> elka.pw.edu. pl )*/
/* And pjf (jfpan20000@sina.com) s article */
/* Compile under cygwin> gcc-o kps. C-I/usr/include/w32api/DDK-lntdll-lntoskrnl */
/* See Jan K. rutkowskis article for more info .*/

/* This tool will list all the procs include those hiden by some rootkit. 2003/10, fantas1a */

# Include <stdio. h>
# Include <stdlib. h>
# Include <windows. h>
# Include <ntddk. h>

Typedef struct _ klister_procinfo {
Int PID;
Char name [18];
} Klister_procinfo, * pklister_procinfo;

Plist_entry pkiwaitinlisthead;
Plist_entry pkiwaitoutlisthead;
Plist_entry pkidispatcherreadylisthead;
# Define waitlist_offset 0x5c // In _ kthread

Pvoid g_pmapphysicalmemory = NULL;
Handle g_hmpm = NULL;

# Define max_procs 1000
Klister_procinfo procs [max_procs];
Int nprocs = 0;

Pvoid lineartophys (Pulong baseaddress, pvoid ADDR)
{
Ulong vaddr = (ulong) ADDR, pgde, PTE, paddr;
Pgde = baseaddress [vaddr> 22];
If (pgde & 1 )! = 0)
{
Ulong TMP = maid x 00000080;
If (TMP! = 0)
{
Paddr = (pgde & 0xffc00000) + (vaddr & 0x003fffff );
}
Else
{
Pgde = (ulong) mapviewoffile (g_hmpm, 4, 0, pgde & 0xfffff000, 0x1000 );
PTE = (Pulong) pgde) [(vaddr & 0x003ff000)> 12];
If (PTE & 1 )! = 0)
{
Paddr = (PTE & 0xfffff000) + (vaddr & 0x00000fff );
Unmapviewoffile (pvoid) pgde );
}
Else {
// Fprintf (stderr, "lineartophys return 0, page not in/R/N ");
Return 0;
}
}
} Else {
// Fprintf (stderr, "lineartophys return 0, page table not in/R/N ");
Return 0;
}
// Fprintf (stderr, "lineartophys return % 08x/R/N", paddr );
Return (pvoid) paddr;
}

Ulong getdata (pvoid ADDR)
{
Ulong phys = (ulong) lineartophys (Pulong) g_pmapphysicalmemory, (pvoid) ADDR );
If (Phys = 0) return 0;
Pulong TMP = (Pulong) mapviewoffile (g_hmpm, 4, 0, Phys & 0xfffff000, 0x1000 );
If (TMP = 0 ){
Exit (-1 );
}
Ulong ret = TMP [(Phys & 0 xfff)> 2];
Unmapviewoffile (TMP );
Return ret;
}

Handle openphysicalmemory ()
{
Ntstatus status;
Unicode_string physmemstring;
Object_attributes attributes;

Rtlinitunicodestring (& physmemstring, l "// device // physicalmemory ");

Attributes. Length = sizeof (object_attributes );
Attributes. rootdirectory = NULL;
Attributes. objectname = & physmemstring;
Attributes. Attributes = 0;
Attributes. securitydescriptor = NULL;
Attributes. securityqualityofservice = NULL;

Status = zwopensection (& g_hmpm, section_map_read, & attributes );

If (! Nt_success (Status ))
{
Return NULL;
}

G_pmapphysicalmemory = mapviewoffile (
G_hmpm,
4,
0,
0x30000,
0x1000 );
If (g_pmapphysicalmemory = NULL)
{
Return NULL;
}

Return g_hmpm;
}

Void insertproc (int pid, char * Name ){
Int I;

For (I = 0; I <nprocs; I ++)
If (procs. PID = PID) return;

Procs [nprocs]. PID = PID;
Strncpy (procs [nprocs]. Name, name, 16 );
// Fprintf (stderr, "% d % S/R/N", PID, name );
Nprocs ++;

}

Peprocess processobject (pethread ETHREAD ){
Ulong P;
P = (ulong) ETHREAD;
// (Peprocess) (ETHREAD-> TCB. apcstate. process );
P = getdata (pvoid) (p + 0x0 + 0x34 + 0x10 ));
Return (peprocess) (p );
}

Char * processname (peprocess eprocess, char * BUF ){
// & Eprocess-> imagefilename [0]
Ulong phys = (ulong) lineartophys (Pulong) g_pmapphysicalmemory, (pvoid) (ulong) eprocess + 0x01fc ));
If (Phys = 0) return 0;
Puchar TMP = (puchar) mapviewoffile (g_hmpm, 4, 0, Phys & 0xfffff000, 0x1000 );
If (TMP = 0 ){
Return 0;
}
Strncpy (BUF, & TMP [(Phys & 0 xfff)], 16 );
Unmapviewoffile (TMP );

Return Buf;
}

Void listproc ()
{
Int I;
Printf ("---- % d process ----/R/N", nprocs );
For (I = 0; I <nprocs; I ++ ){
Printf ("[+] % 4D % S/R/N", procs. PID, procs. Name );
}
} Void createproclist (){
Int I, J;
Char buf1 [18];
Pvoid OBJ, p, q, TMP;
Pethread = NULL;
Ulong PID;
Char * PN;
// Fprintf (stderr, "pkiwaitinlisthead/R/N ");
For (OBJ = (pvoid) getdata (pkiwaitinlisthead );
OBJ & (OBJ! = Pkiwaitinlisthead); OBJ = (pvoid) getdata (OBJ )){
Pethread = (pethread) (getdata (pvoid) OBJ)-waitlist_offset );
P = processobject (pethread );
PID = getdata (pvoid) (ulong) pethread + 0x01e0); // pethread-> CID. uniqueprocess
If (pid = 0 ){
// Fprintf (stderr, "PID is 0/R/N ");
Break;
}
Pn = processname (p, buf1 );
If (Pn = 0) break;
Insertproc (PID, PN );
}
// Fprintf (stderr, "pkiwaitoutlisthead/R/N ");
For (OBJ = (pvoid) getdata (pkiwaitoutlisthead );
OBJ & (OBJ! = Pkiwaitoutlisthead); OBJ = (pvoid) getdata (OBJ )){
Pethread = (pethread) (getdata (pvoid) OBJ)-waitlist_offset );
P = processobject (pethread );
PID = getdata (pvoid) (ulong) pethread + 0x01e0 ));
If (pid = 0 ){
// Fprintf (stderr, "PID is 0/R/N ");
Break;
}
Pn = processname (p, buf1 );
If (Pn = 0) break;
Insertproc (PID, PN );
}
/*
Fprintf (stderr, "pkidispatcherreadylisthead/R/N ");
For (I = 0; I <32; I ++)
For (OBJ = (pvoid) getdata (pvoid) (& pkidispatcherreadylisthead ));
OBJ & (OBJ! = & Pkidispatcherreadylisthead );
OBJ = (pvoid) getdata (OBJ )){
Pethread = (pethread) (getdata (pvoid) OBJ)-waitlist_offset );
P = processobject (pethread );
PID = getdata (pvoid) (ulong) pethread + 0x01e0 ));
If (pid = 0 ){
Fprintf (stderr, "PID is 0/R/N ");
Break;
}
Pn = processname (p, buf1 );
If (Pn = 0) break;
Insertproc (PID, PN );

}
*/
}

Int main (INT argc, char ** argv ){

If (openphysicalmemory () = 0)
{
Printf ("openphysicalmemory failed/R/N ");
Return-1;
}
Pkiwaitinlisthead = (plist_entry) 0x80482258; // under Win2k + sp4en
Pkiwaitoutlisthead = (plist_entry) 0x80482808;
Pkidispatcherreadylisthead = (plist_entry) 0x804822e0;
// Fprintf (stderr, "0x % 08x, 0x % 08x/R/N", (ulong) pkiwaitinlisthead, (ulong) pkiwaitoutlisthead );

Createproclist ();
Listproc ();
Unmapviewoffile (g_pmapphysicalmemory );
Closehandle (g_hmpm );

Return (0 );
}

From: http://th3ee.blogchina.com/271213.html