Skip to content

Commit 2843373

Browse files
tandasattandasat
committed
Delete DSE disabling, update README, solve warnings
1 parent a32b7b0 commit 2843373

17 files changed

+211
-630
lines changed

‎DisPG/DisPG.sln‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,18 @@
11

22
Microsoft Visual Studio Solution File, Format Version 12.00
3-
# Visual Studio Express 2013 for Windows Desktop
4-
VisualStudioVersion = 12.0.30110.0
3+
# Visual Studio 14
4+
VisualStudioVersion = 14.0.23107.0
55
MinimumVisualStudioVersion = 10.0.40219.1
66
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DisPG", "DisPG\DisPG.vcxproj", "{74FA6A70-EA29-4787-A49C-1F33ADCE08F7}"
77
EndProject
88
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DisPGLoader", "DisPGLoader\DisPGLoader.vcxproj", "{71E81282-4D39-4A23-B1D6-953D9754E8B2}"
99
EndProject
10+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{24642E83-0F96-438F-9FF2-CF067ADE394C}"
11+
ProjectSection(SolutionItems) = preProject
12+
NOTE.md = NOTE.md
13+
README.md = README.md
14+
EndProjectSection
15+
EndProject
1016
Global
1117
GlobalSection(SolutionConfigurationPlatforms) = preSolution
1218
Debug|x64 = Debug|x64

‎DisPG/DisPG/DisPG.cpp‎

Lines changed: 11 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
//
55
#include "stdafx.h"
66
#include "util.h"
7-
#include "rootkit.h"
87
#include "win8.h"
98
#include "winX.h"
109

@@ -62,12 +61,6 @@ NTSTATUS DispgpLoadPointerVaule(
6261
EXTERN_C static
6362
NTSTATUS DispgpDisablePatchGuard();
6463

65-
EXTERN_C static
66-
NTSTATUS DispgpEnableRootkitFunction();
67-
68-
EXTERN_C static
69-
void DispgpDisableSigningEnforcement();
70-
7164
EXTERN_C static
7265
bool DispgpIsWindows8OrGreater();
7366

@@ -93,7 +86,6 @@ static ULONG64 g_KernelVersion = 0;
9386
// always
9487
static ULONG_PTR g_ExAcquireResourceSharedLite = 0;
9588
// ifVistaOr7
96-
static BOOLEAN* g_CiEnabled = nullptr;
9789
static POOL_TRACKER_BIG_PAGES** g_PoolBigPageTable = nullptr;
9890
// ifXp
9991
static POOL_TRACKER_BIG_PAGES_XP** g_PoolBigPageTableXp = nullptr;
@@ -107,7 +99,6 @@ static ULONG_PTR g_KiCommitThreadWait = 0;
10799
static ULONG_PTR g_KiAttemptFastRemovePriQueue = 0;
108100
static ULONG_PTR g_KeDelayExecutionThread = 0;
109101
static ULONG_PTR g_KeWaitForSingleObject = 0;
110-
static UINT32* g_CiOptions = nullptr;
111102

112103

113104
////////////////////////////////////////////////////////////////////////////////
@@ -124,50 +115,31 @@ NTSTATUS DriverEntry(
124115
{
125116
PAGED_CODE();
126117

127-
//DBG_BREAK();
118+
DBG_BREAK();
128119

129-
DBG_PRINT("[%4x:%4x] Initialize : Starting DisPG.\n",
130-
PsGetCurrentProcessId(), PsGetCurrentThreadId());
120+
DBG_PRINT("[%5Iu:%5Iu] Initialize : Starting DisPG.\n",
121+
reinterpret_cast<ULONG_PTR>(PsGetCurrentProcessId()),
122+
reinterpret_cast<ULONG_PTR>(PsGetCurrentThreadId()));
131123

132124
auto status = DispgpInitialize(RegistryPath);
133125
if (!NT_SUCCESS(status))
134126
{
135127
return status;
136128
}
137129

138-
// Disable PatchGuard. This function has to be called before
139-
// DispgpEnableRootkitFunction or DispgpDisableSigningEnforcement as these
140-
// functions install kernel patches.
130+
// Disable PatchGuard.
141131
status = DispgpDisablePatchGuard();
142132
if (!NT_SUCCESS(status))
143133
{
144134
return status;
145135
}
146-
DBG_PRINT("[%4x:%4x] Initialize : PatchGuard has been disarmed.\n",
147-
PsGetCurrentProcessId(), PsGetCurrentThreadId());
148-
149-
//// Enables rootkit function by installing kernel patches. The driver should
150-
//// never be unloaded after this function succeeded as it installs hook code
151-
//// that calls this driver.
152-
//status = DispgpEnableRootkitFunction();
153-
//if (!NT_SUCCESS(status))
154-
//{
155-
// return status;
156-
//}
157-
//DBG_PRINT("[%4x:%4x] Initialize : Hiding processes has been enabled.\n",
158-
// PsGetCurrentProcessId(), PsGetCurrentThreadId());
159-
160-
// Disable DSE if applicable
161-
if (!DispgpIsWindowsXp())
162-
{
163-
DispgpDisableSigningEnforcement();
164-
DBG_PRINT("[%4x:%4x] Initialize : Driver Signing Enforcement has been"
165-
" disabled.\n",
166-
PsGetCurrentProcessId(), PsGetCurrentThreadId());
167-
}
136+
DBG_PRINT("[%5Iu:%5Iu] Initialize : PatchGuard has been disarmed.\n",
137+
reinterpret_cast<ULONG_PTR>(PsGetCurrentProcessId()),
138+
reinterpret_cast<ULONG_PTR>(PsGetCurrentThreadId()));
168139

169-
DBG_PRINT("[%4x:%4x] Initialize : Enjoy freedom ;)\n",
170-
PsGetCurrentProcessId(), PsGetCurrentThreadId());
140+
DBG_PRINT("[%5Iu:%5Iu] Initialize : Enjoy freedom ;)\n",
141+
reinterpret_cast<ULONG_PTR>(PsGetCurrentProcessId()),
142+
reinterpret_cast<ULONG_PTR>(PsGetCurrentThreadId()));
171143
return status;
172144
}
173145

@@ -260,7 +232,6 @@ NTSTATUS DispgpLoadSymbolAddresses(
260232
const SymbolSet requireSymbols[] =
261233
{
262234
{ L"ntoskrnl!ExAcquireResourceSharedLite", reinterpret_cast<void**>(&g_ExAcquireResourceSharedLite), always, },
263-
{ L"ntoskrnl!g_CiEnabled", reinterpret_cast<void**>(&g_CiEnabled), ifVistaOr7, },
264235
{ L"ntoskrnl!PoolBigPageTable", reinterpret_cast<void**>(&g_PoolBigPageTable), ifVistaOr7, },
265236
{ L"ntoskrnl!PoolBigPageTable", reinterpret_cast<void**>(&g_PoolBigPageTableXp), ifXp, },
266237
{ L"ntoskrnl!PoolBigPageTableSize", reinterpret_cast<void**>(&g_PoolBigPageTableSize), ifNot8OrGreater, },
@@ -271,7 +242,6 @@ NTSTATUS DispgpLoadSymbolAddresses(
271242
{ L"ntoskrnl!KiAttemptFastRemovePriQueue", reinterpret_cast<void**>(&g_KiAttemptFastRemovePriQueue), if8OrGreater, },
272243
{ L"ntoskrnl!KeDelayExecutionThread", reinterpret_cast<void**>(&g_KeDelayExecutionThread), if8OrGreater, },
273244
{ L"ntoskrnl!KeWaitForSingleObject", reinterpret_cast<void**>(&g_KeWaitForSingleObject), if8OrGreater, },
274-
{ L"ci!g_CiOptions", reinterpret_cast<void**>(&g_CiOptions), if8OrGreater, },
275245
};
276246

277247
// Load each symbol from the registry if required
@@ -391,64 +361,6 @@ NTSTATUS DispgpDisablePatchGuard()
391361
}
392362

393363

394-
// Enable hiding processes function
395-
ALLOC_TEXT(INIT, DispgpEnableRootkitFunction)
396-
EXTERN_C static
397-
NTSTATUS DispgpEnableRootkitFunction()
398-
{
399-
PAGED_CODE();
400-
auto status = STATUS_UNSUCCESSFUL;
401-
402-
if ((g_WindowsVersion.dwMajorVersion == 6 && g_WindowsVersion.dwMinorVersion == 3)
403-
|| (g_WindowsVersion.dwMajorVersion == 6 && g_WindowsVersion.dwMinorVersion == 1))
404-
{
405-
// For Win 8 and 7
406-
status = RootkitEnableRootkit(
407-
18,
408-
reinterpret_cast<ULONG_PTR>(AsmNtQuerySystemInformation_Win8_1),
409-
reinterpret_cast<ULONG_PTR>(AsmNtQuerySystemInformation_Win8_1End));
410-
}
411-
else if (g_WindowsVersion.dwMajorVersion == 6 && g_WindowsVersion.dwMinorVersion == 0)
412-
{
413-
// For Win Vista
414-
status = RootkitEnableRootkit(
415-
18,
416-
reinterpret_cast<ULONG_PTR>(AsmNtQuerySystemInformation_WinVista),
417-
reinterpret_cast<ULONG_PTR>(AsmNtQuerySystemInformation_WinVistaEnd));
418-
}
419-
else if (DispgpIsWindowsXp())
420-
{
421-
// For Win XP
422-
status = RootkitEnableRootkit(
423-
18,
424-
reinterpret_cast<ULONG_PTR>(AsmNtQuerySystemInformation_WinXp),
425-
reinterpret_cast<ULONG_PTR>(AsmNtQuerySystemInformation_WinXpEnd));
426-
}
427-
return status;
428-
}
429-
430-
431-
// Disable Driver Signing Enforcement. This function should never been called
432-
// on Win XP since it has no Driver Signing Enforcement on the platform.
433-
ALLOC_TEXT(INIT, DispgpDisableSigningEnforcement)
434-
EXTERN_C static
435-
void DispgpDisableSigningEnforcement()
436-
{
437-
PAGED_CODE();
438-
439-
if (DispgpIsWindows8OrGreater())
440-
{
441-
// For Win 8.1
442-
*g_CiOptions = 0;
443-
}
444-
else
445-
{
446-
// For Win 7 and Vista
447-
*g_CiEnabled = FALSE;
448-
}
449-
}
450-
451-
452364
// Return true if the platform is Win 8 or later
453365
ALLOC_TEXT(INIT, DispgpIsWindows8OrGreater)
454366
EXTERN_C static

‎DisPG/DisPG/DisPG.vcxproj‎

Lines changed: 0 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,10 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<ItemGroup Label="ProjectConfigurations">
4-
<ProjectConfiguration Include="Debug|Win32">
5-
<Configuration>Debug</Configuration>
6-
<Platform>Win32</Platform>
7-
</ProjectConfiguration>
84
<ProjectConfiguration Include="Debug|x64">
95
<Configuration>Debug</Configuration>
106
<Platform>x64</Platform>
117
</ProjectConfiguration>
12-
<ProjectConfiguration Include="Release|Win32">
13-
<Configuration>Release</Configuration>
14-
<Platform>Win32</Platform>
15-
</ProjectConfiguration>
168
<ProjectConfiguration Include="Release|x64">
179
<Configuration>Release</Configuration>
1810
<Platform>x64</Platform>
@@ -24,25 +16,12 @@
2416
<RootNamespace>DisPG</RootNamespace>
2517
</PropertyGroup>
2618
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
27-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
28-
<ConfigurationType>Application</ConfigurationType>
29-
<UseDebugLibraries>true</UseDebugLibraries>
30-
<PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
31-
<CharacterSet>NotSet</CharacterSet>
32-
</PropertyGroup>
3319
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
3420
<ConfigurationType>Application</ConfigurationType>
3521
<UseDebugLibraries>true</UseDebugLibraries>
3622
<PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
3723
<CharacterSet>NotSet</CharacterSet>
3824
</PropertyGroup>
39-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
40-
<ConfigurationType>Application</ConfigurationType>
41-
<UseDebugLibraries>false</UseDebugLibraries>
42-
<PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
43-
<WholeProgramOptimization>true</WholeProgramOptimization>
44-
<CharacterSet>NotSet</CharacterSet>
45-
</PropertyGroup>
4625
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
4726
<ConfigurationType>Application</ConfigurationType>
4827
<UseDebugLibraries>false</UseDebugLibraries>
@@ -53,58 +32,23 @@
5332
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
5433
<ImportGroup Label="ExtensionSettings">
5534
</ImportGroup>
56-
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
57-
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
58-
</ImportGroup>
5935
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
6036
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
6137
</ImportGroup>
62-
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
63-
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
64-
</ImportGroup>
6538
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
6639
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
6740
</ImportGroup>
6841
<PropertyGroup Label="UserMacros" />
69-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
70-
<LinkIncremental>false</LinkIncremental>
71-
<TargetExt>.sys</TargetExt>
72-
</PropertyGroup>
7342
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
7443
<LinkIncremental>false</LinkIncremental>
7544
<TargetExt>.sys</TargetExt>
7645
<CodeAnalysisRuleSet>..\..\..\..\Program Files (x86)\Windows Kits\8.1\CodeAnalysis\DriverRecommendedRules.ruleset</CodeAnalysisRuleSet>
7746
<RunCodeAnalysis>false</RunCodeAnalysis>
7847
</PropertyGroup>
79-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
80-
<LinkIncremental>false</LinkIncremental>
81-
<TargetExt>.sys</TargetExt>
82-
</PropertyGroup>
8348
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
8449
<LinkIncremental>false</LinkIncremental>
8550
<TargetExt>.sys</TargetExt>
8651
</PropertyGroup>
87-
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
88-
<ClCompile>
89-
<PrecompiledHeader>
90-
</PrecompiledHeader>
91-
<WarningLevel>Level4</WarningLevel>
92-
<Optimization>Disabled</Optimization>
93-
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
94-
<SDLCheck>true</SDLCheck>
95-
<AdditionalIncludeDirectories>$(WindowsSdkDir)Include\km</AdditionalIncludeDirectories>
96-
<TreatWarningAsError>false</TreatWarningAsError>
97-
</ClCompile>
98-
<Link>
99-
<SubSystem>Native</SubSystem>
100-
<GenerateDebugInformation>true</GenerateDebugInformation>
101-
<AdditionalLibraryDirectories>$(WindowsSdkDir)Lib\winv6.3\km\$(PlatformTarget)</AdditionalLibraryDirectories>
102-
<AdditionalDependencies>ntoskrnl.lib;wdm.lib;wmilib.lib;hal.lib;bufferoverflowK.lib</AdditionalDependencies>
103-
<Driver>Driver</Driver>
104-
<EntryPointSymbol>GsDriverEntry@8</EntryPointSymbol>
105-
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
106-
</Link>
107-
</ItemDefinitionGroup>
10852
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
10953
<ClCompile>
11054
<PrecompiledHeader>
@@ -128,31 +72,6 @@
12872
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
12973
</Link>
13074
</ItemDefinitionGroup>
131-
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
132-
<ClCompile>
133-
<WarningLevel>Level4</WarningLevel>
134-
<PrecompiledHeader>
135-
</PrecompiledHeader>
136-
<Optimization>MaxSpeed</Optimization>
137-
<FunctionLevelLinking>true</FunctionLevelLinking>
138-
<IntrinsicFunctions>true</IntrinsicFunctions>
139-
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
140-
<SDLCheck>true</SDLCheck>
141-
<AdditionalIncludeDirectories>$(WindowsSdkDir)Include\km</AdditionalIncludeDirectories>
142-
<TreatWarningAsError>false</TreatWarningAsError>
143-
</ClCompile>
144-
<Link>
145-
<SubSystem>Native</SubSystem>
146-
<GenerateDebugInformation>true</GenerateDebugInformation>
147-
<EnableCOMDATFolding>true</EnableCOMDATFolding>
148-
<OptimizeReferences>true</OptimizeReferences>
149-
<AdditionalLibraryDirectories>$(WindowsSdkDir)Lib\winv6.3\km\$(PlatformTarget)</AdditionalLibraryDirectories>
150-
<AdditionalDependencies>ntoskrnl.lib;wdm.lib;wmilib.lib;hal.lib;bufferoverflowK.lib</AdditionalDependencies>
151-
<Driver>Driver</Driver>
152-
<EntryPointSymbol>GsDriverEntry@8</EntryPointSymbol>
153-
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
154-
</Link>
155-
</ItemDefinitionGroup>
15675
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
15776
<ClCompile>
15877
<WarningLevel>Level4</WarningLevel>
@@ -181,7 +100,6 @@
181100
<ItemGroup>
182101
<ClCompile Include="DisPG.cpp" />
183102
<ClCompile Include="exclusivity.cpp" />
184-
<ClCompile Include="rootkit.cpp" />
185103
<ClCompile Include="stdafx.cpp" />
186104
<ClCompile Include="util.cpp" />
187105
<ClCompile Include="win8.cpp" />
@@ -193,7 +111,6 @@
193111
<ClInclude Include="..\..\Common\unique_resource.h" />
194112
<ClInclude Include="exclusivity.h" />
195113
<ClInclude Include="intrinsics.h" />
196-
<ClInclude Include="rootkit.h" />
197114
<ClInclude Include="stdafx.h" />
198115
<ClInclude Include="util.h" />
199116
<ClInclude Include="win8.h" />

‎DisPG/DisPG/DisPG.vcxproj.filters‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,6 @@
3333
<ClCompile Include="util.cpp">
3434
<Filter>Source Files</Filter>
3535
</ClCompile>
36-
<ClCompile Include="rootkit.cpp">
37-
<Filter>Source Files</Filter>
38-
</ClCompile>
3936
<ClCompile Include="win8.cpp">
4037
<Filter>Source Files</Filter>
4138
</ClCompile>
@@ -56,9 +53,6 @@
5653
<ClInclude Include="util.h">
5754
<Filter>Header Files</Filter>
5855
</ClInclude>
59-
<ClInclude Include="rootkit.h">
60-
<Filter>Header Files</Filter>
61-
</ClInclude>
6256
<ClInclude Include="win8.h">
6357
<Filter>Header Files</Filter>
6458
</ClInclude>

0 commit comments

Comments
 (0)