├── LICENSE
├── README.md
├── bin
├── driver_loader.exe
├── protection.cer
└── protection.sys
├── driver_loader
├── driver_loader.c
├── driver_loader.filters
├── driver_loader.h
├── driver_loader.user
├── driver_loader.vcxproj
└── driver_operation.c
├── kernel_mode_process_protection.sln
└── protection
├── device.c
├── driver.c
├── driver.h
├── major_functions.c
├── message_handler.c
├── protection.c
├── protection.inf
├── protection.vcxproj
├── protection.vcxproj.filters
└── protection.vcxproj.user
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2020 Hanson
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # kernel_mode_process_protection
2 | My first kernel-mode process protection driver!
3 |
4 | # [bin](bin) folder
5 | This folder contains the executable binaries, including the driver loader (.exe file) and the driver (.sys file).
6 |
7 | !! IT IS RECOMMENDED TO TEST THIS PROGRAM IN A VIRTUAL MACHINE !!
8 |
9 | How to use these files:
10 | 1. Put driver_loader.exe and protection.sys in the same folder.
11 | 2. Run driver_loader.exe as Administrator
12 | 3. Press 1, Enter. The driver loader will load the driver. This step may be failed because I don't have an appropriate digital signature. You may want to [disable driver signature enforcement](https://windowsreport.com/driver-signature-enforcement-windows-10/).
13 | 4. Press 2, Enter. Input the PID of the process you want to protect. The driver loader will communicate with the driver and the driver will start the protection.
14 | 5. Try to terminate the target process with Task Manager or taskkill.
15 | 5. Press 3, Enter. The driver loader will communicate with the driver and the driver will stop the protection.
16 | 6. Press 4, Enter. The driver loader will unload the driver.
17 |
18 | # [driver_loader](driver_loader) folder
19 | The source code of driver loader executable (driver_loader.exe).
20 |
21 | Most of the code is copied from [my first kernel-mode driver](https://github.com/SweetIceLolly/My_First_Driver).
22 |
23 | This program does driver-related operations, including loading the driver, communicating with it, and unloading it.
24 |
25 | # [protection](protection) folder
26 | The source code of the driver executable (protection.sys).
27 |
28 | Part of the code is copied from [my first kernel-mode driver](https://github.com/SweetIceLolly/My_First_Driver).
29 |
30 | [driver.c](protection/driver.c): This file defines `DriverEntry`, which is the entry point of the driver. This file also defines `on_driver_unload`. When the driver is being unloaded, this procedure is called and the protection is stopped.
31 |
32 | [device.c](protection/device.c): This file defines device-related functions. `SetupIoDevice` creates an IO device to communicate with the user-mode driver loader.
33 |
34 | [major_functions.c](protection/major_functions.c): This file defines major functions handler for `IRP_MJ_*`. Specifically, `IRP_MJ_CREATE` , `IRP_MJ_CLOSE` and `IRP_MJ_WRITE` are handled. The program will use `handle_buffer_message` to process the message received from `IRP_MJ_WRITE`.
35 |
36 | [major_functions.c](protection/major_functions.c): Thie file defines `handle_buffer_message` to process the message received from `IRP_MJ_WRITE`. Depending on the command received, the driver will call `enable_protection` or `disable_protection`.
37 |
38 | [protection.c](protection/protection.c): This file does everything related to process protection. In `enable_protection` function, the program uses `ObRegisterCallbacks` to register handle creation callbacks. The callback functions are `PreOperationCallback` and `PostOperationCallback`. `PreOperationCallback` is called when a handle to a process is being created. When the driver finds that the opening process handle is the process we want to protect, the access rights are removed so that nobody can access the protected process. In `disable_protection` function, the program uses `ObUnRegisterCallbacks` to unregister callbacks so that the target process is not being protected anymore.
39 |
40 | # Acknowledgment/Credits
41 | I found [this helpful tutorial](https://www.evilsocket.net/2014/02/05/termination-and-injection-self-defense-on-windows/), which helped me to implement the protection. Thank you for the valuable and detailed tutorial! ❤
42 |
43 | This is my first kernel-mode process protection driver. I hope you can find what you need in this repo :)
44 |
--------------------------------------------------------------------------------
/bin/driver_loader.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SweetIceLolly/Kernel_Mode_Process_Protection/f3fe46823ca9a06a3ead602b7a400b8d3bee3f88/bin/driver_loader.exe
--------------------------------------------------------------------------------
/bin/protection.cer:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SweetIceLolly/Kernel_Mode_Process_Protection/f3fe46823ca9a06a3ead602b7a400b8d3bee3f88/bin/protection.cer
--------------------------------------------------------------------------------
/bin/protection.sys:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SweetIceLolly/Kernel_Mode_Process_Protection/f3fe46823ca9a06a3ead602b7a400b8d3bee3f88/bin/protection.sys
--------------------------------------------------------------------------------
/driver_loader/driver_loader.c:
--------------------------------------------------------------------------------
1 | #include "driver_loader.h"
2 |
3 | #define SERVICE_NAME "MyProtectionDriver"
4 | #define DEVICE_NAME "\\\\.\\MyProtectionDriver"
5 |
6 | #ifndef __GNUC__ //Use scanf_s for Visual Studio, but not for gcc
7 | #define scanf scanf_s
8 | #endif
9 |
10 | HANDLE hIoHandle = INVALID_HANDLE_VALUE;
11 |
12 | /*
13 | Purpose: Load the driver
14 | Args: driver_file: Path to the driver file
15 | Return: 0:Failed; 1: Succeed
16 | */
17 | int load_driver(const char *driver_file) {
18 | //Create service
19 | if (Create_Service(SERVICE_NAME, driver_file) == 1) {
20 | printf("Create_Service() succeed!\n");
21 | }
22 | else {
23 | printf("Create_Service() failed!\n");
24 | return 0;
25 | }
26 |
27 | //Start service
28 | if (Start_Service(SERVICE_NAME) == 1) {
29 | printf("Start_Service() succeed!\n");
30 | }
31 | else {
32 | printf("Start_Service() failed!\n");
33 | return 0;
34 | }
35 |
36 | //Get IO handle
37 | hIoHandle = Get_IO_Handle(DEVICE_NAME);
38 | if (hIoHandle != INVALID_HANDLE_VALUE) {
39 | printf("Get_IO_Handle() succeed!\n");
40 | }
41 | else {
42 | printf("Get_IO_Handle() failed: %i\n", GetLastError());
43 | return 0;
44 | }
45 |
46 | return 1;
47 | }
48 |
49 | /*
50 | Purpose: Send message to the device to start the protection
51 | Args: pid: The process ID to protect
52 | Return: 0:Failed; 1: Succeed
53 | */
54 | int protect_process(int pid) {
55 | char command[6] = { 0 };
56 |
57 | command[0] = 'e'; //'e' for enable protection
58 | *((int*)&command[1]) = pid;
59 |
60 | if (Write_IO_Handle(hIoHandle, command, 5) == 1) {
61 | printf("Write_IO_Handle() succeed!\n");
62 | }
63 | else {
64 | printf("Write_IO_Handle() failed!\n");
65 | return 0;
66 | }
67 |
68 | return 1;
69 | }
70 |
71 | int stop_protection() {
72 | char command[1] = { 'd' }; //'d' for disable protection
73 |
74 | if (Write_IO_Handle(hIoHandle, command, 1) == 1) {
75 | printf("Write_IO_Handle() succeed!\n");
76 | }
77 | else {
78 | printf("Write_IO_Handle() failed!\n");
79 | return 0;
80 | }
81 |
82 | return 1;
83 | }
84 |
85 | void unload_driver() {
86 | Close_IO_Handle(hIoHandle);
87 | printf("Close_IO_Handle() called!\n");
88 |
89 | if (Stop_Service(SERVICE_NAME) == 1) {
90 | printf("Stop_Service() succeed!\n");
91 | }
92 | else {
93 | printf("Stop_Service() failed!\n");
94 | }
95 |
96 | if (Delete_Service(SERVICE_NAME) == 1) {
97 | printf("Delete_Service() succeed!\n");
98 | }
99 | else {
100 | printf("Delete_Service() failed!\n");
101 | }
102 | }
103 |
104 | int main(void) {
105 | int selection;
106 | int pid;
107 | char driver_file[MAX_PATH];
108 |
109 | printf(
110 | "1: Load Driver\n"
111 | "2: Protect Process\n"
112 | "3: Stop Protection\n"
113 | "4: Unload Driver\n"
114 | "5: Bye!\n"
115 | "\n"
116 | );
117 |
118 | GetCurrentDirectory(MAX_PATH, driver_file);
119 | #ifndef __GNUC__ //Use strcat_s for Visual Studio, but not for gcc
120 | strcat_s(driver_file, MAX_PATH, "\\protection.sys");
121 | #else
122 | strcat(driver_file, "\\protection.sys");
123 | #endif
124 |
125 | for (;;) {
126 | scanf("%i", &selection);
127 |
128 | switch (selection) {
129 | case 1: //Load driver
130 | load_driver(driver_file);
131 | break;
132 |
133 | case 2: //Protect process
134 | printf("PID: ");
135 | scanf("%i", &pid);
136 | protect_process(pid);
137 | break;
138 |
139 | case 3: //Stop protection
140 | stop_protection();
141 | break;
142 |
143 | case 4: //Unload driver
144 | unload_driver();
145 | break;
146 |
147 | case 5: //Exit
148 | stop_protection();
149 | unload_driver();
150 | return 0;
151 | break;
152 |
153 | default:
154 | printf("What?\n");
155 | }
156 | }
157 |
158 | return 0;
159 | }
160 |
--------------------------------------------------------------------------------
/driver_loader/driver_loader.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 |
10 |
11 | Source Files
12 |
13 |
14 | Source Files
15 |
16 |
17 |
18 |
19 | Source Files
20 |
21 |
22 |
--------------------------------------------------------------------------------
/driver_loader/driver_loader.h:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 |
4 | int Create_Service(const char *ServiceName, const char *ExecutablePath);
5 | int Start_Service(const char *ServiceName);
6 | int Stop_Service(const char *ServiceName);
7 | int Delete_Service(const char *ServiceName);
8 | HANDLE Get_IO_Handle(char *DeviceName);
9 | void Close_IO_Handle(HANDLE hIO);
10 | int Write_IO_Handle(HANDLE hDevice, const char *Buffer, const int WriteSize);
11 |
--------------------------------------------------------------------------------
/driver_loader/driver_loader.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/driver_loader/driver_loader.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 |
14 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}
15 | Win32Proj
16 | driver_loader
17 | driver_loader
18 |
19 |
20 |
21 | Application
22 | true
23 | v120_xp
24 | MultiByte
25 |
26 |
27 | Application
28 | false
29 | v120_xp
30 | true
31 | MultiByte
32 |
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 | true
45 |
46 |
47 | false
48 |
49 |
50 |
51 | NotUsing
52 | Level3
53 | Disabled
54 | WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)
55 | true
56 |
57 |
58 | Console
59 | true
60 |
61 |
62 |
63 |
64 | Level3
65 | NotUsing
66 | MaxSpeed
67 | true
68 | true
69 | WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)
70 | true
71 |
72 |
73 |
74 | Console
75 | true
76 | true
77 | true
78 |
79 |
80 |
81 |
82 |
83 |
84 |
85 |
86 |
87 |
88 |
89 |
90 |
--------------------------------------------------------------------------------
/driver_loader/driver_operation.c:
--------------------------------------------------------------------------------
1 | #include "driver_loader.h"
2 |
3 | /*
4 | Purpose: Create the driver service
5 | Args: ServiceName: The name of the service
6 | . ExecutablePath: File path of the driver file
7 | Return: 0:Failed; 1: Succeed
8 | */
9 | int Create_Service(const char *ServiceName, const char *ExecutablePath) {
10 | printf("Creating service: %s\n", ServiceName);
11 |
12 | SC_HANDLE sh = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS); //Open a handle to Service Manager
13 | if (sh == INVALID_HANDLE_VALUE) {
14 | printf("OpenSCManager() failed!\n");
15 | return 0;
16 | }
17 |
18 | SC_HANDLE hService = CreateService(sh, ServiceName, ServiceName, //Create the driver service
19 | SERVICE_ALL_ACCESS, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL,
20 | ExecutablePath, NULL, NULL, NULL, NULL, NULL);
21 | CloseServiceHandle(sh); //Use this instead of CloseHandle()
22 |
23 | if (hService == NULL) {
24 | printf("CreateService() failed!\n");
25 | return 0;
26 | }
27 |
28 | CloseServiceHandle(hService);
29 | return 1;
30 | }
31 |
32 | /*
33 | Purpose: Start the specified service
34 | Args: ServiceName: Name of the service
35 | Return: 0: Failed; 1: Succeed
36 | */
37 | int Start_Service(const char *ServiceName) {
38 | SC_HANDLE sh = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS); //Open a handle to Service Manager
39 | if (sh == INVALID_HANDLE_VALUE) {
40 | printf("OpenSCManager() failed!\n");
41 | return 0;
42 | }
43 |
44 | SC_HANDLE hService = OpenService(sh, ServiceName, SERVICE_ALL_ACCESS); //Get a handle to the driver service
45 | CloseServiceHandle(sh);
46 | if (hService == NULL) {
47 | printf("OpenService() failed!\n");
48 | return 0;
49 | }
50 |
51 | if (StartService(hService, 0, NULL) == 0) {
52 | int err_code = (int)GetLastError();
53 | printf("StartService() failed: %i\n", err_code);
54 | return 0;
55 | }
56 |
57 | CloseServiceHandle(hService);
58 | return 1;
59 | }
60 |
61 | /*
62 | Purpose: Stop the specified service
63 | Args: ServiceName: Name of the service
64 | Return: 0: Failed; 1: Succeed
65 | */
66 | int Stop_Service(const char *ServiceName) {
67 | SC_HANDLE sh = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS); //Open a handle to Service Manager
68 | if (sh == INVALID_HANDLE_VALUE) {
69 | printf("OpenSCManager() failed!\n");
70 | return 0;
71 | }
72 |
73 | SC_HANDLE hService = OpenService(sh, ServiceName, SERVICE_ALL_ACCESS); //Get a handle to the driver service
74 | CloseServiceHandle(sh);
75 | if (hService == NULL) {
76 | printf("OpenService() failed!\n");
77 | return 0;
78 | }
79 |
80 | SERVICE_STATUS ss;
81 | if (ControlService(hService, SERVICE_CONTROL_STOP, &ss) == 0) {
82 | CloseServiceHandle(hService);
83 | return 0;
84 | }
85 |
86 | CloseServiceHandle(hService);
87 | return 1;
88 | }
89 |
90 | /*
91 | Purpose: Delete the specified service
92 | Args: ServiceName: Name of the service
93 | Return: 0: Failed; 1: Succeed
94 | */
95 | int Delete_Service(const char *ServiceName) {
96 | SC_HANDLE sh = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS); //Open a handle to Service Manager
97 | if (sh == INVALID_HANDLE_VALUE) {
98 | printf("OpenSCManager() failed!\n");
99 | return 0;
100 | }
101 |
102 | SC_HANDLE hService = OpenService(sh, ServiceName, SERVICE_ALL_ACCESS); //Get a handle to the driver service
103 | CloseServiceHandle(sh);
104 | if (hService == NULL) {
105 | printf("OpenService() failed!\n");
106 | return 0;
107 | }
108 |
109 | if (DeleteService(hService) == 0) {
110 | CloseServiceHandle(hService);
111 | return 0;
112 | }
113 |
114 | CloseServiceHandle(hService);
115 | return 1;
116 | }
117 |
118 | /*
119 | Purpose: Get an IO handle
120 | Args: DeviceName: Device name
121 | Return: The IO handle. -1 if failed
122 | Note: Remember to close the handle with Close_IO_Handle()
123 | */
124 | HANDLE Get_IO_Handle(char *DeviceName) {
125 | printf("Opening: %s\n", DeviceName);
126 | return (HANDLE)CreateFile(DeviceName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, 0);
127 | }
128 |
129 | /*
130 | Purpose: Close an IO handle
131 | Args: hIO: The IO handle
132 | */
133 | void Close_IO_Handle(HANDLE hIO) {
134 | if (hIO != INVALID_HANDLE_VALUE) {
135 | CloseHandle(hIO);
136 | }
137 | }
138 |
139 | /*
140 | Purpose: Write data to an IO handle
141 | Args: hDevice: The IO handle
142 | . Buffer: Data to write
143 | . WriteSize: The length of data to write
144 | Return: 0: failed; 1: succeed
145 | */
146 | int Write_IO_Handle(HANDLE hDevice, const char *Buffer, const int WriteSize) {
147 | if (WriteFile(hDevice, Buffer, WriteSize, NULL, NULL) != 0) {
148 | return 1;
149 | }
150 | else {
151 | return 0;
152 | }
153 | }
154 |
--------------------------------------------------------------------------------
/kernel_mode_process_protection.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio 2013
4 | VisualStudioVersion = 12.0.21005.1
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "protection", "protection\protection.vcxproj", "{FA7EC13B-E085-4691-82E8-F74B3E05A68F}"
7 | EndProject
8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "driver_loader", "driver_loader\driver_loader.vcxproj", "{CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}"
9 | EndProject
10 | Global
11 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
12 | Debug|Mixed Platforms = Debug|Mixed Platforms
13 | Debug|Win32 = Debug|Win32
14 | Debug|x64 = Debug|x64
15 | Release|Mixed Platforms = Release|Mixed Platforms
16 | Release|Win32 = Release|Win32
17 | Release|x64 = Release|x64
18 | Win7 Debug|Mixed Platforms = Win7 Debug|Mixed Platforms
19 | Win7 Debug|Win32 = Win7 Debug|Win32
20 | Win7 Debug|x64 = Win7 Debug|x64
21 | Win7 Release|Mixed Platforms = Win7 Release|Mixed Platforms
22 | Win7 Release|Win32 = Win7 Release|Win32
23 | Win7 Release|x64 = Win7 Release|x64
24 | Win8 Debug|Mixed Platforms = Win8 Debug|Mixed Platforms
25 | Win8 Debug|Win32 = Win8 Debug|Win32
26 | Win8 Debug|x64 = Win8 Debug|x64
27 | Win8 Release|Mixed Platforms = Win8 Release|Mixed Platforms
28 | Win8 Release|Win32 = Win8 Release|Win32
29 | Win8 Release|x64 = Win8 Release|x64
30 | Win8.1 Debug|Mixed Platforms = Win8.1 Debug|Mixed Platforms
31 | Win8.1 Debug|Win32 = Win8.1 Debug|Win32
32 | Win8.1 Debug|x64 = Win8.1 Debug|x64
33 | Win8.1 Release|Mixed Platforms = Win8.1 Release|Mixed Platforms
34 | Win8.1 Release|Win32 = Win8.1 Release|Win32
35 | Win8.1 Release|x64 = Win8.1 Release|x64
36 | EndGlobalSection
37 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
38 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Debug|Mixed Platforms.ActiveCfg = Win8.1 Debug|Win32
39 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Debug|Mixed Platforms.Build.0 = Win8.1 Debug|Win32
40 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Debug|Mixed Platforms.Deploy.0 = Win8.1 Debug|Win32
41 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Debug|Win32.ActiveCfg = Win7 Debug|Win32
42 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Debug|Win32.Build.0 = Win7 Debug|Win32
43 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Debug|x64.ActiveCfg = Win8.1 Debug|x64
44 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Debug|x64.Build.0 = Win8.1 Debug|x64
45 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Debug|x64.Deploy.0 = Win8.1 Debug|x64
46 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Release|Mixed Platforms.ActiveCfg = Win8.1 Release|Win32
47 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Release|Mixed Platforms.Build.0 = Win8.1 Release|Win32
48 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Release|Mixed Platforms.Deploy.0 = Win8.1 Release|Win32
49 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Release|Win32.ActiveCfg = Win7 Release|Win32
50 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Release|Win32.Build.0 = Win7 Release|Win32
51 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Release|x64.ActiveCfg = Win7 Release|x64
52 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Release|x64.Build.0 = Win7 Release|x64
53 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Release|x64.Deploy.0 = Win7 Release|x64
54 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Debug|Mixed Platforms.ActiveCfg = Win7 Debug|Win32
55 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Debug|Mixed Platforms.Build.0 = Win7 Debug|Win32
56 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Debug|Mixed Platforms.Deploy.0 = Win7 Debug|Win32
57 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Debug|Win32.ActiveCfg = Win7 Debug|Win32
58 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Debug|Win32.Build.0 = Win7 Debug|Win32
59 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Debug|x64.ActiveCfg = Win7 Debug|x64
60 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Debug|x64.Build.0 = Win7 Debug|x64
61 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Debug|x64.Deploy.0 = Win7 Debug|x64
62 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Release|Mixed Platforms.ActiveCfg = Win7 Release|Win32
63 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Release|Mixed Platforms.Build.0 = Win7 Release|Win32
64 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Release|Mixed Platforms.Deploy.0 = Win7 Release|Win32
65 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Release|Win32.ActiveCfg = Win7 Release|Win32
66 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Release|Win32.Build.0 = Win7 Release|Win32
67 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Release|x64.ActiveCfg = Win7 Release|x64
68 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Release|x64.Build.0 = Win7 Release|x64
69 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win7 Release|x64.Deploy.0 = Win7 Release|x64
70 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Debug|Mixed Platforms.ActiveCfg = Win8 Debug|Win32
71 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Debug|Mixed Platforms.Build.0 = Win8 Debug|Win32
72 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Debug|Mixed Platforms.Deploy.0 = Win8 Debug|Win32
73 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Debug|Win32.ActiveCfg = Win8 Debug|Win32
74 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Debug|Win32.Build.0 = Win8 Debug|Win32
75 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Debug|x64.ActiveCfg = Win8 Debug|x64
76 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Debug|x64.Build.0 = Win8 Debug|x64
77 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Debug|x64.Deploy.0 = Win8 Debug|x64
78 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Release|Mixed Platforms.ActiveCfg = Win8 Release|Win32
79 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Release|Mixed Platforms.Build.0 = Win8 Release|Win32
80 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Release|Mixed Platforms.Deploy.0 = Win8 Release|Win32
81 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Release|Win32.ActiveCfg = Win8 Release|Win32
82 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Release|Win32.Build.0 = Win8 Release|Win32
83 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Release|x64.ActiveCfg = Win8 Release|x64
84 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Release|x64.Build.0 = Win8 Release|x64
85 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8 Release|x64.Deploy.0 = Win8 Release|x64
86 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Debug|Mixed Platforms.ActiveCfg = Win8.1 Debug|Win32
87 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Debug|Mixed Platforms.Build.0 = Win8.1 Debug|Win32
88 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Debug|Mixed Platforms.Deploy.0 = Win8.1 Debug|Win32
89 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Debug|Win32.ActiveCfg = Win8.1 Debug|Win32
90 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Debug|Win32.Build.0 = Win8.1 Debug|Win32
91 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Debug|x64.ActiveCfg = Win8.1 Debug|x64
92 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Debug|x64.Build.0 = Win8.1 Debug|x64
93 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Debug|x64.Deploy.0 = Win8.1 Debug|x64
94 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Release|Mixed Platforms.ActiveCfg = Win8.1 Release|Win32
95 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Release|Mixed Platforms.Build.0 = Win8.1 Release|Win32
96 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Release|Mixed Platforms.Deploy.0 = Win8.1 Release|Win32
97 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Release|Win32.ActiveCfg = Win8.1 Release|Win32
98 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Release|Win32.Build.0 = Win8.1 Release|Win32
99 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Release|x64.ActiveCfg = Win8.1 Release|x64
100 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Release|x64.Build.0 = Win8.1 Release|x64
101 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}.Win8.1 Release|x64.Deploy.0 = Win8.1 Release|x64
102 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32
103 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Debug|Mixed Platforms.Build.0 = Debug|Win32
104 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Debug|Win32.ActiveCfg = Debug|Win32
105 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Debug|Win32.Build.0 = Debug|Win32
106 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Debug|x64.ActiveCfg = Debug|Win32
107 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Release|Mixed Platforms.ActiveCfg = Release|Win32
108 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Release|Mixed Platforms.Build.0 = Release|Win32
109 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Release|Win32.ActiveCfg = Release|Win32
110 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Release|Win32.Build.0 = Release|Win32
111 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Release|x64.ActiveCfg = Release|Win32
112 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Debug|Mixed Platforms.ActiveCfg = Debug|Win32
113 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Debug|Mixed Platforms.Build.0 = Debug|Win32
114 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Debug|Win32.ActiveCfg = Debug|Win32
115 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Debug|Win32.Build.0 = Debug|Win32
116 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Debug|x64.ActiveCfg = Debug|Win32
117 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Release|Mixed Platforms.ActiveCfg = Release|Win32
118 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Release|Mixed Platforms.Build.0 = Release|Win32
119 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Release|Win32.ActiveCfg = Release|Win32
120 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Release|Win32.Build.0 = Release|Win32
121 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win7 Release|x64.ActiveCfg = Release|Win32
122 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Debug|Mixed Platforms.ActiveCfg = Debug|Win32
123 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Debug|Mixed Platforms.Build.0 = Debug|Win32
124 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Debug|Win32.ActiveCfg = Debug|Win32
125 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Debug|Win32.Build.0 = Debug|Win32
126 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Debug|x64.ActiveCfg = Debug|Win32
127 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Release|Mixed Platforms.ActiveCfg = Release|Win32
128 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Release|Mixed Platforms.Build.0 = Release|Win32
129 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Release|Win32.ActiveCfg = Release|Win32
130 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Release|Win32.Build.0 = Release|Win32
131 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8 Release|x64.ActiveCfg = Release|Win32
132 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Debug|Mixed Platforms.ActiveCfg = Debug|Win32
133 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Debug|Mixed Platforms.Build.0 = Debug|Win32
134 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Debug|Win32.ActiveCfg = Debug|Win32
135 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Debug|Win32.Build.0 = Debug|Win32
136 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Debug|x64.ActiveCfg = Debug|Win32
137 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Release|Mixed Platforms.ActiveCfg = Release|Win32
138 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Release|Mixed Platforms.Build.0 = Release|Win32
139 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Release|Win32.ActiveCfg = Release|Win32
140 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Release|Win32.Build.0 = Release|Win32
141 | {CB7F8236-DFD9-4D73-85F6-C4C6C658ACCD}.Win8.1 Release|x64.ActiveCfg = Release|Win32
142 | EndGlobalSection
143 | GlobalSection(SolutionProperties) = preSolution
144 | HideSolutionNode = FALSE
145 | EndGlobalSection
146 | EndGlobal
147 |
--------------------------------------------------------------------------------
/protection/device.c:
--------------------------------------------------------------------------------
1 | #include "driver.h"
2 |
3 | //Global variables -----------------------------------------------
4 | const wchar_t *DeviceName = L"\\Device\\MyProtectionDriver";
5 | const wchar_t *SymbolicLink = L"\\DosDevices\\MyProtectionDriver";
6 |
7 | UNICODE_STRING ustrDeviceName;
8 | UNICODE_STRING ustrSymbolicLink;
9 |
10 | PDEVICE_OBJECT CreatedDeviceObject = NULL;
11 | //----------------------------------------------------------------
12 |
13 | void init_unicode_strings() {
14 | RtlInitUnicodeString(&ustrDeviceName, DeviceName);
15 | RtlInitUnicodeString(&ustrSymbolicLink, SymbolicLink);
16 | }
17 |
18 | /*
19 | Purpose: Create I/O device
20 | Args: DriverObject: Driver Object
21 | Return: 0: Failed; 1: Succeed
22 | */
23 | int SetupIoDevice(PDRIVER_OBJECT DriverObject) {
24 | DbgPrint("Creating I/O device! name: %ws", ustrDeviceName.Buffer);
25 |
26 | int ret = IoCreateDevice(DriverObject, 0, &ustrDeviceName, FILE_DEVICE_UNKNOWN,
27 | FILE_DEVICE_SECURE_OPEN, FALSE, &CreatedDeviceObject);
28 | if (ret != STATUS_SUCCESS) {
29 | DbgPrint("IoCreateDevice() failed!");
30 | return 0;
31 | }
32 |
33 | CreatedDeviceObject->Flags |= DO_BUFFERED_IO;
34 | CreatedDeviceObject->Flags &= (~DO_DEVICE_INITIALIZING);
35 | DbgPrint("Device created!");
36 |
37 | ret = IoCreateSymbolicLink(&ustrSymbolicLink, &ustrDeviceName);
38 | if (ret != STATUS_SUCCESS) {
39 | DbgPrint("IoCreateSymbolicLink() failed!");
40 | return 0;
41 | }
42 | DbgPrint("Symbolic link created!: %ws -> %ws", ustrSymbolicLink.Buffer, ustrDeviceName.Buffer);
43 | return 1;
44 | }
45 |
--------------------------------------------------------------------------------
/protection/driver.c:
--------------------------------------------------------------------------------
1 | #include "driver.h"
2 |
3 | //Function prototypes --------------------------------------------
4 | void on_driver_unload(PDRIVER_OBJECT DriverObject);
5 | NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath);
6 | //----------------------------------------------------------------
7 |
8 | NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) {
9 | UNREFERENCED_PARAMETER(RegistryPath);
10 |
11 | DriverObject->DriverUnload = on_driver_unload;
12 |
13 | unsigned int i;
14 | for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) {
15 | DriverObject->MajorFunction[i] = Io_Unsupported;
16 | }
17 | DriverObject->MajorFunction[IRP_MJ_CREATE] = Create_DeviceIo;
18 | DriverObject->MajorFunction[IRP_MJ_CLOSE] = Close_DeviceIo;
19 | DriverObject->MajorFunction[IRP_MJ_WRITE] = Buffered_Write;
20 |
21 | init_unicode_strings();
22 | if (SetupIoDevice(DriverObject) == 1) {
23 | DbgPrint("SetupIoDevice() succeed!");
24 | }
25 | else {
26 | DbgPrint("SetupIoDevice() failed!");
27 | }
28 |
29 | DbgPrint("Driver loaded!");
30 |
31 | return STATUS_SUCCESS;
32 | }
33 |
34 | void on_driver_unload(PDRIVER_OBJECT DriverObject) {
35 | UNREFERENCED_PARAMETER(DriverObject);
36 |
37 | disable_protection();
38 |
39 | DbgPrint("Driver unloaded.");
40 | }
41 |
--------------------------------------------------------------------------------
/protection/driver.h:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 |
4 | //Define major functions
5 | NTSTATUS Io_Unsupported(PDEVICE_OBJECT DeviceObject, PIRP Irp); //IRP_MJ_*
6 | NTSTATUS Create_DeviceIo(PDEVICE_OBJECT DeviceObject, PIRP Irp); //IRP_MJ_CREATE
7 | NTSTATUS Close_DeviceIo(PDEVICE_OBJECT DeviceObject, PIRP Irp); //IRP_MJ_CLOSE
8 | NTSTATUS Buffered_Write(PDEVICE_OBJECT DeviceObject, PIRP Irp); //IRP_MJ_WRITE
9 |
10 | //Define buffer messaege handler function (for Buffered_Write)
11 | void handle_buffer_message(char *buffer, int len);
12 |
13 | //Define device-related functions
14 | void init_unicode_strings();
15 | int SetupIoDevice(PDRIVER_OBJECT DriverObject);
16 |
17 | //Define protection functions
18 | void disable_protection();
19 | int enable_protection(int pid);
20 |
--------------------------------------------------------------------------------
/protection/major_functions.c:
--------------------------------------------------------------------------------
1 | #include "driver.h"
2 |
3 | NTSTATUS Io_Unsupported(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
4 | UNREFERENCED_PARAMETER(DeviceObject);
5 | UNREFERENCED_PARAMETER(Irp);
6 |
7 | DbgPrint("Io_Unsupported() called!");
8 | return STATUS_SUCCESS;
9 | }
10 |
11 | NTSTATUS Create_DeviceIo(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
12 | UNREFERENCED_PARAMETER(DeviceObject);
13 | UNREFERENCED_PARAMETER(Irp);
14 |
15 | DbgPrint("Create_DeviceIo() called!");
16 | return STATUS_SUCCESS;
17 | }
18 |
19 | NTSTATUS Close_DeviceIo(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
20 | UNREFERENCED_PARAMETER(DeviceObject);
21 | UNREFERENCED_PARAMETER(Irp);
22 |
23 | DbgPrint("Close_DeviceIo() called!");
24 | return STATUS_SUCCESS;
25 | }
26 |
27 | NTSTATUS Buffered_Write(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
28 | UNREFERENCED_PARAMETER(DeviceObject);
29 | PIO_STACK_LOCATION pIoStack = NULL;
30 | char *Buffer = NULL;
31 |
32 | DbgPrint("Buffered_Write() called!");
33 |
34 | pIoStack = IoGetCurrentIrpStackLocation(Irp);
35 | if (pIoStack) { //Check for NULL pointer
36 | Buffer = (char*)(Irp->AssociatedIrp.SystemBuffer);
37 |
38 | if (Buffer) { //Check for NULL pointer
39 | handle_buffer_message(Buffer, pIoStack->Parameters.Write.Length);
40 | DbgPrint("Message received: size: %u, msg: %s", pIoStack->Parameters.Write.Length, Buffer);
41 | }
42 | else {
43 | DbgPrint("Buffer is a NULL pointer!");
44 | }
45 | }
46 | else {
47 | DbgPrint("Invalid IRP stack pointer!");
48 | }
49 |
50 | return STATUS_SUCCESS;
51 | }
52 |
--------------------------------------------------------------------------------
/protection/message_handler.c:
--------------------------------------------------------------------------------
1 | #include "driver.h"
2 |
3 | void handle_buffer_message(char *buffer, int len) {
4 | if (len == 1) {
5 | if (buffer[0] == 'd') { //'d' for disable protection
6 | disable_protection();
7 | }
8 | }
9 | else if (len == 5) {
10 | if (buffer[0] == 'e') { //'e' for enable protection
11 | int pid;
12 |
13 | memcpy(&pid, &buffer[1], 4);
14 | DbgPrint("Got it! Target pid: %i", pid);
15 | if (enable_protection(pid)) {
16 | DbgPrint("enable_protection() succeed!");
17 | }
18 | else {
19 | DbgPrint("enable_protection() failed!");
20 | }
21 | }
22 | }
23 | }
--------------------------------------------------------------------------------
/protection/protection.c:
--------------------------------------------------------------------------------
1 | #include "driver.h"
2 |
3 | /*
4 | Referenced from https://www.evilsocket.net/2014/02/05/termination-and-injection-self-defense-on-windows/
5 | Thank you!
6 | */
7 |
8 | //Function prototypes --------------------------------------------
9 | void PostOperationCallback(PVOID RegistrationContext, POB_POST_OPERATION_INFORMATION OperationInformation);
10 | OB_PREOP_CALLBACK_STATUS PreOperationCallback(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation);
11 | //----------------------------------------------------------------
12 |
13 | //Global variables -----------------------------------------------
14 | void *CallbackRegistrationHandle = NULL;
15 | int ProtectedPid = 0;
16 | //----------------------------------------------------------------
17 |
18 | void disable_protection() {
19 | if (CallbackRegistrationHandle != NULL) {
20 | ObUnRegisterCallbacks(CallbackRegistrationHandle);
21 | CallbackRegistrationHandle = NULL;
22 | }
23 | DbgPrint("disable_protection() called!");
24 | }
25 |
26 | /*
27 | Purpose: Register a handle creation callback function to enable process protection
28 | Args: pid: The process ID to protect
29 | Return: 0: Failed; 1: Succeed
30 | */
31 | int enable_protection(int pid) {
32 | OB_OPERATION_REGISTRATION OperationRegistrations[1] = { { 0 } };
33 | OB_CALLBACK_REGISTRATION CallbackRegistration = { 0 };
34 | UNICODE_STRING ustrAltitude = { 0 };
35 | NTSTATUS status = STATUS_SUCCESS;
36 | ProtectedPid = pid;
37 |
38 | OperationRegistrations[0].ObjectType = PsProcessType; //Set type to process
39 | OperationRegistrations[0].Operations = OB_OPERATION_HANDLE_CREATE; //Intercept all handle creation
40 | OperationRegistrations[0].PreOperation = PreOperationCallback;
41 | OperationRegistrations[0].PostOperation = PostOperationCallback;
42 |
43 | RtlInitUnicodeString(&ustrAltitude, L"1000");
44 | CallbackRegistration.Version = OB_FLT_REGISTRATION_VERSION;
45 | CallbackRegistration.OperationRegistrationCount = 1;
46 | CallbackRegistration.Altitude = ustrAltitude;
47 | CallbackRegistration.RegistrationContext = (PVOID)&ProtectedPid;
48 | CallbackRegistration.OperationRegistration = OperationRegistrations;
49 |
50 | status = ObRegisterCallbacks(&CallbackRegistration, &CallbackRegistrationHandle);
51 | if (NT_SUCCESS(status)) {
52 | DbgPrint("ObRegisterCallbacks() succeed!");
53 | return 1;
54 | }
55 | else {
56 | DbgPrint("ObRegisterCallbacks() failed! status: %i", status);
57 | return 0;
58 | }
59 | }
60 |
61 | /*
62 | Purpose: This callback function is called when a process handle is created
63 | Args: RegistrationContext: Unused. Should be the PID of the protected process
64 | . OperationInformation: Unused. Information of the operation
65 | */
66 | void PostOperationCallback(PVOID RegistrationContext, POB_POST_OPERATION_INFORMATION OperationInformation) {
67 | //Do nothing here
68 | UNREFERENCED_PARAMETER(RegistrationContext);
69 | UNREFERENCED_PARAMETER(OperationInformation);
70 | }
71 |
72 | /*
73 | Purpose: Register a handle creation callback function to enable process protection
74 | Args: pid: The process ID to protect
75 | Return: Must be OB_PREOP_SUCCESS
76 | */
77 | OB_PREOP_CALLBACK_STATUS PreOperationCallback(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) {
78 | PEPROCESS TargetProcess = OperationInformation->Object;
79 | PEPROCESS CurrentProcess = PsGetCurrentProcess();
80 | HANDLE TargetPid = PsGetProcessId(TargetProcess);
81 |
82 | //Allow operations from the process itself
83 | if (CurrentProcess == TargetProcess) {
84 | return OB_PREOP_SUCCESS;
85 | }
86 |
87 | //Allow operations from the kernel
88 | if (OperationInformation->KernelHandle == 1) {
89 | return OB_PREOP_SUCCESS;
90 | }
91 |
92 | //Ignore other processes
93 | if (TargetPid != (HANDLE)(*(int*)RegistrationContext)) {
94 | return OB_PREOP_SUCCESS;
95 | }
96 | else {
97 | //Someone is trying to obtain a handle to the protected process
98 | //Remove "dangerous" access rights!!
99 | OperationInformation->Parameters->CreateHandleInformation.DesiredAccess = 0;
100 | DbgPrint("Hahahaha! Operation blocked! Don't even try to kill me!");
101 | }
102 |
103 | return OB_PREOP_SUCCESS;
104 | }
105 |
--------------------------------------------------------------------------------
/protection/protection.inf:
--------------------------------------------------------------------------------
1 | ;
2 | ; protection.inf
3 | ;
4 |
5 | [Version]
6 | Signature="$WINDOWS NT$"
7 | Class=Sample ; TODO: edit Class
8 | ClassGuid={78A1C341-4539-11d3-B88D-00C04FAD5171} ; TODO: edit ClassGuid
9 | Provider=%ManufacturerName%
10 | CatalogFile=protection.cat
11 | DriverVer= ; TODO: set DriverVer in stampinf property pages
12 |
13 | [DestinationDirs]
14 | DefaultDestDir = 12
15 |
16 | ; ================= Class section =====================
17 |
18 | [ClassInstall32]
19 | Addreg=SampleClassReg
20 |
21 | [SampleClassReg]
22 | HKR,,,0,%ClassName%
23 | HKR,,Icon,,-5
24 |
25 | [SourceDisksNames]
26 | 1 = %DiskName%,,,""
27 |
28 | [SourceDisksFiles]
29 | protection.sys = 1,,
30 |
31 | ;*****************************************
32 | ; Install Section
33 | ;*****************************************
34 |
35 | [Manufacturer]
36 | %ManufacturerName%=Standard,NT$ARCH$
37 |
38 | [Standard.NT$ARCH$]
39 | %protection.DeviceDesc%=protection_Device, Root\protection ; TODO: edit hw-id
40 |
41 | [protection_Device.NT]
42 | CopyFiles=Drivers_Dir
43 |
44 | [Drivers_Dir]
45 | protection.sys
46 |
47 | ;-------------- Service installation
48 | [protection_Device.NT.Services]
49 | AddService = protection,%SPSVCINST_ASSOCSERVICE%, protection_Service_Inst
50 |
51 | ; -------------- protection driver install sections
52 | [protection_Service_Inst]
53 | DisplayName = %protection.SVCDESC%
54 | ServiceType = 1 ; SERVICE_KERNEL_DRIVER
55 | StartType = 3 ; SERVICE_DEMAND_START
56 | ErrorControl = 1 ; SERVICE_ERROR_NORMAL
57 | ServiceBinary = %12%\protection.sys
58 | LoadOrderGroup = Extended Base
59 |
60 | ;
61 | ;--- protection_Device Coinstaller installation ------
62 | ;
63 |
64 | [DestinationDirs]
65 | protection_Device_CoInstaller_CopyFiles = 11
66 |
67 | [protection_Device.NT.CoInstallers]
68 | AddReg=protection_Device_CoInstaller_AddReg
69 | CopyFiles=protection_Device_CoInstaller_CopyFiles
70 |
71 | [protection_Device_CoInstaller_AddReg]
72 | HKR,,CoInstallers32,0x00010000, "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller"
73 |
74 | [protection_Device_CoInstaller_CopyFiles]
75 | WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll
76 |
77 | [SourceDisksFiles]
78 | WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with SourceDisksNames
79 |
80 | [protection_Device.NT.Wdf]
81 | KmdfService = protection, protection_wdfsect
82 | [protection_wdfsect]
83 | KmdfLibraryVersion = $KMDFVERSION$
84 |
85 | [Strings]
86 | SPSVCINST_ASSOCSERVICE= 0x00000002
87 | ManufacturerName="" ; TODO: add ManufacturerName
88 | ClassName="Samples" ; TODO: edit ClassName
89 | DiskName = "protection Installation Disk"
90 | protection.DeviceDesc = "protection Device"
91 | protection.SVCDESC = "protection Service"
92 |
--------------------------------------------------------------------------------
/protection/protection.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Win8.1 Debug
6 | Win32
7 |
8 |
9 | Win8.1 Release
10 | Win32
11 |
12 |
13 | Win8 Debug
14 | Win32
15 |
16 |
17 | Win8 Release
18 | Win32
19 |
20 |
21 | Win7 Debug
22 | Win32
23 |
24 |
25 | Win7 Release
26 | Win32
27 |
28 |
29 | Win8.1 Debug
30 | x64
31 |
32 |
33 | Win8.1 Release
34 | x64
35 |
36 |
37 | Win8 Debug
38 | x64
39 |
40 |
41 | Win8 Release
42 | x64
43 |
44 |
45 | Win7 Debug
46 | x64
47 |
48 |
49 | Win7 Release
50 | x64
51 |
52 |
53 |
54 | {FA7EC13B-E085-4691-82E8-F74B3E05A68F}
55 | {497e31cb-056b-4f31-abb8-447fd55ee5a5}
56 | v4.5
57 | 11.0
58 | Win8.1 Debug
59 | Win32
60 | protection
61 |
62 |
63 |
64 | WindowsV6.3
65 | true
66 | WindowsKernelModeDriver8.1
67 | Driver
68 | KMDF
69 |
70 |
71 | WindowsV6.3
72 | false
73 | WindowsKernelModeDriver8.1
74 | Driver
75 | KMDF
76 |
77 |
78 | Windows8
79 | true
80 | WindowsKernelModeDriver8.1
81 | Driver
82 | KMDF
83 |
84 |
85 | Windows8
86 | false
87 | WindowsKernelModeDriver8.1
88 | Driver
89 | KMDF
90 |
91 |
92 | Windows7
93 | true
94 | WindowsKernelModeDriver8.1
95 | Driver
96 | KMDF
97 |
98 |
99 | Windows7
100 | false
101 | WindowsKernelModeDriver8.1
102 | Driver
103 | KMDF
104 |
105 |
106 | WindowsV6.3
107 | true
108 | WindowsKernelModeDriver8.1
109 | Driver
110 | KMDF
111 |
112 |
113 | WindowsV6.3
114 | false
115 | WindowsKernelModeDriver8.1
116 | Driver
117 | KMDF
118 |
119 |
120 | Windows8
121 | true
122 | WindowsKernelModeDriver8.1
123 | Driver
124 | KMDF
125 |
126 |
127 | Windows8
128 | false
129 | WindowsKernelModeDriver8.1
130 | Driver
131 | KMDF
132 |
133 |
134 | Windows7
135 | true
136 | WindowsKernelModeDriver8.1
137 | Driver
138 | KMDF
139 |
140 |
141 | Windows7
142 | false
143 | WindowsKernelModeDriver8.1
144 | Driver
145 | KMDF
146 |
147 |
148 |
149 |
150 |
151 |
152 |
153 |
154 |
155 |
156 | DbgengKernelDebugger
157 |
158 |
159 | DbgengKernelDebugger
160 |
161 |
162 | DbgengKernelDebugger
163 |
164 |
165 | DbgengKernelDebugger
166 |
167 |
168 | DbgengKernelDebugger
169 |
170 |
171 | DbgengKernelDebugger
172 |
173 |
174 | DbgengKernelDebugger
175 |
176 |
177 | DbgengKernelDebugger
178 |
179 |
180 | DbgengKernelDebugger
181 |
182 |
183 | DbgengKernelDebugger
184 |
185 |
186 | DbgengKernelDebugger
187 |
188 |
189 | DbgengKernelDebugger
190 |
191 |
192 |
193 | false
194 | trace.h
195 | true
196 |
197 |
198 |
199 |
200 |
201 | true
202 | trace.h
203 | true
204 |
205 |
206 |
207 |
208 | true
209 | trace.h
210 | true
211 |
212 |
213 |
214 |
215 | true
216 | trace.h
217 | true
218 |
219 |
220 |
221 |
222 | true
223 | trace.h
224 | true
225 |
226 |
227 |
228 |
229 | true
230 | trace.h
231 | true
232 |
233 |
234 |
235 |
236 | true
237 | trace.h
238 | true
239 |
240 |
241 |
242 |
243 | true
244 | trace.h
245 | true
246 |
247 |
248 |
249 |
250 | true
251 | trace.h
252 | true
253 |
254 |
255 |
256 |
257 | true
258 | trace.h
259 | true
260 |
261 |
262 |
263 |
264 | true
265 | trace.h
266 | true
267 |
268 |
269 |
270 |
271 | false
272 | trace.h
273 | true
274 |
275 |
276 | /INTEGRITYCHECK %(AdditionalOptions)
277 |
278 |
279 |
280 |
281 |
282 |
283 |
284 |
285 |
286 |
287 |
288 |
289 |
290 |
291 |
292 |
293 |
294 |
295 |
296 |
297 |
298 |
299 |
300 |
301 |
--------------------------------------------------------------------------------
/protection/protection.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hpp;hxx;hm;inl;inc;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 | {8E41214B-6785-4CFE-B992-037D68949A14}
18 | inf;inv;inx;mof;mc;
19 |
20 |
21 |
22 |
23 | Driver Files
24 |
25 |
26 |
27 |
28 | Header Files
29 |
30 |
31 |
32 |
33 | Source Files
34 |
35 |
36 | Source Files
37 |
38 |
39 | Source Files
40 |
41 |
42 | Source Files
43 |
44 |
45 | Source Files
46 |
47 |
48 |
--------------------------------------------------------------------------------
/protection/protection.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | TestSign
5 | CN="WDKTestCert 12574,132236232621169406" | 1F2B11D6CF700663EC1B0F8FB6D8594D4111F227
6 |
7 |
--------------------------------------------------------------------------------