crvvdev / masterhide Goto Github PK
View Code? Open in Web Editor NEWA x64 Windows Rootkit using SSDT or Hypervisor hook
License: MIT License
A x64 Windows Rootkit using SSDT or Hypervisor hook
License: MIT License
MasterHide/MasterHide/mh_hooks.cpp
Line 380 in 3e79de1
MasterHide/MasterHide/mh_hooks.cpp
Line 392 in 3e79de1
MasterHide/MasterHide/mh_hooks.cpp
Line 423 in 3e79de1
MasterHide/MasterHide/mh_hooks.cpp
Line 435 in 3e79de1
Decreased performance, more correct do like
Serial [0] != '\0'
Line 17 in 3e79de1
MasterHide/MasterHide/shadow_ssdt.cpp
Lines 387 to 400 in 3e79de1
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERBUILDWNDLIST, oNtUserBuildHwndList ) )
DBGPRINT( "Failed to unhook NtUserBuildHwndList\n" );
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERWNDFROMPOINT, oNtUserWindowFromPoint ) )
DBGPRINT( "Failed to unhook NtUserWindowFromPoint\n" );
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERFINDWNDEX, oNtUserFindWindowEx ) )
DBGPRINT( "Failed to unhook NtUserFindWindowEx\n" );
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTGETFOREGROUNDWND, oNtUserGetForegroundWindow ) )
DBGPRINT( "Failed to unhook NtUserGetForegroundWindow\n" );
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERQUERYWND, oNtUserQueryWindow ) )
DBGPRINT( "Failed to unhook NtUserQueryWindow\n" );
MasterHide/MasterHide/mh_hooks.h
Line 6 in 3e79de1
MasterHide/MasterHide/mh_hooks.h
Line 15 in 3e79de1
correct:
//
// win32k.sys
//
static auto SYSCALL_NTUSERFINDWNDEX = 0x106e;
static auto SYSCALL_NTUSERWNDFROMPOINT = 0x1014;
static auto SYSCALL_NTUSERBUILDWNDLIST = 0x101c;
static auto SYSCALL_NTGETFOREGROUNDWND = 0x103c;
static auto SYSCALL_NTUSERQUERYWND = 0x1010;
//
// ntoskrnl.exe
//
static auto SYSCALL_NTQUERYSYSINFO = 0x0033;
static auto SYSCALL_NTOPENPROCESS = 0x0023;
static auto SYSCALL_NTALLOCVIRTUALMEM = 0x0015;
static auto SYSCALL_NTWRITEVIRTUALMEM = 0x0037;
static auto SYSCALL_NTFREEVIRTUALMEM = 0x001b;
static auto SYSCALL_NTDEVICEIOCTRLFILE = 0x0004;
static auto SYSCALL_NTLOADDRIVER = 0x0004;
[SC] StartService FAILED 31:
A device attached to the system is not functioning.
When i try To Start On My Windows 10 i am getting this error.
I am using on My laptop Lenovo ideapad 330 can anyone help in this.
MasterHide/MasterHide/shadow_ssdt.cpp
Line 203 in 3e79de1
"\Windows\ApiPort" lenght is 17, not 20
wcsncmp( L"\\Windows\\ApiPort", ObjName->Name.Buffer, 17 )
MasterHide/MasterHide/tools.cpp
Line 32 in 3e79de1
MasterHide/MasterHide/tools.cpp
Line 66 in 3e79de1
More better:
wchar_t lpModuleName[ MAX_PATH ];
status = ZwQueryVirtualMemory( NtCurrentProcess(), PsGetProcessSectionBaseAddress( Process ), static_cast<MEMORY_INFORMATION_CLASS>(2), lpModuleName, sizeof( lpModuleName ), nullptr );
if ( NT_SUCCESS( status ) )
{
const auto unModuleNameSize = wcslen(lpModuleName);
if (unModuleNameSize > 0 )
{
AllocateUnicodeString( ProcessImageName, static_cast<USHORT>(unModuleNameSize));
wcscpy_s( ProcessImageName->Buffer, unModuleNameSize, lpModuleName );
bReturn = true;
}
}
MasterHide/MasterHide/tools.cpp
Line 117 in 3e79de1
ProbeForRead( pImageBase, sizeof(IMAGE_DOS_HEADER), __alignof( pImageBase ) );
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.