diff --git a/SbieHide/APIHook.cpp b/SbieHide/APIHook.cpp index fe82e1e..b788ca5 100644 --- a/SbieHide/APIHook.cpp +++ b/SbieHide/APIHook.cpp @@ -60,6 +60,11 @@ NTSTATUS NTAPI NtQueryObjectProxy(_In_opt_ HANDLE Handle, _In_ OBJECT_INFORMATIO return Status; } + if (ObjectName.Length < 7) { + RtlFreeUnicodeString(&ObjectName); + return Status; + } + if ((wcsstr(ObjectName.Buffer, L"SBIEDLL") != 0) || (wcsstr(ObjectName.Buffer, L"SBIEHIDE") != 0)) { RtlZeroMemory(reinterpret_cast(ObjectInformation)->Name.Buffer, reinterpret_cast(ObjectInformation)->Name.MaximumLength); reinterpret_cast(ObjectInformation)->Name.Length = 0; @@ -100,6 +105,11 @@ NTSTATUS NTAPI NtQueryInformationFileProxy(_In_ HANDLE FileHandle, _Out_ PIO_STA return Status; } + if (UpperFileName.Length < 7) { + RtlFreeUnicodeString(&UpperFileName); + return Status; + } + if ((wcsstr(UpperFileName.Buffer, L"SBIEDLL") != 0) || (wcsstr(UpperFileName.Buffer, L"SBIEHIDE") != 0)) { RtlZeroMemory(FileInformation, Length); RtlFreeUnicodeString(&UpperFileName); @@ -127,6 +137,11 @@ NTSTATUS NTAPI NtQueryInformationFileProxy(_In_ HANDLE FileHandle, _Out_ PIO_STA return Status; } + if (UpperFileName.Length < 7) { + RtlFreeUnicodeString(&UpperFileName); + return Status; + } + if ((wcsstr(UpperFileName.Buffer, L"SBIEDLL") != 0) || (wcsstr(UpperFileName.Buffer, L"SBIEHIDE") != 0)) { RtlZeroMemory(FileInformation, Length); RtlFreeUnicodeString(&UpperFileName); diff --git a/SbieHide/HideFromPEB.cpp b/SbieHide/HideFromPEB.cpp index 1384cdb..a449cc0 100644 --- a/SbieHide/HideFromPEB.cpp +++ b/SbieHide/HideFromPEB.cpp @@ -1,6 +1,8 @@ #include "HideFromPEB.h" #include "MemoryImageHideInformation.h" +#include + VOID EraseModuleNameFromPeb() { PPEB ProcessEnvironmentBlock = nullptr; PLIST_ENTRY FirstEntry = nullptr; @@ -18,57 +20,33 @@ VOID EraseModuleNameFromPeb() { CurrentEntryData = CONTAINING_RECORD(reinterpret_cast(CurrentEntry), LDR_DATA_TABLE_ENTRY, InLoadOrderLinks); if (IsAddressShouldHide(CurrentEntryData->DllBase)) { + if (FirstEntry == CurrentEntry) { + FirstEntry = CurrentEntry->Flink; + } + NextEntry = CurrentEntry->Flink; CurrentEntryData->HashLinks.Blink->Flink = CurrentEntryData->HashLinks.Flink; CurrentEntryData->HashLinks.Flink->Blink = CurrentEntryData->HashLinks.Blink; - CurrentEntry->Blink->Flink = CurrentEntry->Flink; - CurrentEntry->Flink->Blink = CurrentEntry->Blink; - - RtlZeroMemory(CurrentEntryData->BaseDllName.Buffer, CurrentEntryData->BaseDllName.MaximumLength); - RtlZeroMemory(CurrentEntryData->FullDllName.Buffer, CurrentEntryData->FullDllName.MaximumLength); - RtlZeroMemory(CurrentEntryData, sizeof(PLDR_DATA_TABLE_ENTRY)); - - CurrentEntry = NextEntry; - continue; - } - - CurrentEntry = CurrentEntry->Flink; - } - - FirstEntry = CurrentEntry = ProcessEnvironmentBlock->Ldr->InMemoryOrderModuleList.Flink; - - while (CurrentEntry->Flink != FirstEntry) { - CurrentEntryData = CONTAINING_RECORD(reinterpret_cast(CurrentEntry), LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks); - - if (IsAddressShouldHide(CurrentEntryData->DllBase)) { - NextEntry = CurrentEntry->Flink; - CurrentEntry->Blink->Flink = CurrentEntry->Flink; - CurrentEntry->Flink->Blink = CurrentEntry->Blink; - - RtlZeroMemory(CurrentEntryData->BaseDllName.Buffer, CurrentEntryData->BaseDllName.MaximumLength); - RtlZeroMemory(CurrentEntryData->FullDllName.Buffer, CurrentEntryData->FullDllName.MaximumLength); - RtlZeroMemory(CurrentEntryData, sizeof(PLDR_DATA_TABLE_ENTRY)); - - CurrentEntry = NextEntry; - continue; - } - CurrentEntry = CurrentEntry->Flink; - } + CurrentEntryData->InLoadOrderLinks.Blink->Flink = CurrentEntryData->InLoadOrderLinks.Flink; + CurrentEntryData->InLoadOrderLinks.Flink->Blink = CurrentEntryData->InLoadOrderLinks.Blink; - FirstEntry = CurrentEntry = ProcessEnvironmentBlock->Ldr->InInitializationOrderModuleList.Flink; + CurrentEntryData->InMemoryOrderLinks.Blink->Flink = CurrentEntryData->InMemoryOrderLinks.Flink; + CurrentEntryData->InMemoryOrderLinks.Flink->Blink = CurrentEntryData->InMemoryOrderLinks.Blink; - while (CurrentEntry->Flink != FirstEntry) { - CurrentEntryData = CONTAINING_RECORD(reinterpret_cast(CurrentEntry), LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks); + CurrentEntryData->InInitializationOrderLinks.Blink->Flink = CurrentEntryData->InInitializationOrderLinks.Flink; + CurrentEntryData->InInitializationOrderLinks.Flink->Blink = CurrentEntryData->InInitializationOrderLinks.Blink; - if (IsAddressShouldHide(CurrentEntryData->DllBase)) { - NextEntry = CurrentEntry->Flink; - CurrentEntry->Blink->Flink = CurrentEntry->Flink; - CurrentEntry->Flink->Blink = CurrentEntry->Blink; + CurrentEntryData->NodeModuleLink.Blink->Flink = CurrentEntryData->NodeModuleLink.Flink; + CurrentEntryData->NodeModuleLink.Flink->Blink = CurrentEntryData->NodeModuleLink.Blink; RtlZeroMemory(CurrentEntryData->BaseDllName.Buffer, CurrentEntryData->BaseDllName.MaximumLength); RtlZeroMemory(CurrentEntryData->FullDllName.Buffer, CurrentEntryData->FullDllName.MaximumLength); - RtlZeroMemory(CurrentEntryData, sizeof(PLDR_DATA_TABLE_ENTRY)); + #ifdef _WIN64 + RtlZeroMemory(CurrentEntryData, 136); + #else + RtlZeroMemory(CurrentEntryData, 72); + #endif CurrentEntry = NextEntry; continue; diff --git a/SbieHide/LibEntry.cpp b/SbieHide/LibEntry.cpp index d956c88..fa96713 100644 --- a/SbieHide/LibEntry.cpp +++ b/SbieHide/LibEntry.cpp @@ -12,7 +12,7 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) InitMemoryImageHideInformation(); EraseModuleNameFromPeb(); - + EraseModuleNameFromPeb(); EnableApiHook(); break; case DLL_THREAD_ATTACH: diff --git a/SbieHide/MemoryImageHideInformation.cpp b/SbieHide/MemoryImageHideInformation.cpp index 48bcc02..3bf48b8 100644 --- a/SbieHide/MemoryImageHideInformation.cpp +++ b/SbieHide/MemoryImageHideInformation.cpp @@ -17,7 +17,7 @@ BOOLEAN InitMemoryImageHideInformation() { while (reinterpret_cast(CONTAINING_RECORD(CurrentEntry->InMemoryOrderLinks.Flink, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks)) != FirstEntry) { - if (_wcsnicmp(CurrentEntry->BaseDllName.Buffer, L"sbiedll.dll", CurrentEntry->BaseDllName.Length) == 0) { + if (_wcsnicmp(CurrentEntry->BaseDllName.Buffer, L"sbiedll.dll", CurrentEntry->BaseDllName.Length) == 0 || _wcsnicmp(CurrentEntry->BaseDllName.Buffer, L"sbiedll", CurrentEntry->BaseDllName.Length) == 0) { MemoryImageHideInformationList.push_back(MemoryImageHideInformation(reinterpret_cast(CurrentEntry->DllBase), reinterpret_cast(CurrentEntry->DllBase) + CurrentEntry->SizeOfImage)); IsSandboxieModuleFound = TRUE; } diff --git a/SbieHide/SbieHide.vcxproj b/SbieHide/SbieHide.vcxproj index 26bd263..1052f1b 100644 --- a/SbieHide/SbieHide.vcxproj +++ b/SbieHide/SbieHide.vcxproj @@ -89,7 +89,7 @@ true true true - WIN32;NDEBUG;SBIEHIDE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + _CRT_SECURE_NO_WARNINGS;WIN32;NDEBUG;SBIEHIDE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) true MultiThreaded @@ -120,7 +120,7 @@ true true true - NDEBUG;SBIEHIDE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + _CRT_SECURE_NO_WARNINGS;NDEBUG;SBIEHIDE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) true MultiThreaded diff --git a/SbieTestConsole/ConsoleEntry.cpp b/SbieTestConsole/ConsoleEntry.cpp index 2a601d7..2b6d2d4 100644 --- a/SbieTestConsole/ConsoleEntry.cpp +++ b/SbieTestConsole/ConsoleEntry.cpp @@ -51,7 +51,7 @@ VOID CheckSandboxieByQueryVirtualMemoryMappedFilename() { return; } - Status = NtQueryVirtualMemory(NtCurrentProcess(), GetModuleHandleA("sbiehide.dll"), MemoryMappedFilenameInformation, NameBuffer, 0x1000, &ReturnedLength); + Status = NtQueryVirtualMemory(NtCurrentProcess(), GetModuleHandleA("sbiehide.dll") + 100, MemoryMappedFilenameInformation, NameBuffer, 0x1000, &ReturnedLength); if (Status != STATUS_ACCESS_DENIED) { printf("Sbiedll found! check hook\n"); diff --git a/SbieTestConsole/SbieTestConsole.vcxproj b/SbieTestConsole/SbieTestConsole.vcxproj index 869725f..49a680a 100644 --- a/SbieTestConsole/SbieTestConsole.vcxproj +++ b/SbieTestConsole/SbieTestConsole.vcxproj @@ -88,8 +88,9 @@ true true true - WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + _CRT_SECURE_NO_WARNINGS;WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true + MultiThreaded Console @@ -116,8 +117,9 @@ true true true - NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + _CRT_SECURE_NO_WARNINGS;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true + MultiThreaded Console @@ -128,11 +130,9 @@ - - diff --git a/SbieTestConsole/SbieTestConsole.vcxproj.filters b/SbieTestConsole/SbieTestConsole.vcxproj.filters index 2bee5fe..037c649 100644 --- a/SbieTestConsole/SbieTestConsole.vcxproj.filters +++ b/SbieTestConsole/SbieTestConsole.vcxproj.filters @@ -18,16 +18,10 @@ 源文件 - - 源文件 - 头文件 - - 头文件 - \ No newline at end of file