查看原文
其他

编写驱动检测虚拟机

微笑明天 看雪学院 2019-05-25

通过CPUID


原理:通过检查功能号1的CPUID返回的ecx的最高位是否为1,如果为1,则在虚拟环境下运行。真机的最高位不为1。


  • 检测处理器是否支持 cpuid 指令(忽略这一条)


现在的CPU都支持 cpuid 指令,没必要去检测是否支持,除非在很早的的机器上运行才有必要(那好像也要80486的机器吧)。


在 eflags.ID 标志位是 Processor Feature Identification 位,即最高位,通过修改这个标志位的值,以此来检测是否支持 cpuid 指令。


  • 要使用CPUID指令,输入eax表示功能号(类似中断的用法)


输出
eax,ebx,ecx,edx


在EDX和ECX中返回的功能标志表明着该CPU都支持那些功能。


ECX返回值定义如下(资料来自Intel):

bit Name Description

---------------------------------------------------------

00 SSE3 Streaming SIMD Extensions 3

01 Reserved

02 DTES64 64-Bit Debug Store

03 MONITOR MONITOR/MWAIT

04 DS-CPL CPL Qualified Debug Store

05 VMX Virtual Machine Extensions

06 SMX Safer Mode Extensions

07 EST Enhanced Intel SpeedStep® Technology

08 TM2 Thermal Monitor 2

09 SSSE3 Supplemental Streaming SIMD Extensions 3

10 CNXT-ID L1 Context ID

12:11 Reserved

13 CX16 CMPXCHG16B

14 xTPR xTPR Update Control

15 PDCM Perfmon and Debug Capability

17:16 Reserved

18 DCA Direct Cache Access

19 SSE4.1 Streaming SIMD Extensions 4.1

20 SSE4.2 Streaming SIMD Extensions 4.2

21 x2APIC Extended xAPIC Support

22 MOVBE MOVBE Instruction

23 POPCNT POPCNT Instruction

25:24 Reserved

26 XSAVE XSAVE/XSTOR States

27 OSXSAVE

31:28 Reserved


下面是使用CPUID检测的核心汇编代码:

.CODE

getcpuid PROC

xor eax,eax

mov eax,1h

cpuid

mov a,eax

mov b,ebx

mov c_var,ecx

mov d,edx

ret

getcpuid ENDP

END


通过利用IoInitializeTimer配合IoStartTimer的定时器来循环判定。



遍历模块


我们说到的第一种CPUID的方法可能通过修改VMX的配置等方法绕过。


还有一种方式是遍历当前系统中所有的sys。我们要查找的是
vmmouse.sys,vmrawdsk.sys,vmusbmouse.sys中的任意一个。


核心是利用
NtQuerySystemInformation

#include <ntddk.h>

#include <windef.h>





typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY

{


HANDLE Section;

PVOID MappedBase;

PVOID Base;

ULONG Size;

ULONG Flags;

USHORT LoadOrderIndex;

USHORT InitOrderIndex;

USHORT LoadCount;

USHORT PathLength;

CHAR ImageName[256];

} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;





typedef NTSTATUS(*NTQUERYSYSTEMINFORMATION) (

IN ULONG SystemInformationClass,

OUT PVOID SystemInformation,

IN ULONG_PTR SystemInformationLength,

OUT PULONG_PTR ReturnLength OPTIONAL

)
;



VOID getcpuid();

BOOLEAN CheckDriverModule();



UNICODE_STRING symLinkName = { 0 };

PDEVICE_OBJECT pDevice;

PETHREAD pThreadObject = NULL;

BOOLEAN boom = FALSE;



//eax为CPU型号

//若为虚拟机,则ecx最高位为1;如果是物理机,则最高位为0.

//code in cpuid.asm

DWORD a = 0, b = 0, c_var = 0, d = 0;





VOID Unload() {//PDRIVER_OBJECT DriverObject

if (pThreadObject) {

boom = TRUE;

KeWaitForSingleObject(pThreadObject, Executive, KernelMode, FALSE, NULL);

}

if (pDevice) {

IoStopTimer(pDevice);

IoDeleteSymbolicLink(&symLinkName);

IoDeleteDevice(pDevice);

pDevice = NULL;

}

DbgPrint("Unload --------");

}



VOID TimerRoutine(PDEVICE_OBJECT DeviceObject, PVOID context) {

DbgPrint("In TimerRoutine\n");

//Begin normal check

getcpuid();

c_var = c_var >> 31;

if (c_var){

DbgPrint("Running in the virtual machine 2. Find VMWare by CPUID!!!!\n");

}

}



BOOLEAN CheckDriverModule() {

BOOLEAN bRet = FALSE;

NTQUERYSYSTEMINFORMATION m_NtQuerySystemInformation = NULL;

UNICODE_STRING NtQuerySystemInformation_Name = { 0 };

PSYSTEM_MODULE_INFORMATION ModuleEntry = NULL;

ULONG_PTR RetLength = 0, BaseAddr = 0, EndAddr = 0;

ULONG ModuleNums = 0, Index = 0;

NTSTATUS status = STATUS_SUCCESS;

PVOID Buffer = NULL;

RtlInitUnicodeString(&NtQuerySystemInformation_Name, L"NtQuerySystemInformation");

do

{

m_NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)MmGetSystemRoutineAddress(&NtQuerySystemInformation_Name);

if (m_NtQuerySystemInformation == NULL) {

bRet = TRUE;

break;

}

status = m_NtQuerySystemInformation(0xb, NULL, 0, &RetLength);

if (status < 0 && status != STATUS_INFO_LENGTH_MISMATCH) {

bRet = TRUE;

break;

}

Buffer = ExAllocatePoolWithTag(PagedPool, RetLength, "ytz");

if (Buffer == NULL) {

bRet = TRUE;

break;

}

RtlZeroMemory(Buffer, RetLength);

status = m_NtQuerySystemInformation(0xb, Buffer, RetLength, &RetLength);

if (status < 0) {

bRet = TRUE;

break;

}

ModuleNums = *(ULONG*)Buffer;

ModuleEntry = (PSYSTEM_MODULE_INFORMATION)((ULONG_PTR)Buffer + 8);

for (Index = 0; Index < ModuleNums; Index++) {

if (strstr(ModuleEntry->ImageName, "vmmouse.sys") ||

strstr(ModuleEntry->ImageName, "vmrawdsk.sys") ||

strstr(ModuleEntry->ImageName, "vmusbmouse.sys")) {





DbgPrint("The Module Name is %s\n", ModuleEntry->ImageName);

bRet = TRUE;

break;

}

ModuleEntry++;

}

break; //Amuse

} while (TRUE);

if (Buffer)

{

ExFreePool(Buffer);

Buffer = NULL;

}

return bRet;



}



VOID CheckVmWare(PVOID context) {

LARGE_INTEGER sleeptime = { 0 };

sleeptime.QuadPart = -20000000;

while (1)

{

if (boom)

break;

if (CheckDriverModule()) {

DbgPrint("Running in the virtual machine 1. Find VMWare!!!!\n");

}

DbgPrint("Thread is working");

KeDelayExecutionThread(KernelMode, 0, &sleeptime);

}

PsTerminateSystemThread(STATUS_SUCCESS);



}



NTSTATUS DriverEntry(PDRIVER_OBJECT driverObject, PUNICODE_STRING RegPath) {

HANDLE hThread = NULL;

NTSTATUS status = NULL;

UNICODE_STRING DeviceName = { 0 };

driverObject->DriverUnload = Unload;



status = PsCreateSystemThread(&hThread, 0, NULL, NULL, NULL, CheckVmWare, NULL);

if (!NT_SUCCESS(status)) {

DbgPrint("Create Thread Failed!\n");

return STATUS_UNSUCCESSFUL;

}



status = ObReferenceObjectByHandle(hThread, THREAD_ALL_ACCESS, *PsThreadType, KernelMode, &pThreadObject, NULL);

if (!NT_SUCCESS(status))

{

DbgPrint("Cannot reference");

ObDereferenceObject(pThreadObject);

}



RtlInitUnicodeString(&DeviceName, L"\\Device\\MyDevices");

status = IoCreateDevice(driverObject, 0, &DeviceName, FILE_DEVICE_UNKNOWN, 0, TRUE, &pDevice);

if (!NT_SUCCESS(status)) {

DbgPrint("Create Device Failed!");

return STATUS_UNSUCCESSFUL;

}

RtlInitUnicodeString(&symLinkName, "\\?\\SybLinkName");

status = IoCreateSymbolicLink(&symLinkName, &DeviceName);

if (!NT_SUCCESS(status)) {

DbgPrint("Create SymLink Failed!");

//return STATUS_UNSUCCESSFUL;

}

IoInitializeTimer(pDevice, (PIO_TIMER_ROUTINE)TimerRoutine, NULL);

IoStartTimer(pDevice);



ZwClose(hThread);

return STATUS_SUCCESS;

}


注:在X64下使用上文的汇编代码时,需要修改下asm的属性。



效果:

 

github:

https://github.com/pcy190/DriverKit/tree/master/AntiVirtualMachine_driver


- End -


看雪ID:微笑明天              

https://bbs.pediy.com/user-821225.htm


本文由看雪论坛 微笑明天 原创

转载请注明来自看雪社区



热门图书推荐:

立即购买!



征题正在火热进行中!

(晋级赛Q1即将于3月10日开启,敬请期待!)



热门文章阅读


1、值得关注的威胁类别:利用脚本语言解析器过主防

2、Cheat Engine gtutorial-i386闯关记 第二关

3、看雪课程 | 选择编程语言前需要知道的事

4、Zircon - Fuchsia 内核分析 - 启动(内核初始化)



公众号ID:ikanxue

官方微博:看雪安全

商务合作:wsc@kanxue.com



点击下方“阅读原文”

    您可能也对以下帖子感兴趣

    文章有问题?点此查看未经处理的缓存