callbacks.cpp File Reference

#include "callbacks.h"
#include "inject.h"
#include "pano_query.h"
#include <ntstrsafe.h>
#include "shellcode.h"

Go to the source code of this file.

Classes
struct	InjectArgs

Functions
PVOID NTAPI	RtlxFindExportedRoutineByName (_In_ PVOID DllBase, _In_ PANSI_STRING ExportName)
OB_PREOP_CALLBACK_STATUS	PreOperationCallback (PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation)
PPANO_PROCESS_INFO	GetProcessInfo (HANDLE ProcessId)
VOID	RemoveProcessInfo (HANDLE ProcessId)
void NTAPI	KernelRoutine (PKAPC apc, PKNORMAL_ROUTINE *NormalRoutine, PVOID *NormalContext, PVOID *SystemArgument1, PVOID *SystemArgument2)
BOOLEAN	CanInject (PPANO_PROCESS_INFO processInfo)
VOID	InjectDllKernelApc (PVOID NormalContext, PVOID SystemArgument1, PVOID SystemArgument2)
NTSTATUS	InstallKernelModeApcToInjectDll (HANDLE ProcessId)
BOOLEAN	Is64BitProcess (PEPROCESS targetProcess)
VOID	LoadImageNotifyRoutine (PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo)
VOID	ProcessCreateCallback (PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo)
NTSTATUS	InitializeKernelCallbacks ()
VOID	RemoveCallbacks ()

Variables
LIST_ENTRY	g_ProcessList {}
KSPIN_LOCK	g_ProcessListLock {}
PVOID	g_ObRegistrationHandle {}

Function Documentation

CanInject()

BOOLEAN CanInject

(

PPANO_PROCESS_INFO

processInfo

)

Definition at line 253 of file callbacks.cpp.

{
    if (processInfo->ntdllLoaded && processInfo->kernel32Loaded && processInfo->kernelBaseLoaded)
    {
        return TRUE;
    }
    return FALSE;
}

References _PANO_PROCESS_INFO::kernel32Loaded, _PANO_PROCESS_INFO::kernelBaseLoaded, and _PANO_PROCESS_INFO::ntdllLoaded.

Referenced by LoadImageNotifyRoutine().

GetProcessInfo()

PPANO_PROCESS_INFO GetProcessInfo

(

HANDLE

ProcessId

)

Definition at line 207 of file callbacks.cpp.

{
    //KIRQL OldIRQL;
    //ExAcquireSpinLock(&g_ProcessListLock, &OldIRQL);
    PLIST_ENTRY entry = g_ProcessList.Flink;
    while (entry != &g_ProcessList) {
        PPANO_PROCESS_INFO processInfo = CONTAINING_RECORD(entry, PANO_PROCESS_INFO, ListEntry);
        if (processInfo->ProcessId == ProcessId) {
            return processInfo;
        }
        entry = entry->Flink;
    }
    //ExReleaseSpinLock(&g_ProcessListLock, NULL);
    return NULL;
}

References g_ProcessList, and _PANO_PROCESS_INFO::ProcessId.

Referenced by InjectDllKernelApc(), and LoadImageNotifyRoutine().

InitializeKernelCallbacks()

NTSTATUS InitializeKernelCallbacks

(

)

Definition at line 558 of file callbacks.cpp.

{
    PAGED_CODE();
    NTSTATUS status;
    //UNICODE_STRING callbackAltitude;
    //RtlInitUnicodeString(&callbackAltitude, L"1931");
 
    //OB_CALLBACK_REGISTRATION callbackRegistration;
    //OB_OPERATION_REGISTRATION operationRegistration;
    //RtlSecureZeroMemory(&operationRegistration, sizeof(OB_OPERATION_REGISTRATION));
    //RtlSecureZeroMemory(&callbackRegistration, sizeof(OB_CALLBACK_REGISTRATION));
    //operationRegistration.ObjectType = PsProcessType;
    //operationRegistration.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
    //operationRegistration.PreOperation = PreOperationCallback;
    //operationRegistration.PostOperation = NULL;
 
    //callbackRegistration.Version = OB_FLT_REGISTRATION_VERSION;
    //callbackRegistration.OperationRegistrationCount = 1;
    //callbackRegistration.Altitude = callbackAltitude;
    //callbackRegistration.OperationRegistration = &operationRegistration;
    //callbackRegistration.RegistrationContext = NULL;
 
    //status = ObRegisterCallbacks(&callbackRegistration, &g_ObRegistrationHandle);
    //if (!NT_SUCCESS(status)) {
    //  DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[!] Panoptes: Driver Failed to Set Object Registration Callbacks - Ensure /INTEGRITYCHECK is added to the linker options\n");
    //  return status;
    //}
    //DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Set Object Registration Callbacks\n");
 
    InitializeListHead(&g_ProcessList);
    //KeInitializeSpinLock(&g_ProcessListLock);
    status = PsSetCreateProcessNotifyRoutineEx(ProcessCreateCallback, FALSE);
    if (!NT_SUCCESS(status)) {
        //ObUnRegisterCallbacks(g_ObRegistrationHandle);
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[!] Panoptes: Driver Failed to Set Process Creation Notify Routine Notify Routine - Ensure /INTEGRITYCHECK is added to the linker options\n");
        return status;
    }
    DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Set Process Creation Notify Callbacks\n");
 
    status = PsSetLoadImageNotifyRoutine(LoadImageNotifyRoutine);
    if (!NT_SUCCESS(status)) {
        NTSTATUS removeStatus = PsSetCreateProcessNotifyRoutineEx(ProcessCreateCallback, TRUE);
        if (!NT_SUCCESS(removeStatus)) {
            DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[!] Panoptes: Driver Failed to remove callback for Set Process Creation Notify Routine Notify Routine\n");
            return removeStatus;
        }
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[!] Panoptes: Driver Failed to Set Process Load Image Notify Routine - Ensure /INTEGRITYCHECK is added to the linker options\n");
        return status;
    }
    DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Set Image Load Notify Callbacks\n");
 
    return STATUS_SUCCESS;
}

References g_ProcessList, LoadImageNotifyRoutine(), and ProcessCreateCallback().

Referenced by DriverEntry().

InjectDllKernelApc()

VOID InjectDllKernelApc	(	PVOID	NormalContext,
		PVOID	SystemArgument1,
		PVOID	SystemArgument2
	)

Definition at line 262 of file callbacks.cpp.

{
    DbgPrint("InjectDll Entered");
    HANDLE pProcessId = (HANDLE)NormalContext;
    UNREFERENCED_PARAMETER(SystemArgument1);
    UNREFERENCED_PARAMETER(SystemArgument2);
 
    if (nullptr == pProcessId)
    {
        DbgPrint("InjectDll - pProcessId is null");
    }
 
    PPANO_PROCESS_INFO pi = GetProcessInfo(pProcessId);
    ANSI_STRING loadDllRoutineName = RTL_CONSTANT_STRING("LoadLibraryExW");
    PVOID shellcodeAddress = RtlxFindExportedRoutineByName(pi->kernel32BaseAddress, &loadDllRoutineName);
 
 
 
    UNICODE_STRING dllToInject;
    UNICODE_STRING dllFullPathx64;
    UNICODE_STRING dllFullPathx86;
    RtlInitUnicodeString(&dllFullPathx64, L"C:\\Program Files\\Panoptes\\PanoptesDLLx64.dll");
    RtlInitUnicodeString(&dllFullPathx86, L"C:\\Program Files\\Panoptes\\PanoptesDLLx86.dll");
    PVOID allocatedAddressContainingDllFullPath = nullptr;
 
    if (pi->is64Bit)
    {
        dllToInject = dllFullPathx64;
    }
    else
    {
        dllToInject = dllFullPathx86;
    }
 
    NTSTATUS status = ZwAllocateVirtualMemory(NtCurrentProcess(), &allocatedAddressContainingDllFullPath, 0, (PSIZE_T)&dllToInject.Length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!NT_SUCCESS(status))
    {
        DbgPrint("Error: Unable to allocate memory in the target process.");
        return;
    }
    RtlCopyMemory(allocatedAddressContainingDllFullPath, dllToInject.Buffer, dllToInject.Length);
 
    PKAPC pKapc = (PKAPC)ExAllocatePool2(POOL_FLAG_NON_PAGED, sizeof(KAPC), 'tikt'); // Allocate the APC object
    if (!pKapc)
    {
        DbgPrint("Error: Unable to allocate the APC object.");
        ZwFreeVirtualMemory(NtCurrentProcess(), &allocatedAddressContainingDllFullPath, (PSIZE_T)&dllToInject.Length, MEM_RELEASE);  // Free the allocated memory
        return;
    }
 
    KeInitializeApc(pKapc, KeGetCurrentThread(), OriginalApcEnvironment, KernelRoutine, NULL, (PKNORMAL_ROUTINE)(shellcodeAddress), UserMode, allocatedAddressContainingDllFullPath); // Initialize the APC
 
    DbgPrint("Inserting APC to target thread");
    if (!KeInsertQueueApc(pKapc, NULL, NULL, IO_NO_INCREMENT))
    {
        DbgPrint("Error: Unable to insert APC to target thread.");
        ZwFreeVirtualMemory(NtCurrentProcess(), &allocatedAddressContainingDllFullPath, (PSIZE_T)&dllToInject.Length, MEM_RELEASE);  // Free the allocated memory
        ExFreePool(pKapc); // Free the APC object
        return;
    }
 
    KeTestAlertThread(UserMode);
 
    DbgPrint("InjectDllKernelApc exiting");
}

References GetProcessInfo(), _PANO_PROCESS_INFO::is64Bit, KeInitializeApc(), KeInsertQueueApc(), _PANO_PROCESS_INFO::kernel32BaseAddress, KernelRoutine(), KeTestAlertThread(), OriginalApcEnvironment, and RtlxFindExportedRoutineByName().

Referenced by InstallKernelModeApcToInjectDll().

InstallKernelModeApcToInjectDll()

NTSTATUS InstallKernelModeApcToInjectDll

(

HANDLE

ProcessId

)

Definition at line 328 of file callbacks.cpp.

{
    PRKAPC pKapc = nullptr;
    PETHREAD pThread = nullptr;
 
    pKapc = (PKAPC)ExAllocatePool2(POOL_FLAG_NON_PAGED, sizeof(KAPC), 'tiky'); // Allocate the APC object
    if (nullptr == pKapc)
    {
        DbgPrint("InstallKernelModeApcToInjectDll Failed to allocate memory for the APC");
        return STATUS_INSUFFICIENT_RESOURCES;
    }
 
    pThread = KeGetCurrentThread();
    KeInitializeApc(pKapc, pThread,
        OriginalApcEnvironment,
        KernelRoutine, NULL,
        (PKNORMAL_ROUTINE)InjectDllKernelApc,
        KernelMode, (PVOID)ProcessId);
    if (!KeInsertQueueApc(pKapc, NULL, NULL, IO_NO_INCREMENT))
    {
        DbgPrint("InstallKernelModeApcToInjectDll Failed to insert APC");
        ExFreePool(pKapc); // Free the APC object
        return STATUS_UNSUCCESSFUL;
    }
    else
    {
        DbgPrint("InstallKernelModeApcToInjectDll APC delivered");
    }
 
    return STATUS_SUCCESS;
}

References InjectDllKernelApc(), KeInitializeApc(), KeInsertQueueApc(), KernelRoutine(), and OriginalApcEnvironment.

Referenced by LoadImageNotifyRoutine().

Is64BitProcess()

BOOLEAN Is64BitProcess

(

PEPROCESS

targetProcess

)

Definition at line 360 of file callbacks.cpp.

                                                {
    UINT64* processAsUint64 = reinterpret_cast<UINT64*>(targetProcess);
    PVOID* wow64ProcessPtr = reinterpret_cast<PVOID*>(processAsUint64 + 0x580 / sizeof(UINT64));
    if (*wow64ProcessPtr == NULL)
    {
        return TRUE;
    }
    return FALSE;
}

Referenced by LoadImageNotifyRoutine().

KernelRoutine()

void NTAPI KernelRoutine	(	PKAPC	apc,
		PKNORMAL_ROUTINE *	NormalRoutine,
		PVOID *	NormalContext,
		PVOID *	SystemArgument1,
		PVOID *	SystemArgument2
	)

Definition at line 237 of file callbacks.cpp.

{
    UNREFERENCED_PARAMETER(NormalRoutine);
    UNREFERENCED_PARAMETER(NormalContext);
    UNREFERENCED_PARAMETER(SystemArgument1);
    UNREFERENCED_PARAMETER(SystemArgument2);
 
    ExFreePool(apc);
}

Referenced by InjectDllKernelApc(), and InstallKernelModeApcToInjectDll().

LoadImageNotifyRoutine()

VOID LoadImageNotifyRoutine	(	PUNICODE_STRING	FullImageName,
		HANDLE	ProcessId,
		PIMAGE_INFO	ImageInfo
	)

Definition at line 370 of file callbacks.cpp.

{
    PAGED_CODE();
    UNREFERENCED_PARAMETER(ImageInfo);
 
    PPANO_PROCESS_INFO processInfo = GetProcessInfo(ProcessId);
    if (!processInfo || processInfo->Injected)
    {
        return;
    }
 
    if (PsIsProtectedProcess(PsGetCurrentProcess()))
    {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[-] Panoptes: Skipping protected process %llu", (ULONG64)ProcessId);
        RemoveProcessInfo(ProcessId);
        return;
    }
 
    if (!CanInject(processInfo))
    {
        UNICODE_STRING ntdllLoadImage;
        RtlInitUnicodeString(&ntdllLoadImage, L"ntdll.dll");
        if (wcsstr(FullImageName->Buffer, ntdllLoadImage.Buffer) != NULL) {
            //DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Loaded ntdll in %llu\n", (ULONG64)ProcessId);
            processInfo->ntdllLoaded = TRUE;
            return;
        }
 
        UNICODE_STRING kernel32LoadImage;
        RtlInitUnicodeString(&kernel32LoadImage, L"kernel32.dll");
        if (wcsstr(FullImageName->Buffer, kernel32LoadImage.Buffer) != NULL) {
            //DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Loaded kernel32 in %llu\n", (ULONG64)ProcessId);
            processInfo->kernel32Loaded = TRUE;
            processInfo->kernel32BaseAddress = ImageInfo->ImageBase;
            return;
        }
 
        UNICODE_STRING kernelbaseLoadImage;
        RtlInitUnicodeString(&kernelbaseLoadImage, L"KernelBase.dll");
        if (wcsstr(FullImageName->Buffer, kernelbaseLoadImage.Buffer) != NULL) {
            //DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Loaded kernelbase in %llu\n", (ULONG64)ProcessId);
            processInfo->kernelBaseLoaded = TRUE;
            return;
        }
    }
    else
    {
        PEPROCESS targetProcess = NULL;
        NTSTATUS status = PsLookupProcessByProcessId(ProcessId, &targetProcess);
        if (!NT_SUCCESS(status)) {
            return;
        }
 
        PUNICODE_STRING processPath{};
        status = SeLocateProcessImageName(targetProcess, &processPath);
        if (!NT_SUCCESS(status)) {
            DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[-] Panoptes: Failed to get process name, status: 0x%X\n", status);
            return;
        }
 
        processInfo->is64Bit = Is64BitProcess(targetProcess);
        if (processInfo->is64Bit) {
            DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Injecting into x64: (%llu) %wZ\n", (ULONG64)ProcessId, processPath);
        }
        else {
            DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Injecting Into x86: (%llu) %wZ\n", (ULONG64)ProcessId, processPath);
        }
 
        InstallKernelModeApcToInjectDll(ProcessId);
        processInfo->Injected = TRUE;
    }
 
    //PEPROCESS ProcessStruct;
    //PsLookupProcessByProcessId(ProcessId, &ProcessStruct);
    // We dont want to deal with trying to inject into protected processes
    //if (PsIsProtectedProcess(ProcessStruct))
    //{
    //  //RemoveProcessInfoByProcessId(ProcessId);
    //  return;
    //}
    //if (ZwQueryInformationProcessPtr == NULL)
    //{
    //  DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[-] Panoptes: Cannot resolve ZwQueryInformationProcess\n");
    //  InitializeZwQueryInformationProcessCallback();
    //}
    //ZwQueryInformationProcessPtr(
    //  ProcessStruct,
    //  ProcessBasicInformation,
    //  NULL,
    //  0,
    //  NULL
    //);
    //HANDLE processHandle;
    //NTSTATUS status = ObOpenObjectByPointer(
    //  ProcessStruct,
    //  OBJ_KERNEL_HANDLE,
    //  NULL,
    //  PROCESS_ALL_ACCESS,
    //  *PsProcessType,
    //  KernelMode,
    //  &processHandle
    //);
    //PROCESS_BASIC_INFORMATION pbi;
    //ULONG returnLength;
    //status = ZwQueryInformationProcessPtr(
    //  processHandle,
    //  ProcessBasicInformation,
    //  &pbi,
    //  sizeof(PROCESS_BASIC_INFORMATION),
    //  &returnLength
    //);
    //if (!processInfo->LdrLoadDllRoutineAddress) {
    //  ANSI_STRING ldrLoadDll;
    //  RtlInitAnsiString(&ldrLoadDll, "LdrLoadDll");
    //  UNICODE_STRING kernel32LoadImage;
    //  RtlInitUnicodeString(&kernel32LoadImage, L"*\\ntdll.dll");
    //  if (FsRtlIsNameInExpression(&kernel32LoadImage, FullImageName, TRUE, NULL)) {
    //      processInfo->LdrLoadDllRoutineAddress = RtlFindExportedRoutineByName((PVOID)ImageInfo->ImageBase, ldrLoadDll.Buffer);
    //      processInfo->NtdllLoaded = TRUE;
    //      return;
    //  }
    //}
    //else
    //{
    //  //UINT64 Process, ProcessHead;
    //  //NTSTATUS status = PsLookupProcessByProcessId(ProcessId, (PEPROCESS*)&ProcessHead);
    //  //if (!NT_SUCCESS(status))
    //  //{
    //  //  return;
    //  //}
    //  //Process = ProcessHead;
    //  //UINT64 Thread, ThreadHead = *(UINT64*)(Process + 0x5e0) - 0x538; // Thread->ThreadListHead.Flink
    //  //Thread = ThreadHead;
    //  //bool found = false;
    //  //do {
    //  //  if (*(UINT32*)(Thread + 0x74) & (1 << 4)) { // Thread.Tcb.MiscFlags & Alertable
    //  //      found = true;
    //  //      break;
    //  //  }
    //  //  Thread = *(UINT64*)(Thread + 0x538) - 0x538; // Thread->ThreadListEntry.Flink
    //  //} while (Thread != ThreadHead);
    //  DbgBreakPoint();
    //  InjectDLL(ProcessId, processInfo);
    //}
 
    return;
}

References CanInject(), GetProcessInfo(), _PANO_PROCESS_INFO::Injected, InstallKernelModeApcToInjectDll(), _PANO_PROCESS_INFO::is64Bit, Is64BitProcess(), _PANO_PROCESS_INFO::kernel32BaseAddress, _PANO_PROCESS_INFO::kernel32Loaded, _PANO_PROCESS_INFO::kernelBaseLoaded, _PANO_PROCESS_INFO::ntdllLoaded, PsIsProtectedProcess(), and RemoveProcessInfo().

Referenced by InitializeKernelCallbacks(), and RemoveCallbacks().

PreOperationCallback()

OB_PREOP_CALLBACK_STATUS PreOperationCallback	(	PVOID	RegistrationContext,
		POB_PRE_OPERATION_INFORMATION	OperationInformation
	)

Definition at line 153 of file callbacks.cpp.

{
    PAGED_CODE();
    UNREFERENCED_PARAMETER(RegistrationContext);
    UNREFERENCED_PARAMETER(OperationInformation);
    //if (OperationInformation->ObjectType == *IoDeviceObjectType)
    //{
    //  ULONG returnLength; 
    //  PDEVICE_OBJECT deviceObject = (PDEVICE_OBJECT)OperationInformation->Object;
    //  // Query the object name
    //  NTSTATUS status = ObQueryNameString(deviceObject, NULL, 0, &returnLength);
    //  if (status != STATUS_INFO_LENGTH_MISMATCH)
    //  {
    //      return OB_PREOP_SUCCESS;
    //  }
    //  // Allocate memory for the name information
    //  POBJECT_NAME_INFORMATION objectNameInfo = NULL;
    //  objectNameInfo = (POBJECT_NAME_INFORMATION)ExAllocatePool2(POOL_FLAG_NON_PAGED, returnLength, 'NveD');
    //  if (objectNameInfo == NULL)
    //  {
    //      return OB_PREOP_SUCCESS;
    //  }
    //  // Get the object name
    //  UNICODE_STRING deviceName;
    //  // Initialize the UNICODE_STRING
    //  RtlInitUnicodeString(&deviceName, NULL);
    //  // Allocate a buffer for the device name
    //  deviceName.Buffer = (PWCH)ExAllocatePool2(POOL_FLAG_NON_PAGED, returnLength, 'NveD');
    //  if (deviceName.Buffer == NULL)
    //  {
    //      return OB_PREOP_SUCCESS;
    //  }
    //  status = ObQueryNameString(deviceObject, objectNameInfo, returnLength, &returnLength);
    //  if (NT_SUCCESS(status))
    //  {
    //      // Copy the name to the output parameter
    //      RtlCopyUnicodeString(&deviceName, &objectNameInfo->Name);
    //  }
    //  if (deviceName.Buffer && wcsstr(deviceName.Buffer, L"\\Device\\NamedPipe\\") != NULL)
    //  {
    //      DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Named Pipe created: %wZ\n", deviceName.Buffer);
    //  }
    //  return OB_PREOP_SUCCESS;
    //}
 
    return OB_PREOP_SUCCESS;
}

ProcessCreateCallback()

VOID ProcessCreateCallback	(	PEPROCESS	Process,
		HANDLE	ProcessId,
		PPS_CREATE_NOTIFY_INFO	CreateInfo
	)

Definition at line 518 of file callbacks.cpp.

{
    UNREFERENCED_PARAMETER(Process);
 
    if (CreateInfo != NULL) {
        UNICODE_STRING onlyProc;
        RtlInitUnicodeString(&onlyProc, L"die.exe");
        if (wcsstr(CreateInfo->ImageFileName->Buffer, onlyProc.Buffer) != NULL) {
            PPANO_PROCESS_INFO processInfo = (PPANO_PROCESS_INFO)ExAllocatePool2(POOL_FLAG_NON_PAGED, sizeof(PANO_PROCESS_INFO), 'corP');
            if (processInfo) {
                processInfo->ProcessId = ProcessId;
                processInfo->Injected = FALSE;
                processInfo->ntdllLoaded = FALSE;
                processInfo->kernel32Loaded = FALSE;
                processInfo->kernelBaseLoaded = FALSE;
 
                InsertTailList(&g_ProcessList, &processInfo->ListEntry);
            }
 
            PROCESS_MITIGATION_POLICY_INFORMATION policyInfo{};
            NTSTATUS status = QueryProcessMitigationPolicy(ProcessId, &policyInfo);
            if (!NT_SUCCESS(status)) {
                DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[-] Panoptes: Failed to get process mitigation policy, status: 0x%X\n", status);
            }
        }
 
        //if (CreateInfo->ImageFileName->Buffer != NULL) {
            //DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Panoptes: Process Starting: %wZ\n", CreateInfo->ImageFileName->Buffer);
 
 
        //  //EventWriteProcessCreation(NULL, (UINT64)ProcessId, processPath->Buffer, (UINT64)CreateInfo->ParentProcessId, 0, (UINT64)&policyInfo);
        //  EventWriteProcessCreation(NULL, (UINT64)ProcessId, processPath->Buffer, (UINT64)CreateInfo->ParentProcessId, 0, 0);
        //  ExFreePool(processPath->Buffer);
        //}
    }
    else {
        RemoveProcessInfo(ProcessId);
    }
}

References g_ProcessList, _PANO_PROCESS_INFO::Injected, _PANO_PROCESS_INFO::kernel32Loaded, _PANO_PROCESS_INFO::kernelBaseLoaded, _PANO_PROCESS_INFO::ListEntry, _PANO_PROCESS_INFO::ntdllLoaded, _PANO_PROCESS_INFO::ProcessId, QueryProcessMitigationPolicy(), and RemoveProcessInfo().

Referenced by InitializeKernelCallbacks(), and RemoveCallbacks().

RemoveCallbacks()

VOID RemoveCallbacks

(

)

Definition at line 614 of file callbacks.cpp.

                       {
    //ObUnRegisterCallbacks(g_ObRegistrationHandle);
    PsSetCreateProcessNotifyRoutineEx(ProcessCreateCallback, TRUE);
    PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine);
    return;
}

References LoadImageNotifyRoutine(), and ProcessCreateCallback().

Referenced by UnloadPanoptes().

RemoveProcessInfo()

VOID RemoveProcessInfo

(

HANDLE

ProcessId

)

Definition at line 223 of file callbacks.cpp.

{
    PLIST_ENTRY entry = g_ProcessList.Flink;
    while (entry != &g_ProcessList) {
        PPANO_PROCESS_INFO processInfo = CONTAINING_RECORD(entry, PANO_PROCESS_INFO, ListEntry);
        if (processInfo->ProcessId == ProcessId) {
            RemoveEntryList(entry);
            return;
        }
        entry = entry->Flink;
    }
    return;
}

References g_ProcessList, and _PANO_PROCESS_INFO::ProcessId.

Referenced by LoadImageNotifyRoutine(), and ProcessCreateCallback().

RtlxFindExportedRoutineByName()

PVOID NTAPI RtlxFindExportedRoutineByName	(	_In_ PVOID	DllBase,
		_In_ PANSI_STRING	ExportName
	)

Definition at line 14 of file callbacks.cpp.

{
    //
    // RtlFindExportedRoutineByName is not exported by ntoskrnl until Win10.
    // Following code is borrowed from ReactOS.
    //
 
    PULONG NameTable;
    PUSHORT OrdinalTable;
    PIMAGE_EXPORT_DIRECTORY ExportDirectory;
    LONG Low = 0, Mid = 0, High, Ret;
    USHORT Ordinal;
    PVOID Function;
    ULONG ExportSize;
    PULONG ExportTable;
 
    //
    // Get the export directory.
    //
 
    ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RtlImageDirectoryEntryToData(DllBase,
        TRUE,
        IMAGE_DIRECTORY_ENTRY_EXPORT,
        &ExportSize);
 
    if (!ExportDirectory)
    {
        return NULL;
    }
 
    //
    // Setup name tables.
    //
 
    NameTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNames);
    OrdinalTable = (PUSHORT)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNameOrdinals);
 
    //
    // Do a binary search.
    //
 
    High = ExportDirectory->NumberOfNames - 1;
    while (High >= Low)
    {
        //
        // Get new middle value.
        //
 
        Mid = (Low + High) >> 1;
 
        //
        // Compare name.
        //
 
        Ret = strcmp(ExportName->Buffer, (PCHAR)DllBase + NameTable[Mid]);
        if (Ret < 0)
        {
            //
            // Update high.
            //
            High = Mid - 1;
        }
        else if (Ret > 0)
        {
            //
            // Update low.
            //
            Low = Mid + 1;
        }
        else
        {
            //
            // We got it.
            //
            break;
        }
    }
 
    //
    // Check if we couldn't find it.
    //
 
    if (High < Low)
    {
        return NULL;
    }
 
    //
    // Otherwise, this is the ordinal.
    //
 
    Ordinal = OrdinalTable[Mid];
 
    //
    // Validate the ordinal.
    //
 
    if (Ordinal >= ExportDirectory->NumberOfFunctions)
    {
        return NULL;
    }
 
    //
    // Resolve the address and write it.
    //
 
    ExportTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfFunctions);
    Function = (PVOID)((ULONG_PTR)DllBase + ExportTable[Ordinal]);
 
    //
    // We found it!
    //
 
    NT_ASSERT(
        (Function < (PVOID)ExportDirectory) ||
        (Function > (PVOID)((ULONG_PTR)ExportDirectory + ExportSize))
    );
 
    return Function;
}

References _IMAGE_EXPORT_DIRECTORY::AddressOfFunctions, _IMAGE_EXPORT_DIRECTORY::AddressOfNameOrdinals, _IMAGE_EXPORT_DIRECTORY::AddressOfNames, IMAGE_DIRECTORY_ENTRY_EXPORT, _IMAGE_EXPORT_DIRECTORY::NumberOfFunctions, _IMAGE_EXPORT_DIRECTORY::NumberOfNames, and RtlImageDirectoryEntryToData().

Referenced by InjectDllKernelApc().

Variable Documentation

g_ObRegistrationHandle

PVOID g_ObRegistrationHandle {}

Definition at line 10 of file callbacks.cpp.

{};

g_ProcessList

LIST_ENTRY g_ProcessList {}

Definition at line 8 of file callbacks.cpp.

{};

Referenced by GetProcessInfo(), InitializeKernelCallbacks(), ProcessCreateCallback(), and RemoveProcessInfo().

g_ProcessListLock

KSPIN_LOCK g_ProcessListLock {}

Definition at line 9 of file callbacks.cpp.

{};