forked from zouxianyu/KernelHiddenExecute
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathControlPanel.cpp
More file actions
271 lines (225 loc) · 7.37 KB
/
Copy pathControlPanel.cpp
File metadata and controls
271 lines (225 loc) · 7.37 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
#include "ControlPanel.h"
ControlPanel::ControlPanel(QWidget* parent)
: QWidget(parent),
//initialize strings
protectedServiceName("KernelHiddenExecute"),
protectedServiceDisplayName("Kernel Hidden Execute"),
//protectedDriverPath(".\\sys\\protected.sys"),
protectedDeviceName("\\\\.\\KernelHiddenExecute"),
protectedDriverControl(),
malwareServiceName("KernelHiddenExecuteMalware"),
malwareServiceDisplayName("Kernel Hidden Execute Malware"),
//malwareDriverPath(".\\sys\\malware.sys"),
malwareDeviceName("\\\\.\\KernelHiddenExecuteMalware"),
malwareDriverControl(),
//initialize bool variables
initialized(false)
//isSafeProcExecuted1(false),
//isUnsafeProcExecuted1(false),
//isAttacked(false),
//isSafeProcExecuted2(false),
//isUnsafeProcExecuted2(false)
{
ui.setupUi(this);
//initialize buttons connection
connect(ui.initBtn, &QPushButton::clicked, this, &ControlPanel::initialize);
connect(ui.attackBtn, &QPushButton::clicked, this, &ControlPanel::attack);
connect(ui.unsafeProcBtn, &QPushButton::clicked, this, &ControlPanel::normalProcedure);
connect(ui.safeProcBtn, &QPushButton::clicked, this, &ControlPanel::protectedProcedure);
//fix relative path
QDir protectedDriverDir("./sys/KernelHiddenExecute.sys");
protectedDriverPath = protectedDriverDir.absolutePath().replace(QString("/"), QString("\\"));
QDir malwareDriverDir("./sys/KernelHiddenExecuteMalware.sys");
malwareDriverPath = malwareDriverDir.absolutePath().replace(QString("/"), QString("\\"));
//add helper text
ui.helperTextBrowser->clear();
ui.helperTextBrowser->append("请进行初始化");
ui.helperTextBrowser->append("下方会显示初始化的状态");
}
void ControlPanel::initialize()
{
qDebug() << "initialize";
if (initialized)
{
return;
}
//initialize service control manager
ui.outputTextBrowser->append("开始初始化SCM");
if (Services::init() == false)
{
ui.outputTextBrowser->append("SCM初始化失败");
return;
}
ui.outputTextBrowser->append("SCM初始化成功");
//load protected driver
//TODO:FIX ABSOLUTE PATH
ui.outputTextBrowser->append("开始加载被攻击的程序");
if (!loadDriver(protectedDriverPath, protectedServiceName, protectedServiceDisplayName))
{
return;
}
//load malware driver
ui.outputTextBrowser->append("开始加载恶意程序");
if (!loadDriver(malwareDriverPath, malwareServiceName, malwareServiceDisplayName))
{
return;
}
//open drivers handle
ui.outputTextBrowser->append("开始连接到被攻击的程序");
if (!protectedDriverControl.open(protectedDeviceName))
{
ui.outputTextBrowser->append("打开失败");
return;
}
ui.outputTextBrowser->append("打开成功");
ui.outputTextBrowser->append("开始连接到恶意程序");
if (!malwareDriverControl.open(malwareDeviceName))
{
ui.outputTextBrowser->append("打开失败");
return;
}
ui.outputTextBrowser->append("打开成功");
initialized = true;
//scroll to next page
ui.controlStackedWidget->setCurrentIndex(1);
//add helper text
ui.helperTextBrowser->clear();
ui.helperTextBrowser->append("初始化成功");
ui.helperTextBrowser->append("建议先点击上方的两个按钮，观察程序的执行情况。然后再进行攻击。最后再次点击上方的两个按钮，再次观察程序的执行情况");
}
void ControlPanel::attack()
{
qDebug() << "attack";
if (!malwareDriverControl.attack())
{
ui.outputTextBrowser->append("攻击失败");
return;
}
ui.outputTextBrowser->append("攻击成功");
}
void ControlPanel::normalProcedure()
{
qDebug() << "normalProcedure";
ui.outputTextBrowser->append("开始演示未受保护的过程");
ui.outputTextBrowser->append(QString("读取的数据：") + protectedDriverControl.unsafeRead());
ui.outputTextBrowser->append(QString("执行的结果：") + protectedDriverControl.unsafeExec());
}
void ControlPanel::protectedProcedure()
{
qDebug() << "protectedProcedure";
ui.outputTextBrowser->append("开始演示受保护的过程");
ui.outputTextBrowser->append(QString("读取的数据：") + protectedDriverControl.safeRead());
ui.outputTextBrowser->append(QString("执行的结果：") + protectedDriverControl.safeExec());
}
void ControlPanel::closeEvent(QCloseEvent* event)
{
qDebug() << "closeEvent";
if (QMessageBox::question(this, "退出", "确定要退出吗？", QMessageBox::Yes, QMessageBox::No) == QMessageBox::Yes)
{
//unload drivers
malwareDriverControl.close();
protectedDriverControl.close();
unloadDriver(malwareServiceName);
unloadDriver(protectedServiceName);
//ui.outputTextBrowser->append("卸载中");
//QThread::sleep(2);
//uninitialize SCM
Services::uninit();
event->accept();
}
else
{
event->ignore();
}
}
bool ControlPanel::loadDriver(QString driverPath, QString serviceName, QString serviceDisplayName)
{
unsigned long registrationResult = Services::Register(driverPath,
serviceName,
serviceDisplayName,
"Demand",
"Normal");
switch (registrationResult) {
case ERROR_SERVICE_EXISTS:
ui.outputTextBrowser->append("Service registration failed. The service already exists.");
break;
case 1:
ui.outputTextBrowser->append("Service registration failed. Empty or invalid parameters have been provided.");
return false;
case 0:
ui.outputTextBrowser->append("Service registration succeeded.");
break;
default:
ui.outputTextBrowser->append(QString("Service registration failed. Error code %1.").arg(registrationResult));
return false;
}
unsigned long startResult = Services::Start(serviceName);
switch (startResult) {
case 1:
ui.outputTextBrowser->append("Starting service failed.");
return false;
case ERROR_SHARING_VIOLATION:
ui.outputTextBrowser->append("The process cannot access the file because it is being used by another process.");
return false;
case ERROR_SERVICE_DOES_NOT_EXIST:
ui.outputTextBrowser->append("The specified service does not exist as an installed service.");
return false;
case ERROR_SERVICE_ALREADY_RUNNING:
ui.outputTextBrowser->append("An instance of the service is already running.");
break;
case 0:
ui.outputTextBrowser->append("Service started.");
break;
default:
ui.outputTextBrowser->append(QString("Starting service failed. Error code %1.").arg(startResult));
return false;
}
return true;
}
bool ControlPanel::unloadDriver(QString serviceName)
{
//if (!initialized)
//{
// return false;
//}
unsigned long stopResult = Services::Stop(serviceName);
switch (stopResult) {
case 1:
ui.outputTextBrowser->append("Stopping service failed.");
break;
case ERROR_SERVICE_NOT_ACTIVE:
ui.outputTextBrowser->append("The service has not been started.");
break;
case ERROR_SERVICE_DOES_NOT_EXIST:
ui.outputTextBrowser->append("The specified service does not exist as an installed service.");
break;
case 0:
ui.outputTextBrowser->append("Service stopped.");
break;
default:
ui.outputTextBrowser->append(QString("Stopping service failed. Error code %1.").arg(stopResult));
break;
}
unsigned long unregistrationResult = Services::Unregister(serviceName);
bool unregResult = false;
switch (unregistrationResult) {
case 1:
ui.outputTextBrowser->append("Service unregistration failed.");
unregResult = false;
break;
case ERROR_SERVICE_DOES_NOT_EXIST:
ui.outputTextBrowser->append("The specified service does not exist as an installed service.");
unregResult = false;
break;
case 0:
ui.outputTextBrowser->append("Service unregistration succeeded.");
unregResult = true;
break;
default:
ui.outputTextBrowser->append(QString("Service unregistration failed. Error code %1.").arg(unregistrationResult));
unregResult = false;
break;
}
//initialized = false;
return unregResult;
}