diff --git a/course/ScyllaHide/DetectOD/DetectOD.vcxproj b/course/ScyllaHide/DetectOD/DetectOD.vcxproj
index 376f127ffe6fccad568f9041cc4c6b6e7f86af2c..2a83bfec1ff13bfe3b1d6ec40a0f879e3a78419f 100644
--- a/course/ScyllaHide/DetectOD/DetectOD.vcxproj
+++ b/course/ScyllaHide/DetectOD/DetectOD.vcxproj
@@ -72,6 +72,8 @@
.\Debug\
.\Debug\
EnableFastChecks
+ /I"D:\_ALL\CODE\github\DarthTon\Blackbone\src\BlackBoneTest\.." %(AdditionalOptions)
+ stdcpplatest
true
@@ -110,6 +112,8 @@
stdafx.h
.\Release\
.\Release\
+ /I"D:\_ALL\CODE\github\DarthTon\Blackbone\src\BlackBoneTest\.." %(AdditionalOptions)
+ stdcpplatest
true
diff --git a/course/ScyllaHide/DetectOD/DetectODDlg.cpp b/course/ScyllaHide/DetectOD/DetectODDlg.cpp
index 00f637ac2bcd3c0b792a2a976e66777947a53930..0d11770fbb1235f24681c7c0d15b0fb70cdaf644 100644
--- a/course/ScyllaHide/DetectOD/DetectODDlg.cpp
+++ b/course/ScyllaHide/DetectOD/DetectODDlg.cpp
@@ -10,6 +10,24 @@
// #include "Winable.h"
#include
#include "eh.h"
+
+//////////////////////////////////////////////////////////////////////////
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+#pragma comment(lib, "D:\\_ALL\\CODE\\github\\DarthTon\\Blackbone\\build\\Win32\\Debug\\BlackBone.lib")
+//////////////////////////////////////////////////////////////////////////
+
+
#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
@@ -369,48 +387,48 @@ void CDetectODDlg::OnGetStartupInfo()
//**********************************************
// typedef ULONG NTSTATUS;
-typedef ULONG PPEB;
-typedef ULONG KAFFINITY;
-typedef ULONG KPRIORITY;
-
-typedef struct _PROCESS_BASIC_INFORMATION { // Information Class 0
-NTSTATUS ExitStatus;
-PPEB PebBaseAddress;
-KAFFINITY AffinityMask;
-KPRIORITY BasePriority;
-ULONG UniqueProcessId;
-ULONG InheritedFromUniqueProcessId;
-} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
-
-typedef enum _PROCESSINFOCLASS {
-ProcessBasicInformation, // 0 Y N
-ProcessQuotaLimits, // 1 Y Y
-ProcessIoCounters, // 2 Y N
-ProcessVmCounters, // 3 Y N
-ProcessTimes, // 4 Y N
-ProcessBasePriority, // 5 N Y
-ProcessRaisePriority, // 6 N Y
-ProcessDebugPort, // 7 Y Y
-ProcessExceptionPort, // 8 N Y
-ProcessAccessToken, // 9 N Y
-ProcessLdtInformation, // 10 Y Y
-ProcessLdtSize, // 11 N Y
-ProcessDefaultHardErrorMode, // 12 Y Y
-ProcessIoPortHandlers, // 13 N Y
-ProcessPooledUsageAndLimits, // 14 Y N
-ProcessWorkingSetWatch, // 15 Y Y
-ProcessUserModeIOPL, // 16 N Y
-ProcessEnableAlignmentFaultFixup, // 17 N Y
-ProcessPriorityClass, // 18 N Y
-ProcessWx86Information, // 19 Y N
-ProcessHandleCount, // 20 Y N
-ProcessAffinityMask, // 21 N Y
-ProcessPriorityBoost, // 22 Y Y
-ProcessDeviceMap,// 23 Y Y
-ProcessSessionInformation, // 24 Y Y
-ProcessForegroundInformation, // 25 N Y
-ProcessWow64Information // 26 Y N
-} PROCESSINFOCLASS;
+// typedef ULONG PPEB;
+// typedef ULONG KAFFINITY;
+// typedef ULONG KPRIORITY;
+
+// typedef struct _PROCESS_BASIC_INFORMATION { // Information Class 0
+// NTSTATUS ExitStatus;
+// PPEB PebBaseAddress;
+// KAFFINITY AffinityMask;
+// KPRIORITY BasePriority;
+// ULONG UniqueProcessId;
+// ULONG InheritedFromUniqueProcessId;
+// } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
+
+// typedef enum _PROCESSINFOCLASS {
+// ProcessBasicInformation, // 0 Y N
+// ProcessQuotaLimits, // 1 Y Y
+// ProcessIoCounters, // 2 Y N
+// ProcessVmCounters, // 3 Y N
+// ProcessTimes, // 4 Y N
+// ProcessBasePriority, // 5 N Y
+// ProcessRaisePriority, // 6 N Y
+// ProcessDebugPort, // 7 Y Y
+// ProcessExceptionPort, // 8 N Y
+// ProcessAccessToken, // 9 N Y
+// ProcessLdtInformation, // 10 Y Y
+// ProcessLdtSize, // 11 N Y
+// ProcessDefaultHardErrorMode, // 12 Y Y
+// ProcessIoPortHandlers, // 13 N Y
+// ProcessPooledUsageAndLimits, // 14 Y N
+// ProcessWorkingSetWatch, // 15 Y Y
+// ProcessUserModeIOPL, // 16 N Y
+// ProcessEnableAlignmentFaultFixup, // 17 N Y
+// ProcessPriorityClass, // 18 N Y
+// ProcessWx86Information, // 19 Y N
+// ProcessHandleCount, // 20 Y N
+// ProcessAffinityMask, // 21 N Y
+// ProcessPriorityBoost, // 22 Y Y
+// ProcessDeviceMap,// 23 Y Y
+// ProcessSessionInformation, // 24 Y Y
+// ProcessForegroundInformation, // 25 N Y
+// ProcessWow64Information // 26 Y N
+// } PROCESSINFOCLASS;
typedef NTSTATUS (_stdcall *ZwQueryInformationProcess)(
@@ -421,9 +439,38 @@ ULONG ProcessInformationLength,
PULONG ReturnLength
); //定义函数指针
+using namespace blackbone;
+void MyOnPebflags()
+{
+ Process _proc;
+ PEB_T peb = { };
+ _PEB32 peb32 = { };
+ _PEB64 peb64 = { };
+
+ _proc.Attach(GetCurrentProcessId());
+ auto ppeb = _proc.core().peb<>(&peb);
+ auto ppeb32 = _proc.core().peb32(&peb32);
+ auto ppeb64 = _proc.core().peb64(&peb64);
+
+ int size = sizeof(PEB_T);
+ size = sizeof(_PEB32);
+ size = sizeof(_PEB64);
+
+ if (peb32.BeingDebugged)
+ {
+ MessageBoxA(NULL, "peb32.BeingDebugged", "MyOnPebflags", MB_OK);
+ }
+ if (peb64.BeingDebugged)
+ {
+ MessageBoxA(NULL, "peb64.BeingDebugged", "MyOnPebflags", MB_OK);
+ }
+}
+
void CDetectODDlg::OnPebflags()
{
// TODO: Add your control notification handler code here
+ MyOnPebflags();
+ return;
//定义函数指针变量
ZwQueryInformationProcess MyZwQueryInformationProcess;
@@ -626,33 +673,33 @@ void CDetectODDlg::OnSeDebugPrivilege()
#define STATUS_INFO_LENGTH_MISMATCH ((UINT32)0xC0000004L)
#endif
-typedef enum _POOL_TYPE {
- NonPagedPool,
- PagedPool,
- NonPagedPoolMustSucceed,
- DontUseThisType,
- NonPagedPoolCacheAligned,
- PagedPoolCacheAligned,
- NonPagedPoolCacheAlignedMustS
-} POOL_TYPE;
-
-typedef struct _UNICODE_STRING {
- USHORT Length;
- USHORT MaximumLength;
- PWSTR Buffer;
-} UNICODE_STRING;
-typedef UNICODE_STRING *PUNICODE_STRING;
-typedef const UNICODE_STRING *PCUNICODE_STRING;
-
-typedef enum _OBJECT_INFORMATION_CLASS
-{
- ObjectBasicInformation, // Result is OBJECT_BASIC_INFORMATION structure
- ObjectNameInformation, // Result is OBJECT_NAME_INFORMATION structure
- ObjectTypeInformation, // Result is OBJECT_TYPE_INFORMATION structure
- ObjectAllTypesInformation, // Result is OBJECT_ALL_INFORMATION structure
- ObjectDataInformation // Result is OBJECT_DATA_INFORMATION structure
-
-} OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
+// typedef enum _POOL_TYPE {
+// NonPagedPool,
+// PagedPool,
+// NonPagedPoolMustSucceed,
+// DontUseThisType,
+// NonPagedPoolCacheAligned,
+// PagedPoolCacheAligned,
+// NonPagedPoolCacheAlignedMustS
+// } POOL_TYPE;
+
+// typedef struct _UNICODE_STRING {
+// USHORT Length;
+// USHORT MaximumLength;
+// PWSTR Buffer;
+// } UNICODE_STRING;
+// typedef UNICODE_STRING *PUNICODE_STRING;
+// typedef const UNICODE_STRING *PCUNICODE_STRING;
+
+// typedef enum _OBJECT_INFORMATION_CLASS
+// {
+// ObjectBasicInformation, // Result is OBJECT_BASIC_INFORMATION structure
+// ObjectNameInformation, // Result is OBJECT_NAME_INFORMATION structure
+// ObjectTypeInformation, // Result is OBJECT_TYPE_INFORMATION structure
+// ObjectAllTypesInformation, // Result is OBJECT_ALL_INFORMATION structure
+// ObjectDataInformation // Result is OBJECT_DATA_INFORMATION structure
+//
+// } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
typedef struct _OBJECT_TYPE_INFORMATION {
UNICODE_STRING TypeName;
@@ -701,16 +748,16 @@ void CDetectODDlg::OnNTQueryObject()
OBJECT_ALL_TYPES_INFORMATION *Types;
OBJECT_TYPE_INFORMATION *t;
ZwQueryObject_t ZwQueryObject;
-
+ DWORD ObjectAllTypesInformation = 3;
hNtDLL = GetModuleHandle("ntdll.dll");
if(hNtDLL){
ZwQueryObject = (ZwQueryObject_t)GetProcAddress(hNtDLL, "ZwQueryObject");
- UINT32 iResult = ZwQueryObject(NULL, ObjectAllTypesInformation, NULL, NULL, &dwSize);
+ UINT32 iResult = ZwQueryObject(NULL, (OBJECT_INFORMATION_CLASS)ObjectAllTypesInformation, NULL, NULL, &dwSize);
if(iResult==STATUS_INFO_LENGTH_MISMATCH)
{
Types = (OBJECT_ALL_TYPES_INFORMATION*)VirtualAlloc(NULL,dwSize,MEM_COMMIT,PAGE_READWRITE);
if (Types == NULL) return;
- if (iResult=ZwQueryObject(NULL,ObjectAllTypesInformation, Types, dwSize, &dwSize)) return;
+ if (iResult=ZwQueryObject(NULL, (OBJECT_INFORMATION_CLASS)ObjectAllTypesInformation, Types, dwSize, &dwSize)) return;
for (t=Types->TypeInformation,i=0;iNumberOfTypes;i++)
{
if ( !_wcsicmp(t->TypeName.Buffer,L"DebugObject")) //比较两个是否相等，这个L很特殊，本地的意思
@@ -871,30 +918,31 @@ void CDetectODDlg::OnEnableWindow()
wnd->EnableWindow(TRUE);
}
/*********************************************************/
-typedef enum _THREADINFOCLASS {
-ThreadBasicInformation, // 0 Y N
-ThreadTimes, // 1 Y N
-ThreadPriority, // 2 N Y
-ThreadBasePriority, // 3 N Y
-ThreadAffinityMask, // 4 N Y
-ThreadImpersonationToken, // 5 N Y
-ThreadDescriptorTableEntry, // 6 Y N
-ThreadEnableAlignmentFaultFixup, // 7 N Y
-ThreadEventPair, // 8 N Y
-ThreadQuerySetWin32StartAddress, // 9 Y Y
-ThreadZeroTlsCell, // 10 N Y
-ThreadPerformanceCount, // 11 Y N
-ThreadAmILastThread, // 12 Y N
-ThreadIdealProcessor, // 13 N Y
-ThreadPriorityBoost, // 14 Y Y
-ThreadSetTlsArrayAddress, // 15 N Y
-ThreadIsIoPending, // 16 Y N
-ThreadHideFromDebugger // 17 N Y
-} THREAD_INFO_CLASS;
+// typedef enum _THREADINFOCLASS {
+// ThreadBasicInformation, // 0 Y N
+// ThreadTimes, // 1 Y N
+// ThreadPriority, // 2 N Y
+// ThreadBasePriority, // 3 N Y
+// ThreadAffinityMask, // 4 N Y
+// ThreadImpersonationToken, // 5 N Y
+// ThreadDescriptorTableEntry, // 6 Y N
+// ThreadEnableAlignmentFaultFixup, // 7 N Y
+// ThreadEventPair, // 8 N Y
+// ThreadQuerySetWin32StartAddress, // 9 Y Y
+// ThreadZeroTlsCell, // 10 N Y
+// ThreadPerformanceCount, // 11 Y N
+// ThreadAmILastThread, // 12 Y N
+// ThreadIdealProcessor, // 13 N Y
+// ThreadPriorityBoost, // 14 Y Y
+// ThreadSetTlsArrayAddress, // 15 N Y
+// ThreadIsIoPending, // 16 Y N
+// ThreadHideFromDebugger // 17 N Y
+// } THREAD_INFO_CLASS;
typedef NTSTATUS (NTAPI *ZwSetInformationThread)(
IN HANDLE ThreadHandle,
-IN THREAD_INFO_CLASS ThreadInformaitonClass,
+// IN THREAD_INFO_CLASS ThreadInformaitonClass,
+IN DWORD ThreadInformaitonClass,
IN PVOID ThreadInformation,
IN ULONG ThreadInformationLength
);
@@ -905,6 +953,8 @@ void CDetectODDlg::OnZwSetInformationThread()
CString str="利用我定位";
HANDLE hwnd;
HMODULE hModule;
+ DWORD ThreadHideFromDebugger = 17;
+
hwnd=GetCurrentThread();
hModule=LoadLibrary("ntdll.dll");
ZwSetInformationThread myFunc;
@@ -939,7 +989,7 @@ void CDetectODDlg::OnGetEntryPoint()
/**************************************************************/
void terminateFunc()
{
- AfxMessageBox("set_terminate指定的函数\n");
+ AfxMessageBox("set_terminate指定的函数\\n");
exit(0);
}
void CDetectODDlg::OnButton1()