Part1

1

DriverEntry固定返回STATUS_VIRUS_INFECTED.

修改代码使之返回STATUS_SUCCESS后成功加载.

RVA 0x24F1  06 09 00 C0 =>  00 00 00 00

OptionalHeader.Checksum  00009863 =>  0000919A

2

调用 NtLoadDriver 加载驱动.

完整代码见 src/loaddriver.c

3 & 4

int main()

{  

  HKEY hKey;

  RegCreateKeyW(HKEY_LOCAL_MACHINE, L"System\\CurrentControlSet\\Services\\"

DRIVER_NAME, &hKey);

  DWORD Temp = 1;

  RegSetValueExW(hKey, L"Type", 0, REG_DWORD, &Temp, sizeof(DWORD));

  Temp = 1;

  RegSetValueExW(hKey, L"ErrorControl", 0, REG_DWORD, &Temp, sizeof(DWORD));

  Temp = 3;

  RegSetValueExW(hKey, L"Start", 0, REG_DWORD, &Temp, sizeof(DWORD));

  RegSetValueExW(hKey, L"ImagePath", 0, REG_SZ, L"\\??\\" DRIVER_PATH,

sizeof(L"\\??\\" DRIVER_PATH));

  RegCloseKey(hKey);

  BOOLEAN Enabled;

  RtlAdjustPrivilege(SeLoadDriverPrivilege, TRUE, FALSE, &Enabled);

  UNICODE_STRING ServiceName;

  RtlInitUnicodeString(&ServiceName,

L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\" DRIVER_NAME);

  NtLoadDriver(&ServiceName);

  return 0;

}

3 & 4

Function 800

输入:

输出:  INT32

功能: 以内核态执行传入的回调函数.

Function 801

输入:  BYTE[8]

输出:  UINT64

传入8字节, 计算MurmurHash64A哈希.,带OLLVM

Function 802

输入:  BYTE[8]

输出:  UINT64

传入8字节, 计算MurmurHash2哈希.

Function 803

输入:  BYTE[8]

输出:  UINT64

传入8字节, 计算MurmurHash2哈希, 算法魔数m改为0x12345678

5

ULONG NTAPI

HideMe(PVOID P1, PVOID P2)

{

     using pfnGetProcAddr = PVOID(NTAPI *)(PWCHAR Name);

     auto pGetProcAddr = (pfnGetProcAddr)P1;

     auto pArg = (PVOID)P2;

     wchar_t wszPsLoadedModuleList[] = {

         L'P', L's', L'L', L'o', L'a', L'd', L'e', L'd', L'M', L'o', L'd', L'u', L'l', L'e', L'L', L'i', L's', L't', 0};

     auto pPsLoadedModuleList = (PLIST_ENTRY)pGetProcAddr(wszPsLoadedModuleList);

     auto pSelfLdr = (PLDR_DATA_TABLE_ENTRY)pPsLoadedModuleList->Blink;

     auto pPrevEntry = (PLDR_DATA_TABLE_ENTRY)pSelfLdr->InLoadOrderLinks.Blink;

     auto pNextEntry = (PLDR_DATA_TABLE_ENTRY)pSelfLdr->InLoadOrderLinks.Flink;

     auto uOriCr8 = __readcr8();

     __writecr8(2);

     if (pPrevEntry)

     {

         pPrevEntry->InLoadOrderLinks.Flink = pSelfLdr->InLoadOrderLinks.Flink;

     }

     if (pNextEntry)

     {

         pNextEntry->InLoadOrderLinks.Blink = pSelfLdr->InLoadOrderLinks.Blink;

     }

     pSelfLdr->InLoadOrderLinks.Flink = NULL;

     pSelfLdr->InLoadOrderLinks.Blink = NULL;

     __writecr8(uOriCr8);

     return 0;

}

6

flag.fg是一段shellcode, 判断自身作为64位代码执行还是32位代码执行, 转向对应函数.

64位下js不跳转.

32位下js跳转.

调用 RtlDecompressBuffer 解压出一个exe, 通过 DeviceIoControl 调用驱动的功能计算flag.

flag: " 16447126361811417937 "

Part2

此题为自由发挥题，无标准答案。

上述大部分答案采用 申奥成 的WP。