Skip to content

Commit da05f87

Browse files
AdvDebugAdvDebug
authored
Add files via upload
1 parent bf2a446 commit da05f87

File tree

1 file changed

+54
-27
lines changed

1 file changed

+54
-27
lines changed

‎NoMoreCookies/NoMoreCookies/dllmain.cpp‎

Lines changed: 54 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,13 @@ typedef NTSTATUS(NTAPI* RealNtResumeThread)(HANDLE, PULONG);
2121
typedef NTSTATUS(NTAPI* RealNtSetValueKey)(HANDLE, PUNICODE_STRING, ULONG, ULONG, PVOID, ULONG);
2222
typedef NTSTATUS(NTAPI* RealNtProtectVirtualMemory)(HANDLE, PVOID*, PULONG, ULONG, PULONG);
2323
typedef NTSTATUS(NTAPI* RealNtWriteVirtualMemory)(HANDLE, PVOID, LPCVOID, SIZE_T, PSIZE_T);
24+
typedef NTSTATUS(NTAPI* RealNtDeleteValueKey)(HANDLE, PUNICODE_STRING);
2425
HANDLE Mutex = CreateMutex(NULL, FALSE, NULL);
2526
HANDLE Mutex2 = CreateMutex(NULL, FALSE, NULL);
2627
HANDLE Mutex3 = CreateMutex(NULL, FALSE, NULL);
2728
HANDLE Mutex4 = CreateMutex(NULL, FALSE, NULL);
2829
HANDLE Mutex5 = CreateMutex(NULL, FALSE, NULL);
30+
HANDLE Mutex6 = CreateMutex(NULL, FALSE, NULL);
2931
BOOL XMode = FALSE; //you set the mode you want
3032
HMODULE Module = NULL;
3133

@@ -34,6 +36,7 @@ RealNtResumeThread OriginalNtResumeThread = nullptr;
3436
RealNtSetValueKey OriginalNtSetValueKey = nullptr;
3537
RealNtProtectVirtualMemory OriginalNtProtectVirtualMemory = nullptr;
3638
RealNtWriteVirtualMemory OriginalNtWriteVirtualMemory = nullptr;
39+
RealNtDeleteValueKey OriginalNtDeleteValueKey = nullptr;
3740

3841
BOOL IsSigned(HANDLE hProcess)
3942
{
@@ -153,6 +156,12 @@ bool IsBrowser(char* FileName)
153156
return false;
154157
}
155158

159+
BOOL IsBlacklistedApp(char* FileName, BOOL Signed)
160+
{
161+
if (hasEnding(FileName, "javaw.exe") && Signed || hasEnding(FileName, "py.exe") && Signed || hasEnding(FileName, "python.exe") && Signed || hasEnding(FileName, "pythonw.exe") && Signed || hasEnding(FileName, "explorer.exe") && Signed || std::string(FileName).find("C:\\Windows\\Microsoft.NET\\Framework") == 0)
162+
return false;
163+
}
164+
156165
BOOL IsProcessAllowed()
157166
{
158167
char FileName[MAX_PATH + 1];
@@ -165,7 +174,7 @@ BOOL IsProcessAllowed()
165174
}
166175
else
167176
{
168-
if (hasEnding(FileName, "javaw.exe") && Signed || hasEnding(FileName, "py.exe") && Signed || hasEnding(FileName, "python.exe") && Signed || hasEnding(FileName, "pythonw.exe") && Signed || hasEnding(FileName, "explorer.exe") && Signed)
177+
if (IsBlacklistedApp(FileName, Signed))
169178
return false;
170179
}
171180
if (XMode)
@@ -192,7 +201,7 @@ BOOL IsNoMoreCookiesInstaller()
192201
}
193202
WCHAR CheckSum[9];
194203
swprintf_s(CheckSum, 9, L"%08X", Sum);
195-
if (wcscmp(CheckSum, L"00089A3A") == 0)
204+
if (wcscmp(CheckSum, L"000A7944") == 0)
196205
{
197206
return TRUE;
198207
}
@@ -202,41 +211,43 @@ BOOL IsNoMoreCookiesInstaller()
202211

203212
BOOL IsSandboxedProcess()
204213
{
205-
HANDLE hToken;
206-
DWORD dwLengthNeeded;
207-
PTOKEN_MANDATORY_LABEL pTIL = NULL;
208-
if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
214+
HANDLE hToken = NULL;
215+
DWORD dwLengthNeeded = 0;
216+
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
217+
return TRUE;
218+
if (!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &dwLengthNeeded) && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
219+
{
220+
CloseHandle(hToken);
221+
return TRUE;
222+
}
223+
PTOKEN_MANDATORY_LABEL pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(0, dwLengthNeeded);
224+
if (!pTIL)
209225
{
210-
if (GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &dwLengthNeeded))
226+
CloseHandle(hToken);
227+
return TRUE;
228+
}
229+
if (GetTokenInformation(hToken, TokenIntegrityLevel, pTIL, dwLengthNeeded, &dwLengthNeeded))
230+
{
231+
DWORD dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid, (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid) - 1));
232+
if (dwIntegrityLevel == SECURITY_MANDATORY_LOW_RID || dwIntegrityLevel == SECURITY_MANDATORY_UNTRUSTED_RID)
211233
{
212-
pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(0, dwLengthNeeded);
213-
if (pTIL != NULL)
214-
{
215-
if (GetTokenInformation(hToken, TokenIntegrityLevel, pTIL, dwLengthNeeded, &dwLengthNeeded))
216-
{
217-
DWORD dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid, (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid) - 1));
218-
if (dwIntegrityLevel <= SECURITY_MANDATORY_LOW_RID)
219-
{
220-
return true;
221-
}
222-
}
223-
LocalFree(pTIL);
224-
}
234+
return TRUE;
225235
}
226-
CloseHandle(hToken);
227236
}
228-
return false;
237+
LocalFree(pTIL);
238+
CloseHandle(hToken);
239+
return FALSE;
229240
}
230241

231242
DWORD WINAPI ShowNotification(std::wstring Text)
232243
{
233244
NOTIFYICONDATAW nid = { sizeof(nid) };
234245
nid.uFlags = NIF_INFO;
235246
nid.hWnd = NULL;
236-
nid.uID = 1;
237247
nid.dwInfoFlags = NIIF_ERROR;
238248
nid.hIcon = LoadIcon(NULL, IDI_ERROR);
239249
nid.uTimeout = 7000;
250+
nid.cbSize = sizeof(nid);
240251
wcsncpy_s(nid.szInfoTitle, L"Unauthorized Action", _TRUNCATE);
241252
wcsncpy_s(nid.szInfo, Text.c_str(), _TRUNCATE);
242253
Shell_NotifyIconW(NIM_ADD, &nid);
@@ -364,13 +375,14 @@ FARPROC NtResumeThreadAddress = NULL;
364375
FARPROC NtSetValueKeyAddress = NULL;
365376
FARPROC NtWriteVirtualMemory = NULL;
366377
FARPROC NtProtectVirtualMemory = NULL;
378+
FARPROC NtDeleteValueKey = NULL;
367379

368380
NTSTATUS NTAPI HookedNtProtectVirtualMemory(HANDLE ProcessHandle, PVOID* BaseAddress, PULONG NumberOfBytesToProtect, ULONG NewAccessProtection, PULONG OldAccessProtection)
369381
{
370382
WaitForSingleObject(Mutex4, INFINITE);
371383
if (GetProcessId(ProcessHandle) == GetCurrentProcessId())
372384
{
373-
if ((int)(*BaseAddress) == (int)(NtCreateFileAddress) || (int)(*BaseAddress) == (int)(NtResumeThreadAddress) || (int)(*BaseAddress) == (int)(NtSetValueKeyAddress) || (int)(*BaseAddress) == (int)(NtWriteVirtualMemory) || (int)(*BaseAddress) == (int)(NtProtectVirtualMemory))
385+
if ((int)(*BaseAddress) == (int)(NtCreateFileAddress) || (int)(*BaseAddress) == (int)(NtResumeThreadAddress) || (int)(*BaseAddress) == (int)(NtSetValueKeyAddress) || (int)(*BaseAddress) == (int)(NtWriteVirtualMemory) || (int)(*BaseAddress) == (int)(NtProtectVirtualMemory) || (int)(*BaseAddress) == (int)(NtDeleteValueKey))
374386
{
375387
ReleaseMutex(Mutex4);
376388
return STATUS_ACCESS_DENIED;
@@ -385,7 +397,7 @@ NTSTATUS NTAPI HookedNtWriteVirtualMemory(HANDLE ProcessHandle, PVOID BaseAddres
385397
WaitForSingleObject(Mutex5, INFINITE);
386398
if (GetProcessId(ProcessHandle) == GetCurrentProcessId())
387399
{
388-
if ((int)(BaseAddress) == (int)(NtCreateFileAddress) || (int)(BaseAddress) == (int)(NtResumeThreadAddress) || (int)(BaseAddress) == (int)(NtSetValueKeyAddress) || (int)(BaseAddress) == (int)(NtWriteVirtualMemory) || (int)(BaseAddress) == (int)(NtProtectVirtualMemory))
400+
if ((int)(BaseAddress) == (int)(NtCreateFileAddress) || (int)(BaseAddress) == (int)(NtResumeThreadAddress) || (int)(BaseAddress) == (int)(NtSetValueKeyAddress) || (int)(BaseAddress) == (int)(NtWriteVirtualMemory) || (int)(BaseAddress) == (int)(NtProtectVirtualMemory) || (int)(BaseAddress) == (int)(NtDeleteValueKey))
389401
{
390402
ReleaseMutex(Mutex5);
391403
return STATUS_ACCESS_DENIED;
@@ -395,18 +407,31 @@ NTSTATUS NTAPI HookedNtWriteVirtualMemory(HANDLE ProcessHandle, PVOID BaseAddres
395407
return OriginalNtWriteVirtualMemory(ProcessHandle, BaseAddress, Buffer, BufferSize, NumberOfBytesWritten);
396408
}
397409

410+
NTSTATUS NTAPI HookedNtDeleteValueKey(HANDLE KeyHandle, PUNICODE_STRING ValueName)
411+
{
412+
WaitForSingleObject(Mutex6, INFINITE);
413+
WCHAR* Buffer = ValueName->Buffer;
414+
if (wcsncmp(Buffer, L"AppInit_DLLs", 13) == 0 || wcsncmp(Buffer, L"LoadAppInit_DLLs", 17) == 0)
415+
{
416+
ReleaseMutex(Mutex6);
417+
return STATUS_ACCESS_DENIED;
418+
}
419+
ReleaseMutex(Mutex6);
420+
return OriginalNtDeleteValueKey(KeyHandle, ValueName);
421+
}
422+
398423
void CheckHook()
399424
{
400425
NtCreateFileAddress = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtCreateFile");
401426
NtResumeThreadAddress = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtResumeThread");
402427
NtSetValueKeyAddress = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtSetValueKey");
403428
NtWriteVirtualMemory = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtWriteVirtualMemory");
404429
NtProtectVirtualMemory = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtProtectVirtualMemory");
405-
const char* Functions[] = { "NtCreateFile", "NtResumeThread", "NtSetValueKey", "NtProtectVirtualMemory", "NtWriteVirtualMemory" };
430+
const char* Functions[] = { "NtCreateFile", "NtResumeThread", "NtSetValueKey", "NtProtectVirtualMemory", "NtWriteVirtualMemory", "NtDeleteValueKey"};
406431
const int Size = sizeof(Functions) / sizeof(Functions[0]);
407432
while (true)
408433
{
409-
Sleep(2000);
434+
Sleep(1000);
410435
for (int i = 0; i < Size; i++)
411436
{
412437
FARPROC FunctionAddress = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), Functions[i]);
@@ -435,6 +460,8 @@ void HookingThread()
435460
DetourAttach(&(LPVOID&)OriginalNtProtectVirtualMemory, HookedNtProtectVirtualMemory);
436461
OriginalNtWriteVirtualMemory = reinterpret_cast<RealNtWriteVirtualMemory>(DetourFindFunction("ntdll.dll", "NtWriteVirtualMemory"));
437462
DetourAttach(&(LPVOID&)OriginalNtWriteVirtualMemory, HookedNtWriteVirtualMemory);
463+
OriginalNtDeleteValueKey = reinterpret_cast<RealNtDeleteValueKey>(DetourFindFunction("ntdll.dll", "NtDeleteValueKey"));
464+
DetourAttach(&(LPVOID&)OriginalNtDeleteValueKey, HookedNtDeleteValueKey);
438465
DetourTransactionCommit();
439466
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)CheckHook, NULL, 0, NULL);
440467
}

0 commit comments

Comments
 (0)