protectprocess.c

   1 // protectprocess.c
   2 // Copyright (C) 2011 Suguru Kawamoto
   3 // \83v\83\8d\83Z\83X\82Ì\95Û\8cì
   4
   5 // \8e\9f\82Ì\92\86\82©\82ç1\8cÂ\82Ì\82Ý\97L\8cø\82É\82·\82é
   6 // \83t\83b\83N\90æ\82Ì\8aÖ\90\94\82Ì\83R\81[\83h\82ð\8f\91\82«\8a·\82¦\82é
   7 // \91S\82Ä\82Ì\8cÄ\82Ñ\8fo\82µ\82ð\83t\83b\83N\89Â\94\\82¾\82ª\8c´\97\9d\93I\82É\93ñ\8fd\8cÄ\82Ñ\8fo\82µ\82É\91Î\89\9e\82Å\82«\82È\82¢
   8 #define USE_CODE_HOOK
   9 // \83t\83b\83N\90æ\82Ì\8aÖ\90\94\82Ì\83C\83\93\83|\81[\83g\83A\83h\83\8c\83X\83e\81[\83u\83\8b\82ð\8f\91\82«\8a·\82¦\82é
  10 // \93ñ\8fd\8cÄ\82Ñ\8fo\82µ\82ª\89Â\94\\82¾\82ª\8cÄ\82Ñ\8fo\82µ\95û\96@\82É\82æ\82Á\82Ä\82Í\83t\83b\83N\82ð\89ñ\94ð\82³\82ê\82é
  11 //#define USE_IAT_HOOK
  12
  13 // \83t\83b\83N\91Î\8fÛ\82Ì\8aÖ\90\94\96¼ %s
  14 // \83t\83b\83N\91Î\8fÛ\82Ì\8c^ _%s
  15 // \83t\83b\83N\91Î\8fÛ\82Ì\83|\83C\83\93\83^ p_%s
  16 // \83t\83b\83N\97p\82Ì\8aÖ\90\94\96¼ h_%s
  17 // \83t\83b\83N\91Î\8fÛ\82Ì\83R\81[\83h\82Ì\83o\83b\83N\83A\83b\83v c_%s
  18
  19 #include <tchar.h>
  20 #include <windows.h>
  21 #include <ntsecapi.h>
  22 #include <wincrypt.h>
  23 #include <wintrust.h>
  24 #include <softpub.h>
  25 #include <aclapi.h>
  26 #include <sfc.h>
  27 #include <tlhelp32.h>
  28 #include <imagehlp.h>
  29 #ifdef USE_IAT_HOOK
  30 #include <dbghelp.h>
  31 #endif
  32
  33 #define DO_NOT_REPLACE
  34 #include "protectprocess.h"
  35 #include "mbswrapper.h"
  36
  37 #ifdef USE_IAT_HOOK
  38 #pragma comment(lib, "dbghelp.lib")
  39 #endif
  40
  41 #ifdef USE_CODE_HOOK
  42 #if defined(_X86_)
  43 #define HOOK_JUMP_CODE_LENGTH 5
  44 #elif defined(_AMD64_)
  45 #define HOOK_JUMP_CODE_LENGTH 14
  46 #endif
  47 #endif
  48
  49 BOOL LockThreadLock();
  50 BOOL UnlockThreadLock();
  51 #ifdef USE_CODE_HOOK
  52 BOOL HookFunctionInCode(void* pOriginal, void* pNew, void* pBackupCode, BOOL bRestore);
  53 #endif
  54 #ifdef USE_IAT_HOOK
  55 BOOL HookFunctionInIAT(void* pOriginal, void* pNew);
  56 #endif
  57 HANDLE LockExistingFile(LPCWSTR Filename);
  58 BOOL FindTrustedModuleSHA1Hash(void* pHash);
  59 BOOL VerifyFileSignature(LPCWSTR Filename);
  60 BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename);
  61 BOOL GetSHA1HashOfModule(LPCWSTR Filename, void* pHash);
  62 BOOL IsModuleTrusted(LPCWSTR Filename);
  63
  64 // \95Ï\90\94\82Ì\90é\8c¾
  65 #ifdef USE_CODE_HOOK
  66 #define HOOK_FUNCTION_VAR(name) _##name p_##name;BYTE c_##name[HOOK_JUMP_CODE_LENGTH * 2];
  67 #endif
  68 #ifdef USE_IAT_HOOK
  69 #define HOOK_FUNCTION_VAR(name) _##name p_##name;
  70 #endif
  71 // \8aÖ\90\94\83|\83C\83\93\83^\82ð\8eæ\93¾
  72 #define GET_FUNCTION(h, name) p_##name = (_##name)GetProcAddress(h, #name)
  73 // \83t\83b\83N\91Î\8fÛ\82Ì\83R\81[\83h\82ð\92u\8a·\82µ\82Ä\83t\83b\83N\82ð\8aJ\8en
  74 #define SET_HOOK_FUNCTION(name) HookFunctionInCode(p_##name, h_##name, &c_##name, FALSE)
  75 // \83t\83b\83N\91Î\8fÛ\82ð\8cÄ\82Ñ\8fo\82·\91O\82É\91Î\8fÛ\82Ì\83R\81[\83h\82ð\95\9c\8c³
  76 #define START_HOOK_FUNCTION(name) HookFunctionInCode(p_##name, h_##name, &c_##name, TRUE)
  77 // \83t\83b\83N\91Î\8fÛ\82ð\8cÄ\82Ñ\8fo\82µ\82½\8cã\82É\91Î\8fÛ\82Ì\83R\81[\83h\82ð\92u\8a·
  78 #define END_HOOK_FUNCTION(name) HookFunctionInCode(p_##name, h_##name, NULL, FALSE)
  79
  80 HOOK_FUNCTION_VAR(LoadLibraryA)
  81 HOOK_FUNCTION_VAR(LoadLibraryW)
  82 HOOK_FUNCTION_VAR(LoadLibraryExA)
  83 HOOK_FUNCTION_VAR(LoadLibraryExW)
  84
  85 typedef NTSTATUS (NTAPI* _LdrLoadDll)(LPCWSTR, DWORD*, UNICODE_STRING*, HMODULE*);
  86 typedef NTSTATUS (NTAPI* _LdrGetDllHandle)(LPCWSTR, DWORD*, UNICODE_STRING*, HMODULE*);
  87 typedef PIMAGE_NT_HEADERS (NTAPI* _RtlImageNtHeader)(PVOID);
  88 typedef BOOL (WINAPI* _CryptCATAdminCalcHashFromFileHandle)(HANDLE, DWORD*, BYTE*, DWORD);
  89
  90 _LdrLoadDll p_LdrLoadDll;
  91 _LdrGetDllHandle p_LdrGetDllHandle;
  92 _RtlImageNtHeader p_RtlImageNtHeader;
  93 _CryptCATAdminCalcHashFromFileHandle p_CryptCATAdminCalcHashFromFileHandle;
  94
  95 #define MAX_LOCKED_THREAD 16
  96 #define MAX_TRUSTED_FILENAME_TABLE 16
  97 #define MAX_TRUSTED_MD5_HASH_TABLE 16
  98
  99 DWORD g_ProcessProtectionLevel;
 100 DWORD g_LockedThread[MAX_LOCKED_THREAD];
 101 WCHAR* g_pTrustedFilenameTable[MAX_TRUSTED_FILENAME_TABLE];
 102 BYTE g_TrustedMD5HashTable[MAX_TRUSTED_MD5_HASH_TABLE][20];
 103
 104 // \88È\89º\83t\83b\83N\8aÖ\90\94
 105 // \83t\83b\83N\91Î\8fÛ\82ð\8cÄ\82Ñ\8fo\82·\8fê\8d\87\82Í\91O\8cã\82ÅSTART_HOOK_FUNCTION\82ÆEND_HOOK_FUNCTION\82ð\8eÀ\8ds\82·\82é\95K\97v\82ª\82 \82é
 106
 107 HMODULE WINAPI h_LoadLibraryA(LPCSTR lpLibFileName)
 108 {
 109         HMODULE r = NULL;
 110         wchar_t* pw0 = NULL;
 111         if(pw0 = DuplicateAtoW(lpLibFileName, -1))
 112                 r = LoadLibraryExW(pw0, NULL, 0);
 113         FreeDuplicatedString(pw0);
 114         return r;
 115 }
 116
 117 HMODULE WINAPI h_LoadLibraryW(LPCWSTR lpLibFileName)
 118 {
 119         HMODULE r = NULL;
 120         r = LoadLibraryExW(lpLibFileName, NULL, 0);
 121         return r;
 122 }
 123
 124 HMODULE WINAPI h_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
 125 {
 126         HMODULE r = NULL;
 127         wchar_t* pw0 = NULL;
 128         if(pw0 = DuplicateAtoW(lpLibFileName, -1))
 129                 r = LoadLibraryExW(pw0, hFile, dwFlags);
 130         FreeDuplicatedString(pw0);
 131         return r;
 132 }
 133
 134 HMODULE WINAPI h_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
 135 {
 136         HMODULE r = NULL;
 137         BOOL bTrusted;
 138         wchar_t* pw0;
 139         HANDLE hLock;
 140         HMODULE hModule;
 141         DWORD Length;
 142         bTrusted = FALSE;
 143         pw0 = NULL;
 144         hLock = NULL;
 145 //      if(dwFlags & (DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE))
 146         if(dwFlags & (DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE | 0x00000020 | 0x00000040))
 147                 bTrusted = TRUE;
 148         if(!bTrusted)
 149         {
 150                 if(hModule = System_LoadLibrary(lpLibFileName, NULL, DONT_RESOLVE_DLL_REFERENCES))
 151                 {
 152                         Length = MAX_PATH;
 153                         if(pw0 = AllocateStringW(Length))
 154                         {
 155                                 if(GetModuleFileNameW(hModule, pw0, Length) > 0)
 156                                 {
 157                                         while(pw0)
 158                                         {
 159                                                 if(GetModuleFileNameW(hModule, pw0, Length) + 1 <= Length)
 160                                                 {
 161                                                         lpLibFileName = pw0;
 162                                                         break;
 163                                                 }
 164                                                 Length = Length * 2;
 165                                                 FreeDuplicatedString(pw0);
 166                                                 pw0 = AllocateStringW(Length);
 167                                         }
 168                                 }
 169                         }
 170                         hLock = LockExistingFile(lpLibFileName);
 171                         FreeLibrary(hModule);
 172                 }
 173                 if((g_ProcessProtectionLevel & PROCESS_PROTECTION_LOADED) && GetModuleHandleW(lpLibFileName))
 174                         bTrusted = TRUE;
 175         }
 176         if(!bTrusted)
 177         {
 178                 if(hLock)
 179                 {
 180                         if(IsModuleTrusted(lpLibFileName))
 181                                 bTrusted = TRUE;
 182                 }
 183         }
 184         if(bTrusted)
 185                 r = System_LoadLibrary(lpLibFileName, hFile, dwFlags);
 186         FreeDuplicatedString(pw0);
 187         if(hLock)
 188                 CloseHandle(hLock);
 189         return r;
 190 }
 191
 192 // \88È\89º\83w\83\8b\83p\81[\8aÖ\90\94
 193
 194 BOOL LockThreadLock()
 195 {
 196         BOOL bResult;
 197         DWORD ThreadId;
 198         DWORD i;
 199         bResult = FALSE;
 200         ThreadId = GetCurrentThreadId();
 201         i = 0;
 202         while(i < MAX_LOCKED_THREAD)
 203         {
 204                 if(g_LockedThread[i] == ThreadId)
 205                         break;
 206                 i++;
 207         }
 208         if(i >= MAX_LOCKED_THREAD)
 209         {
 210                 i = 0;
 211                 while(i < MAX_LOCKED_THREAD)
 212                 {
 213                         if(g_LockedThread[i] == 0)
 214                         {
 215                                 g_LockedThread[i] = ThreadId;
 216                                 bResult = TRUE;
 217                                 break;
 218                         }
 219                         i++;
 220                 }
 221         }
 222         return bResult;
 223 }
 224
 225 BOOL UnlockThreadLock()
 226 {
 227         BOOL bResult;
 228         DWORD ThreadId;
 229         DWORD i;
 230         bResult = FALSE;
 231         ThreadId = GetCurrentThreadId();
 232         i = 0;
 233         while(i < MAX_LOCKED_THREAD)
 234         {
 235                 if(g_LockedThread[i] == ThreadId)
 236                 {
 237                         g_LockedThread[i] = 0;
 238                         bResult = TRUE;
 239                         break;
 240                 }
 241                 i++;
 242         }
 243         return bResult;
 244 }
 245
 246 #ifdef USE_CODE_HOOK
 247 BOOL HookFunctionInCode(void* pOriginal, void* pNew, void* pBackupCode, BOOL bRestore)
 248 {
 249         BOOL bResult;
 250         DWORD Protect;
 251 #if defined(_X86_)
 252         BYTE JumpCode[HOOK_JUMP_CODE_LENGTH] = {0xe9, 0x00, 0x00, 0x00, 0x00};
 253         size_t Relative;
 254         Relative = (size_t)pNew - (size_t)pOriginal - HOOK_JUMP_CODE_LENGTH;
 255         memcpy(&JumpCode[1], &Relative, 4);
 256         bResult = FALSE;
 257         if(bRestore)
 258         {
 259                 if(VirtualProtect(pOriginal, HOOK_JUMP_CODE_LENGTH, PAGE_EXECUTE_READWRITE, &Protect))
 260                 {
 261                         memcpy(pOriginal, pBackupCode, HOOK_JUMP_CODE_LENGTH);
 262                         VirtualProtect(pOriginal, HOOK_JUMP_CODE_LENGTH, Protect, &Protect);
 263                         bResult = TRUE;
 264                 }
 265         }
 266         else
 267         {
 268                 if(pBackupCode)
 269                         memcpy(pBackupCode, pOriginal, HOOK_JUMP_CODE_LENGTH);
 270                 if(VirtualProtect(pOriginal, HOOK_JUMP_CODE_LENGTH, PAGE_EXECUTE_READWRITE, &Protect))
 271                 {
 272                         memcpy(pOriginal, &JumpCode, HOOK_JUMP_CODE_LENGTH);
 273                         VirtualProtect(pOriginal, HOOK_JUMP_CODE_LENGTH, Protect, &Protect);
 274                         bResult = TRUE;
 275                 }
 276         }
 277 #elif defined(_AMD64_)
 278         BYTE JumpCode[HOOK_JUMP_CODE_LENGTH] = {0xff, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 279         size_t Absolute;
 280         Absolute = (size_t)pOriginal;
 281         memcpy(&JumpCode[6], &Absolute, 8);
 282         bResult = FALSE;
 283         if(bRestore)
 284         {
 285                 if(VirtualProtect(pOriginal, HOOK_JUMP_CODE_LENGTH, PAGE_EXECUTE_READWRITE, &Protect))
 286                 {
 287                         memcpy(pOriginal, pBackupCode, HOOK_JUMP_CODE_LENGTH);
 288                         VirtualProtect(pOriginal, HOOK_JUMP_CODE_LENGTH, Protect, &Protect);
 289                         bResult = TRUE;
 290                 }
 291         }
 292         else
 293         {
 294                 if(pBackupCode)
 295                         memcpy(pBackupCode, pOriginal, HOOK_JUMP_CODE_LENGTH);
 296                 if(VirtualProtect(pOriginal, HOOK_JUMP_CODE_LENGTH, PAGE_EXECUTE_READWRITE, &Protect))
 297                 {
 298                         memcpy(pOriginal, &JumpCode, HOOK_JUMP_CODE_LENGTH);
 299                         VirtualProtect(pOriginal, HOOK_JUMP_CODE_LENGTH, Protect, &Protect);
 300                         bResult = TRUE;
 301                 }
 302         }
 303 #endif
 304         return bResult;
 305 }
 306 #endif
 307
 308 #ifdef USE_IAT_HOOK
 309 BOOL HookFunctionInIAT(void* pOriginal, void* pNew)
 310 {
 311         BOOL bResult;
 312         HANDLE hSnapshot;
 313         MODULEENTRY32 me;
 314         BOOL bFound;
 315         IMAGE_IMPORT_DESCRIPTOR* piid;
 316         ULONG Size;
 317         IMAGE_THUNK_DATA* pitd;
 318         DWORD Protect;
 319         bResult = FALSE;
 320         if((hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId())) != INVALID_HANDLE_VALUE)
 321         {
 322                 me.dwSize = sizeof(MODULEENTRY32);
 323                 if(Module32First(hSnapshot, &me))
 324                 {
 325                         bFound = FALSE;
 326                         do
 327                         {
 328                                 if(piid = (IMAGE_IMPORT_DESCRIPTOR*)ImageDirectoryEntryToData(me.hModule, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &Size))
 329                                 {
 330                                         while(!bFound && piid->Name != 0)
 331                                         {
 332                                                 pitd = (IMAGE_THUNK_DATA*)((BYTE*)me.hModule + piid->FirstThunk);
 333                                                 while(!bFound && pitd->u1.Function != 0)
 334                                                 {
 335                                                         if((void*)pitd->u1.Function == pOriginal)
 336                                                         {
 337                                                                 bFound = TRUE;
 338                                                                 if(VirtualProtect(&pitd->u1.Function, sizeof(void*), PAGE_EXECUTE_READWRITE, &Protect))
 339                                                                 {
 340                                                                         memcpy(&pitd->u1.Function, &pNew, sizeof(void*));
 341                                                                         VirtualProtect(&pitd->u1.Function, sizeof(void*), Protect, &Protect);
 342                                                                         bResult = TRUE;
 343                                                                 }
 344                                                         }
 345                                                         pitd++;
 346                                                 }
 347                                                 piid++;
 348                                         }
 349                                 }
 350                         }
 351                         while(!bFound && Module32Next(hSnapshot, &me));
 352                 }
 353                 CloseHandle(hSnapshot);
 354         }
 355         return bResult;
 356 }
 357 #endif
 358
 359 // \83t\83@\83C\83\8b\82ð\95Ï\8dX\95s\94\\82É\90Ý\92è
 360 HANDLE LockExistingFile(LPCWSTR Filename)
 361 {
 362         HANDLE hResult;
 363         hResult = NULL;
 364         if((hResult = CreateFileW(Filename, 0, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL)) == INVALID_HANDLE_VALUE)
 365                 hResult = NULL;
 366         return hResult;
 367 }
 368
 369 // DLL\82Ì\83n\83b\83V\83\85\82ð\8c\9f\8dõ
 370 BOOL FindTrustedModuleSHA1Hash(void* pHash)
 371 {
 372         BOOL bResult;
 373         int i;
 374         bResult = FALSE;
 375         i = 0;
 376         while(i < MAX_TRUSTED_MD5_HASH_TABLE)
 377         {
 378                 if(memcmp(&g_TrustedMD5HashTable[i], pHash, 20) == 0)
 379                 {
 380                         bResult = TRUE;
 381                         break;
 382                 }
 383                 i++;
 384         }
 385         return bResult;
 386 }
 387
 388 // \83t\83@\83C\83\8b\82Ì\8f\90\96¼\82ð\8am\94F
 389 BOOL VerifyFileSignature(LPCWSTR Filename)
 390 {
 391         BOOL bResult;
 392         GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
 393         WINTRUST_FILE_INFO wfi;
 394         WINTRUST_DATA wd;
 395         LONG Error;
 396         bResult = FALSE;
 397         ZeroMemory(&wfi, sizeof(WINTRUST_FILE_INFO));
 398         wfi.cbStruct = sizeof(WINTRUST_FILE_INFO);
 399         wfi.pcwszFilePath = Filename;
 400         ZeroMemory(&wd, sizeof(WINTRUST_DATA));
 401         wd.cbStruct = sizeof(WINTRUST_DATA);
 402         wd.dwUIChoice = WTD_UI_NONE;
 403         wd.dwUnionChoice = WTD_CHOICE_FILE;
 404         wd.pFile = &wfi;
 405         Error = WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd);
 406         if(Error == ERROR_SUCCESS)
 407                 bResult = TRUE;
 408         else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_EXPIRED) && Error == CERT_E_EXPIRED)
 409                 bResult = TRUE;
 410         else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_UNAUTHORIZED) && (Error == CERT_E_UNTRUSTEDROOT || Error == CERT_E_UNTRUSTEDCA))
 411                 bResult = TRUE;
 412         return bResult;
 413 }
 414
 415 // \83t\83@\83C\83\8b\82Ì\8f\90\96¼\82ð\83J\83^\83\8d\83O\83t\83@\83C\83\8b\82Å\8am\94F
 416 BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename)
 417 {
 418         BOOL bResult;
 419         GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
 420         WINTRUST_CATALOG_INFO wci;
 421         WINTRUST_DATA wd;
 422         LONG Error;
 423         bResult = FALSE;
 424         if(VerifyFileSignature(Catalog))
 425         {
 426                 ZeroMemory(&wci, sizeof(WINTRUST_CATALOG_INFO));
 427                 wci.cbStruct = sizeof(WINTRUST_CATALOG_INFO);
 428                 wci.pcwszCatalogFilePath = Catalog;
 429                 wci.pcwszMemberFilePath = Filename;
 430                 if((wci.hMemberFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL)) != INVALID_HANDLE_VALUE)
 431                 {
 432                         p_CryptCATAdminCalcHashFromFileHandle(wci.hMemberFile, &wci.cbCalculatedFileHash, NULL, 0);
 433                         if(wci.pbCalculatedFileHash = (BYTE*)malloc(wci.cbCalculatedFileHash))
 434                         {
 435                                 if(p_CryptCATAdminCalcHashFromFileHandle(wci.hMemberFile, &wci.cbCalculatedFileHash, wci.pbCalculatedFileHash, 0))
 436                                 {
 437                                         ZeroMemory(&wd, sizeof(WINTRUST_DATA));
 438                                         wd.cbStruct = sizeof(WINTRUST_DATA);
 439                                         wd.dwUIChoice = WTD_UI_NONE;
 440                                         wd.dwUnionChoice = WTD_CHOICE_CATALOG;
 441                                         wd.pCatalog = &wci;
 442                                         Error = WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd);
 443                                         if(Error == ERROR_SUCCESS)
 444                                                 bResult = TRUE;
 445                                         else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_EXPIRED) && Error == CERT_E_EXPIRED)
 446                                                 bResult = TRUE;
 447                                         else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_UNAUTHORIZED) && (Error == CERT_E_UNTRUSTEDROOT || Error == CERT_E_UNTRUSTEDCA))
 448                                                 bResult = TRUE;
 449                                 }
 450                                 free(wci.pbCalculatedFileHash);
 451                         }
 452                         CloseHandle(wci.hMemberFile);
 453                 }
 454         }
 455         return bResult;
 456 }
 457
 458 BOOL WINAPI GetSHA1HashOfModule_Function(DIGEST_HANDLE refdata, PBYTE pData, DWORD dwLength)
 459 {
 460         return CryptHashData(*(HCRYPTHASH*)refdata, pData, dwLength, 0);
 461 }
 462
 463 // \83\82\83W\83\85\81[\83\8b\82ÌSHA1\83n\83b\83V\83\85\82ð\8eæ\93¾
 464 // \83}\83j\83t\83F\83X\83g\83t\83@\83C\83\8b\82Ìfile\97v\91f\82Ìhash\91®\90«\82Í\8eÀ\8ds\89Â\94\\83t\83@\83C\83\8b\82Ì\8fê\8d\87\82ÉImageGetDigestStream\82Å\8eZ\8fo\82³\82ê\82é
 465 BOOL GetSHA1HashOfModule(LPCWSTR Filename, void* pHash)
 466 {
 467         BOOL bResult;
 468         HCRYPTPROV hProv;
 469         HCRYPTHASH hHash;
 470         HANDLE hFile;
 471         DWORD dw;
 472         bResult = FALSE;
 473         if(CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, 0) || CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET))
 474         {
 475                 if(CryptCreateHash(hProv, CALG_SHA1, 0, 0, &hHash))
 476                 {
 477                         if((hFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
 478                         {
 479                                 if(ImageGetDigestStream(hFile, CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO, GetSHA1HashOfModule_Function, (DIGEST_HANDLE)&hHash))
 480                                 {
 481                                         dw = 20;
 482                                         if(CryptGetHashParam(hHash, HP_HASHVAL, (BYTE*)pHash, &dw, 0))
 483                                                 bResult = TRUE;
 484                                 }
 485                                 CloseHandle(hFile);
 486                         }
 487                         CryptDestroyHash(hHash);
 488                 }
 489                 CryptReleaseContext(hProv, 0);
 490         }
 491         return bResult;
 492 }
 493
 494 BOOL IsSxsModuleTrusted_Function(LPCWSTR Catalog, LPCWSTR Manifest, LPCWSTR Module)
 495 {
 496         BOOL bResult;
 497         HANDLE hLock0;
 498         HANDLE hLock1;
 499         BYTE Hash[20];
 500         int i;
 501         static char HexTable[16] = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
 502         char HashHex[41];
 503         HANDLE hFile;
 504         DWORD Size;
 505         char* pData;
 506         DWORD dw;
 507         bResult = FALSE;
 508         if(hLock0 = LockExistingFile(Catalog))
 509         {
 510                 if(hLock1 = LockExistingFile(Manifest))
 511                 {
 512                         if(VerifyFileSignatureInCatalog(Catalog, Manifest))
 513                         {
 514                                 if(GetSHA1HashOfModule(Module, &Hash))
 515                                 {
 516                                         for(i = 0; i < 20; i++)
 517                                         {
 518                                                 HashHex[i * 2] = HexTable[(Hash[i] >> 4) & 0x0f];
 519                                                 HashHex[i * 2 + 1] = HexTable[Hash[i] & 0x0f];
 520                                         }
 521                                         HashHex[i * 2] = '\0';
 522                                         if((hFile = CreateFileW(Manifest, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL)) != INVALID_HANDLE_VALUE)
 523                                         {
 524                                                 Size = GetFileSize(hFile, NULL);
 525                                                 if(pData = (char*)VirtualAlloc(NULL, Size + 1, MEM_COMMIT, PAGE_READWRITE))
 526                                                 {
 527                                                         VirtualLock(pData, Size + 1);
 528                                                         if(ReadFile(hFile, pData, Size, &dw, NULL))
 529                                                         {
 530                                                                 pData[dw] = '\0';
 531                                                                 if(strstr(pData, HashHex))
 532                                                                         bResult = TRUE;
 533                                                         }
 534                                                         VirtualUnlock(pData, Size + 1);
 535                                                         VirtualFree(pData, Size + 1, MEM_DECOMMIT);
 536                                                 }
 537                                                 CloseHandle(hFile);
 538                                         }
 539                                 }
 540                         }
 541                         CloseHandle(hLock1);
 542                 }
 543                 CloseHandle(hLock0);
 544         }
 545         return bResult;
 546 }
 547
 548 // \83T\83C\83h\83o\83C\83T\83C\83hDLL\82ð\8am\94F
 549 // \83p\83X\82Í"%SystemRoot%\WinSxS"\88È\89º\82ð\91z\92è
 550 // \88È\89º\82Ì\83t\83@\83C\83\8b\82ª\91¶\8dÝ\82·\82é\82à\82Ì\82Æ\82·\82é
 551 // "\xxx\yyy.dll"\81A"\manifests\xxx.cat"\81A"\manifests\xxx.manifest"\82Ì\83Z\83b\83g\81iXP\82Ì\91S\82Ä\82ÌDLL\81AVista\88È\8d~\82Ì\88ê\95\94\82ÌDLL\81j
 552 // "\xxx\yyy.dll"\81A"\catalogs\zzz.cat"\81A"\manifests\xxx.manifest"\82Ì\83Z\83b\83g\81iVista\88È\8d~\82Ì\82Ù\82Æ\82ñ\82Ç\82ÌDLL\81j
 553 // \8f\90\96¼\82³\82ê\82½\83J\83^\83\8d\83O\83t\83@\83C\83\8b\82ð\97p\82¢\82Ä\83}\83j\83t\83F\83X\83g\83t\83@\83C\83\8b\82ª\89üâ\82\82³\82ê\82Ä\82¢\82È\82¢\82±\82Æ\82ð\8am\94F
 554 // \83n\83b\83V\83\85\92l\82Í \83}\83j\83t\83F\83X\83g\83t\83@\83C\83\8b\82Ìfile\97v\91f\82Ìhash\91®\90«\82É\8bL\8fq\82³\82ê\82Ä\82¢\82é\82à\82Ì\82ð\97p\82¢\82é
 555 // \83}\83j\83t\83F\83X\83g\83t\83@\83C\83\8b\93à\82ÉSHA1\83n\83b\83V\83\85\92l\82Ì16\90i\90\94\95\\8bL\82ð\92¼\90Ú\8c\9f\8dõ\82µ\82Ä\82¢\82é\82ª\8am\97¦\93I\82É\96â\91è\82È\82µ
 556 BOOL IsSxsModuleTrusted(LPCWSTR Filename)
 557 {
 558         BOOL bResult;
 559         wchar_t* pw0;
 560         wchar_t* pw1;
 561         wchar_t* pw2;
 562         wchar_t* pw3;
 563         wchar_t* pw4;
 564         wchar_t* pw5;
 565         wchar_t* p;
 566         HANDLE hFind;
 567         WIN32_FIND_DATAW wfd;
 568         bResult = FALSE;
 569         if(pw0 = AllocateStringW(wcslen(Filename) + 1))
 570         {
 571                 wcscpy(pw0, Filename);
 572                 if(p = wcsrchr(pw0, L'\\'))
 573                 {
 574                         wcscpy(p, L"");
 575                         if(p = wcsrchr(pw0, L'\\'))
 576                         {
 577                                 p++;
 578                                 if(pw1 = AllocateStringW(wcslen(p) + 1))
 579                                 {
 580                                         wcscpy(pw1, p);
 581                                         wcscpy(p, L"");
 582                                         if(pw2 = AllocateStringW(wcslen(pw0) + wcslen(L"manifests\\") + wcslen(pw1) + wcslen(L".cat") + 1))
 583                                         {
 584                                                 wcscpy(pw2, pw0);
 585                                                 wcscat(pw2, L"manifests\\");
 586                                                 wcscat(pw2, pw1);
 587                                                 if(pw3 = AllocateStringW(wcslen(pw2) + wcslen(L".manifest") + 1))
 588                                                 {
 589                                                         wcscpy(pw3, pw2);
 590                                                         wcscat(pw3, L".manifest");
 591                                                         wcscat(pw2, L".cat");
 592                                                         if(IsSxsModuleTrusted_Function(pw2, pw3, Filename))
 593                                                                 bResult = TRUE;
 594                                                         FreeDuplicatedString(pw3);
 595                                                 }
 596                                                 FreeDuplicatedString(pw2);
 597                                         }
 598                                         if(!bResult)
 599                                         {
 600                                                 if(pw2 = AllocateStringW(wcslen(pw0) + wcslen(L"catalogs\\") + 1))
 601                                                 {
 602                                                         if(pw3 = AllocateStringW(wcslen(pw0) + wcslen(L"manifests\\") + wcslen(pw1) + wcslen(L".manifest") + 1))
 603                                                         {
 604                                                                 wcscpy(pw2, pw0);
 605                                                                 wcscat(pw2, L"catalogs\\");
 606                                                                 wcscpy(pw3, pw0);
 607                                                                 wcscat(pw3, L"manifests\\");
 608                                                                 wcscat(pw3, pw1);
 609                                                                 wcscat(pw3, L".manifest");
 610                                                                 if(pw4 = AllocateStringW(wcslen(pw2) + wcslen(L"*.cat") + 1))
 611                                                                 {
 612                                                                         wcscpy(pw4, pw2);
 613                                                                         wcscat(pw4, L"*.cat");
 614                                                                         if((hFind = FindFirstFileW(pw4, &wfd)) != INVALID_HANDLE_VALUE)
 615                                                                         {
 616                                                                                 do
 617                                                                                 {
 618                                                                                         if(pw5 = AllocateStringW(wcslen(pw2) + wcslen(wfd.cFileName) + 1))
 619                                                                                         {
 620                                                                                                 wcscpy(pw5, pw2);
 621                                                                                                 wcscat(pw5, wfd.cFileName);
 622                                                                                                 if(IsSxsModuleTrusted_Function(pw5, pw3, Filename))
 623                                                                                                         bResult = TRUE;
 624                                                                                                 FreeDuplicatedString(pw5);
 625                                                                                         }
 626                                                                                 }
 627                                                                                 while(!bResult && FindNextFileW(hFind, &wfd));
 628                                                                                 FindClose(hFind);
 629                                                                         }
 630                                                                         FreeDuplicatedString(pw4);
 631                                                                 }
 632                                                                 FreeDuplicatedString(pw3);
 633                                                         }
 634                                                         FreeDuplicatedString(pw2);
 635                                                 }
 636                                         }
 637                                         FreeDuplicatedString(pw1);
 638                                 }
 639                         }
 640                 }
 641                 FreeDuplicatedString(pw0);
 642         }
 643         return bResult;
 644 }
 645
 646 // DLL\82ð\8am\94F
 647 BOOL IsModuleTrusted(LPCWSTR Filename)
 648 {
 649         BOOL bResult;
 650         BYTE Hash[20];
 651         bResult = FALSE;
 652         if(LockThreadLock())
 653         {
 654                 if(GetSHA1HashOfFile(Filename, &Hash))
 655                 {
 656                         if(FindTrustedModuleSHA1Hash(&Hash))
 657                                 bResult = TRUE;
 658                 }
 659                 if(!bResult)
 660                 {
 661                         if((g_ProcessProtectionLevel & PROCESS_PROTECTION_BUILTIN) && VerifyFileSignature(Filename))
 662                                 bResult = TRUE;
 663                 }
 664                 if(!bResult)
 665                 {
 666                         if((g_ProcessProtectionLevel & PROCESS_PROTECTION_SIDE_BY_SIDE) && IsSxsModuleTrusted(Filename))
 667                                 bResult = TRUE;
 668                 }
 669                 if(!bResult)
 670                 {
 671                         if((g_ProcessProtectionLevel & PROCESS_PROTECTION_SYSTEM_FILE) && SfcIsFileProtected(NULL, Filename))
 672                                 bResult = TRUE;
 673                 }
 674                 UnlockThreadLock();
 675         }
 676         return bResult;
 677 }
 678
 679 // kernel32.dll\82ÌLoadLibraryExW\91\8a\93\96\82Ì\8aÖ\90\94
 680 // \83h\83L\83\85\83\81\83\93\83g\82ª\96³\82¢\82½\82ß\8fÚ\8d×\82Í\95s\96¾
 681 // \88ê\95\94\82Ì\83E\83B\83\8b\83X\91Î\8dô\83\\83t\83g\81iAvast!\93\99\81j\82ªLdrLoadDll\82ð\83t\83b\83N\82µ\82Ä\82¢\82é\82½\82ßLdrLoadDll\82ð\8f\91\82«\8a·\82¦\82é\82×\82«\82Å\82Í\82È\82¢
 682 // \83J\81[\83l\83\8b\83\82\81[\83h\82Ì\83R\81[\83h\82É\91Î\82µ\82Ä\82Í\8cø\89Ê\82È\82µ
 683 // SeDebugPrivilege\82ª\8eg\97p\89Â\94\\82È\83\86\81[\83U\81[\82É\91Î\82µ\82Ä\82Í\8cø\89Ê\82È\82µ
 684 HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
 685 {
 686         HMODULE r = NULL;
 687         UNICODE_STRING us;
 688         HANDLE hDataFile;
 689         HANDLE hMapping;
 690         DWORD DllFlags;
 691         us.Length = sizeof(wchar_t) * wcslen(lpLibFileName);
 692         us.MaximumLength = sizeof(wchar_t) * (wcslen(lpLibFileName) + 1);
 693         us.Buffer = (PWSTR)lpLibFileName;
 694 //      if(dwFlags & (LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE))
 695         if(dwFlags & (LOAD_LIBRARY_AS_DATAFILE | 0x00000040))
 696         {
 697 //              if(p_LdrGetDllHandle(NULL, NULL, &us, &r) == STATUS_SUCCESS)
 698                 if(p_LdrGetDllHandle(NULL, NULL, &us, &r) == 0)
 699                 {
 700 //                      dwFlags &= ~(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE);
 701                         dwFlags &= ~(LOAD_LIBRARY_AS_DATAFILE | 0x00000040);
 702                         dwFlags |= DONT_RESOLVE_DLL_REFERENCES;
 703                 }
 704                 else
 705                 {
 706 //                      if(dwFlags & LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE)
 707                         if(dwFlags & 0x00000040)
 708                                 hDataFile = CreateFileW(lpLibFileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
 709                         else
 710                                 hDataFile = CreateFileW(lpLibFileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
 711                         if(hDataFile != INVALID_HANDLE_VALUE)
 712                         {
 713                                 if(hMapping = CreateFileMappingW(hDataFile, NULL, PAGE_READONLY, 0, 0, NULL))
 714                                 {
 715                                         if(r = (HMODULE)MapViewOfFileEx(hMapping, FILE_MAP_READ, 0, 0, 0, NULL))
 716                                         {
 717                                                 if(p_RtlImageNtHeader(r))
 718                                                         r = (HMODULE)((size_t)r | 1);
 719                                                 else
 720                                                 {
 721                                                         UnmapViewOfFile(r);
 722                                                         r = NULL;
 723                                                 }
 724                                         }
 725                                         CloseHandle(hMapping);
 726                                 }
 727                                 CloseHandle(hDataFile);
 728                         }
 729                         else
 730                         {
 731 //                              dwFlags &= ~(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE);
 732                                 dwFlags &= ~(LOAD_LIBRARY_AS_DATAFILE | 0x00000040);
 733                                 dwFlags |= DONT_RESOLVE_DLL_REFERENCES;
 734                         }
 735                 }
 736         }
 737 //      if(!(dwFlags & (LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE)))
 738         if(!(dwFlags & (LOAD_LIBRARY_AS_DATAFILE | 0x00000040)))
 739         {
 740                 DllFlags = 0;
 741 //              if(dwFlags & (DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_IMAGE_RESOURCE))
 742                 if(dwFlags & (DONT_RESOLVE_DLL_REFERENCES | 0x00000020))
 743                         DllFlags |= 0x00000002;
 744 //              if(p_LdrLoadDll(NULL, &DllFlags, &us, &r) == STATUS_SUCCESS)
 745                 if(p_LdrLoadDll(NULL, &DllFlags, &us, &r) == 0)
 746                 {
 747                 }
 748                 else
 749                         r = NULL;
 750         }
 751         return r;
 752 }
 753
 754 void SetProcessProtectionLevel(DWORD Level)
 755 {
 756         g_ProcessProtectionLevel = Level;
 757 }
 758
 759 // \83t\83@\83C\83\8b\82ÌSHA1\83n\83b\83V\83\85\82ð\8eæ\93¾
 760 BOOL GetSHA1HashOfFile(LPCWSTR Filename, void* pHash)
 761 {
 762         BOOL bResult;
 763         HCRYPTPROV hProv;
 764         HCRYPTHASH hHash;
 765         HANDLE hFile;
 766         DWORD Size;
 767         void* pData;
 768         DWORD dw;
 769         bResult = FALSE;
 770         if(CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, 0) || CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET))
 771         {
 772                 if(CryptCreateHash(hProv, CALG_SHA1, 0, 0, &hHash))
 773                 {
 774                         if((hFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
 775                         {
 776                                 Size = GetFileSize(hFile, NULL);
 777                                 if(pData = VirtualAlloc(NULL, Size, MEM_COMMIT, PAGE_READWRITE))
 778                                 {
 779                                         VirtualLock(pData, Size);
 780                                         if(ReadFile(hFile, pData, Size, &dw, NULL))
 781                                         {
 782                                                 if(CryptHashData(hHash, (BYTE*)pData, Size, 0))
 783                                                 {
 784                                                         dw = 20;
 785                                                         if(CryptGetHashParam(hHash, HP_HASHVAL, (BYTE*)pHash, &dw, 0))
 786                                                                 bResult = TRUE;
 787                                                 }
 788                                         }
 789                                         VirtualUnlock(pData, Size);
 790                                         VirtualFree(pData, Size, MEM_DECOMMIT);
 791                                 }
 792                                 CloseHandle(hFile);
 793                         }
 794                         CryptDestroyHash(hHash);
 795                 }
 796                 CryptReleaseContext(hProv, 0);
 797         }
 798         return bResult;
 799 }
 800
 801 // DLL\82Ì\83n\83b\83V\83\85\82ð\93o\98^
 802 BOOL RegisterTrustedModuleSHA1Hash(void* pHash)
 803 {
 804         BOOL bResult;
 805         BYTE NullHash[20] = {0};
 806         int i;
 807         bResult = FALSE;
 808         if(FindTrustedModuleSHA1Hash(pHash))
 809                 bResult = TRUE;
 810         else
 811         {
 812                 i = 0;
 813                 while(i < MAX_TRUSTED_MD5_HASH_TABLE)
 814                 {
 815                         if(memcmp(&g_TrustedMD5HashTable[i], &NullHash, 20) == 0)
 816                         {
 817                                 memcpy(&g_TrustedMD5HashTable[i], pHash, 20);
 818                                 bResult = TRUE;
 819                                 break;
 820                         }
 821                         i++;
 822                 }
 823         }
 824         return bResult;
 825 }
 826
 827 // DLL\82Ì\83n\83b\83V\83\85\82Ì\93o\98^\82ð\89ð\8f\9c
 828 BOOL UnregisterTrustedModuleSHA1Hash(void* pHash)
 829 {
 830         BOOL bResult;
 831         BYTE NullHash[20] = {0};
 832         int i;
 833         bResult = FALSE;
 834         i = 0;
 835         while(i < MAX_TRUSTED_MD5_HASH_TABLE)
 836         {
 837                 if(memcmp(&g_TrustedMD5HashTable[i], pHash, 20) == 0)
 838                 {
 839                         memcpy(&g_TrustedMD5HashTable[i], &NullHash, 20);
 840                         bResult = TRUE;
 841                         break;
 842                 }
 843                 i++;
 844         }
 845         return bResult;
 846 }
 847
 848 // \90M\97\8a\82Å\82«\82È\82¢DLL\82ð\83A\83\93\83\8d\81[\83h
 849 BOOL UnloadUntrustedModule()
 850 {
 851         BOOL bResult;
 852         wchar_t* pw0;
 853         HANDLE hSnapshot;
 854         MODULEENTRY32 me;
 855         DWORD Length;
 856         bResult = FALSE;
 857         pw0 = NULL;
 858         if((hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId())) != INVALID_HANDLE_VALUE)
 859         {
 860                 bResult = TRUE;
 861                 me.dwSize = sizeof(MODULEENTRY32);
 862                 if(Module32First(hSnapshot, &me))
 863                 {
 864                         do
 865                         {
 866                                 Length = MAX_PATH;
 867                                 FreeDuplicatedString(pw0);
 868                                 if(pw0 = AllocateStringW(Length))
 869                                 {
 870                                         if(GetModuleFileNameW(me.hModule, pw0, Length) > 0)
 871                                         {
 872                                                 while(pw0)
 873                                                 {
 874                                                         if(GetModuleFileNameW(me.hModule, pw0, Length) + 1 <= Length)
 875                                                                 break;
 876                                                         Length = Length * 2;
 877                                                         FreeDuplicatedString(pw0);
 878                                                         pw0 = AllocateStringW(Length);
 879                                                 }
 880                                         }
 881                                 }
 882                                 if(pw0)
 883                                 {
 884                                         if(!IsModuleTrusted(pw0))
 885                                         {
 886                                                 if(me.hModule != GetModuleHandleW(NULL))
 887                                                 {
 888                                                         while(FreeLibrary(me.hModule))
 889                                                         {
 890                                                         }
 891                                                         if(GetModuleFileNameW(me.hModule, pw0, Length) > 0)
 892                                                         {
 893                                                                 bResult = FALSE;
 894                                                                 break;
 895                                                         }
 896                                                 }
 897                                         }
 898                                 }
 899                                 else
 900                                 {
 901                                         bResult = FALSE;
 902                                         break;
 903                                 }
 904                         }
 905                         while(Module32Next(hSnapshot, &me));
 906                 }
 907                 CloseHandle(hSnapshot);
 908         }
 909         FreeDuplicatedString(pw0);
 910         return bResult;
 911 }
 912
 913 // \8aÖ\90\94\83|\83C\83\93\83^\82ð\8eg\97p\89Â\94\\82È\8fó\91Ô\82É\8f\89\8aú\89»
 914 BOOL InitializeLoadLibraryHook()
 915 {
 916         BOOL bResult;
 917         HMODULE hModule;
 918         bResult = TRUE;
 919         if(!(hModule = GetModuleHandleW(L"kernel32.dll")))
 920                 bResult = FALSE;
 921         if(!(GET_FUNCTION(hModule, LoadLibraryA)))
 922                 bResult = FALSE;
 923         if(!(GET_FUNCTION(hModule, LoadLibraryW)))
 924                 bResult = FALSE;
 925         if(!(GET_FUNCTION(hModule, LoadLibraryExA)))
 926                 bResult = FALSE;
 927         if(!(GET_FUNCTION(hModule, LoadLibraryExW)))
 928                 bResult = FALSE;
 929         if(!(hModule = GetModuleHandleW(L"ntdll.dll")))
 930                 bResult = FALSE;
 931         if(!(GET_FUNCTION(hModule, LdrLoadDll)))
 932                 bResult = FALSE;
 933         if(!(GET_FUNCTION(hModule, LdrGetDllHandle)))
 934                 bResult = FALSE;
 935         if(!(GET_FUNCTION(hModule, RtlImageNtHeader)))
 936                 bResult = FALSE;
 937         if(!(hModule = LoadLibraryW(L"wintrust.dll")))
 938                 bResult = FALSE;
 939         if(!(GET_FUNCTION(hModule, CryptCATAdminCalcHashFromFileHandle)))
 940                 bResult = FALSE;
 941         return bResult;
 942 }
 943
 944 // SetWindowsHookEx\91Î\8dô
 945 // DLL Injection\82³\82ê\82½\8fê\8d\87\82Í\8fã\82Ìh_LoadLibrary\8cn\8aÖ\90\94\82Å\83g\83\89\83b\83v\89Â\94\
 946 BOOL EnableLoadLibraryHook(BOOL bEnable)
 947 {
 948         BOOL bResult;
 949         bResult = FALSE;
 950         if(bEnable)
 951         {
 952                 bResult = TRUE;
 953 #ifdef USE_CODE_HOOK
 954                 if(!SET_HOOK_FUNCTION(LoadLibraryA))
 955                         bResult = FALSE;
 956                 if(!SET_HOOK_FUNCTION(LoadLibraryW))
 957                         bResult = FALSE;
 958                 if(!SET_HOOK_FUNCTION(LoadLibraryExA))
 959                         bResult = FALSE;
 960                 if(!SET_HOOK_FUNCTION(LoadLibraryExW))
 961                         bResult = FALSE;
 962 #endif
 963 #ifdef USE_IAT_HOOK
 964                 if(!HookFunctionInIAT(p_LoadLibraryA, h_LoadLibraryA))
 965                         bResult = FALSE;
 966                 if(!HookFunctionInIAT(p_LoadLibraryW, h_LoadLibraryW))
 967                         bResult = FALSE;
 968                 if(!HookFunctionInIAT(p_LoadLibraryExA, h_LoadLibraryExA))
 969                         bResult = FALSE;
 970                 if(!HookFunctionInIAT(p_LoadLibraryExW, h_LoadLibraryExW))
 971                         bResult = FALSE;
 972 #endif
 973         }
 974         else
 975         {
 976                 bResult = TRUE;
 977 #ifdef USE_CODE_HOOK
 978                 if(!END_HOOK_FUNCTION(LoadLibraryA))
 979                         bResult = FALSE;
 980                 if(!END_HOOK_FUNCTION(LoadLibraryW))
 981                         bResult = FALSE;
 982                 if(!END_HOOK_FUNCTION(LoadLibraryExA))
 983                         bResult = FALSE;
 984                 if(!END_HOOK_FUNCTION(LoadLibraryExW))
 985                         bResult = FALSE;
 986 #endif
 987 #ifdef USE_IAT_HOOK
 988                 if(!HookFunctionInIAT(h_LoadLibraryA, p_LoadLibraryA))
 989                         bResult = FALSE;
 990                 if(!HookFunctionInIAT(h_LoadLibraryW, p_LoadLibraryW))
 991                         bResult = FALSE;
 992                 if(!HookFunctionInIAT(h_LoadLibraryExA, p_LoadLibraryExA))
 993                         bResult = FALSE;
 994                 if(!HookFunctionInIAT(h_LoadLibraryExW, p_LoadLibraryExW))
 995                         bResult = FALSE;
 996 #endif
 997         }
 998         return bResult;
 999 }
1000
1001 // ReadProcessMemory\81AWriteProcessMemory\81ACreateRemoteThread\91Î\8dô
1002 // TerminateProcess\82Ì\82Ý\8b\96\89Â
1003 BOOL RestartProtectedProcess(LPCTSTR Keyword)
1004 {
1005         BOOL bResult;
1006         ACL* pACL;
1007         SID_IDENTIFIER_AUTHORITY sia = SECURITY_WORLD_SID_AUTHORITY;
1008         PSID pSID;
1009         SECURITY_DESCRIPTOR sd;
1010         TCHAR* CommandLine;
1011         SECURITY_ATTRIBUTES sa;
1012         STARTUPINFO si;
1013         PROCESS_INFORMATION pi;
1014         bResult = FALSE;
1015         if(_tcslen(GetCommandLine()) >= _tcslen(Keyword) && _tcscmp(GetCommandLine() + _tcslen(GetCommandLine()) - _tcslen(Keyword), Keyword) == 0)
1016                 return FALSE;
1017         if(pACL = (ACL*)malloc(sizeof(ACL) + 1024))
1018         {
1019                 if(InitializeAcl(pACL, sizeof(ACL) + 1024, ACL_REVISION))
1020                 {
1021                         if(AllocateAndInitializeSid(&sia, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &pSID))
1022                         {
1023                                 if(AddAccessAllowedAce(pACL, ACL_REVISION, PROCESS_TERMINATE, pSID))
1024                                 {
1025                                         if(InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION))
1026                                         {
1027                                                 if(SetSecurityDescriptorDacl(&sd, TRUE, pACL, FALSE))
1028                                                 {
1029                                                         if(CommandLine = (TCHAR*)malloc(sizeof(TCHAR) * (_tcslen(GetCommandLine()) + _tcslen(Keyword) + 1)))
1030                                                         {
1031                                                                 _tcscpy(CommandLine, GetCommandLine());
1032                                                                 _tcscat(CommandLine, Keyword);
1033                                                                 sa.nLength = sizeof(SECURITY_ATTRIBUTES);
1034                                                                 sa.lpSecurityDescriptor = &sd;
1035                                                                 sa.bInheritHandle = FALSE;
1036                                                                 GetStartupInfo(&si);
1037                                                                 if(CreateProcess(NULL, CommandLine, &sa, NULL, FALSE, 0, NULL, NULL, &si, &pi))
1038                                                                 {
1039                                                                         CloseHandle(pi.hThread);
1040                                                                         CloseHandle(pi.hProcess);
1041                                                                         bResult = TRUE;
1042                                                                 }
1043                                                                 free(CommandLine);
1044                                                         }
1045                                                 }
1046                                         }
1047                                 }
1048                                 FreeSid(pSID);
1049                         }
1050                 }
1051                 free(pACL);
1052         }
1053         return bResult;
1054 }
1055