Windows Native Applications thiab Acronis Active Restore kev pabcuam
Niaj hnub no peb txuas ntxiv zaj dab neeg ntawm yuav ua li cas peb, nrog rau cov hais mav los ntawm Innopolis University, tab tom tsim Active Restore thev naus laus zis los tso cai rau cov neeg siv pib ua haujlwm ntawm lawv lub tshuab sai li sai tau tom qab ua tsis tiav. Peb yuav tham txog cov kev siv Windows ib txwm muaj, suav nrog cov yam ntxwv ntawm lawv cov kev tsim thiab tso tawm. Hauv qab ntawm qhov txiav yog me ntsis txog peb qhov project, nrog rau cov lus qhia ua haujlwm ntawm kev sau cov ntawv thov ib txwm muaj.
Hauv cov ntawv dhau los peb twb tau tham txog qhov nws yog dab tsi Active Restore, thiab cov tub ntxhais kawm los ntawm Innopolis txhim kho li cas kev pab cuam. Niaj hnub no kuv xav tsom mus rau cov ntawv thov ib txwm muaj, mus rau qib uas peb xav "faus" peb cov kev pabcuam rov ua haujlwm zoo. Yog tias txhua yam ua tiav, peb yuav tuaj yeem:
Tua tawm qhov kev pab cuam nws tus kheej ntau ua ntej
Hu rau huab qhov chaw thaub qab nyob ntau dua
Ntau dhau los kom nkag siab tias hom twg yog qhov system nyob rau hauv - khau raj ib txwm lossis rov qab
Ntau tsawg cov ntaub ntawv rov qab ua ntej
Tso cai rau tus neeg siv kom pib sai dua.
Yuav ua li cas yog ib haiv neeg app lawm?
Txhawm rau teb cov lus nug no, cia peb saib cov kab ke hu ua qhov system ua, piv txwv li, yog tias tus programmer hauv nws daim ntawv thov sim tsim cov ntaub ntawv.
Pavel Yosifovich - Windows Kernel Programming (2019)
Tus programmer siv lub luag haujlwm CreateFile, uas tau tshaj tawm hauv header file fileapi.h thiab siv hauv Kernel32.dll. Txawm li cas los xij, qhov haujlwm no nws tus kheej tsis tsim cov ntaub ntawv, nws tsuas yog kuaj xyuas cov lus sib cav thiab hu rau cov haujlwm NtCreateFile (cov lus ua ntej Nt tsuas yog qhia tias qhov ua haujlwm yog haiv neeg). Txoj haujlwm no tau tshaj tawm hauv cov ntaub ntawv winternl.h header thiab siv hauv ntdll.dll. Nws npaj dhia mus rau hauv qhov chaw nuclear, tom qab ntawd nws ua rau lub kaw lus hu los tsim cov ntaub ntawv. Hauv qhov no, nws hloov tawm tias Kernel32 tsuas yog qhwv rau Ntdll. Ib qho ntawm cov laj thawj vim li cas qhov no tau ua tiav yog tias Microsoft yog li muaj peev xwm hloov pauv cov haujlwm ntawm lub ntiaj teb ib txwm muaj, tab sis tsis kov cov qauv kev sib tshuam. Microsoft tsis pom zoo hu xov tooj rau cov haujlwm hauv zej zog ncaj qha thiab tsis sau lawv feem ntau. Los ntawm txoj kev, cov haujlwm tsis muaj ntaub ntawv tuaj yeem pom S, SΡS,.
Qhov txiaj ntsig tseem ceeb ntawm cov ntawv thov ib txwm yog tias ntdll tau thauj mus rau hauv lub kaw lus ua ntej ntau dua kernel32. Qhov no yog qhov laj thawj, vim kernel32 xav tau ntdll ua haujlwm. Yog li ntawd, cov ntawv thov uas siv cov haujlwm hauv ib txwm muaj tuaj yeem pib ua haujlwm ntau dhau los.
Yog li, Windows Native Applications yog cov kev pab cuam uas tuaj yeem pib ntxov hauv Windows boot. Lawv tsuas yog siv cov haujlwm los ntawm ntdll. Ib qho piv txwv ntawm xws li ib daim ntawv thov: autochk ua leej twg ua chkdisk siv txhawm rau txheeb xyuas qhov tsis raug ua ntej pib cov kev pabcuam tseem ceeb. Qhov no yog raws nraim theem peb xav kom peb Active Restore ua.
Peb xav tau dab tsi?
DDK (Driver Development Kit), tam sim no tseem hu ua WDK 7 (Windows Driver Kit).
Txhua yam peb xav tau yog siv NtReadFile ntawm lub cuab yeej qhib, thiab tos kom txog thaum cov keyboard rov qab los rau peb. Yog tias tus yuam sij ESC raug nias, peb yuav ua haujlwm ntxiv. Txhawm rau qhib lub cuab yeej, peb yuav tsum hu rau NtCreateFile muaj nuj nqi (peb yuav tsum qhib DeviceKeyboardClass0). Peb kuj yuav hu NtCreateEventlos pib qhov khoom tos. Peb yuav tshaj tawm cov qauv KEYBOARD_INPUT_DATA peb tus kheej, uas sawv cev rau cov ntaub ntawv keyboard. Qhov no yuav ua rau peb txoj haujlwm yooj yim dua.
Daim ntawv thov haiv neeg xaus nrog lub luag haujlwm hu NtTerminateProcessvim peb tsuas yog tua peb tus kheej xwb.
Tag nrho cov cai rau peb daim ntawv thov me me:
#include "ntifs.h" // WinDDK7600.16385.1incddk
#include "ntdef.h"
//------------------------------------
// Following function definitions can be found in native development kit
// but I am too lazy to include `em so I declare it here
//------------------------------------
NTSYSAPI
NTSTATUS
NTAPI
NtTerminateProcess(
IN HANDLE ProcessHandle OPTIONAL,
IN NTSTATUS ExitStatus
);
NTSYSAPI
NTSTATUS
NTAPI
NtDisplayString(
IN PUNICODE_STRING String
);
NTSTATUS
NtWaitForSingleObject(
IN HANDLE Handle,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Timeout
);
NTSYSAPI
NTSTATUS
NTAPI
NtCreateEvent(
OUT PHANDLE EventHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN EVENT_TYPE EventType,
IN BOOLEAN InitialState
);
// https://docs.microsoft.com/en-us/windows/win32/api/ntddkbd/ns-ntddkbd-keyboard_input_data
typedef struct _KEYBOARD_INPUT_DATA {
USHORT UnitId;
USHORT MakeCode;
USHORT Flags;
USHORT Reserved;
ULONG ExtraInformation;
} KEYBOARD_INPUT_DATA, *PKEYBOARD_INPUT_DATA;
//----------------------------------------------------------
// Our code goes here
//----------------------------------------------------------
// usage: WriteLn(L"Hello Native World!n");
void WriteLn(LPWSTR Message)
{
UNICODE_STRING string;
RtlInitUnicodeString(&string, Message);
NtDisplayString(&string);
}
void NtProcessStartup(void* StartupArgument)
{
// it is important to declare all variables at the beginning
HANDLE hKeyBoard, hEvent;
UNICODE_STRING skull, keyboard;
OBJECT_ATTRIBUTES ObjectAttributes;
IO_STATUS_BLOCK Iosb;
LARGE_INTEGER ByteOffset;
KEYBOARD_INPUT_DATA kbData;
PVOID memory = NULL;
PVOID buffer = NULL;
ULONG bufferSize = 42;
//use it if debugger connected to break
//DbgBreakPoint();
WriteLn(L"Hello Native World!n");
// inialize variables
RtlInitUnicodeString(&keyboard, L"DeviceKeyboardClass0");
InitializeObjectAttributes(&ObjectAttributes, &keyboard, OBJ_CASE_INSENSITIVE, NULL, NULL);
// open keyboard device
NtCreateFile(&hKeyBoard,
SYNCHRONIZE | GENERIC_READ | FILE_READ_ATTRIBUTES,
&ObjectAttributes,
&Iosb,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,FILE_DIRECTORY_FILE,
NULL, 0);
// create event to wait on
InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
NtCreateEvent(&hEvent, EVENT_ALL_ACCESS, &ObjectAttributes, 1, 0);
WriteLn(L"Keyboard readyn");
// create heap in order to allocate memory later
memory = RtlCreateHeap(
HEAP_GROWABLE,
NULL,
1000,
0, NULL, NULL
);
WriteLn(L"Heap readyn");
// allocate buffer of size bufferSize
buffer = RtlAllocateHeap(
memory,
HEAP_ZERO_MEMORY,
bufferSize
);
WriteLn(L"Buffer allocatedn");
// free buffer (actually not needed because we destroy heap in next step)
RtlFreeHeap(memory, 0, buffer);
RtlDestroyHeap(memory);
WriteLn(L"Heap destroyedn");
WriteLn(L"Press ESC to continue...n");
while (TRUE)
{
NtReadFile(hKeyBoard, hEvent, NULL, NULL, &Iosb, &kbData, sizeof(KEYBOARD_INPUT_DATA), &ByteOffset, NULL);
NtWaitForSingleObject(hEvent, TRUE, NULL);
if (kbData.MakeCode == 0x01) // if ESC pressed
{
break;
}
}
NtTerminateProcess(NtCurrentProcess(), 0);
}
PS: Peb tuaj yeem yooj yim siv DbgBreakPoint() muaj nuj nqi hauv peb cov cai kom txwv tsis pub nws hauv qhov debugger. Muaj tseeb, koj yuav tsum txuas WinDbg mus rau lub tshuab virtual rau kev debugging kernel. Cov lus qhia yuav ua li cas thiaj nrhiav tau S, SΡS, los yog siv xwb VirtualKD.
Compilation thiab assembling
Txoj kev yooj yim tshaj plaws los tsim ib daim ntawv thov ib txwm siv yog siv DDK (Driver Development Kit). Peb xav tau lub xya xyoo qub, txij li cov versions tom qab muaj qhov sib txawv me ntsis thiab ua haujlwm ze nrog Visual Studio. Yog tias peb siv DDK, ces peb qhov project tsuas yog xav tau Makefile thiab qhov chaw.
Makefile
!INCLUDE $(NTMAKEENV)makefile.def
qhov chaw:
TARGETNAME = MyNative
TARGETTYPE = PROGRAM
UMTYPE = nt
BUFFER_OVERFLOW_CHECKS = 0
MINWIN_SDK_LIB_PATH = $(SDK_LIB_PATH)
SOURCES = source.c
INCLUDES = $(DDK_INC_PATH);
C:WinDDK7600.16385.1ndk;
TARGETLIBS = $(DDK_LIB_PATH)ntdll.lib
$(DDK_LIB_PATH)nt.lib
USE_NTDLL = 1
TARGETNAME β lub npe ntawm cov ntaub ntawv executable uas yuav tsum tau ua thaum kawg.
TARGETTYPE β hom ntaub ntawv executable, nws tuaj yeem yog tus tsav tsheb (.sys), ces tus nqi teb yuav tsum yog DRIVER, yog lub tsev qiv ntawv (.lib), ces tus nqi yog LIBRARY. Hauv peb qhov xwm txheej, peb xav tau cov ntaub ntawv ua tiav (.exe), yog li peb teeb tsa tus nqi rau PROGRAM.
UMTYPE - qhov muaj peev xwm ua tau rau daim teb no: console rau daim ntawv thov console, qhov rais rau kev ua haujlwm hauv hom windowed. Tab sis peb yuav tsum tau qhia nt kom tau ib daim ntawv thov haiv.
Tus neeg saib xyuas kev sib kho ua haujlwm ntawm cov npe no ib los ntawm ib qho. Tus thawj tswj kev sib ntsib nrhiav cov ntaub ntawv ua tiav lawv tus kheej hauv cov npe system32. Daim ntawv teev npe tus nqi tseem ceeb yog raws li hauv qab no:
autocheck autochk *MyNative
Tus nqi yuav tsum yog hom hexadecimal, tsis yog ASCII li ib txwm, yog li tus yuam sij qhia saum toj no yuav yog hom: