diff --git a/SilentLoad.sln b/SilentLoad.sln new file mode 100644 index 0000000..02dd594 --- /dev/null +++ b/SilentLoad.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.11.35327.3 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SilentLoad", "SilentLoad\SilentLoad.vcxproj", "{A5D2F9C8-0DC2-4A2D-B72F-2FD5FF740043}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {A5D2F9C8-0DC2-4A2D-B72F-2FD5FF740043}.Debug|x64.ActiveCfg = Debug|x64 + {A5D2F9C8-0DC2-4A2D-B72F-2FD5FF740043}.Debug|x64.Build.0 = Debug|x64 + {A5D2F9C8-0DC2-4A2D-B72F-2FD5FF740043}.Debug|x86.ActiveCfg = Debug|Win32 + {A5D2F9C8-0DC2-4A2D-B72F-2FD5FF740043}.Debug|x86.Build.0 = Debug|Win32 + {A5D2F9C8-0DC2-4A2D-B72F-2FD5FF740043}.Release|x64.ActiveCfg = Release|x64 + {A5D2F9C8-0DC2-4A2D-B72F-2FD5FF740043}.Release|x64.Build.0 = Release|x64 + {A5D2F9C8-0DC2-4A2D-B72F-2FD5FF740043}.Release|x86.ActiveCfg = Release|Win32 + {A5D2F9C8-0DC2-4A2D-B72F-2FD5FF740043}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {FB2054AB-CC9E-4B15-B438-B4E89375DCD1} + EndGlobalSection +EndGlobal diff --git a/SilentLoad/SilentLoad.vcxproj b/SilentLoad/SilentLoad.vcxproj new file mode 100644 index 0000000..4d61c8a --- /dev/null +++ b/SilentLoad/SilentLoad.vcxproj @@ -0,0 +1,140 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 17.0 + Win32Proj + {a5d2f9c8-0dc2-4a2d-b72f-2fd5ff740043} + SilentLoad + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + ntdll.lib;%(AdditionalDependencies) + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + ntdll.lib;%(AdditionalDependencies) + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdc17 + + + Console + true + ntdll.lib;%(AdditionalDependencies) + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + ntdll.lib;%(AdditionalDependencies) + + + + + + + + + \ No newline at end of file diff --git a/SilentLoad/SilentLoad.vcxproj.filters b/SilentLoad/SilentLoad.vcxproj.filters new file mode 100644 index 0000000..ce0c35c --- /dev/null +++ b/SilentLoad/SilentLoad.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/SilentLoad/main.cpp b/SilentLoad/main.cpp new file mode 100644 index 0000000..e20ca74 --- /dev/null +++ b/SilentLoad/main.cpp @@ -0,0 +1,162 @@ +#include +#include +#include +#include + +#define SERVICE_NAME L"SilentLoad" +#define DRIVER_PATH L"\\??\\C:\\Windows\\System32\\drivers\\SilentLoad.sys" + +typedef NTSTATUS(NTAPI* _NtLoadDriver)(PUNICODE_STRING DriverServiceName); + +static _NtLoadDriver NtLoadDriver = NULL; + +static bool GrantPrivilege(LPCTSTR privilege) +{ + HANDLE Token; + TOKEN_PRIVILEGES TokenPrivileges; + LUID Luid; + + if (!LookupPrivilegeValueW(NULL, SE_LOAD_DRIVER_NAME, &Luid)) + return false; + + if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &Token)) + return false; + + TokenPrivileges = { 0 }; + TokenPrivileges.PrivilegeCount = 1; + TokenPrivileges.Privileges[0].Luid = Luid; + TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + + if (!AdjustTokenPrivileges(Token, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL) + || GetLastError() == ERROR_NOT_ALL_ASSIGNED) + { + CloseHandle(Token); + return false; + } + + CloseHandle(Token); + + return true; +} + +static _NtLoadDriver ResolveNtLoadDriver() +{ + HMODULE Handle; + + Handle = GetModuleHandleW(L"ntdll.dll"); + if (!Handle) + return NULL; + + return (_NtLoadDriver)GetProcAddress(Handle, "NtLoadDriver"); +} + +static bool AddService(LPCWSTR ServiceName, LPCWSTR DriverPath) +{ + HKEY ServicesKey; + DWORD ImagePathLength; + DWORD ServiceType; + DWORD ServiceStartType; + DWORD ServiceErrorControl; + DWORD ServiceNameLength; + + if (!NT_SUCCESS(RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SYSTEM\\CurrentControlSet\\Services", 0, KEY_ALL_ACCESS, &ServicesKey))) + goto Error; + + if (!NT_SUCCESS(RegCreateKeyW(ServicesKey, ServiceName, &ServicesKey))) + goto Error; + + ImagePathLength = (wcslen(DriverPath) + 1) * sizeof(WCHAR); + if (!NT_SUCCESS(RegSetValueExW(ServicesKey, L"ImagePath", 0, REG_EXPAND_SZ, (LPBYTE)DriverPath, ImagePathLength))) + goto Error; + + ServiceType = SERVICE_KERNEL_DRIVER; + if (!NT_SUCCESS(RegSetValueExW(ServicesKey, L"Type", 0, REG_DWORD, (LPBYTE)&ServiceType, sizeof(ServiceType)))) + goto Error; + + ServiceStartType = SERVICE_DEMAND_START; + if (!NT_SUCCESS(RegSetValueExW(ServicesKey, L"Start", 0, REG_DWORD, (LPBYTE)&ServiceStartType, sizeof(ServiceStartType)))) + goto Error; + + ServiceErrorControl = SERVICE_ERROR_NORMAL; + if (!NT_SUCCESS(RegSetValueExW(ServicesKey, L"ErrorControl", 0, REG_DWORD, (LPBYTE)&ServiceErrorControl, sizeof(ServiceErrorControl)))) + goto Error; + + ServiceNameLength = (wcslen(ServiceName) + 1) * sizeof(WCHAR); + if (!NT_SUCCESS(RegSetValueExW(ServicesKey, L"DisplayName", 0, REG_SZ, (LPBYTE)ServiceName, ServiceNameLength))) + goto Error; + + RegCloseKey(ServicesKey); + + return true; + +Error: + RegCloseKey(ServicesKey); + + return false; +} + +static bool RemoveService(LPCWSTR ServiceName) +{ + WCHAR RegistryPath[MAX_PATH]; + + StringCchPrintfW(RegistryPath, ARRAYSIZE(RegistryPath), L"SYSTEM\\CurrentControlSet\\Services\\%s", ServiceName); + + return NT_SUCCESS(RegDeleteTreeW(HKEY_LOCAL_MACHINE, RegistryPath)); +} + +static bool LoadDriver(LPCWSTR ServiceName) +{ + UNICODE_STRING DriverServiceName; + WCHAR Buffer[MAX_PATH]; + NTSTATUS Status; + + StringCchPrintfW(Buffer, ARRAYSIZE(Buffer), L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\%s", ServiceName); + RtlInitUnicodeString(&DriverServiceName, Buffer); + + Status = NtLoadDriver(&DriverServiceName); + if (Status == 0xC000010E) + { + printf("Driver already loaded\n"); + return true; + } + + return NT_SUCCESS(Status); + +} + +int main(int argc, char* argv[]) +{ + if (!GrantPrivilege(SE_LOAD_DRIVER_NAME)) + { + printf("Failed to grant privilege\n"); + goto End; + } + + NtLoadDriver = ResolveNtLoadDriver(); + if (!NtLoadDriver) + { + printf("Failed to resolve NtLoadDriver\n"); + goto End; + } + + printf("NtLoadDriver: 0x%p\n", NtLoadDriver); + + if (!AddService(SERVICE_NAME, DRIVER_PATH)) + { + printf("Failed to add service\n"); + goto End; + } + + if (!LoadDriver(SERVICE_NAME)) + { + printf("Failed to load driver\n"); + goto End; + } + + +End: + if (!RemoveService(SERVICE_NAME)) + printf("Failed to remove service\n"); + + return 0; +} \ No newline at end of file