Skip to content

Commit 255f9ac

Browse files
AdvDebugAdvDebug
authored
Add files via upload
1 parent 288eef7 commit 255f9ac

File tree

1 file changed

+100
-12
lines changed

1 file changed

+100
-12
lines changed

‎NoMoreCookies/NoMoreCookies/dllmain.cpp‎

Lines changed: 100 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,36 +10,39 @@
1010
#include <detours.h>
1111
#include <shellapi.h>
1212
#include <fileapi.h>
13+
#include <filesystem>
1314
#pragma comment(lib, "wintrust.lib")
1415
#pragma comment(lib, "advapi32.lib")
1516
#pragma comment(lib, "shell32.lib")
1617
#pragma comment(lib, "version.lib")
18+
#pragma comment(lib, "amsi.lib")
1719
#define STATUS_ACCESS_DENIED 0xC0000022
1820

1921
typedef NTSTATUS(NTAPI* RealNtCreateFile)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK, PLARGE_INTEGER, ULONG, ULONG, ULONG, ULONG, PVOID, ULONG);
20-
typedef NTSTATUS(NTAPI *RealNtOpenFile)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK, ULONG, ULONG);
22+
typedef NTSTATUS(NTAPI* RealNtOpenFile)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK, ULONG, ULONG);
2123
typedef NTSTATUS(NTAPI* RealNtResumeThread)(HANDLE, PULONG);
2224
typedef NTSTATUS(NTAPI* RealNtSetValueKey)(HANDLE, PUNICODE_STRING, ULONG, ULONG, PVOID, ULONG);
2325
typedef NTSTATUS(NTAPI* RealNtProtectVirtualMemory)(HANDLE, PVOID*, PULONG, ULONG, PULONG);
2426
typedef NTSTATUS(NTAPI* RealNtWriteVirtualMemory)(HANDLE, PVOID, LPCVOID, SIZE_T, PSIZE_T);
25-
typedef NTSTATUS(NTAPI* RealNtDeleteValueKey)(HANDLE, PUNICODE_STRING);
2627
HANDLE Mutex = CreateMutex(NULL, FALSE, NULL);
2728
HANDLE Mutex2 = CreateMutex(NULL, FALSE, NULL);
2829
HANDLE Mutex3 = CreateMutex(NULL, FALSE, NULL);
2930
HANDLE Mutex4 = CreateMutex(NULL, FALSE, NULL);
3031
HANDLE Mutex5 = CreateMutex(NULL, FALSE, NULL);
3132
HANDLE Mutex6 = CreateMutex(NULL, FALSE, NULL);
32-
BOOL XMode = TRUE; //you set the mode you want
33-
BOOL Mini = FALSE; //Mini Mode FALSE/TRUE
33+
BOOL XMode = FALSE; //you set the mode you want
34+
BOOL Mini = TRUE; //Mini Mode FALSE/TRUE
3435
HMODULE Module = NULL;
36+
HANDLE ProtectionThread = NULL;
37+
HANDLE WatchingThread = NULL;
38+
BOOL WatchThread = FALSE;
3539

3640
RealNtCreateFile OriginalNtCreateFile = nullptr;
3741
RealNtOpenFile OriginalNtOpenFile = nullptr;
3842
RealNtResumeThread OriginalNtResumeThread = nullptr;
3943
RealNtSetValueKey OriginalNtSetValueKey = nullptr;
4044
RealNtProtectVirtualMemory OriginalNtProtectVirtualMemory = nullptr;
4145
RealNtWriteVirtualMemory OriginalNtWriteVirtualMemory = nullptr;
42-
RealNtDeleteValueKey OriginalNtDeleteValueKey = nullptr;
4346

4447
BOOL IsSigned(HANDLE hProcess)
4548
{
@@ -206,7 +209,7 @@ BOOL IsNoMoreCookiesInstaller()
206209
}
207210
WCHAR CheckSum[9];
208211
swprintf_s(CheckSum, 9, L"%08X", Sum);
209-
if (wcscmp(CheckSum, L"000C66AD") == 0)
212+
if (wcscmp(CheckSum, L"000CB710") == 0)
210213
{
211214
return TRUE;
212215
}
@@ -256,6 +259,7 @@ DWORD WINAPI ShowNotification(std::wstring Text)
256259
wcsncpy_s(nid.szInfoTitle, L"Unauthorized Action", _TRUNCATE);
257260
wcsncpy_s(nid.szInfo, Text.c_str(), _TRUNCATE);
258261
Shell_NotifyIconW(NIM_ADD, &nid);
262+
Shell_NotifyIconW(NIM_DELETE, &nid);
259263
return 0;
260264
}
261265

@@ -318,6 +322,8 @@ BOOL IsBlacklistedPath(LPCWSTR FilePath)
318322
return false;
319323
}
320324

325+
std::wstring ProgramName[256];
326+
321327
BOOL AlreadyShown = FALSE;
322328
NTSTATUS NTAPI HookedNtCreateFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength)
323329
{
@@ -352,7 +358,11 @@ NTSTATUS NTAPI HookedNtOpenFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, P
352358
{
353359
if (!AlreadyShown2)
354360
{
355-
std::wstring NotificationString(L"NoMoreCookies: A process tried to access a restricted browser path, which was denied successfully.");
361+
std::wstring NotificationString(L"NoMoreCookies: The process ");
362+
NotificationString.append(L"\"");
363+
NotificationString.append(ProgramName->c_str());
364+
NotificationString.append(L"\"");
365+
NotificationString.append(L" tried to access a restricted browser path, which was denied successfully.");
356366
ShowNotification(NotificationString);
357367
AlreadyShown = TRUE;
358368
}
@@ -404,13 +414,14 @@ FARPROC NtResumeThreadAddress = NULL;
404414
FARPROC NtSetValueKeyAddress = NULL;
405415
FARPROC NtWriteVirtualMemory = NULL;
406416
FARPROC NtProtectVirtualMemory = NULL;
417+
LPVOID NtdllBaseAddress = NULL;
407418

408419
NTSTATUS NTAPI HookedNtProtectVirtualMemory(HANDLE ProcessHandle, PVOID* BaseAddress, PULONG NumberOfBytesToProtect, ULONG NewAccessProtection, PULONG OldAccessProtection)
409420
{
410421
WaitForSingleObject(Mutex5, INFINITE);
411422
if (GetProcessId(ProcessHandle) == GetCurrentProcessId())
412423
{
413-
if ((int)(*BaseAddress) == (int)(NtCreateFileAddress) || (int)(*BaseAddress) == (int)(NtOpenFileAddress) || (int)(*BaseAddress) == (int)(NtResumeThreadAddress) || (int)(*BaseAddress) == (int)(NtSetValueKeyAddress) || (int)(*BaseAddress) == (int)(NtWriteVirtualMemory) || (int)(*BaseAddress) == (int)(NtProtectVirtualMemory))
424+
if ((int)(*BaseAddress) == (int)(NtCreateFileAddress) || (int)(*BaseAddress) == (int)(NtOpenFileAddress) || (int)(*BaseAddress) == (int)(NtResumeThreadAddress) || (int)(*BaseAddress) == (int)(NtSetValueKeyAddress) || (int)(*BaseAddress) == (int)(NtdllBaseAddress) || (int)(*BaseAddress) == (int)(NtWriteVirtualMemory) || (int)(*BaseAddress) == (int)(NtProtectVirtualMemory))
414425
{
415426
ReleaseMutex(Mutex5);
416427
return STATUS_ACCESS_DENIED;
@@ -435,27 +446,95 @@ NTSTATUS NTAPI HookedNtWriteVirtualMemory(HANDLE ProcessHandle, PVOID BaseAddres
435446
return OriginalNtWriteVirtualMemory(ProcessHandle, BaseAddress, Buffer, BufferSize, NumberOfBytesWritten);
436447
}
437448

438-
void CheckHook()
449+
void ForceExit()
450+
{
451+
ExitProcess(0);
452+
//incase it didn't exit
453+
int* NullPointer = nullptr;
454+
*NullPointer = 42;
455+
}
456+
457+
void VarsInitThread()
439458
{
440459
NtCreateFileAddress = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtCreateFile");
441460
NtOpenFileAddress = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtOpenFile");
442461
NtResumeThreadAddress = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtResumeThread");
443462
NtSetValueKeyAddress = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtSetValueKey");
444463
NtWriteVirtualMemory = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtWriteVirtualMemory");
445464
NtProtectVirtualMemory = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtProtectVirtualMemory");
465+
HMODULE Ntdll = GetModuleHandle(L"ntdll.dll");
466+
MODULEINFO Mi = { 0 };
467+
if (GetModuleInformation(GetCurrentProcess(), Ntdll, &Mi, sizeof(Mi)))
468+
{
469+
PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)Mi.lpBaseOfDll;
470+
PIMAGE_NT_HEADERS NtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)Mi.lpBaseOfDll + DosHeader->e_lfanew);
471+
for (WORD i = 0; i < NtHeader->FileHeader.NumberOfSections; i++)
472+
{
473+
PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)((DWORD_PTR)IMAGE_FIRST_SECTION(NtHeader) + ((DWORD_PTR)IMAGE_SIZEOF_SECTION_HEADER * i));
474+
if (!strcmp((char*)SectionHeader->Name, ".text"))
475+
{
476+
NtdllBaseAddress = (LPVOID)((DWORD_PTR)Mi.lpBaseOfDll + (DWORD_PTR)SectionHeader->VirtualAddress);
477+
break;
478+
}
479+
}
480+
}
481+
wchar_t ImageFileName[MAX_PATH + 1];
482+
if (GetProcessImageFileName(GetCurrentProcess(), ImageFileName, MAX_PATH))
483+
{
484+
std::wstring ProcessName(ImageFileName);
485+
size_t LastSlash = ProcessName.find_last_of(L"\\");
486+
if (LastSlash != std::wstring::npos) {
487+
ProcessName = ProcessName.substr(LastSlash + 1);
488+
}
489+
ProgramName->append(ProcessName);
490+
}
491+
}
492+
493+
void CheckHook()
494+
{
446495
const char* Functions[] = { "NtCreateFile", "NtOpenFile", "NtResumeThread", "NtSetValueKey", "NtProtectVirtualMemory", "NtWriteVirtualMemory" };
447496
const int Size = sizeof(Functions) / sizeof(Functions[0]);
448497
while (true)
449498
{
450-
Sleep(2000);
499+
Sleep(1000);
451500
for (int i = 0; i < Size; i++)
452501
{
453502
FARPROC FunctionAddress = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), Functions[i]);
454503
BYTE* StartAddressBytes = (BYTE*)FunctionAddress;
455504
if (StartAddressBytes[0] != 0xE9 || StartAddressBytes[0] == 0xCC)
456505
{
457-
ExitProcess(0);
506+
ForceExit();
507+
}
508+
}
509+
510+
if (WatchThread)
511+
{
512+
DWORD ExitCode = 0;
513+
if (GetExitCodeThread(WatchingThread, &ExitCode))
514+
{
515+
if (ExitCode != STILL_ACTIVE)
516+
{
517+
ForceExit();
518+
}
519+
ExitCode = 0;
520+
}
521+
}
522+
}
523+
}
524+
525+
void ThreadWatcher()
526+
{
527+
while (true)
528+
{
529+
Sleep(1000);
530+
DWORD ExitCode = 0;
531+
if (GetExitCodeThread(ProtectionThread, &ExitCode))
532+
{
533+
if (ExitCode != STILL_ACTIVE)
534+
{
535+
ForceExit();
458536
}
537+
ExitCode = 0;
459538
}
460539
}
461540
}
@@ -464,6 +543,7 @@ void HookingThread()
464543
{
465544
if (Startup())
466545
{
546+
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)VarsInitThread, NULL, 0, NULL);
467547
DetourTransactionBegin();
468548
DetourUpdateThread(GetCurrentThread());
469549
OriginalNtCreateFile = reinterpret_cast<RealNtCreateFile>(DetourFindFunction("ntdll.dll", "NtCreateFile"));
@@ -484,7 +564,15 @@ void HookingThread()
484564
DetourTransactionCommit();
485565
if (!Mini)
486566
{
487-
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)CheckHook, NULL, 0, NULL);
567+
ProtectionThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)CheckHook, NULL, 0, NULL);
568+
if (ProtectionThread != NULL)
569+
{
570+
WatchingThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ThreadWatcher, NULL, 0, NULL);
571+
if (WatchingThread != NULL)
572+
{
573+
WatchThread = TRUE;
574+
}
575+
}
488576
}
489577
}
490578
else

0 commit comments

Comments
 (0)