Doge-Whisper

golang implementation of Syswhisper2/Syswhisper3

按系统调用地址排序获取System Service Number(SSN)即为sysid以绕过hook,

Sorting by System Call Address

dogewhisper.DWhisper() will parse the EAT of NTDLL.dll, locating all function names that begin with "Zw". 

dogewhisper.DWhisper() 将解析 NTDLL.dll 的 EAT，定位所有以“Zw”开头的函数名。

It replaces "Zw" with "Nt" before generating a hash of the function name.

它在生成函数名称的散列之前将“Zw”替换为“Nt”。

It then saves the hash and address of code stub to a table of SYSCALL_ENTRY structures. 

然后它将代码存根的哈希和地址保存到 SYSCALL_ENTRY 结构表中。

After gathering all the names, it uses a simple bubble sort of code addresses in ascending order. 

收集所有名称后，使用简单的冒泡排序代码地址按升序排列。

The SSN is the index of the system call stored in the table. 

System Service Number (SSN) 是存储在表中的系统调用的索引。

与原版的区别之一是在于生成的索引最后是存储于map中以便更快的查找。

目前采用package动态获取的方式，后续有空的话会加上和原版类似的生成用法,指定api生成一个pkg直接调用

后续会集成进gabh项目

使用方式可以借鉴一下example

Usage

package main

import (
	"fmt"
	"github.com/timwhitez/Doge-Whisper/pkg/dogewhisper"
	"syscall"
	"unsafe"
)

//需要被排除掉的api
var hookedapi = []string{"NtAllocateVirtualMemory", "NtAllocateVirtualMemoryEx"}
var hashhooked []string

//致敬原版的hash算法
var SW2_SEED = 0xA7A0175C

func SW2_ROR8(v uint32) uint32 {
	return v>>8 | v<<24
}

func SW2_HashSyscall(fname string) string {
	fn, _ := syscall.BytePtrFromString(fname)
	FunctionName := uintptr(unsafe.Pointer(fn))
	var Hash = uint32(SW2_SEED)
	for j := 0; j < len(fname); j++ {
		i := uintptr(j)
		PartialName := *(*uint16)(unsafe.Pointer(FunctionName + i))
		Hash ^= uint32(PartialName) + SW2_ROR8(Hash)
	}
	return fmt.Sprintf("%x", Hash)
}


func main() {
	// 初始化DW_SYSCALL_LIST ,SW2_HashSyscall可以换成其他加密函数
	var newWhisper = dogewhisper.DWhisper(SW2_HashSyscall)
	if newWhisper == nil {
		return
	}

  //对排除的函数进行hash化，当然你可以直接写成hash之后的list
	for _, v := range hookedapi {
		hashhooked = append(hashhooked, SW2_HashSyscall(v))
	}

  //使用初始化后的DW_SYSCALL_LIST获取NtDelayExecution的sysid
	//SW2_HashSyscall("NtDelayExecution")=4942059d
	sysid := newWhisper.GetSysid("4942059d")
	if sysid == 0 {
		return
	}

	fmt.Printf("NtDelayExecution sysid: 0x%x\n", sysid)
	var ti = -(5000 * 10000)

	//动态获取syscall;ret的地址，排除掉hashhooked列表
	callAddr := dogewhisper.GetCall("", hashhooked, SW2_HashSyscall)
	fmt.Printf("Syscall;ret Address: 0x%x\n", callAddr)

  //执行
	//Call
	r, e1 := dogewhisper.DWcall(sysid, callAddr, uintptr(0), uintptr(unsafe.Pointer(&ti)))
	if e1 != nil {
		fmt.Printf("0x%x\n", r)
		fmt.Println(e1)
	}

}