A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #31492  by lwbkm
 Sat Apr 28, 2018 4:51 am
hi,
Recently I am writing a rootkit software, but I have a function that I can not realization.
that is delete have been loaded driver file sys.and still Keep communication.
like this soft,I want to implement this function,who can help me,thanks vevrymuch.
1.png
1.png (152.81 KiB) Viewed 670 times
 #31507  by EP_X0FF
 Sun Apr 29, 2018 4:05 am
Starting from Windows 10 you cannot delete file of loaded driver as it locked on disk.
If you want similar functionality from your screenshot you need to send IRP to filesystem device driver. Search for KSBinSword for "code". However conseqences of this is unknown for Windows 10.
 #31531  by Li Yong
 Tue May 01, 2018 4:40 pm
EP_X0FF wrote: Sun Apr 29, 2018 4:05 am Starting from Windows 10 you cannot delete file of loaded driver as it locked on disk.
If you want similar functionality from your screenshot you need to send IRP to filesystem device driver. Search for KSBinSword for "code". However conseqences of this is unknown for Windows 10.
Good suggestion EP_X0FF, i already made a question here about this approach, but until now i still not understood what's commands i must send to ntifs.sys (and that he be able to recognize). For example in KSBinSword, to kill a determinated process, is sent from usermode app (via DeviceIOControl the following request that contain the pid:
Code: Select all
case IOCTL_KSBINSWORD_KILLPROCESS://强制杀掉 进程
{		
     status=STATUS_SUCCESS;
     DbgPrint("IOCTL_KSBINSWORD_KILLPROCESS");
   //DbgBreakPoint();
			
     KillPro(*(int*)ioBuf);
    outBufLength=inBufLength;
    Irp->IoStatus.Information = inBufLength;
    break;
}
Obviously the .sys file of KSBinSword will understand that is a request to kill a determinated process because this already was previously coded in your .sys file.
Then my main doubt is what request name (having as example IOCTL_KSBINSWORD_KILLPROCESS of KSBinSword) i must send (including a folder name or file name) to ntifs.sys, since that i not know how he was coded?

If possible could provide a code snnipet about how do this?

Thank.
 #31533  by lwbkm
 Wed May 02, 2018 1:41 am
EP_X0FF wrote: Sun Apr 29, 2018 4:05 am Starting from Windows 10 you cannot delete file of loaded driver as it locked on disk.
If you want similar functionality from your screenshot you need to send IRP to filesystem device driver. Search for KSBinSword for "code". However conseqences of this is unknown for Windows 10.
thank you. let me try.
 #31541  by Li Yong
 Thu May 03, 2018 3:35 am
lwbkm wrote: Thu May 03, 2018 2:19 am
Li Yong wrote: Wed May 02, 2018 12:18 pm If success, could provide a code example please? i also need of this functionality force delete.

waiting... ;)
I still do not understand, maybe close the kernel handle can be deleted, you can try.
Only closing opened handles not will solve to files locked by a FSD (File System Driver) or Minifilter, i already tested :D
I think that suggestion of EP_X0FF gave here, can solve my last question and this your question here.
Even least for me, now the question is: - Someone could share a code snippet about how send IRP's directly to ntifs.sys requesting remotion of a file/folder please?

Eg: i never tested this ARK of image above, but already that you have, probably will can see a option of Force Delete on File section.
Choise a folder that you know that have a FSD protecting these files and try use normal exclusion, obviously not will work, already with option Force Delete (probably present in WIN64AST) the file can be deleted with success ;) . So i have almost by
sure, that great part of these chinese ARK's, use (or he already used) something based on suggestion of EP_X0FF (or the same approach).

Then by all this, i belive that we can solve our questions with this approach, but i not have a idea about how must be in source code :-(