PE下的驱动注入工具(201000901)更新！ - 无忧启动论坛

#Region ;**** 参数创建于 ACNWrapper_GUI ****
#AutoIt3Wrapper_Version=Ver:0.1.2010.07.25
#AutoIt3Wrapper_Icon=.\ico\1.ico
#AutoIt3Wrapper_OutFile=C:\Documents and Settings\Administrator\桌面\离线驱动注入工具.exe
#AutoIt3Wrapper_UseUPX=n
#AutoIt3Wrapper_Res_FileVersion=0.1.2010.07.25
#AutoIt3Wrapper_Res_Comment=本工具可将PE系统中正使用的SRS驱动注入到目标系统中。
#AutoIt3Wrapper_Res_Description=本工具只能PE1.X环境下运行！目标系统暂时只支持WIN2000、WINXP、WIN2003。
#AutoIt3Wrapper_Res_LegalCopyright=版权归仙乃日所有！
#AutoIt3Wrapper_Run_Tidy=y
#EndRegion ;**** 参数创建于 ACNWrapper_GUI ****
#include <ButtonConstants.au3>
#include <EditConstants.au3>
#include <GUIConstantsEx.au3>
#include <StaticConstants.au3>
#include <WindowsConstants.au3>
#include <SetupApi.au3>
#include <LocalSecurityAuthority.au3>
If _WinAPI_CreateSemaphore(@ScriptName) <> 0 Then
;MsgBox(16,"error","程序已经运行！")
Exit
EndIf
Global Const $SE_PRIVILEGE_ENABLED = 0x00000002
Global $SYSTEMROOT, $n, $ControlSet
Global $stp = 1
If Not StringInStr(RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control", "SystemStartOptions"), "MININT") Then
MsgBox(16, "离线驱动注入工具", "该程序只能在 windows PE 下运行!")
Exit
EndIf
$Form1 = GUICreate("离线驱动注入工具 By 仙乃日", 450, 220, -1, -1)
$Label1 = GUICtrlCreateLabel("", 35, 16, 400, 20)
$Label2 = GUICtrlCreateLabel("", 45, 78, 70, 20)
$Edit1 = GUICtrlCreateEdit("", 35, 40, 383, 129, BitOR($ES_AUTOVSCROLL, $ES_AUTOHSCROLL, $ES_READONLY, $ES_WANTRETURN, $ES_AUTOVSCROLL, $ES_AUTOHSCROLL), 0)
GUICtrlSetData(-1, "Edit1")
$Button1 = GUICtrlCreateButton("< 上一步[&B]", 200, 185, 89, 25, 0)
$Button2 = GUICtrlCreateButton("下一步[&N] >", 325, 185, 89, 25, 0)
$Button3 = GUICtrlCreateButton("打开", 290, 75, 40, 20)
GUICtrlSetState($Button3, $gui_hide)
$Button4 = GUICtrlCreateButton("确定注入", 150, 65, 150, 90, $WS_GROUP)
GUICtrlSetFont(-1, 25, 400, 0)
GUICtrlSetState($Button4, $gui_hide)
$Input1 = GUICtrlCreateInput("", 105, 75, 180, 20)
GUISetState(@SW_SHOW)
step1(1)
While 1
$nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE
Exit
Case $Button1
Call("step" & $stp, 0)
$stp -= 1
Call("step" & $stp, 1)
Case $Button2
If GUICtrlRead($Button2) = "完成[&F]" Then
Exit
EndIf
Call("step" & $stp, 0)
$stp += 1
Call("step" & $stp, 1)
Case $Button3
GUICtrlSetState($Button2, $gui_disable)
$SYSTEMROOT = FileSelectFolder("请选择目标系统目录，如：C:\Windows", "::{20D04FE0-3AEA-1069-A2D8-08002B30309D}")
If Not @error Then
$ROOT = StringLeft($SYSTEMROOT, 2)
GUICtrlSetData($Input1, $SYSTEMROOT)
$SYSTEMROOT = GUICtrlRead($Input1)
If FileExists($SYSTEMROOT & "\system32\config\system") = 1 Then
GUICtrlSetState($Button2, $gui_enable)
Else
MsgBox(16, "提醒您，重新选择！", "貌似您所选择的目录不是有效的系统目录！")
ContinueLoop
EndIf
EndIf
Case $Button4
_REGLOADHIVE($SYSTEMROOT & "\system32\CONFIG\SYSTEM", "HKLM\hSYS")
_REGLOADHIVE($SYSTEMROOT & "\system32\CONFIG\SOFTWARE", "HKLM\xSoft")
$n = RegRead("HKEY_LOCAL_MACHINE\hSYS\Select", "Current")
If $n < 10 Then
$ControlSet = "ControlSet00" & $n
Else
$ControlSet = "ControlSet0" & $n
EndIf
GET_SCSI_driver()
_REGUNLOADHIVE("HKLM\hSYS")
_REGUNLOADHIVE("HKLM\xSoft")
GUICtrlSetState($Button1, $gui_disable)
GUICtrlSetState($Button4, $gui_hide)
GUICtrlSetState($Label1, $gui_hide)
GUICtrlCreateEdit("恭喜您！" & @CRLF & @CRLF & "驱动注入成功啦！", 35, 25, 250, 120, BitOR($ES_AUTOVSCROLL, $ES_AUTOHSCROLL, $ES_READONLY, $ES_WANTRETURN, $ES_AUTOVSCROLL, $ES_AUTOHSCROLL), 0)
GUICtrlSetFont(-1, 23, 400, 0)
EndSwitch
WEnd
Func step1($x)
If $x = 1 Then
GUICtrlSetState($Label2, $gui_hide)
GUICtrlSetState($Input1, $gui_hide)
GUICtrlSetState($Button1, $gui_disable)
GUICtrlSetState($Button2, $gui_disable)
GUICtrlSetData($Label1, "欢迎访问仙乃日博客(hi.baidu.com/hdj20030403/blog)！")
GUICtrlSetData($Edit1, @CRLF & "这是一个将PE系统使用中的SRS驱动，注入到目标系统中的工具。如果你" & _
@CRLF & @CRLF & "所使用的PE在启动时就删除了SRS驱动文件，那么注入将失败。本工具不" & @CRLF & @CRLF & "会改写目标系统即有驱动文件。虽竭诚为之，但限于水平，疏漏、谬误之" & _
@CRLF & @CRLF & "处在所难免，望使用者见谅。作者不对由此工具引起的任何问题负责。")
Sleep(900)
GUICtrlSetState($Button2, $gui_enable)
Else
GUICtrlSetState($Button1, $gui_enable)
EndIf
EndFunc ;==>step1
Func Step2($x)
If $x = 1 Then
GUICtrlSetState($Button3, $gui_show)
GUICtrlSetState($Button4, $gui_hide)
GUICtrlSetState($Button2, $gui_disable)
GUICtrlSetData($Label1, "请选择目标系统所在的目录，默认为C:\Windows")
GUICtrlSetData($Label2, "系统路径:")
GUICtrlSetState($Label2, $gui_show)
GUICtrlSetState($Input1, $gui_show)
GUICtrlSetState($Edit1, $gui_hide)
If FileExists("C:\boot.ini") = 1 And FileExists("C:\windows\system32\ntdll.dll") = 1 Then
$SYSTEMROOT = "C:\Windows"
GUICtrlSetData($Input1, $SYSTEMROOT)
EndIf
Sleep(700)
$SYSTEMROOT = GUICtrlRead($Input1)
If FileExists($SYSTEMROOT & "\system32\config\system") = 1 Then
GUICtrlSetState($Button2, $gui_enable)
Else
MsgBox(16, "提醒您，重新选择！", "貌似您所选择的目录不是有效的系统目录！")
EndIf
Else
GUICtrlSetState($Edit1, $gui_show)
GUICtrlSetState($Label2, $gui_hide)
GUICtrlSetState($Input1, $gui_hide)
EndIf
EndFunc ;==>Step2
Func step3($x)
If $x = 1 Then
GUICtrlSetState($Edit1, $gui_hide)
GUICtrlSetData($Label1, "按“确定注入”键后将自动注入驱动。本工具暂不提供恢复功能！")
GUICtrlSetState($Label2, $gui_hide)
GUICtrlSetState($Input1, $gui_hide)
GUICtrlSetState($Button3, $gui_hide)
GUICtrlSetState($Button4, $gui_show)
GUICtrlSetData($Button2, "完成[&F]")
Else
GUICtrlSetState($Button3, $gui_show)
GUICtrlSetState($Button2, $gui_disable)
GUICtrlSetState($Button3, $gui_show)
GUICtrlSetData($Button2, "下一步[&N] >")
GUICtrlSetData($Label1, "请选择目标系统所在的目录，默认为C:\Windows")
GUICtrlSetData($Label2, "系统路径:")
GUICtrlSetState($Label2, $gui_show)
GUICtrlSetState($Input1, $gui_show)
GUICtrlSetState($Edit1, $gui_hide)
If FileExists("C:\boot.ini") = 1 And FileExists("C:\windows\system32\ntdll.dll") = 1 Then
$SYSTEMROOT = "C:\Windows"
GUICtrlSetData($Input1, $SYSTEMROOT)
EndIf
$SYSTEMROOT = GUICtrlRead($Input1)
If FileExists($SYSTEMROOT & "\system32\config\system") = 1 Then
GUICtrlSetState($Button2, $gui_enable)
Else
MsgBox(16, "提醒您，重新选择！", "貌似您所选择的目录不是有效的系统目录！")
EndIf
EndIf
EndFunc ;==>step3
Func GET_SCSI_driver()
Local $i = 1
Local $ScsiPort, $scsiname, $ImagePath, $scsienum
While 1
$ScsiPort = RegEnumKey("HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi", $i)
If @error Then ExitLoop
$scsiname = RegRead("HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi" & $ScsiPort, "Driver")
If $scsiname <> "atapi" Then
$ImagePath = StringStripWS(RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" & $scsiname, "ImagePath"), 3)
If FileExists(@SystemDir & "\DRIVERS" & $ImagePath) = 0 Then
_REGUNLOADHIVE("HKLM\hSYS")
_REGUNLOADHIVE("HKLM\xSoft")
MsgBox(4096, "警告", "PE下的" & @SystemDir & "\DRIVERS" & $ImagePath & "文件不存在，驱动注入失败！")
Exit
Else
FileCopy(@SystemDir & "\DRIVERS" & $ImagePath, $SYSTEMROOT & "\system32\DRIVERS" & $ImagePath, 9)
$scsienum = StringStripWS(RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" & $scsiname & "\Enum", "0"), 3)
If StringLeft($scsienum, 4) = "PCI" Then
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & "pci#" & StringMid($scsienum, 5, 17), "ClassGUID", "REG_SZ", "{4D36E97B-E325-11CE-BFC1-08002BE10318}")
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & "pci#" & StringMid($scsienum, 5, 17), "Service", "REG_SZ", $scsiname)
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & "pci#" & StringMid($scsienum, 5), "ClassGUID", "REG_SZ", "{4D36E97B-E325-11CE-BFC1-08002BE10318}")
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & "pci#" & StringMid($scsienum, 5), "Service", "REG_SZ", $scsiname)
ElseIf StringLeft($scsienum, 5) = "SCSI" Then
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & "SCSI#" & StringMid($scsienum, 6, 17), "ClassGUID", "REG_SZ", "{4D36E97B-E325-11CE-BFC1-08002BE10318}")
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & "SCSI#" & StringMid($scsienum, 6, 17), "Service", "REG_SZ", $scsiname)
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & "SCSI#" & StringMid($scsienum, 6), "ClassGUID", "REG_SZ", "{4D36E97B-E325-11CE-BFC1-08002BE10318}")
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & "SCSI#" & StringMid($scsienum, 6), "Service", "REG_SZ", $scsiname)
Else
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & $scsienum, "ClassGUID", "REG_SZ", "{4D36E97B-E325-11CE-BFC1-08002BE10318}")
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Control\CriticalDeviceDatabase" & $scsienum, "Service", "REG_SZ", $scsiname)
EndIf
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Services" & $scsiname, "ImagePath", "REG_SZ", "system32\DRIVERS" & $ImagePath)
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Services" & $scsiname, "ErrorControl", "REG_DWORD", "0x00000001")
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Services" & $scsiname, "Group", "REG_SZ", "scsi miniport")
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Services" & $scsiname, "Start", "REG_DWORD", "0x00000000")
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Services" & $scsiname, "Tag", "REG_DWORD", "0x00000001")
RegWrite("HKEY_LOCAL_MACHINE\hSYS" & $ControlSet & "\Services" & $scsiname, "Type", "REG_DWORD", "0x00000001")
EndIf
EndIf
$i += 1
WEnd
EndFunc ;==>GET_SCSI_driver
Func _REGLOADHIVE($SFILE, $SKEY)
Local $AVARRAY = SPLIT_SROOTKEY($SKEY)
Local $HKEY = REGCONNECTREGISTRY($AVARRAY[0], $AVARRAY[1])
Local $AVCURR[2][2] = [[$SE_RESTORE_NAME, $SE_PRIVILEGE_ENABLED],[$SE_BACKUP_NAME, $SE_PRIVILEGE_ENABLED]]
Local $AVPREV = _SETPRIVILEGE($AVCURR)
Local $AVRLH = DllCall("Advapi32.dll", "long", "RegLoadKey", "hwnd", $HKEY, "str", $AVARRAY[2], "str", $SFILE)
_SETPRIVILEGE($AVPREV)
REGCLOSEKEY($HKEY)
Return SetError($AVRLH[0], 0, Number($AVRLH[0] = 0))
EndFunc ;==>_REGLOADHIVE
Func _REGUNLOADHIVE($SKEY)
Local $AVARRAY = SPLIT_SROOTKEY($SKEY)
Local $HKEY = REGCONNECTREGISTRY($AVARRAY[0], $AVARRAY[1])
Local $AVCURR[2][2] = [[$SE_RESTORE_NAME, $SE_PRIVILEGE_ENABLED],[$SE_BACKUP_NAME, $SE_PRIVILEGE_ENABLED]]
Local $AVPREV = _SETPRIVILEGE($AVCURR)
Local $AVRUH = DllCall("Advapi32.dll", "long", "RegUnLoadKey", "hwnd", $HKEY, "str", $AVARRAY[2])
_SETPRIVILEGE($AVPREV)
REGCLOSEKEY($HKEY)
Return SetError($AVRUH[0], 0, Number($AVRUH[0] = 0))
EndFunc ;==>_REGUNLOADHIVE
Func REGCLOSEKEY($HKEY)
Local $AVRCK = DllCall("Advapi32.dll", "long", "RegCloseKey", "hwnd", $HKEY)
Return SetError($AVRCK[0], 0, Number($AVRCK[0] = 0))
EndFunc ;==>REGCLOSEKEY
Func REGCONNECTREGISTRY($SCOMPUTER, $HKEY)
Local $AVRCR = DllCall("Advapi32.dll", "long", "RegConnectRegistry", "str", $SCOMPUTER, "hwnd", $HKEY, "hwnd*", 0)
Return SetError($AVRCR[0], 0, $AVRCR[3])
EndFunc ;==>REGCONNECTREGISTRY
Func SPLIT_SROOTKEY($SROOTKEY)
Local Const $HKEY_CLASSES_ROOT = 0x80000000
Local Const $HKEY_CURRENT_USER = 0x80000001
Local Const $HKEY_LOCAL_MACHINE = 0x80000002
Local Const $HKEY_USERS = 0x80000003
Local Const $HKEY_CURRENT_CONFIG = 0x80000005
Local $AVHKEY[5][3] = [["HKCR", "HKEY_CLASSES_ROOT", $HKEY_CLASSES_ROOT],["HKCU", "HKEY_CURRENT_USER", $HKEY_CURRENT_USER],["HKLM", "HKEY_LOCAL_MACHINE", $HKEY_LOCAL_MACHINE],["HKU", "HKEY_USERS", $HKEY_USERS],["HKCC", "HKEY_CURRENT_CONFIG", $HKEY_CURRENT_CONFIG]]
Local $AVARRAY[3]
If StringInStr($SROOTKEY, "\") = 1 Then
Local $ASCOMPUTER = StringRegExp($SROOTKEY, "\\\\[^\\]*\", 1)
If Not @error Then
$AVARRAY[0] = StringTrimRight($ASCOMPUTER[0], 1)
$SROOTKEY = StringReplace($SROOTKEY, $ASCOMPUTER[0], "", 1)
EndIf
EndIf
If StringInStr($SROOTKEY, "") = 1 Or StringInStr($SROOTKEY, "", 0, -1) = StringLen($SROOTKEY) Or StringInStr($SROOTKEY, "\") Then
$AVARRAY[0] = ""
Return $AVARRAY
Else
Local $ASSPLIT = StringSplit($SROOTKEY, "")
For $i = 0 To UBound($AVHKEY) - 1
If $ASSPLIT[1] = $AVHKEY[$i][0] Or $ASSPLIT[1] = $AVHKEY[$i][1] Then
$AVARRAY[1] = $AVHKEY[$i][2]
ExitLoop
EndIf
Next
If $AVARRAY[1] = "" Then
$AVARRAY[0] = ""
Return $AVARRAY
EndIf
For $i = 2 To $ASSPLIT[0] - 1
$AVARRAY[2] &= $ASSPLIT[$i] & ""
Next
If $ASSPLIT[0] > 1 Then $AVARRAY[2] &= $ASSPLIT[$ASSPLIT[0]]
EndIf
Return $AVARRAY
EndFunc ;==>SPLIT_SROOTKEY
Func _SETPRIVILEGE($AVPRIVILEGE)
Local $IDIM = UBound($AVPRIVILEGE, 0), $AVPREVSTATE[1][2]
If Not ($IDIM <= 2 And UBound($AVPRIVILEGE, $IDIM) = 2) Then Return SetError(1300, 0, $AVPREVSTATE)
If $IDIM = 1 Then
Local $AVTEMP[1][2]
$AVTEMP[0][0] = $AVPRIVILEGE[0]
$AVTEMP[0][1] = $AVPRIVILEGE[1]
$AVPRIVILEGE = $AVTEMP
$AVTEMP = 0
EndIf
Local $K, $TAGTP = "dword", $ITOKENS = UBound($AVPRIVILEGE, 1)
Do
$K += 1
$TAGTP &= ";dword;long;dword"
Until $K = $ITOKENS
Local $TCURRSTATE, $TPREVSTATE, $PPREVSTATE, $TLUID, $HADVAPI32, $HKERNEL32, $AHGCP, $AVOPT, $AIGLE
$TCURRSTATE = DllStructCreate($TAGTP)
$TPREVSTATE = DllStructCreate($TAGTP)
$PPREVSTATE = DllStructGetPtr($TPREVSTATE)
$TLUID = DllStructCreate("dword;long")
DllStructSetData($TCURRSTATE, 1, $ITOKENS)
$HADVAPI32 = DllOpen("Advapi32.dll")
For $i = 0 To $ITOKENS - 1
DllCall($HADVAPI32, "int", "LookupPrivilegeValue", "str", "", "str", $AVPRIVILEGE[$i][0], "ptr", DllStructGetPtr($TLUID))
DllStructSetData($TCURRSTATE, 3 * $i + 2, DllStructGetData($TLUID, 1))
DllStructSetData($TCURRSTATE, 3 * $i + 3, DllStructGetData($TLUID, 2))
DllStructSetData($TCURRSTATE, 3 * $i + 4, $AVPRIVILEGE[$i][1])
Next
$HKERNEL32 = DllOpen("Kernel32.dll")
$AHGCP = DllCall($HKERNEL32, "hwnd", "GetCurrentProcess")
$AVOPT = DllCall($HADVAPI32, "int", "OpenProcessToken", "hwnd", $AHGCP[0], "dword", BitOR($TOKEN_ADJUST_PRIVILEGES, $TOKEN_QUERY), "hwnd*", 0)
DllCall($HADVAPI32, "int", "AdjustTokenPrivileges", "hwnd", $AVOPT[3], "int", False, "ptr", DllStructGetPtr($TCURRSTATE), "dword", DllStructGetSize($TCURRSTATE), "ptr", $PPREVSTATE, "dword*", 0)
$AIGLE = DllCall($HKERNEL32, "dword", "GetLastError")
DllCall($HKERNEL32, "int", "CloseHandle", "hwnd", $AVOPT[3])
DllClose($HKERNEL32)
Local $ICOUNT = DllStructGetData($TPREVSTATE, 1)
If $ICOUNT > 0 Then
Local $PLUID, $AVLPN, $TNAME, $AVPREVSTATE[$ICOUNT][2]
For $i = 0 To $ICOUNT - 1
$PLUID = $PPREVSTATE + 12 * $i + 4
$AVLPN = DllCall($HADVAPI32, "int", "LookupPrivilegeName", "str", "", "ptr", $PLUID, "ptr", 0, "dword*", 0)
$TNAME = DllStructCreate("char[" & $AVLPN[4] & "]")
DllCall($HADVAPI32, "int", "LookupPrivilegeName", "str", "", "ptr", $PLUID, "ptr", DllStructGetPtr($TNAME), "dword*", DllStructGetSize($TNAME))
$AVPREVSTATE[$i][0] = DllStructGetData($TNAME, 1)
$AVPREVSTATE[$i][1] = DllStructGetData($TPREVSTATE, 3 * $i + 4)
Next
EndIf
DllClose($HADVAPI32)
Return SetError($AIGLE[0], 0, $AVPREVSTATE)
EndFunc ;==>_SETPRIVILEGE
Func _WinAPI_CreateSemaphore($sName);阻止重复运行
Local $Sema, $Turn
$Sema = DllCall("Kernel32.dll", "ptr", "CreateSemaphore", "ptr", 0, "long", True, "long", True, "str", $sName)
$Turn = DllCall("Kernel32.dll", "int", "WaitForSingleObject", "ptr", $Sema[0], "int", False)
Return $Turn[0]
EndFunc ;==>_WinAPI_CreateSemaphore

复制代码