List of SCSI commands

Code	Command
00	TEST UNIT READY (mandatory)
01	RECALIBRATE or REWIND
03	REQUEST SENSE (mandatory except RBC)
04	FORMAT UNIT
05	READ BLOCK LIMITS
07	REASSIGN BLOCKS
07	INITIALIZE ELEMENT STATUS
08	READ (6)
0A	WRITE (6)
0B	SEEK (6)
0F	READ REVERSE (6)
10	WRITE FILEMARKS (6)
11	SPACE (6)
12	INQUIRY (mandatory)
13	VERIFY(6)
14	RECOVER BUFFERED DATA
15	MODE SELECT (6)
16	RESERVE (6)
17	RELEASE (6)
18	COPY
19	ERASE (6)
1A	MODE SENSE (6)
1B	START/STOP UNIT
1B	LOAD UNLOAD
1C	RECEIVE DIAGNOSTIC RESULTS
1D	SEND DIAGNOSTIC
1E	PREVENT/ALLOW MEDIUM REMOVAL
23	READ FORMAT CAPACITIES (MMC)
24	SET WINDOW
25	READ CAPACITY (10)
28	READ (10)
29	READ GENERATION
2A	WRITE (10)
2B	SEEK (10)
2C	ERASE (10)
2D	READ UPDATED BLOCK
2E	WRITE AND VERIFY (10)
2F	VERIFY (10)
30	SEARCH DATA HIGH (10)
31	SEARCH DATA EQUAL (10)
32	SEARCH DATA LOW (10)
33	SET LIMITS (10)
34	PRE-FETCH (10)
35	SYNCHRONIZE CACHE (10)
36	LOCK/UNLOCK CACHE (10)
37	READ DEFECT DATA (10)
37	INITIALIZE ELEMENT STATUS WITH RANGE
38	MEDIUM SCAN
39	COMPARE
3A	COPY AND VERIFY
3B	WRITE BUFFER
3C	READ BUFFER
3D	UPDATE BLOCK
3E	READ LONG
3F	WRITE LONG
40	CHANGE DEFINITION
41	WRITE SAME (10)
44	REPORT DENSITY SUPPORT
45	PLAY AUDIO (10)
46	GET CONFIGURATION
47	PLAY AUDIO MSF
48	AUDIO TRACK INDEX (not mentioned in T10 overview)
49	AUDIO TRACK RELATIVE 10 (not mentioned in T10 overview)
4A	GET EVENT STATUS NOTIFICATION
4B	PAUSE / RESUME
4C	LOG SELECT
4D	LOG SENSE
50	XDWRITE (10)
51	XPWRITE (10) /*READ DISC INFORMATION CDB (in mmc5r02c 6.22.2)*/
52	XDREAD (10)
53	XDWRITEREAD (10)
54	SEND OPC INFORMATION
55	MODE SELECT (10)
56	RESERVE (10)
57	RELEASE (10)
58	REPAIR TRACK
5A	MODE SENSE (10)
5B	CLOSE TRACK / SESSION
5C	READ BUFFER CAPACITY
5D	SEND CUE SHEET
5E	PERSISTENT RESERVE IN
5F	PERSISTENT RESERVE OUT
7E	EXTENDED CDB
7F	VARIABLE LENGTH CDB
80	XDWRITE EXTENDED (16)
80	WRITE FILEMARKS (16)
81	REBUILD (16)
81	READ REVERSE (16)
82	REGENERATE (16)
83	EXTENDED COPY
84	RECEIVE COPY RESULTS
85	ATA COMMAND PASS THROUGH (16)
86	ACCESS CONTROL IN
87	ACCESS CONTROL OUT
88	READ (16)
89	COMPARE AND WRITE
8A	WRITE (16)
8B	ORWRITE
8C	READ ATTRIBUTE
8D	WRITE ATTRIBUTE
8E	WRITE AND VERIFY (16)
8F	VERIFY (16)
90	PRE-FETCH (16)
91	SYNCHRONIZE CACHE (16)
92	SPACE (16)
92	LOCK UNLOCK CACHE (16)
93	WRITE SAME (16)
9E	SERVICE ACTION IN (16)
9F	SERVICE ACTION OUT (16)
A0	REPORT LUNS
A1	ATA COMMAND PASS THROUGH (12)
A2	SECURITY PROTOCOL IN
A2	SEND EVENT (not mentioned in T10 overview)
A3	REPORT SUPPORTED OPCODES
A4	MAINTENANCE (OUT) (REPORT_KEY)
A5	MOVE MEDIUM
A5	PLAY AUDIO 12 (not mentioned in T10 overview)
A6	EXCHANGE MEDIUM
A7	MOVE MEDIUM ATTACHED
A8	READ (12)
A9	SERVICE ACTION OUT (12)
A9	AUDIO TRACK RELATIVE 12 (not mentioned in T10 overview)
AA	WRITE (12)
AB	SERVICE ACTION IN (12)
AC	ERASE (12)
AD	READ DVD STRUCTURE
AE	WRITE AND VERIFY (12)
AF	VERIFY (12)
B0	SEARCH DATA HIGH (12)
B1	SEARCH DATA EQUAL (12)
B2	SEARCH DATA LOW (12)
B3	SET LIMITS (12)
B4	READ ELEMENT STATUS ATTACHED
B5	SECURITY PROTOCOL OUT
B6	SEND VOLUME TAG
B7	READ DEFECT DATA (12)
B8	READ ELEMENT STATUS
B9	READ CD MSF
BA	REDUNDANCY GROUP (IN)
BB	REDUNDANCY GROUP (OUT)
BC	SPARE (IN)
BC	PLAY CD (not mentioned in T10 overview)
BD	SPARE (OUT)
BE	VOLUME SET (IN)
BF	VOLUME SET (OUT)

#define IOCTL_EXAMPLE_SAMPLE_DIRECT_IN_IO  CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_IN_DIRECT, FILE_READ_DATA | FILE_WRITE_DATA)

METHOD_IN_DIRECT
METHOD_IOUT_DIRECT
METHOD_BUFFERED
METHOD_NEITHER : 3(11b), App 메모리 주소를 사용(?)

/* coded by Ray Linn */
        IOCTL_STORAGE_BASE = FileDevice.MASS_STORAGE,
        IOCTL_STORAGE_CHECK_VERIFY = (IOCTL_STORAGE_BASE << 16) | (0x0200 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_CHECK_VERIFY2 = (IOCTL_STORAGE_BASE << 16) | (0x0200 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_MEDIA_REMOVAL = (IOCTL_STORAGE_BASE << 16) | (0x0201 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_EJECT_MEDIA = (IOCTL_STORAGE_BASE << 16) | (0x0202 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_LOAD_MEDIA = (IOCTL_STORAGE_BASE << 16) | (0x0203 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_LOAD_MEDIA2 = (IOCTL_STORAGE_BASE << 16) | (0x0203 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_RESERVE = (IOCTL_STORAGE_BASE << 16) | (0x0204 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
       IOCTL_STORAGE_RELEASE = (IOCTL_STORAGE_BASE << 16) | (0x0205 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_FIND_NEW_DEVICES = (IOCTL_STORAGE_BASE << 16) | (0x0206 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_MCN_CONTROL = (IOCTL_STORAGE_BASE << 16) | (0x0251 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_MEDIA_TYPES = (IOCTL_STORAGE_BASE << 16) | (0x0300 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_MEDIA_TYPES_EX = (IOCTL_STORAGE_BASE << 16) | (0x0301 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_MEDIA_SERIAL_NUMBER = (IOCTL_STORAGE_BASE << 16) | (0x0304 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_HOTPLUG_INFO = (IOCTL_STORAGE_BASE << 16) | (0x0305 << 2) | (Method.Buffered) | (0 << 14),
      
        IOCTL_STORAGE_SET_HOTPLUG_INFO = (IOCTL_STORAGE_BASE << 16) | (0x0306 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_RESET_BUS = (IOCTL_STORAGE_BASE << 16) | (0x0400 << 2) | (Method.Buffered) | (FileAccess.Read << 14),

        IOCTL_STORAGE_RESET_DEVICE = (IOCTL_STORAGE_BASE << 16) | (0x0401 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_BREAK_RESERVATION = (IOCTL_STORAGE_BASE << 16) | (0x0405 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_PERSISTENT_RESERVE_IN = (IOCTL_STORAGE_BASE << 16) | (0x0406 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_PERSISTENT_RESERVE_OUT = (IOCTL_STORAGE_BASE << 16) | (0x0407 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_GET_DEVICE_NUMBER = (IOCTL_STORAGE_BASE << 16) | (0x0420 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_PREDICT_FAILURE = (IOCTL_STORAGE_BASE << 16) | (0x0440 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_READ_CAPACITY = (IOCTL_STORAGE_BASE << 16) | (0x0450 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_QUERY_PROPERTY = (IOCTL_STORAGE_BASE << 16) | (0x0500 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_MANAGE_DATA_SET_ATTRIBUTES = (IOCTL_STORAGE_BASE << 16) | (0x0501 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        IOCTL_STORAGE_GET_BC_PROPERTIES = (IOCTL_STORAGE_BASE << 16) | (0x0600 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_ALLOCATE_BC_STREAM = (IOCTL_STORAGE_BASE << 16) | (0x0601 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_FREE_BC_STREAM = (IOCTL_STORAGE_BASE << 16) | (0x0602 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_CHECK_PRIORITY_HINT_SUPPORT = (IOCTL_STORAGE_BASE << 16) | (0x0620 << 2) | (Method.Buffered) | (0 << 14),
        OBSOLETE_IOCTL_STORAGE_RESET_BUS = (IOCTL_STORAGE_BASE << 16) | (0x0400 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        OBSOLETE_IOCTL_STORAGE_RESET_DEVICE = (IOCTL_STORAGE_BASE << 16) | (0x0401 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_BASE = FileDevice.DISK,
        IOCTL_DISK_GET_DRIVE_GEOMETRY = (IOCTL_DISK_BASE << 16) | (0x0000 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_GET_PARTITION_INFO = (IOCTL_DISK_BASE << 16) | (0x0001 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_SET_PARTITION_INFO = (IOCTL_DISK_BASE << 16) | (0x0002 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_DRIVE_LAYOUT = (IOCTL_DISK_BASE << 16) | (0x0003 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_SET_DRIVE_LAYOUT = (IOCTL_DISK_BASE << 16) | (0x0004 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_VERIFY = (IOCTL_DISK_BASE << 16) | (0x0005 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_FORMAT_TRACKS = (IOCTL_DISK_BASE << 16) | (0x0006 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_REASSIGN_BLOCKS = (IOCTL_DISK_BASE << 16) | (0x0007 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_PERFORMANCE = (IOCTL_DISK_BASE << 16) | (0x0008 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_IS_WRITABLE = (IOCTL_DISK_BASE << 16) | (0x0009 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_LOGGING = (IOCTL_DISK_BASE << 16) | (0x000a << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_FORMAT_TRACKS_EX = (IOCTL_DISK_BASE << 16) | (0x000b << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_HISTOGRAM_STRUCTURE = (IOCTL_DISK_BASE << 16) | (0x000c << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_HISTOGRAM_DATA = (IOCTL_DISK_BASE << 16) | (0x000d << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_HISTOGRAM_RESET = (IOCTL_DISK_BASE << 16) | (0x000e << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_REQUEST_STRUCTURE = (IOCTL_DISK_BASE << 16) | (0x000f << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_REQUEST_DATA = (IOCTL_DISK_BASE << 16) | (0x0010 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_PERFORMANCE_OFF = (IOCTL_DISK_BASE << 16) | (0x0018 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_CONTROLLER_NUMBER = (IOCTL_DISK_BASE << 16) | (0x0011 << 2) | (Method.Buffered) | (0 << 14),
        SMART_GET_VERSION = (IOCTL_DISK_BASE << 16) | (0x0020 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        SMART_SEND_DRIVE_COMMAND = (IOCTL_DISK_BASE << 16) | (0x0021 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        SMART_RCV_DRIVE_DATA = (IOCTL_DISK_BASE << 16) | (0x0022 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_PARTITION_INFO_EX = (IOCTL_DISK_BASE << 16) | (0x0012 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_SET_PARTITION_INFO_EX = (IOCTL_DISK_BASE << 16) | (0x0013 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_DRIVE_LAYOUT_EX = (IOCTL_DISK_BASE << 16) | (0x0014 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_SET_DRIVE_LAYOUT_EX = (IOCTL_DISK_BASE << 16) | (0x0015 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_CREATE_DISK = (IOCTL_DISK_BASE << 16) | (0x0016 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_LENGTH_INFO = (IOCTL_DISK_BASE << 16) | (0x0017 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_GET_DRIVE_GEOMETRY_EX = (IOCTL_DISK_BASE << 16) | (0x0028 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_REASSIGN_BLOCKS_EX = (IOCTL_DISK_BASE << 16) | (0x0029 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_UPDATE_DRIVE_SIZE = (IOCTL_DISK_BASE << 16) | (0x0032 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GROW_PARTITION = (IOCTL_DISK_BASE << 16) | (0x0034 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_CACHE_INFORMATION = (IOCTL_DISK_BASE << 16) | (0x0035 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_SET_CACHE_INFORMATION = (IOCTL_DISK_BASE << 16) | (0x0036 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_WRITE_CACHE_STATE = (IOCTL_DISK_BASE << 16) | (0x0037 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        OBSOLETE_DISK_GET_WRITE_CACHE_STATE = (IOCTL_DISK_BASE << 16) | (0x0037 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_DELETE_DRIVE_LAYOUT = (IOCTL_DISK_BASE << 16) | (0x0040 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_UPDATE_PROPERTIES = (IOCTL_DISK_BASE << 16) | (0x0050 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_FORMAT_DRIVE = (IOCTL_DISK_BASE << 16) | (0x00f3 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_SENSE_DEVICE = (IOCTL_DISK_BASE << 16) | (0x00f8 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_CHECK_VERIFY = (IOCTL_DISK_BASE << 16) | (0x0200 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_MEDIA_REMOVAL = (IOCTL_DISK_BASE << 16) | (0x0201 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_EJECT_MEDIA = (IOCTL_DISK_BASE << 16) | (0x0202 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_LOAD_MEDIA = (IOCTL_DISK_BASE << 16) | (0x0203 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_RESERVE = (IOCTL_DISK_BASE << 16) | (0x0204 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_RELEASE = (IOCTL_DISK_BASE << 16) | (0x0205 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_FIND_NEW_DEVICES = (IOCTL_DISK_BASE << 16) | (0x0206 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_GET_MEDIA_TYPES = (IOCTL_DISK_BASE << 16) | (0x0300 << 2) | (Method.Buffered) | (0 << 14),

        IOCTL_DISK_RESET_SNAPSHOT_INFO = (IOCTL_DISK_BASE << 16) | (0x0084 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_CHANGER_BASE = FileDevice.CHANGER,
        IOCTL_CHANGER_GET_PARAMETERS = (IOCTL_CHANGER_BASE << 16) | (0x0000 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_GET_STATUS = (IOCTL_CHANGER_BASE << 16) | (0x0001 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_GET_PRODUCT_DATA = (IOCTL_CHANGER_BASE << 16) | (0x0002 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_SET_ACCESS = (IOCTL_CHANGER_BASE << 16) | (0x0004 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_CHANGER_GET_ELEMENT_STATUS = (IOCTL_CHANGER_BASE << 16) | (0x0005 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_CHANGER_INITIALIZE_ELEMENT_STATUS = (IOCTL_CHANGER_BASE << 16) | (0x0006 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_SET_POSITION = (IOCTL_CHANGER_BASE << 16) | (0x0007 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_EXCHANGE_MEDIUM = (IOCTL_CHANGER_BASE << 16) | (0x0008 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_MOVE_MEDIUM = (IOCTL_CHANGER_BASE << 16) | (0x0009 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_REINITIALIZE_TRANSPORT = (IOCTL_CHANGER_BASE << 16) | (0x000A << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_QUERY_VOLUME_TAGS = (IOCTL_CHANGER_BASE << 16) | (0x000B << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),

        IOCTL_SERIAL_LSRMST_INSERT = (FileDevice.SERIAL_PORT << 16) | (31 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_EXPOSE_HARDWARE = (FileDevice.SERENUM << 16) | (128 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_REMOVE_HARDWARE = (FileDevice.SERENUM << 16) | (129 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_PORT_DESC = (FileDevice.SERENUM << 16) | (130 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_GET_PORT_NAME = (FileDevice.SERENUM << 16) | (131 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_OPLOCK_LEVEL_1 = (FileDevice.FILE_SYSTEM << 16) | (0 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_OPLOCK_LEVEL_2 = (FileDevice.FILE_SYSTEM << 16) | (1 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_BATCH_OPLOCK = (FileDevice.FILE_SYSTEM << 16) | (2 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_OPLOCK_BREAK_ACKNOWLEDGE = (FileDevice.FILE_SYSTEM << 16) | (3 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_OPBATCH_ACK_CLOSE_PENDING = (FileDevice.FILE_SYSTEM << 16) | (4 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_OPLOCK_BREAK_NOTIFY = (FileDevice.FILE_SYSTEM << 16) | (5 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_LOCK_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (6 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_UNLOCK_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (7 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DISMOUNT_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (8 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_VOLUME_MOUNTED = (FileDevice.FILE_SYSTEM << 16) | (10 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_PATHNAME_VALID = (FileDevice.FILE_SYSTEM << 16) | (11 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MARK_VOLUME_DIRTY = (FileDevice.FILE_SYSTEM << 16) | (12 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_RETRIEVAL_POINTERS = (FileDevice.FILE_SYSTEM << 16) | (14 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_GET_COMPRESSION = (FileDevice.FILE_SYSTEM << 16) | (15 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_COMPRESSION = (FileDevice.FILE_SYSTEM << 16) | (16 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        FSCTL_SET_BOOTLOADER_ACCESSED = (FileDevice.FILE_SYSTEM << 16) | (19 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_OPLOCK_BREAK_ACK_NO_2 = (FileDevice.FILE_SYSTEM << 16) | (20 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_INVALIDATE_VOLUMES = (FileDevice.FILE_SYSTEM << 16) | (21 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_FAT_BPB = (FileDevice.FILE_SYSTEM << 16) | (22 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_FILTER_OPLOCK = (FileDevice.FILE_SYSTEM << 16) | (23 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_FILESYSTEM_GET_STATISTICS = (FileDevice.FILE_SYSTEM << 16) | (24 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_NTFS_VOLUME_DATA = (FileDevice.FILE_SYSTEM << 16) | (25 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_NTFS_FILE_RECORD = (FileDevice.FILE_SYSTEM << 16) | (26 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_VOLUME_BITMAP = (FileDevice.FILE_SYSTEM << 16) | (27 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_GET_RETRIEVAL_POINTERS = (FileDevice.FILE_SYSTEM << 16) | (28 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_MOVE_FILE = (FileDevice.FILE_SYSTEM << 16) | (29 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_VOLUME_DIRTY = (FileDevice.FILE_SYSTEM << 16) | (30 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_ALLOW_EXTENDED_DASD_IO = (FileDevice.FILE_SYSTEM << 16) | (32 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_FIND_FILES_BY_SID = (FileDevice.FILE_SYSTEM << 16) | (35 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SET_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (38 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (39 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DELETE_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (40 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_REPARSE_POINT = (FileDevice.FILE_SYSTEM << 16) | (41 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_REPARSE_POINT = (FileDevice.FILE_SYSTEM << 16) | (42 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DELETE_REPARSE_POINT = (FileDevice.FILE_SYSTEM << 16) | (43 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_ENUM_USN_DATA = (FileDevice.FILE_SYSTEM << 16) | (44 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SECURITY_ID_CHECK = (FileDevice.FILE_SYSTEM << 16) | (45 << 2) | (Method.Neither) | (FileAccess.Read << 14),
        FSCTL_READ_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (46 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SET_OBJECT_ID_EXTENDED = (FileDevice.FILE_SYSTEM << 16) | (47 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CREATE_OR_GET_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (48 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_SPARSE = (FileDevice.FILE_SYSTEM << 16) | (49 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_ZERO_DATA = (FileDevice.FILE_SYSTEM << 16) | (50 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_QUERY_ALLOCATED_RANGES = (FileDevice.FILE_SYSTEM << 16) | (51 << 2) | (Method.Neither) | (FileAccess.Read << 14),
        FSCTL_ENABLE_UPGRADE = (FileDevice.FILE_SYSTEM << 16) | (52 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_SET_ENCRYPTION = (FileDevice.FILE_SYSTEM << 16) | (53 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_ENCRYPTION_FSCTL_IO = (FileDevice.FILE_SYSTEM << 16) | (54 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_WRITE_RAW_ENCRYPTED = (FileDevice.FILE_SYSTEM << 16) | (55 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_READ_RAW_ENCRYPTED = (FileDevice.FILE_SYSTEM << 16) | (56 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_CREATE_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (57 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_READ_FILE_USN_DATA = (FileDevice.FILE_SYSTEM << 16) | (58 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_WRITE_USN_CLOSE_RECORD = (FileDevice.FILE_SYSTEM << 16) | (59 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_EXTEND_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (60 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (61 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DELETE_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (62 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MARK_HANDLE = (FileDevice.FILE_SYSTEM << 16) | (63 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SIS_COPYFILE = (FileDevice.FILE_SYSTEM << 16) | (64 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SIS_LINK_FILES = (FileDevice.FILE_SYSTEM << 16) | (65 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        FSCTL_RECALL_FILE = (FileDevice.FILE_SYSTEM << 16) | (69 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_READ_FROM_PLEX = (FileDevice.FILE_SYSTEM << 16) | (71 << 2) | (Method.OutDirect) | (FileAccess.Read << 14),
        FSCTL_FILE_PREFETCH = (FileDevice.FILE_SYSTEM << 16) | (72 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MAKE_MEDIA_COMPATIBLE = (FileDevice.FILE_SYSTEM << 16) | (76 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_SET_DEFECT_MANAGEMENT = (FileDevice.FILE_SYSTEM << 16) | (77 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_QUERY_SPARING_INFO = (FileDevice.FILE_SYSTEM << 16) | (78 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_ON_DISK_VOLUME_INFO = (FileDevice.FILE_SYSTEM << 16) | (79 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_VOLUME_COMPRESSION_STATE = (FileDevice.FILE_SYSTEM << 16) | (80 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_MODIFY_RM = (FileDevice.FILE_SYSTEM << 16) | (81 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_QUERY_RM_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (82 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_ROLLFORWARD_REDO = (FileDevice.FILE_SYSTEM << 16) | (84 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_ROLLFORWARD_UNDO = (FileDevice.FILE_SYSTEM << 16) | (85 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_START_RM = (FileDevice.FILE_SYSTEM << 16) | (86 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_SHUTDOWN_RM = (FileDevice.FILE_SYSTEM << 16) | (87 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_READ_BACKUP_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (88 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_WRITE_BACKUP_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (89 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_CREATE_SECONDARY_RM = (FileDevice.FILE_SYSTEM << 16) | (90 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_GET_METADATA_INFO = (FileDevice.FILE_SYSTEM << 16) | (91 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_GET_TRANSACTED_VERSION = (FileDevice.FILE_SYSTEM << 16) | (92 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_SAVEPOINT_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (94 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_CREATE_MINIVERSION = (FileDevice.FILE_SYSTEM << 16) | (95 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_TRANSACTION_ACTIVE = (FileDevice.FILE_SYSTEM << 16) | (99 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_SET_ZERO_ON_DEALLOCATION = (FileDevice.FILE_SYSTEM << 16) | (101 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (102 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (103 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_WAIT_FOR_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (104 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_INITIATE_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (106 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSC_INTERNAL = (FileDevice.FILE_SYSTEM << 16) | (107 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SHRINK_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (108 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_SHORT_NAME_BEHAVIOR = (FileDevice.FILE_SYSTEM << 16) | (109 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DFSR_SET_GHOST_HANDLE_STATE = (FileDevice.FILE_SYSTEM << 16) | (110 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES = (FileDevice.FILE_SYSTEM << 16) | (120 << 2) | (Method.Buffered) | (FileAccess.Read),
        FSCTL_TXFS_LIST_TRANSACTIONS = (FileDevice.FILE_SYSTEM << 16) | (121 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_QUERY_PAGEFILE_ENCRYPTION = (FileDevice.FILE_SYSTEM << 16) | (122 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_RESET_VOLUME_ALLOCATION_HINTS = (FileDevice.FILE_SYSTEM << 16) | (123 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_DEPENDENT_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (124 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SD_GLOBAL_CHANGE = (FileDevice.FILE_SYSTEM << 16) | (125 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_READ_BACKUP_INFORMATION2 = (FileDevice.FILE_SYSTEM << 16) | (126 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_LOOKUP_STREAM_FROM_CLUSTER = (FileDevice.FILE_SYSTEM << 16) | (127 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 = (FileDevice.FILE_SYSTEM << 16) | (128 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_FILE_TYPE_NOTIFICATION = (FileDevice.FILE_SYSTEM << 16) | (129 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_BOOT_AREA_INFO = (FileDevice.FILE_SYSTEM << 16) | (140 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_RETRIEVAL_POINTER_BASE = (FileDevice.FILE_SYSTEM << 16) | (141 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_PERSISTENT_VOLUME_STATE = (FileDevice.FILE_SYSTEM << 16) | (142 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_PERSISTENT_VOLUME_STATE = (FileDevice.FILE_SYSTEM << 16) | (143 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_OPLOCK = (FileDevice.FILE_SYSTEM << 16) | (144 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_TUNNEL_REQUEST = (FileDevice.FILE_SYSTEM << 16) | (145 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_CSV_FILE = (FileDevice.FILE_SYSTEM << 16) | (146 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_FILE_SYSTEM_RECOGNITION = (FileDevice.FILE_SYSTEM << 16) | (147 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_GET_VOLUME_PATH_NAME = (FileDevice.FILE_SYSTEM << 16) | (148 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT = (FileDevice.FILE_SYSTEM << 16) | (149 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME = (FileDevice.FILE_SYSTEM << 16) | (150 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_FILE_ON_CSV_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (151 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MARK_AS_SYSTEM_HIVE = FSCTL_SET_BOOTLOADER_ACCESSED,
        //IOCTL_AVIO_ALLOCATE_STREAM    =    (FILE_DEVICE_AVIO<<16)|( 1<<2)|( Method.Buffered)|( 0<<14),
        //IOCTL_AVIO_FREE_STREAM    =    (FILE_DEVICE_AVIO<<16)|( 2<<2)|( Method.Buffered)|( 0<<14),
        //IOCTL_AVIO_MODIFY_STREAM    =    (FILE_DEVICE_AVIO<<16)|( 3<<2)|( Method.Buffered)|( 0<<14),
        IOCTL_VOLUME_BASE = 0x00000056,
        IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS = (IOCTL_VOLUME_BASE << 16) | (0 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_VOLUME_ONLINE = (IOCTL_VOLUME_BASE << 16) | (2 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_VOLUME_OFFLINE = (IOCTL_VOLUME_BASE << 16) | (3 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_VOLUME_IS_CLUSTERED = (IOCTL_VOLUME_BASE << 16) | (12 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_VOLUME_GET_GPT_ATTRIBUTES = (IOCTL_VOLUME_BASE << 16) | (14 << 2) | (Method.Buffered) | (0 << 14)

UserMode Hooking

일단 프로세스를 조작하는 API인
NTDLL.DLL의
NtOpenProcess, NtTerminateProcess, NtReadVirtualMemory,NtWriteVirtualMemory

KERNEL32.DLL의 DebugActiveProcess 등이 후킹되어야 한다

그리고 WINSTA.DLL의 WinStationTerminateProcess를 후킹하여 Terminal Service를 이용한
프로세스 종료를 차단합니다

Internal 함수 후킹

PspTerminateThreadByPointer:

프로세스 종료의 가장 근본적인 API로 쓰레드를 종료시키는 가장 저수준의 API입니다. 따라서 이 함수를 후킹해놓으면 프로세스를 함부로 종료할 수 없습니다. 이 API는 NtTerminateThread()에서 ObfDereferenceObject()전에 호출되므로 코드바이트로부터 이를 추적해나갈 수 있습니다.

KiAttachProcess:

KeAttachProcess/KeStackAttachProcess의 Internal 함수로 후킹할 수 있으면 해놓는게 좋습니다. KeAttachProcess()에서 호출하는데, 이것이 이미 후킹되어있었을 수도 있으므로, 파일로부터 구해와야 합니다. 이 방법은 제가 블로그에 쓴 적 있습니다.

참고: [Unexported Symbol] KiAttachProcess() 주소값 구하기

DKOM

적절한 DKOM은 강력한 무기가 될 수 있습니다. 아래와 같은 방법을 사용함으로써 프로세스를 효과적으로 보호할 수 있습니다.

1. DebugPort = NULL

디버거를 무력화하여 예외 처리를 프로세스에게 넘기는 방법으로, 디버거를 무력화시키는 방법중 하나입니다. 이 값이 NULL인지 아닌지 체크하는 방법도 비교적 괜찮은 방법이나, NT4/2000계열에서는 간혹 쓰레기값이 들어있는 경우가 있기 때문에 권장하지 않습니다.

EPROCESS에서의 DebugPort의 Offset 구하는 방법은 대략 아래와 같이 코딩할 수 있습니다.

VOID CalcHandleTableOffset(VOID)
{

PEPROCESS Proc = IoGetCurrentProcess();
HANDLE PID = PsGetCurrentProcessId();
PVOID GuessHandleTable = NULL;
int i = 0;
for(i = 0; i < PAGE_SIZE; i+=4)
{

GuessHandleTable = *(PVOID *)((PCHAR)Proc + i);
if(MmIsAddressValid(GuessHandleTable))
{

if(*(PHANDLE)((PCHAR)GuessHandleTable + 0x08) == PID)
{
         HANDLE_TABLE_OFFSET = i;
         return;
}

}

}

}

CalcHandleTableOffset();

DEBUG_PORT_OFFSET = HANDLE_TABLE_OFFSET - 8;

2. EPROCESS->ActiveProcessLinks Unlinking

프로세스를 숨겨서 보호합니다. 추가적으로 EPROCESS의 UniqueProcessId를 이상한 값으로 바꾸면 핸들을 얻는것을 어느정도 막을 수 있습니다. (물론 관련 ETHREAD 구조체에서 PID를 얻을수도 있기 때문에 이 방법이 꼭 좋은건 아닙니다.)

만약 프로세스 ID를 바꾸었다면 프로세스 종료 전에 복구하여야합니다.(그렇지 않으면 CID_HANDLE_DELETION 블루스크린을 맛보시게 될겁니다.)

그리고, 추가적으로 PspCidTable이라는 Unexported symbol에서 프로세스 Offset을 NULL로 만들어놓으면, 근본적으로 핸들을 얻을 수가 없을겁니다. PspCidTable은 PsLookupProcessByProcessId()에서 ExMapHandleToPointer(Ex)를 호출하기 전에 참조하는 심볼로, 바이트 코드를 트래버싱하거나, XP 이상에서는 KPCR->KdVersionBlock의 PspCidTable 필드를 참조해서 구할 수도 있습니다.

3. EPROCESS::HandleTable Unlinking

숨겨진 프로세스를 찾는 대표적인 방법으로는 크게 두가지가 있습니다. EPROCESS::HandleTable를 traverse 하거나 PspCidTable을 트레버싱하는 방법입니다. 물론, ETHREAD를 이용하거나 기타 여러가지 방법(brute-force 등등)을 이용하면 뚫리긴 합니다만, HandleTable을 끊음으로서 더욱 찾기 힘들게 할 수 있습니다.

위에서 언급한 ActiveProcessLinks와 핸들 테이블은 아래와 같은 LIST_ENTRY 구조입니다.

typedef struct _LIST_ENTRY {
    PLIST_ENTRY Flink;
    PLIST_ENTRY Blink;
} LIST_ENTRY, *PLIST_ENTRY;

드라이버를 효과적으로 숨기는 방법

1. PsLoadedModuleList unlinking

PsLoadedModuleList는 DRIVER_OBJECT 구조체의 DriverSection에 의해 Point됩니다. 그리고 아래와 같은 구조를 가지고 있습니다.(출처: rootkit.com 책)


typedef struct _MODULE_ENTRY
{

LIST_ENTRY ModuleListEntry;
DWORD Unknown1[4];
DWORD BaseAddress;
DWORD DriverStart;
DWORD Unknown2;
UNICODE_STRING Driver_Path;
UNICODE_STRING Driver_Name;

} MODULE_ENTRY, *PMODULE_ENTRY;

ModuleListEntry를 순회해서 BaseAddress가 DriverObject->DriverStart와 같은 엔트리를 찾아내서 ModuleListEntry를 끊어주면 숨겨줄 수 있을겁니다.

2. IoGetDeviceObjectPointer Hook

심볼릭 링크로부터 DEVICE_OBJECT를 얻는 대표적인 방법으로 이를 후킹하면 DEVICE_OBJECT를 얻는걸 막을 수 있고, 결과적으로 드라이버를 2차적인 루트킷 스캐너로부터 숨길 수 있게됩니다. DEVICE_OBJECT는 DRIVER_OBJECT를 포인트하기 때문에, 필수적으로 후킹해야합니다.

3. ZwOpenKey() Hook

드라이버 서비스 키를 traversing 하여 드라이버 정보를 얻는것을 차단할 수 있습니다.

4. IoCreateFile() Hook

드라이버 파일을 접근하지 못하게 함으로써 드라이버에 대한 접근을 차단합니다. ZwCreateFile()은 IoCreateFile을 직접 호출하므로, IoCreateFile()을 후킹하면 탐지되기가 더 어려우며, 그만큼 효과를 발휘하게 됩니다.