BLIND
Windows 用户态检测工具，将 hooks、launch-gate injection、direct-syscall 探测和运行时 self-maps 转化为可读的进程行为。
是否曾好奇过一个可执行文件到底在做什么？它调用了哪些 API？它是否“可疑”，或者你想阻止它触碰某些内容？**BLIND** 正是你寻找答案的完美工具！
**BLIND** 是一款 Windows 用户态进程检测工具。它会注入或手动映射 `BLIND.dll`，在用户代码开始运行之前部署好 NT/module/Winsock/VEH hook 表面，并输出结构化的遥测数据，用于揭示并解释进程行为：API 调用、调用者、stack/register 上下文、内存保护属性变更、direct-syscall 页面、launch-gate 状态以及运行时 self-mapping 元数据。
当你需要验证 EDR/终端检测、逆向分析恶意进程行为、查明进程的具体动作、测试 hook 策略，或者希望基于具体的 Windows 运行时证据构建本地传感器时，本工具将大显身手。
## 环境要求
Windows 10 22H2 或更高版本，64 位系统，并安装有 Visual Studio 2022+ 及 MSVC C++ 工具链。
## 功能说明
- 启动受控的进程，通过 `LoadLibrary` 或 manual map 加载 `BLIND.dll`，并在目标进程恢复运行前验证其就绪状态
- 记录 NT/module/Winsock API 活动，包含调用者偏移量、stack 角色标签、register 快照、拒绝策略以及调用者过滤器
- 将繁杂的内存、保护属性、线程、映射、句柄和远程读取活动归纳为简洁的行为摘要
- 检测 direct-syscall 页面、受保护的 `ntdll` 导出表读取、hook patch 状态、syscall stubs、launch-gate 页面以及运行时 self-map 变更
- 通过公开的 `IXIPC` 数据包 ABI 导出结构化事件，供主机端工具、SDK 集成和诊断数据包使用
## 仓库结构
- `DLL/`：注入运行时、hook 实现、IPC 客户端、VEH/guard 逻辑以及运行时 self-map 遥测模块
- `Injector/`：`BlindRunner.exe` 控制器代码，按职责划分为 `App/`、`Core/`、`Policy/`、`Telemetry/`、`Diagnostics/`、`Ipc/` 和 `Launch/`
- `Mapper/`：当选择 `--manual-map` / `--mm` 时，runner 所使用的 manual-map 加载器
- `SDK/`：用于直接集成的公共头文件和示例主机端
- `Testing/`：受控的探测目标，编译生成 `BlindTestTarget.exe` 和 `BlindLaunchGateTarget.exe`
- `Scripts/`：本地构建、验证、清理、连接、格式化和缓解措施的测试套件
- `Docs/`：SDK、集成、诊断和受控发布说明
## 发布测试捕获
以下示例是经过筛选的 Release x64 捕获记录，来源于本地的
`BlindRunner.exe` / `BlindTestTarget.exe` 测试。其中的 PID、pipe 后缀、stack
地址以及 ASLR 基址均来自此次捕获，在其他运行中会有所不同；
但事件字段、计数和判定结果均为真实输出，而非伪代码。
### API log-hook 冒烟测试
```
.\bin\Release\x64\BlindRunner.exe --cli .\bin\Release\x64\BlindTestTarget.exe --lhook NtQueryInformationProcess
```
```
[blind] listening on \\.\pipe\BLINDCli-32620
[blind] child pid=35264 target=.\bin\Release\x64\BlindTestTarget.exe launch_gate=1 guarded=0 inject=loadlibrary
[blind] hook client connected
[blind] ready pid=35264 mask=0x00000001 observed=0x00000001
[blind] ready pid=35264 mask=0x00000005 observed=0x00000005
[blind] ready wait=0 mask=0x00000005
[blind] ready pid=35264 mask=0x0000000D observed=0x0000000D
[blind] NtQueryInformationProcess hit status=0x00000000 caller=KERNELBASE.dll+0x21B8E args=[0xFFFFFFFFFFFFFFFF,0x34,0x58AB7BF2A0,0x8]
[blind] NtQueryInformationProcess hit status=0x00000000 caller=KERNELBASE.dll+0x4194E args=[0xFFFFFFFFFFFFFFFF,0x25,0x58AB7BF370,0x40]
[blind] child exit=0x00000000 events=25 suppressed=0
[blind] launch-gate traps=0
```
### Stack、symbols 与 registers
```
.\bin\Release\x64\BlindRunner.exe --cli .\bin\Release\x64\BlindTestTarget.exe --lhook NtQueryInformationProcess --stack-trace --syms --r
```
```
[blind] NtQueryInformationProcess hit status=0x00000000 caller=KERNELBASE.dll+0x21B8E args=[0xFFFFFFFFFFFFFFFF,0x34,0xDDB94FF460,0x8]
regs rip=0x7FFA645D1B8E rsp=0xDDB94FDF50 rbp=0xDDB94FE570 rax=0x0 rbx=0x7FFA645D1B8E rcx=0xFFFFFFFFFFFFFFFF rdx=0x34 rsi=0xDDB94FEDB0 rdi=0xDDB94FE4A0 r8=0xDDB94FF460 r9=0x8 r10=0x7FFA53840000 r11=0x7FFA5385E62B r12=0x8 r13=0x0 r14=0xDDB94FE4C8 r15=0x0 eflags=0x206
#00 [internal] BLIND.dll!IX_NT::NtQueryInformationProcess_Hook+0xB2
#01 [system] KERNELBASE.dll!GetProcessMitigationPolicy+0x4E
#02 [system] ws2_32.dll!getnameinfo+0x1BCA
#03 [system] ws2_32.dll!getnameinfo+0x589
#04 [system] ws2_32.dll!WSASocketW+0xAC3
#05 [system] ws2_32.dll!getnameinfo+0x1AB4
#06 [system] ws2_32.dll!getnameinfo+0x8C0
#07 [system] ws2_32.dll!WSAStartup+0x4EE
#08 [system] ws2_32.dll!WSAStartup+0x30C
#09 [app] BlindTestTarget.exe!`anonymous namespace'::ExerciseWinsock+0x131
#10 [app] BlindTestTarget.exe!wmain+0x55E
#11 [app] BlindTestTarget.exe!__scrt_common_main_seh+0x10F
#12 [system] KERNEL32.DLL!BaseThreadInitThunk+0x17
#13 [system] ntdll.dll!RtlUserThreadStart+0x2C
```
### 拒绝策略
```
.\bin\Release\x64\BlindRunner.exe --cli .\bin\Release\x64\BlindTestTarget.exe --lhook NtQueryInformationProcess --deny
```
```
[blind] NtQueryInformationProcess denied status=0xC0000022 caller=KERNELBASE.dll+0x21B8E args=[0xFFFFFFFFFFFFFFFF,0x34,0x623A6FF350,0x8]
[blind] NtQueryInformationProcess denied status=0xC0000022 caller=KERNELBASE.dll+0x4194E args=[0xFFFFFFFFFFFFFFFF,0x25,0x623A6FF420,0x40]
[blind] child exit=0x00000000 events=25 suppressed=0
```
### Manual-map 注入
```
.\bin\Release\x64\BlindRunner.exe --cli --mm .\bin\Release\x64\BlindTestTarget.exe --lhook NtQueryInformationProcess
```
```
[blind] child pid=41152 target=.\bin\Release\x64\BlindTestTarget.exe launch_gate=1 guarded=0 inject=manual-map
[blind] manual-map visible=0 base=0x0 mapped=0x180000000
[blind] ready wait=0 mask=0x00000005
[blind] NtQueryInformationProcess hit status=0x00000000 caller=KERNELBASE.dll+0x21B8E args=[0xFFFFFFFFFFFFFFFF,0x34,0xA849AFF410,0x8]
[blind] NtQueryInformationProcess hit status=0x00000000 caller=KERNELBASE.dll+0x4194E args=[0xFFFFFFFFFFFFFFFF,0x25,0xA849AFF4E0,0x40]
[blind] child exit=0x00000000 events=25 suppressed=0
```
### 行为折叠
```
.\bin\Release\x64\BlindRunner.exe --cli .\bin\Release\x64\BlindTestTarget.exe --behavior
```
```
[blind] child exit=0x00000000 events=122 suppressed=0
[blind:behavior] final targets=1 regions=10 protect_groups=13 thread_starts=1 handles=0
[blind:behavior] memory target=self allocs=15 total=3.10MB pages=793 maps=5 mapped=2.72MB regions=10 protects=48 queries=0 query_info=0B reads=0 read=0B writes=0 written=0B opens=0/0 rwx=2.72MB threads=1 apc=0 risk=rwx
[blind:behavior] protect target=self count=7 pages=14 size=8.00KB RW->R first=0x24DAFC30000 last=0x24DAFC30000 span=0x24DAFC30000-0x24DAFC30000 vad=MEM_COMMIT/MEM_PRIVATE caller=ntdll.dll+0x40974 stack=0x2B68C4E0DAABA1B5 rwx=0 risk=- caller_region=MEM_IMAGE/RX
[blind:behavior] region target=self base=0x24DAFC30000 size=8.00KB pages=2 protect=R vad=MEM_COMMIT/MEM_PRIVATE alloc_protect=RW alloc_type=0x0 allocs=0 maps=0 protects=13 flips=13 queries=0 last_query=MemoryBasicInformation(0) reads=0 read=0B writes=0 written=0B caller=ntdll.dll+0x40974 stack=0x2B68C4E0DAABA1B5 risk=protect_flips seq=R->RW->R->RW->R->RW->R->R->RW->R->RW->R->RW->R caller_region=MEM_IMAGE/RX
[blind:behavior] thread target=self count=1 suspended=0 start=0x7FFA637475D0 private=0 vad=MEM_COMMIT/MEM_IMAGE/RX start_region=MEM_IMAGE/RX caller=KERNELBASE.dll+0xC8079 stack=0xBD624BEEB1544B29 risk=- caller_region=MEM_IMAGE/RX
```
### Direct-syscall 探测与 RW-to-RX 关联
```
.\bin\Release\x64\BlindRunner.exe --cli .\bin\Release\x64\BlindTestTarget.exe --cli-probe-direct-syscall --lhook NtProtectVirtualMemory --stack-trace --sym
```
```
[blind:behavior] auto-enabled protect folding for NtProtectVirtualMemory; add --raw for raw hits
[blind:detection] direct-syscall source=NtProtectVirtualMemory page=0x1F503750000 size=0x1000 stub=0x1F503750000 ssn=0x1234 caller=KERNELBASE.dll+0xBE73B sample=4C8BD1B8341200000F05C300000000000000000000000000000000000000000000000000000000000000000000000000...
#00 [internal] BLIND.dll!IX_RUNTIME_INTERNAL::RegisterDirectSyscallPage+0xAEB
#01 [internal] BLIND.dll!IX_NT::TryObserveDirectSyscallRange+0x393
#02 [internal] BLIND.dll!IX_NT::TryAnnotateProtectTarget+0x64
#03 [internal] BLIND.dll!IX_NT::NtProtectVirtualMemory_Hook+0x287
#04 [system] KERNELBASE.dll!VirtualProtect+0x3B
#05 [app] BlindTestTarget.exe!`anonymous namespace'::RunCliProbeDirectSyscallPage+0x9E
#06 [app] BlindTestTarget.exe!wmain+0x594
[blind:behavior] protect target=self count=1 pages=1 size=4.00KB RW->RX first=0x1F503750000 last=0x1F503750000 span=0x1F503750000-0x1F503750000 vad=MEM_COMMIT/MEM_UNKNOWN caller=KERNELBASE.dll!VirtualProtect+0x3B stack=0x641EF0EDD4A2B1D5 rwx=0 risk=- caller_region=MEM_IMAGE/RX
[blind:behavior] region target=self base=0x1F503750000 size=4.00KB pages=1 protect=RX vad=MEM_COMMIT/MEM_UNKNOWN alloc_protect=UNKNOWN alloc_type=0x0 allocs=0 maps=0 protects=1 flips=1 queries=0 last_query=MemoryBasicInformation(0) reads=0 read=0B writes=0 written=0B caller=KERNELBASE.dll!VirtualProtect+0x3B stack=0x641EF0EDD4A2B1D5 risk=protect_flips seq=RW->RX caller_region=MEM_IMAGE/RX
```
### Debug 诊断与 self-map
```
.\bin\Release\x64\BlindRunner.exe --cli .\bin\Release\x64\BlindTestTarget.exe --debug --hook NtQueryInformationProcess
```
```
[blind] diagnostics dir=C:\$ARSENAL\TitanToolchain\BLIND\bin\Release\x64\BlindDiagnostics\run-20260602-171410-38864
[blind] child pid=18088 target=.\bin\Release\x64\BlindTestTarget.exe launch_gate=1 guarded=0 inject=loadlibrary
[blind] runtime log=C:\$ARSENAL\TitanToolchain\BLIND\bin\Release\x64\BlindDiagnostics\run-20260602-171410-38864\logs\blind-runtime-18088.log
[blind] IxSelfMap hit kind=integrity module=Runtime caller=BLIND.dll+0x5D018 args=[0x1,0x1F,0x7FF9F7630000,0x1000] sample="runtime.readyMask"
[blind] IxSelfMap hit kind=integrity module=NtStub caller=0x15D98100000 args=[0x1,0x0,0x15D98100000,0x1000] sample="NtQueryInformationProcess"
[blind] IxSelfMap hit kind=integrity module=HookPatch caller=ntdll.dll+0x160380 args=[0x0,0x1,0x7FFA671A0000,0x12000] sample="NtQueryInformationProcess"
[blind] IxSelfMap hit kind=integrity module=Runtime caller=BLIND.dll+0x19BA0 args=[0x49A646043AF696E0,0x5,0x7FF9F7630000,0x1A000] sample="summary entries=20 truncated=0 ready=0x00000005 signature=0x49A"
[blind] child exit=0x00000000 events=25 suppressed=0
[blind] self-map entries=21
```
该次运行中选取的 `summary.txt` 记录：
```
child_exit=0x00000000
ready_mask=0x0000000D
events=25
launch_gate_mode=1
launch_gate_traps=0
self_map_entries=21
event_counts:
nt=2
integrity=23
self_map_by_kind:
runtime=14
indirect_handle=4
hook_patch=1
syscall_stub=1
summary=1
```
该次运行中选取的 `selfmap.tsv` 记录：
```
index total truncated kind owner name address size flags ref0 ref1 allocation_base region_size protect state type
4 21 0 runtime Runtime runtime.readyMask 0x7FF9F768D018 0x4 0x00000152 0x1 0x1F 0x7FF9F7630000 0x1000 0x00000004 0x00001000 0x01000000
15 21 0 syscall_stub NtStub NtQueryInformationProcess 0x15D98100000 0x10 0x00000037 0x1 0x0 0x15D98100000 0x1000 0x00000020 0x00001000 0x00020000
16 21 0 indirect_handle IHR ihr.NtHookTarget slot=1 tag=0xEA2DDA8A gen=0x70000001 0x7FFA67300380 0x10 0x00000059 0x1 0x6EA2DDA8A 0x7FFA671A0000 0x12000 0x00000020 0x00001000 0x01000000
20 21 0 hook_patch HookPatch NtQueryInformationProcess 0x7FFA67300380 0x10 0x00000055 0x0 0x1 0x7FFA671A0000 0x12000 0x00000020 0x00001000 0x01000000
21 21 0 summary Runtime summary entries=20 truncated=0 ready=0x00000005 signature=0x49A 0x7FF9F7649BA0 0x14 0x00000053 0x49A646043AF696E0 0x5 0x7FF9F7630000 0x1A000 0x00000020 0x00001000 0x01000000
```
## SDK 集成
SDK 的接口设计得非常精简：
- `SDK/include/blind/blind_ipc.h`：面向主机端的 IPC 数据包 ABI、pipe 常量、事件记录、批次和就绪状态掩码
- `SDK/include/blind/blind_veh.h`：导出的进程内 VEH 遥测辅助 API
- `SDK/samples/host/BlindSdkHost.cpp`：一个极简的主机端示例，用于创建 pipe、启动受控目标、加载 `BLIND.dll` 并消费事件
运行 SDK 主机端：
```
.\bin\Debug\x64\BlindSdkHost.exe
.\bin\Debug\x64\BlindSdkHost.exe --pipe \\.\pipe\BLINDSdkPipe --verbose
```
链接 `BLIND.dll` 的消费者应定义 `IX_BLIND_IMPORTS`，并链接相应的 `BLIND.lib`。
## 编译
使用 Visual Studio 2022+ MSBuild 在本目录下进行构建：
```
msbuild .\VCXProj\BLIND.vcxproj /p:Configuration=Release /p:Platform=x64
msbuild .\VCXProj\BlindTestTarget.vcxproj /p:Configuration=Release /p:Platform=x64
msbuild .\VCXProj\BlindLaunchGateTarget.vcxproj /p:Configuration=Release /p:Platform=x64
msbuild .\VCXProj\BlindRunner.vcxproj /p:Configuration=Release /p:Platform=x64
msbuild .\VCXProj\BlindSdkHost.vcxproj /p:Configuration=Release /p:Platform=x64
```
产物：
```
.\bin\Release\x64\BLIND.dll
.\bin\Release\x64\BLIND.lib
.\bin\Release\x64\BlindRunner.exe
.\bin\Release\x64\BlindSdkHost.exe
.\bin\Release\x64\BlindTestTarget.exe
.\bin\Release\x64\BlindLaunchGateTarget.exe
```
发布预检：
```
.\bin\Release\x64\BlindRunner.exe
.\bin\Release\x64\BlindRunner.exe --launch-gate --pipe \\.\pipe\BLINDReleaseLaunchGate
.\bin\Release\x64\BlindSdkHost.exe
```
一次通过的 launch-gate 运行至少会报告 `BLIND_SDK_READY_CORE_MASK`（`0x0000000D`：IPC、NT、KI）、`child_exit=0x00000000` 以及 `launch_gate_traps > 0`。带有 module hooks 的 CLI 运行通常会发布 `0x0000001D`（核心加上 module）；当 Winsock 也处于活动状态时，完全就绪状态为 `0x0000001F`。
运行本地测试套件，且不生成额外的控制台窗口：
```
.\Scripts\run_blind_tests.ps1 -Configuration Release
```
## 文档
- `Docs/SDK.md`：SDK 头文件、数据包 ABI 和主机端要求
- `Docs/INTEGRATION.md`：集成边界和主机端职责
- `Docs/DIAGNOSTICS.md`：runner 输出、事件 JSONL、self-map TSV 和运行时日志
- `Docs/RELEASE.md`：受控交接和预检清单
## 免责声明
## 许可证
版权所有 (c) TITAN Softwork Solutions。保留所有权利。
BLIND 受 `LICENSE.md` 约束：PolyForm Noncommercial 1.0.0，附带 BLIND 防御性使用补充条款和 DSGL/出口管制通知。