进程保护 (非Hook;非DKOM)

进程保护 (非Hook;非DKOM)

Posted by JiaJia 13 February,2009 (0)Comment

BOOL Lock_CurrentProcess ()
{
HANDLE hProcess = :: GetCurrentProcess ();
SID_IDENTIFIER_AUTHORITY sia = SECURITY_WORLD_SID_AUTHORITY ;
PSID pSid ;
BOOL bSus = FALSE ;
bSus = :: AllocateAndInitializeSid (& sia , 1 , NULL , NULL , NULL , NULL , NULL , NULL , NULL , NULL ,& pSid );
if (! bSus ) goto Cleanup ;
HANDLE hToken ;
bSus = :: OpenProcessToken ( hProcess , TOKEN_QUERY ,& hToken );
if (! bSus ) goto Cleanup ;
DWORD dwReturnLength ;
:: GetTokenInformation ( hToken , TokenUser , NULL , NULL ,& dwReturnLength );
if ( dwReturnLength > 0x400 ) goto Cleanup ;
LPVOID TokenInformation ;
TokenInformation = :: LocalAlloc ( LPTR , 0x400 ); //这里就引用SDK的函数不引用CRT的了
DWORD dw ;
bSus = :: GetTokenInformation ( hToken , TokenUser , TokenInformation , 0x400 ,& dw );
if (! bSus ) goto Cleanup ;
PTOKEN_USER pTokenUser = ( PTOKEN_USER ) TokenInformation ;
BYTE Buf [ 0x200 ];
PACL pAcl = ( PACL )& Buf ;
bSus = :: InitializeAcl ( pAcl , 1024 , ACL_REVISION );
if (! bSus ) goto Cleanup ;
bSus = :: AddAccessDeniedAce ( pAcl , ACL_REVISION , 0x000000FA , pSid );
if (! bSus ) goto Cleanup ;
bSus = :: AddAccessAllowedAce ( pAcl , ACL_REVISION , 0x00100701 , pTokenUser -> User . Sid );
if (! bSus ) goto Cleanup ;
if (:: SetSecurityInfo ( hProcess , SE_KERNEL_OBJECT , DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION , NULL , NULL , pAcl , NULL ) == 0 )
bSus = TRUE ;
Cleanup :
if ( hProcess != NULL )
:: CloseHandle ( hProcess );
if ( pSid != NULL )
:: FreeSid ( pSid );
return bSus ;
}