进程伪装代码

最新推荐文章于 2024-08-23 22:51:28 发布

沭阳

最新推荐文章于 2024-08-23 22:51:28 发布

阅读量2.6k

点赞数

分类专栏： Windows黑客基础编程

本文链接：https://blog.csdn.net/yan_star/article/details/88528556

版权

Windows黑客基础编程专栏收录该内容

21 篇文章 6 订阅

订阅专栏

// DisguiseProcess.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include "DisguiseProcess.h"



int _tmain(int argc, _TCHAR* argv[])
{
	if (FALSE == DisguiseProcess(9540, L"C:\\Windows\\explorer.exe", L"explorer.exe"));
	{
		printf("DisguiseProcess ERROR!\n");
		
	}
	printf("DisguiseProcess SUCCESS!\n");

	return 0;
}

#include "stdafx.h"
#include "DisguiseProcess.h"


void ShowError(char *lpszText)
{
	char szErr[MAX_PATH] = { 0 };
	sprintf(szErr, "%s ERROR [%d]", lpszText, GetLastError());
	MessageBoxA(NULL, szErr, "ERROR", MB_OK | MB_ICONERROR);
}

BOOL DisguiseProcess(DWORD dwProcessId, wchar_t *lpwszPath, wchar_t *lpwszCmd)
{
	HANDLE hProcess = ::OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
	if (NULL == hProcess)
	{
		ShowError("OpenProcess");
		return FALSE;
	}

	typedef_NtQueryInformationProcess NtQueryInformationProcess = NULL;
	PROCESS_BASIC_INFORMATION pbi = { 0 };
	PEB peb = { 0 };
	RTL_USER_PROCESS_PARAMETERS Param = { 0 };
	USHORT usCmdLen = 0;
	USHORT usPathLen = 0;

	NtQueryInformationProcess = (typedef_NtQueryInformationProcess)::GetProcAddress(LoadLibraryA("ntdll.dll"), "NtQueryInformationProcess");
	if (NULL == NtQueryInformationProcess)
	{
		ShowError("GetProcAddress");
		return FALSE;
	}

	NTSTATUS status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);
	if (!NT_SUCCESS(status))
	{
		ShowError("NtQueryInformationProcess");
		return FALSE;
	}


	::ReadProcessMemory(hProcess, pbi.PebBaseAddress, &peb, sizeof(peb), NULL);
	::ReadProcessMemory(hProcess, peb.ProcessParameters, &Param, sizeof(Param), NULL);

	usCmdLen = 2 + 2 * ::wcslen(lpwszCmd);
	::WriteProcessMemory(hProcess, Param.CommandLine.Buffer, lpwszCmd, usCmdLen, NULL);
	::WriteProcessMemory(hProcess, &Param.CommandLine.Length, &usCmdLen, sizeof(usCmdLen), NULL);


	usPathLen = 2 + 2 * ::wcslen(lpwszPath);
	::WriteProcessMemory(hProcess, Param.ImagePathName.Buffer, lpwszPath, usPathLen, NULL);
	::WriteProcessMemory(hProcess, &Param.ImagePathName.Length, &usPathLen, sizeof(usPathLen), NULL);
	
	return TRUE;

}