Ring3下无驱动移除winlogon.exe进程ctrl+alt+del,win+u,win+l三个系统热键,非屏蔽热键

随手而作，纯粹技术研究，没什么实际意义。

打开xuetr,正常情况下.winlogon.exe注册了三个热键。
ctrl+alt+del,win+u,win+l三个。

这三个键用SetWindowsHookEx()函数，使用键盘钩子也屏蔽不了。

我们先把UnregisterSystemHotKey.dll解压出来，放到任意目录.

比如E盘根目录,就运行

rundll32 E:\UnregisterSystemHotKey.dll,Hook

再打开xuetr看下,Winlogo.exe进程注册的热键都没有了.

#include <windows.h>
#include <process.h> 
#include <tchar.h>
#include <stdio.h>
#include <shlwapi.h>
#include <psapi.h>

#pragma comment(lib, "psapi.lib")
#pragma comment(lib, "shlwapi.lib")

TCHAR ModuleFile[MAX_PATH];
TCHAR szText[128] = {0};
WNDPROC OldWindowProc;
HWND hWinLogon;
HMODULE hDll;


LRESULT CALLBACK NewWindowProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
	if (message == WM_NULL)
	{
		::UnregisterHotKey(hWnd, 0); //Ctrl+Alt+delete
		::UnregisterHotKey(hWnd, 4); //Ctrl+Shift+Esc
		::UnregisterHotKey(hWnd, 5); //Win+L
		::UnregisterHotKey(hWnd, 6); //Win+U
		::SetWindowLongPtr(hWnd, GWL_WNDPROC, (LONG)OldWindowProc);
		return 1;
	}
	
	return CallWindowProc(OldWindowProc, hWnd, message, wParam, lParam);
}

BOOL WINAPI EnablePrivileges()
{
	HANDLE hToken; 
	TOKEN_PRIVILEGES tkp; 

	if (!OpenProcessToken(GetCurrentProcess(), 
		TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) 
		return( FALSE ); 

	LookupPrivilegeValue(NULL, SE_DEBUG_NAME, 
		&tkp.Privileges[0].Luid); 

	tkp.PrivilegeCount = 1; 
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 

	AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, 
		(PTOKEN_PRIVILEGES)NULL, 0); 

	if (GetLastError() != ERROR_SUCCESS) 
		return FALSE; 

	return TRUE;
}

BOOL CALLBACK lpEnumWindowsProc(HWND hwnd, LPARAM lParam)
{
	if (IsWindow(hwnd))
	{
		::GetWindowText(hwnd, szText, _countof(szText));

		if (!_tcscmp(szText, TEXT("SAS window")))
		{
			hWinLogon = hwnd;
			OldWindowProc = (WNDPROC)::SetWindowLongPtr(hwnd, GWL_WNDPROC, (LONG)NewWindowProc);
			PostMessage(hwnd, WM_NULL, 0, 0);
			return FALSE;
		}
	}

	return TRUE;
}

UINT _stdcall FreeSelfProc(void *Arg)
{
	FreeLibraryAndExitThread(hDll, 0);
	return 1;
}

BOOL WINAPI DllMain(HINSTANCE hDllHandle, DWORD nReason, LPVOID Reserved)
{
	switch ( nReason )
	{
	case DLL_PROCESS_ATTACH:
		hDll = hDllHandle;
		GetModuleFileName(NULL, ModuleFile, _countof(ModuleFile));
		EnablePrivileges();
		
		if (StrStrI(ModuleFile, TEXT("winlogon.exe")))
		{
			HANDLE hThread;
			UINT ThreadId;

			HDESK hWinLogon = OpenDesktop(TEXT("Winlogon"), 0, FALSE, GENERIC_ALL);
			::EnumDesktopWindows(hWinLogon, lpEnumWindowsProc, NULL);
			CloseDesktop(hWinLogon);

			hThread = (HANDLE)_beginthreadex(NULL, NULL, &FreeSelfProc, 0, 0, &ThreadId);
			WaitForSingleObject(hThread, INFINITE);
			CloseHandle(hThread);			
		}
		else
		{
			DWORD dwProcessId = 0;
			HANDLE hProcess = 0;  
			DWORD ProcessList[512], cbNeeded, cProcess;
			TCHAR szFileName[256];

			EnumProcesses(ProcessList, sizeof(ProcessList), &cbNeeded);
			cProcess = cbNeeded/sizeof(DWORD);

			for (UINT i=0; i<cProcess; i++)
			{
				if (ProcessList[i] != 0)
				{
					hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessList[i]);
					if (hProcess)
					{
						GetModuleBaseName(hProcess, NULL, szFileName, _countof(szFileName));
						if (!_tcsicmp(szFileName, TEXT("winlogon.exe")))
						{
							dwProcessId = ProcessList[i];
							break;
						}
					}
				}
			}

			if (dwProcessId)
			{
				hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
			}

			if (!hProcess)
			{
				return 0;
			}
		
			LPVOID Param = VirtualAllocEx(hProcess, 0, 512, MEM_COMMIT, PAGE_READWRITE);
			if (!Param)
			{
				MessageBox(NULL, TEXT("申请内存失败"), TEXT("申请内存失败"), MB_ICONWARNING);
				return 0;
			}

			GetModuleFileName(hDllHandle, ModuleFile, _countof(ModuleFile));

			if (!WriteProcessMemory(hProcess, Param, (LPVOID)ModuleFile, 256, NULL))
			{
				MessageBox(NULL, TEXT("写入内存失败"), TEXT("写入内存失败"), MB_ICONWARNING);
				return 0;
			}
			
			HANDLE hThread = CreateRemoteThread(hProcess, 
					NULL, 
					NULL, 
					(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryW"),
					Param, 
					NULL, 
					NULL);
			if (hThread)
			{
				WaitForSingleObject(hThread, INFINITE);
			}
			else
			{
				TCHAR sztmp[1024];
				_stprintf_s(sztmp, _countof(sztmp), TEXT("创建远程线程失败, 错误代码:%d, dll=%s"), GetLastError(), ModuleFile);
				MessageBox(NULL, sztmp, TEXT("创建远程线程失败"), MB_ICONWARNING);
				return 0;				
			}

			VirtualFreeEx(hProcess, Param , 0, MEM_RELEASE);
			CloseHandle(hThread);
			CloseHandle(hProcess);
		}
		break;
	case DLL_THREAD_ATTACH:
		break;
	case DLL_THREAD_DETACH:
		break;
	case DLL_PROCESS_DETACH:
		::SetWindowLongPtr(hWinLogon, GWL_WNDPROC, (LONG)OldWindowProc);
		break;
	default:
		break;
	}

	return 1;
}

EXTERN_C __declspec(dllexport) int Hook(void)
{
	return 1;
}