監(jiān)控Explorer的進(jìn)程創(chuàng)建問題
Posted on 2009-09-20 22:27 S.l.e!ep.¢% 閱讀(667) 評論(0) 編輯 收藏 引用 所屬分類: 系統(tǒng)低層監(jiān)控Explorer的進(jìn)程創(chuàng)建問題
上一篇 / 下一篇 ?2008-08-23 14:50:57
近日筆者收到某網(wǎng)友的信件稱,“為何自己寫的監(jiān)控 Explorer進(jìn)程代碼運(yùn)行后,系統(tǒng)會崩潰?!爆F(xiàn)筆者就這一問題,拿出與用戶共同探討。NT 下的 Explorer 通過 CreateProcessInternalW建立,R3的控制權(quán)。代碼如下:
????? bInheritHandles, DWORD?dwCreationFlags, LPVOID?lpEnvironment, LPCWSTR?lpCurrentDirectory, LPSTARTUPINFOW?lpStartupInfo, LPPROCESS_INFORMATION?lpProcessInformation, PHANDLE?hNewToken); int?APIENTRY?DllMain(HINSTANCE?hInstance,?DWORD?dwReason,?LPVOID?lpReserved) { UNREFERENCED_PARAMETER(lpReserved); if?(dwReason?==?DLL_PROCESS_ATTACH) { ExampleJmp(); } else?if?(dwReason?==?DLL_PROCESS_DETACH) { SetHookOff(); } return?1; } void?HookOneAPI(LPCTSTR?ModuleName,?LPCTSTR?ApiName,?FARPROC?lpNewFunc) { BYTE?str[8]?=?{?0x0B8,?0x0,?0x0,?0x40,?0x0,?0x0FF,?0x0E0,0};?//?mov?eax,addr?jmp?eax memcpy(m_NewFunc,str,8); m_lpHookFunc?=?GetProcAddress(GetModuleHandle(ModuleName),ApiName); m_hProc?=?GetCurrentProcess(); memcpy(m_OldFunc,(char?*)m_lpHookFunc,8); *(DWORD?*)(?m_NewFunc?+?1?)?=?(DWORD)lpNewFunc; } void?WINAPI?SetHookOn() { MEMORY_BASIC_INFORMATION?mbi; VirtualQuery(m_lpHookFunc,&mbi,sizeof(mbi)); VirtualProtect(m_lpHookFunc,sizeof(DWORD),PAGE_READWRITE,0); DWORD?dwOldFlag; WriteProcessMemory(m_hProc,?(void?*)m_lpHookFunc, (void?*)m_NewFunc,?8,&dwOldFlag); } void?WINAPI?SetHookOff() { DWORD?dwOldFlag; WriteProcessMemory(m_hProc,?(void?*)m_lpHookFunc, (void?*)m_OldFunc,?8,?&dwOldFlag); } BOOL?WINAPI?MyCreateProcess(HANDLE?hToken, LPCWSTR?lpApplicationName, LPWSTR?lpCommandLine, LPSECURITY_ATTRIBUTES?lpProcessAttributes, LPSECURITY_ATTRIBUTES?lpThreadAttributes, BOOL?bInheritHandles, DWORD?dwCreationFlags, LPVOID?lpEnvironment, LPCWSTR?lpCurrentDirectory, LPSTARTUPINFOW?lpStartupInfo, LPPROCESS_INFORMATION?lpProcessInformation, PHANDLE?hNewToken) { BOOL?BReturn=TRUE; SetHookOff(); CreateProcessHH?CreateProcessHHH=(CreateProcessHH)GetProcAddress(GetModuleHandle("Kernel32.dll"),"CreateProcessInternalW"); BReturn=CreateProcessHHH(hToken,lpApplicationName,lpCommandLine,lpProcessAttributes ,lpThreadAttributes,bInheritHandles,dwCreationFlags,lpEnvironment,lpCurrentDirectory, lpStartupInfo,lpProcessInformation,hNewToken); SetHookOn(); return?BReturn; } BOOL?UpPrivilege(HANDLE?hprocess,LPCTSTR?lpname)?//提升進(jìn)程權(quán)限?debug { HANDLE?hToken; TOKEN_PRIVILEGES?Privileges; LUID?luid; OpenProcessToken(hprocess,TOKEN_ADJUST_PRIVILEGES,&hToken); Privileges.PrivilegeCount=1; LookupPrivilegeValue(NULL,lpname,&luid); Privileges.Privileges[0].Luid=luid; Privileges.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED; if(AdjustTokenPrivileges(hToken,FALSE,&Privileges,NULL,NULL,NULL)!=0) return?TRUE; return?FALSE; } void?WINAPI?ExampleJmp() { char?privilege[]=SE_DEBUG_NAME; HANDLE?hprocess; hprocess=GetCurrentProcess(); if(!UpPrivilege(hprocess,privilege))?//開始提權(quán) { exit(-1); } HookOneAPI("Kernel32.dll","CreateProcessInternalW",(FARPROC)MyCreateProcess); SetHookOn(); } |
????? 歡迎大家把自己的意見和代碼公布出來,IT專家網(wǎng)將給您和您的團(tuán)隊提供更多展現(xiàn)自己的舞臺!