• <ins id="pjuwb"></ins>
    <blockquote id="pjuwb"><pre id="pjuwb"></pre></blockquote>
    <noscript id="pjuwb"></noscript>
          <sup id="pjuwb"><pre id="pjuwb"></pre></sup>
            <dd id="pjuwb"></dd>
            <abbr id="pjuwb"></abbr>

            S.l.e!ep.¢%

            像打了激速一樣,以四倍的速度運轉,開心的工作
            簡單、開放、平等的公司文化;尊重個性、自由與個人價值;
            posts - 1098, comments - 335, trackbacks - 0, articles - 1
              C++博客 :: 首頁 :: 新隨筆 :: 聯系 :: 聚合  :: 管理

            HOOK SSDT Hide Process (四)

            Posted on 2009-10-25 20:55 S.l.e!ep.¢% 閱讀(367) 評論(0)  編輯 收藏 引用 所屬分類: RootKit
            Enum Process Under Ring3

            taskmgr.exe 就是通過以下方式 Enum Process 的

            #include?<stdlib.h>
            #include?
            <stdio.h>
            #include?
            <windows.h>

            typedef?
            long?NTSTATUS;

            //
            //?Unicode?strings?are?counted?16-bit?character?strings.?If?they?are
            //?NULL?terminated,?Length?does?not?include?trailing?NULL.
            //

            typedef?
            struct?_UNICODE_STRING
            {
            ????USHORT?Length;
            ????USHORT?MaximumLength;
            ????PWSTR??Buffer;

            }?UNICODE_STRING,?
            *PUNICODE_STRING;

            //
            //?Thread?priority
            //

            typedef?LONG?KPRIORITY;

            //-----------------------------------------------------------------------------
            //?Query?system?information

            typedef?
            enum?_SYSTEM_INFORMATION_CLASS
            {
            ????SystemBasicInformation,?????????????????
            //?0x00?SYSTEM_BASIC_INFORMATION
            ????SystemProcessorInformation,?????????????//?0x01?SYSTEM_PROCESSOR_INFORMATION
            ????SystemPerformanceInformation,???????????//?0x02
            ????SystemTimeOfDayInformation,?????????????//?0x03
            ????SystemPathInformation,??????????????????//?0x04
            ????SystemProcessInformation,???????????????//?0x05
            ????SystemCallCountInformation,?????????????//?0x06
            ????SystemDeviceInformation,????????????????//?0x07
            ????SystemProcessorPerformanceInformation,??//?0x08
            ????SystemFlagsInformation,?????????????????//?0x09
            ????SystemCallTimeInformation,??????????????//?0x0A
            ????SystemModuleInformation,????????????????//?0x0B?SYSTEM_MODULE_INFORMATION
            ????SystemLocksInformation,?????????????????//?0x0C
            ????SystemStackTraceInformation,????????????//?0x0D
            ????SystemPagedPoolInformation,?????????????//?0x0E
            ????SystemNonPagedPoolInformation,??????????//?0x0F
            ????SystemHandleInformation,????????????????//?0x10
            ????SystemObjectInformation,????????????????//?0x11
            ????SystemPageFileInformation,??????????????//?0x12
            ????SystemVdmInstemulInformation,???????????//?0x13
            ????SystemVdmBopInformation,????????????????//?0x14
            ????SystemFileCacheInformation,?????????????//?0x15
            ????SystemPoolTagInformation,???????????????//?0x16
            ????SystemInterruptInformation,?????????????//?0x17
            ????SystemDpcBehaviorInformation,???????????//?0x18
            ????SystemFullMemoryInformation,????????????//?0x19
            ????SystemLoadGdiDriverInformation,?????????//?0x1A
            ????SystemUnloadGdiDriverInformation,???????//?0x1B
            ????SystemTimeAdjustmentInformation,????????//?0x1C
            ????SystemSummaryMemoryInformation,?????????//?0x1D
            ????SystemNextEventIdInformation,???????????//?0x1E
            ????SystemEventIdsInformation,??????????????//?0x1F
            ????SystemCrashDumpInformation,?????????????//?0x20
            ????SystemExceptionInformation,?????????????//?0x21
            ????SystemCrashDumpStateInformation,????????//?0x22
            ????SystemKernelDebuggerInformation,????????//?0x23
            ????SystemContextSwitchInformation,?????????//?0x24
            ????SystemRegistryQuotaInformation,?????????//?0x25
            ????SystemExtendServiceTableInformation,????//?0x26
            ????SystemPrioritySeperation,???????????????//?0x27
            ????SystemPlugPlayBusInformation,???????????//?0x28
            ????SystemDockInformation,??????????????????//?0x29
            ????
            //SystemPowerInformation,???????????????//?0x2A
            ????
            //SystemProcessorSpeedInformation,??????//?0x2B
            ????
            //SystemCurrentTimeZoneInformation,?????//?0x2C
            ????
            //SystemLookasideInformation????????????//?0x2D

            }?SYSTEM_INFORMATION_CLASS,?
            *PSYSTEM_INFORMATION_CLASS;

            //
            //?Process?information
            //?NtQuerySystemInformation?with?SystemProcessInformation
            //

            typedef?
            struct?_SYSTEM_PROCESS_INFORMATION?{
            ????ULONG?NextEntryOffset;
            ????ULONG?NumberOfThreads;
            ????LARGE_INTEGER?SpareLi1;
            ????LARGE_INTEGER?SpareLi2;
            ????LARGE_INTEGER?SpareLi3;
            ????LARGE_INTEGER?CreateTime;
            ????LARGE_INTEGER?UserTime;
            ????LARGE_INTEGER?KernelTime;
            ????UNICODE_STRING?ImageName;
            ????KPRIORITY?BasePriority;
            ????ULONG_PTR?UniqueProcessId;
            ????ULONG_PTR?InheritedFromUniqueProcessId;
            ????ULONG?HandleCount;
            ????
            //?Next?part?is?platform?dependent

            }?SYSTEM_PROCESS_INFORMATION,?
            *PSYSTEM_PROCESS_INFORMATION;

            typedef?NTSTATUS?(
            *PNFNtQuerySystemInformation)(
            ????IN?SYSTEM_INFORMATION_CLASS?SystemInformationClass,
            ????OUT?PVOID?SystemInformation,
            ????IN?ULONG?SystemInformationLength,
            ????OUT?PULONG?ReturnLength
            ????);

            PNFNtQuerySystemInformation?pNtQuerySystemInformation;

            BOOL?LoadNTDLL()
            {
            ????HMODULE?hMod?
            =?GetModuleHandle("ntdll.dll");

            ????
            if?(hMod?==?NULL)
            ????{
            ????????hMod?
            =?LoadLibrary("ntdll.dll");
            ????????
            if?(hMod?==?NULL)
            ????????{
            ????????????printf(
            "LoadLibrary?Error:?%d\n",?GetLastError());
            ????????????
            return?FALSE;
            ????????}
            ????}

            ????pNtQuerySystemInformation?
            =?(PNFNtQuerySystemInformation)GetProcAddress(hMod,?"NtQuerySystemInformation");

            ????
            if(?pNtQuerySystemInformation?==?NULL?)
            ????{
            ????????printf(
            "GetProcAddress?for?NtQuerySystemInformation?Error:?%d\n",?GetLastError());
            ????????
            return?FALSE;
            ????}

            ????ULONG?dwNumberBytes?
            =?0x8000;
            ????
            char*?pBuf?=?(char*)malloc(dwNumberBytes);
            ????PSYSTEM_PROCESS_INFORMATION?pProcessInfo?
            =?(PSYSTEM_PROCESS_INFORMATION)pBuf;
            ????ULONG?dwReturn?
            =?0;

            ????pNtQuerySystemInformation(SystemProcessInformation,?pProcessInfo,?dwNumberBytes,?
            &dwReturn);

            ????
            return?TRUE;
            }

            int?main()
            {
            ????
            if(?!LoadNTDLL()?)
            ????{
            ????????printf(
            "LoadNTDLL?Error!\n");
            ????????
            return?0;
            ????}

            ????printf(
            "test\n");
            ????
            return?0;
            }


            運行后,出現
            Debug Error
            File: chkesp.c
            line: 42

            出現這個錯誤通常有兩種情況
            1. 參數個數錯
            2. 函數的調用方式錯

            詳細檢查之下
            typedef NTSTATUS
            ?(*PNFNtQuerySystemInformation)(
            ??? IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
            ??? OUT PVOID SystemInformation,
            ??? IN ULONG SystemInformationLength,
            ??? OUT PULONG ReturnLength
            ??? );

            這里的寫法有問題,少寫了 __stdcall 的調用方式

            typedef NTSTATUS
            ?(NTAPI *PNFNtQuerySystemInformation)(
            ??? IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
            ??? OUT PVOID SystemInformation,
            ??? IN ULONG SystemInformationLength,
            ??? OUT PULONG ReturnLength
            ??? );

            這樣的寫法就OK了

            久久精品国产亚洲综合色| 国产激情久久久久影院老熟女| 狠狠色综合网站久久久久久久| 亚洲狠狠久久综合一区77777 | 欧美久久久久久精选9999| 国产精品久久久久乳精品爆| 少妇久久久久久被弄到高潮| 人妻无码αv中文字幕久久琪琪布 人妻无码久久一区二区三区免费 人妻无码中文久久久久专区 | 久久免费国产精品一区二区| 久久综合狠狠综合久久97色| 午夜精品久久久久久毛片| 国产91久久综合| 漂亮人妻被黑人久久精品| 日本三级久久网| 一本色道久久88—综合亚洲精品| 久久精品国产91久久综合麻豆自制 | 久久精品成人| 久久精品国产亚洲av麻豆小说| 99久久亚洲综合精品网站| 久久精品国产色蜜蜜麻豆| Xx性欧美肥妇精品久久久久久 | 国内精品伊人久久久久av一坑| 精品久久久久久久中文字幕| 久久综合亚洲欧美成人| 亚洲精品国产自在久久| 久久综合九色综合精品| 三上悠亚久久精品| 亚洲色欲久久久久综合网| www.久久热| 久久婷婷五月综合国产尤物app | 久久99精品久久久久久野外 | 亚洲国产精品成人久久| 亚洲国产成人久久一区久久| 国产精品免费久久久久影院| 久久99精品久久久久久动态图 | 色妞色综合久久夜夜| 久久精品中文无码资源站| 久久综合五月丁香久久激情| 久久无码人妻精品一区二区三区| 国产成人久久久精品二区三区| .精品久久久麻豆国产精品|