-
-
[转帖]震惊支持XP-win10的进程隐藏居然是
-
发表于: 2019-10-30 14:37
-
任务管理器和工具上的进程都不见了,那么他到底去哪里了呢?
上代码
BOOLEAN PathSeAuditProcessCreationInfo(PEPROCESS Process, WCHAR* ProcessName){
PUNICODE_STRING Name ;
PUNICODE_STRING SelocateName;
SeLocateProcessImageName(Process, &SelocateName);
ExFreePool(SelocateName);
Name = (PUNICODE_STRING)(*(PULONG_PTR)((ULONG_PTR)Process + 0x468));//+0x468 SeAuditProcessCreationInfo
if ((wcslen(ProcessName) * 2) > Name->Length)
{
return FALSE;
}
RtlZeroMemory(Name->Buffer, Name->MaximumLength);
RtlCopyMemory(Name->Buffer, ProcessName, wcslen(ProcessName) * 2);
Name->Length = wcslen(ProcessName) * 2;
return TRUE;
}
对应结构体中
BOOLEAN PathImageFileName(PEPROCESS Process, char* cName)
{
char szNameBuff[15] = { 0 };
UCHAR* szProcessBuff = NULL;
size_t cNamelen = 0;
cNamelen = strlen(cName);
RtlZeroMemory(szNameBuff, sizeof(szNameBuff));
if (cNamelen > 15)
RtlCopyMemory(szNameBuff, cName, sizeof(szNameBuff));
else
RtlCopyMemory(szNameBuff, cName, cNamelen);
szProcessBuff = PsGetProcessImageFileName(Process);
RtlZeroMemory(szProcessBuff, sizeof(szNameBuff));
RtlCopyMemory(szProcessBuff, szNameBuff, sizeof(szNameBuff));
return TRUE;
}
bool Win10ImageNamePoint(PEPROCESS Process, WCHAR* szFullName)
{
BOOLEAN bRet ;
PFILE_OBJECT pFileObject ;
WCHAR* szNewFullName = NULL;
szNewFullName = static_cast<WCHAR*>( ExAllocatePool(NonPagedPool, MAX_PATH * 2));
RtlZeroMemory(szNewFullName, MAX_PATH * 2);
pFileObject = (PFILE_OBJECT)(*(PULONG_PTR)((ULONG_PTR)Process + 0x448)); //+0x448 ImageFilePointer
if (pFileObject->FileName.Length >= wcslen(szFullName) * 2)
{
RtlZeroMemory(pFileObject->FileName.Buffer, pFileObject->FileName.MaximumLength);
RtlCopyMemory(pFileObject->FileName.Buffer, szFullName, wcslen(szFullName) * 2);
pFileObject->FileName.Length = wcslen(szFullName) * 2;
ExFreePool(szNewFullName);
bRet = TRUE;
}
else
{
RtlCopyMemory(szNewFullName, szFullName, wcslen(szFullName) * 2);
pFileObject->FileName.Buffer = szNewFullName;
pFileObject->FileName.Length = wcslen(szFullName) * 2;
pFileObject->FileName.MaximumLength = MAX_PATH * 2;
bRet = TRUE;
}
return bRet;
}
这个结构体成员似乎只有win10 才有
还有很重要的一步
BOOLEAN checkProcessModify(HANDLE pid)
{
PEPROCESS Process = NULL;
NTSTATUS status = PsLookupProcessByProcessId((HANDLE)pid, &Process);
if (!NT_SUCCESS(status))
{
return FALSE;
}
PathImageFileName(Process, "svchost.exe");
PathWin10ImageNamePoint(Process, L" ");
PathSeAuditProcessCreationInfo(Process, L" ");
modifyProcessUniqueProcessId(Process);
ObDereferenceObject(Process);
return TRUE;
}
附上windbg的效果图
对了似乎还有3环的PEB结构中的三个链条没断，那个三环就可以做.
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
山总的意思。。只要搜到易语言程序不管你干啥，就封号？牛批!正在学易语言的我瑟瑟发抖。 |
|
|
你说对了，腾讯就是这么干的 |
|
|
|
|
|
|
|
|
|
|
|
|
