首页
社区
课程
招聘
win10 内核中读取中文进程文件名
2023-11-20 22:19 1314

win10 内核中读取中文进程文件名

2023-11-20 22:19
1314

//新人贴子不要 只供自己学习

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
#include <ntifs.h>
#include "Header.h"
 
 
void mFindProcess(const wchar_t* ModeName)
{  
    //内核中查找中文进程
    ULONG64 ulProcessName ;
    ULONG64 ulProcessID ;
    int i = 1;
    mPEPROCESS pEprocess = NULL;   
    mPEPROCESS pFirstEprocess = NULL;  
    pEprocess = (mPEPROCESS)PsGetCurrentProcess();  //取得eprocess结构体
    pFirstEprocess = pEprocess;
    if (pEprocess == NULL)
    {
        DbgPrintEx(0,77,"PsGetCurrentProcess Failed!\n");
        return;
    }
    do  /*win10 19043.1237 版本 如果不是这个版本请需构造EPROCESS结构体*/
    {      
        ulProcessID = (DWORD_PTR)pEprocess->UniqueProcessId;
        if (pEprocess->ImageFilePointer != NULL)
        {
            ulProcessName =(ULONG64) wcsstr(pEprocess->ImageFilePointer->FileName.Buffer, ModeName);
            if (ulProcessName)
            {
                DbgPrintEx(0, 77, "pEprocess = %p Process ID = %08d | DebugPort:%d Process Name=%ws Count:%d\n", pEprocess, ulProcessID,pEprocess->DebugPort, ulProcessName, i);
                break;
            }          
        }      
        pEprocess = (mPEPROCESS)(*(ULONG64*)(pEprocess->ActiveProcessLinks.Flink) - ((ULONG64)&pEprocess->ActiveProcessLinks - (ULONG64)pEprocess));     
        i++;
    } while (pEprocess != pFirstEprocess && pEprocess->UniqueProcessId != NULL);
}
NTSTATUS mHideProcess/*隐藏进程*/(const wchar_t* ModulName)
{
    //内核中断链进程     注:当退出时会蓝屏
    mPEPROCESS pEprocess;
    DWORD_PTR ulProcessName;
    pEprocess = (mPEPROCESS)PsGetCurrentProcess();
    PLIST_ENTRY pActiveProcessLinks = (LIST_ENTRY*)(pEprocess->ActiveProcessLinks.Flink);  //指向下一个结构
    PLIST_ENTRY pNextLinks = pActiveProcessLinks;
     
    do{
pEprocess =(mPEPROCESS)((DWORD_PTR)pNextLinks- ((ULONG64)&pEprocess->ActiveProcessLinks - (ULONG64)pEprocess));  // +2e8  ActiveProcessLinks
        if (pEprocess->ImageFilePointer != NULL)
        {  
            ulProcessName = (DWORD_PTR)wcsstr((wchar_t*)((mPEPROCESS)pEprocess->ImageFilePointer->FileName.Buffer), ModulName);
            if (ulProcessName)
            {
                pNextLinks->Blink->Flink = pNextLinks->Flink;
                pNextLinks->Flink->Blink = pNextLinks->Blink;
                DbgPrintEx(0, 77, "Hide Success\n");
                break;
            }
        }
        pNextLinks = pNextLinks->Flink;
    } while (pNextLinks->Flink != pActiveProcessLinks->Flink);
    return STATUS_SUCCESS;
}
 
void DriverUnLoad(PDRIVER_OBJECT pDriverObjct)
{
    DbgPrint("%ws UnLoad success!\n", pDriverObjct->DriverName.Buffer);
}
 
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObjct, PUNICODE_STRING pRegPath)
{
    DbgBreakPoint();   
    DbgPrintEx(0, 77, "Load Success %ws\n", pRegPath->Buffer);
    mFindProcess(L"中文名.exe");   //如果用PsGetProcessImageFileName  取名字为乱码
    mHideProcess(L"中文名.exe");
    pDriverObjct->DriverUnload = DriverUnLoad;
     
    return STATUS_SUCCESS;
}

[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》,视频+靶场+题目!助力进入CTF世界

最后于 2023-11-20 22:43 被foxkinglxq编辑 ,原因:
收藏
点赞1
打赏
分享
最新回复 (2)
雪    币: 16305
活跃值: (20482)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
秋狝 2023-11-21 09:34
2
1
感谢分享
雪    币: 3334
活跃值: (3090)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
caolinkai 2023-11-21 10:19
3
0
感谢分享
游客
登录 | 注册 方可回帖
返回