瑞星的窗口保护太脆弱了----请增强窗口保护！！！

Inline hook SSDT SHADOW 保護程序窗體
HOOK 了一些SSDT SHADOW表裏的未導出函數來實現


部分代xxx參考PEDIY裏 “完整的可編譯HOOK SSDTSHADOW” 實現

函數編号采用硬編xxx 隻能在XP SP2下運行
需要的朋友請自行修改.


下面是一些HOOK函數的代理函數 代xxx

//下面函數實現都很簡單 較爲依賴NtUserQueryWindow 函數 關聯窗口和進程ID

NTSTATUS fake_NtUserFindWindowEx(
IN HWND hwndParent,
IN HWND hwndChild,
IN PUNICODE_STRING pstrClassName OPTIONAL,
IN PUNICODE_STRING pstrWindowName OPTIONAL,
IN DWORD dwType)

{
ULONG hWnd;
hWnd = Old_NtUserFindWindowEx(hwndParent, hwndChild, pstrClassName, pstrWindowName, dwType);//執行原函數

if (PsGetCurrentProcess()!= ProtectedProcess)//操作進程不是自身則
{
ULONG ProcessID = Old_NtUserQueryWindow(hWnd, 0);//查詢返回窗口的進程ID

if (ProcessID == (ULONG)PsGetProcessId(ProtectedProcess))//是保護進程 則返回0
{
return FALSE;
}
}
return hWnd;
}



NTSTATUS fake_NtUserBuildHwndList(
IN HDESK hdesk,
IN HWND hwndNext,
IN ULONG fEnumChildren,
IN DWORD idThread,
IN UINT cHwndMax,
OUT HWND *phwndFirst,
OUT ULONG* pcHwndNeeded)
{
NTSTATUS ntStatus;
ULONG i=0;

if (PsGetCurrentProcess()!= ProtectedProcess)
{
if (fEnumChildren==1)//是否是枚舉子窗口
{ //如果是枚舉本程序子窗體 返回失敗
if (Old_NtUserQueryWindow((ULONG)hwndNext, 0) == (ULONG)PsGetProcessId(ProtectedProcess))
{
return STATUS_UNSUCCESSFUL;
}
}
//枚舉頂層窗口
ntStatus = Old_NtUserBuildHwndList(hdesk, hwndNext, fEnumChildren, idThread, cHwndMax, phwndFirst, pcHwndNeeded);
if (NT_SUCCESS(ntStatus))
{
while (i<*pcHwndNeeded)//循環查詢是否爲本程序窗體 從數組中擦掉
{

if (Old_NtUserQueryWindow((ULONG)phwndFirst,0) == (ULONG)PsGetProcessId(ProtectedProcess))
{ //直接置0就好了 前面代xxx有問題
phwndFirst=0;
}
i++;
}
}
return ntStatus;
}
return Old_NtUserBuildHwndList(hdesk, hwndNext, fEnumChildren, idThread, cHwndMax, phwndFirst, pcHwndNeeded);
}

UINT_PTR __stdcall fake_NtUserQueryWindow(IN ULONG WindowHandle,IN ULONG TypeInformation)
{
if( PsGetCurrentProcess() != ProtectedProcess )
{
if (Old_NtUserQueryWindow(WindowHandle, TypeInformation) == (ULONG)PsGetProcessId(ProtectedProcess))
{//試圖關聯保護的PID 返回0
return FALSE;
}
}
return Old_NtUserQueryWindow(WindowHandle, TypeInformation);
}


ULONG fake_NtUserWindowFromPoint(LONG x, LONG y)
{
ULONG hWnd;
hWnd=Old_NtUserWindowFromPoint(x,y);

if (PsGetCurrentProcess() != ProtectedProcess)
{
if (Old_NtUserQueryWindow(hWnd, 0) == (ULONG)PsGetProcessId(ProtectedProcess))
{
return FALSE;
}
}
return hWnd;
}




//思路很簡單 執行原函數後 直接判斷輸出句柄 如果是我們的 直接close掉 然後返回失敗
//還好NtDuplicateObject 系統調用不是很頻繁 如果是調用頻繁的系統函數 不建議這樣亂來.^_^
NTSTATUS fake_NtDuplicateObject(
IN HANDLE SourceProcessHandle,
IN HANDLE SourceHandle,
IN HANDLE TargetProcessHandle,
OUT PHANDLE TargetHandle OPTIONAL,
IN ACCESS_MASK DesiredAccess,
IN ULONG Attributes,
IN ULONG Options)
{
NTSTATUS ntStatus,Tmp;
//PVOID pObj=NULL;
PROCESS_BASIC_INFORMATION PBI;
ntStatus=Old_NtDuplicateObject(SourceProcessHandle,SourceHandle,TargetProcessHandle,
TargetHandle,DesiredAccess,Attributes,Options);


if (NT_SUCCESS(ntStatus) )
{ //在當前進程上下文 直接查詢輸出句柄所屬ID 是我們的直接CLOSE掉
//這裏 用内核提供的查詢句柄函數似乎更精确 可以直接獲取對象 然後對比是否是我們的進線程對象.
Tmp=ZwQueryInformationProcess(*TargetHandle,ProcessBasicInformation,&PBI,sizeof(PBI),NULL);
//Tmp=ObReferenceObjectByHandle(*TargetHandle, 0, NULL, KernelMode, &pObj, NULL );

if (NT_SUCCESS(Tmp))
{ /* //需要自己替換 可防止COPY 進線程句柄
if (pObj==(PVOID)ProtectedProcess|pObj==(PVOID)ProtectedThread)
{
ZwClose(*TargetHandle);
*TargetHandle=0;
ntStatus= STATUS_UNSUCCESSFUL;
}*/


if (PBI.UniqueProcessId ==(ULONG)PsGetProcessId(ProtectedProcess))
{
ZwClose(*TargetHandle);
*TargetHandle=0;
ntStatus= STATUS_UNSUCCESSFUL;
}

}
}
return ntStatus;
}


NTSTATUS fake_ObOpenObjectByPointer(
IN PVOID Object,
IN ULONG HandleAttributes,
IN PACCESS_STATE PassedAccessState OPTIONAL,
IN ACCESS_MASK DesiredAccess OPTIONAL,
IN POBJECT_TYPE ObjectType OPTIONAL,
IN KPROCESSOR_MODE AccessMode,
OUT PHANDLE Handle)


{

if ((Object != NULL) && (MmIsAddressValid(Object)))
{
if ((ProtectedThread !=PsGetCurrentThread())) //當前操作者不是本程序自身的線程
{
if (Object == IoThreadToProcess(ProtectedThread)|| Object==ProtectedThread)
{//目标是否爲我們保護的對象
return STATUS_ACCESS_DENIED;// 是則拒絕訪問
}
}

}
return Old_ObOpenObjectByPointer (Object, HandleAttributes,PassedAccessState,
DesiredAccess,ObjectType,AccessMode,Handle);

}




用户系统信息：Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.33 Safari/534.3 SE 2.X MetaSr 1.0

hooksys.sys [25.0.0.34]版本解决
感谢支持。