Posted on 2010-02-08 21:28
S.l.e!ep.￠% 阅读(709)
评论(0) 编辑 收藏 引用 所属分类:
RootKit
不用hook 实现挂机锁
创建作业对象，关联winlogon.exe 进程 Winlogon控制重启，关机，注销等动作。设置作业对象的属性为JOB_OBJECT_UILIMIT_EXITWINDOWS (参考
即可 Prevents processes associated with the job from calling the ExitWindows or ExitWindowsEx function.
// 挂机
BOOL res = FALSE;
JOBOBJECT_BASIC_UI_RESTRICTIONS JobInfo;
ZeroMemory(&JobInfo, sizeof(JOBOBJECT_BASIC_UI_RESTRICTIONS));
JobInfo.UIRestrictionsClass = JOB_OBJECT_UILIMIT_EXITWINDOWS;
EnableDebugPriv(SE_DEBUG_NAME);
// 建立JOB 对象 命名为WINLOCK
HANDLE hjob = CreateJobObject(NULL, TEXT("WINLOCK"));
SetInformationJobObject(hjob, JobObjectBasicUIRestrictions, &JobInfo, sizeof(JobInfo));
DWORD Pid = GetProcessId("winlogon.exe");
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);
if (hProcess == NULL)
{
MessageBox("打开winlogon进程失败");
return;
}
res = AssignProcessToJobObject(hjob,hProcess);//将进程和对象关联起来
if (!res)
{
MessageBox("挂机失败");
}