Ring3 下隐藏进程

最新推荐文章于 2020-02-17 23:44:38 发布

原创

最新推荐文章于 2020-02-17 23:44:38 发布 · 2.6k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#descriptor #integer #import #image #module #function

该篇博客介绍了如何在Ring3级别隐藏进程的技术。通过替换模块的IAT（导入地址表）中的NtQuerySystemInformation函数，实现对系统调用的拦截，从而达到隐藏指定进程的目的。详细讲解了替换函数的过程，并提供了InterceptFunctions和UninterceptFunctions两个过程来完成函数拦截与恢复。此外，还涉及了创建文件映射、安装钩子等技术。

library nthide;

uses
Windows,
ImageHlp,
TlHelp32;

type SYSTEM_INFORMATION_CLASS = (
SystemBasicInformation,
SystemProcessorInformation,
SystemPerformanceInformation,
SystemTimeOfDayInformation,
SystemNotImplemented1,
SystemProcessesAndThreadsInformation,
SystemCallCounts,
SystemConfigurationInformation,
SystemProcessorTimes,
SystemGlobalFlag,
SystemNotImplemented2,
SystemModuleInformation,
SystemLockInformation,
SystemNotImplemented3,
SystemNotImplemented4,
SystemNotImplemented5,
SystemHandleInformation,
SystemObjectInformation,
SystemPagefileInformation,
SystemInstructionEmulationCounts,
SystemInvalidInfoClass1,
SystemCacheInformation,
SystemPoolTagInformation,
SystemProcessorStatistics,
SystemDpcInformation,
SystemNotImplemented6,
SystemLoadImage,
SystemUnloadImage,
SystemTimeAdjustment,
SystemNotImplemented7,
SystemNotImplemented8,
SystemNotImplemented9,
SystemCrashDumpInformation,
SystemExceptionInformation,
SystemCrashDumpStateInformation,
SystemKernelDebuggerInformation,
SystemContextSwitchInformation,
SystemRegistryQuotaInformation,
SystemLoadAndCallImage,
SystemPrioritySeparation,
SystemNotImplemented10,
SystemNotImplemented11,
SystemInvalidInfoClass2,
SystemInvalidInfoClass3,
SystemTimeZoneInformation,
SystemLookasideInformation,
SystemSetTimeSlipEvent,
SystemCreateSession,
SystemDeleteSession,
SystemInvalidInfoC