0环进程断链

使用PsLookupProcessByProcessId操作Windows进程及其隐藏/显示的PEPROCESS函数

原创已于 2024-05-02 17:00:04 修改 · 283 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#c++ #操作系统 #c语言 #windows

于 2024-05-02 16:27:12 首次发布

文章介绍了如何通过PsLookupProcessByProcessId查询PID为4的进程并获取PEPROCESS结构，以及如何隐藏和显示进程链表中的节点。作者展示了HideProcess函数用于从链表中移除进程，而UnHideProcess函数则用于恢复进程在链表中的位置。

通过PsLookupProcessByProcessId查询PID=4的进程获得eprocess，再通过偏移量遍历链表对比断链。

PEPROCESS HideProcess(PCHAR sourceName) {
	PEPROCESS processNode = 0;
	NTSTATUS status = PsLookupProcessByProcessId((HANDLE)4, &processNode);
	if (!NT_SUCCESS(status)) {
		DbgPrint("PsLookupProcessByProcessId\n");
		return STATUS_UNSUCCESSFUL;
	}

	PLIST_ENTRY pCur = processNode;
	PLIST_ENTRY pNext = processNode;
	STRING sourceStr = { 0 };
	RtlInitString(&sourceStr, sourceName);
	STRING targetStr = { 0 };
	do {
		pNext = (ULONG)((PLIST_ENTRY)((ULONG)pNext + 0xb8))->Flink - 0xb8;
		RtlInitString(&targetStr, (PCHAR)pNext + 0x16c);
		if (!RtlCompareString(&sourceStr, &targetStr, TRUE)) {
			DbgPrint("PROCESS:%p %s\n", pNext, (PCHAR)pNext + 0x16c);
			RemoveEntryList((ULONG)pNext + 0xb8);
			ObDereferenceObject(processNode);
			return pNext;
		}
	} while (pNext - pCur);
	ObDereferenceObject(processNode);
	return 0;
}

复原

VOID UnHideProcess(PEPROCESS processNode) {
	PLIST_ENTRY Node = (PUCHAR)processNode + 0xb8;
	PLIST_ENTRY LastNode = Node->Blink;
	PLIST_ENTRY NextNode = Node->Flink;
	LastNode->Flink = Node;
	NextNode->Blink = Node;
}