应用层隐藏服务的项目

最新推荐文章于 2020-10-21 21:20:01 发布
最新推荐文章于 2020-10-21 21:20:01 发布
阅读量1.1k 收藏 1
点赞数
文章标签： hook null winapi service dll thread
 
应用层隐藏服务的项目2006-03-28
HideService

　

// *****************************************************************************//
//
// 文件名: AgentHk.cpp
// 所属项目名称：
// 所属模块名称： AGENT Service Hook
// 所属项目版本： 2.0
// 文件用途 :
// 文件作者 : horse_b
// 创建日期 : 2004-11-30
//
// 文件修改说明：
// 文件修改人：
// 修改日期：
//
//
//
//********************************************************************************//

#include <stdio.h>
#include <tchar.h> // Make program ansi AND unicode safe
#include <windows.h> // Most Windows functions
#include <commctrl.h> // Used for TreeView controls
#include <setupapi.h> // Used for SetupDiXxx functions
#include <basetsd.h>
#include <cfgmgr32.h> // Used for CM_Xxxx functions
#include <regstr.h> // Extract Registry Strings
#include <devguid.h>


//API HOOK方式
#define APIHOOK16

#ifdef APIHOOK16
#include "apihook16.h"
#define CAPIHook CAPIHook16
#else
#include "apihook32.h"
#define CAPIHook CAPIHook32
#endif


#pragma comment(lib, "setupapi.lib")
#pragma comment(lib, "advapi32.lib")

//setupapi.dll中的函数声明
/*
BOOL
WINAPI
mySetupDiSetClassInstallParamsA(
IN HDEVINFO DeviceInfoSet,
IN PSP_DEVINFO_DATA DeviceInfoData,
IN PSP_CLASSINSTALL_HEADER ClassInstallParams,
IN DWORD ClassInstallParamsSize
);
*/

BOOL
WINAPI
mySetupDiSetClassInstallParamsW(
IN HDEVINFO DeviceInfoSet,
IN PSP_DEVINFO_DATA DeviceInfoData,
IN PSP_CLASSINSTALL_HEADER ClassInstallParams,
IN DWORD ClassInstallParamsSize
);


//setupapi.dll hook
CAPIHook g_hook_setupapi_paramsw("setupapi.dll", "SetupDiSetClassInstallParamsW", (FARPROC)mySetupDiSetClassInstallParamsW);
//CAPIHook g_hook_setupapi_paramsa("setupapi.dll", "SetupDiSetClassInstallParamsA", (FARPROC)mySetupDiSetClassInstallParamsA);

//advapi32.lib
BOOL
WINAPI
myChangeServiceConfigW(
SC_HANDLE hService,
DWORD dwServiceType,
DWORD dwStartType,
DWORD dwErrorControl,
LPCWSTR lpBinaryPathName,
LPCWSTR lpLoadOrderGroup,
LPDWORD lpdwTagId,
LPCWSTR lpDependencies,
LPCWSTR lpServiceStartName,
LPCWSTR lpPassword,
LPCWSTR lpDisplayName
);



//CAPIHook g_hook_advapi32_ChangeA("advapi32.dll", "ChangeServiceConfigA", (FARPROC)myChangeServiceConfigA);
CAPIHook g_hook_advapi32_ChangeW("advapi32.dll", "ChangeServiceConfigW", (FARPROC)myChangeServiceConfigW);

LPSTR WideStringToAnsiString(LPCWSTR lpcsUnicode)
{
LPSTR lpAnsiString = NULL;

if (lpcsUnicode)
{
DWORD dwSize = wcstombs(NULL, lpcsUnicode, 0);
lpAnsiString = new char[dwSize+1];
size_t rc = wcstombs(lpAnsiString, lpcsUnicode, dwSize);
//ASSERT(rc != (size_t)(-1));
lpAnsiString[dwSize] = '/0';
}

return lpAnsiString;
}

void WriteLog(char *fmt,...)
{
/*
FILE *fp;
va_list args;
char modname[200];

if((fp =fopen("c://hooksetupapi.log", "a")) !=NULL)
{
va_start(args,fmt);

GetModuleFileName(NULL, modname, sizeof(modname));
fprintf(fp, ":%s:", modname);
vfprintf(fp, fmt, args);
fprintf(fp, "/n");
fclose(fp);

va_end(args);
}
*/

}

BOOL
WINAPI
mySetupDiSetClassInstallParamsW(
IN HDEVINFO DeviceInfoSet,
IN PSP_DEVINFO_DATA DeviceInfoData,
IN PSP_CLASSINSTALL_HEADER ClassInstallParams,
IN DWORD ClassInstallParamsSize
)
{
BOOL ret = FALSE;
#ifdef APIHOOK16
g_hook_setupapi_paramsw.Hook(FALSE);
//g_hook_setupapi_paramsa.Hook(FALSE);
g_hook_advapi32_ChangeW.Hook(FALSE);

#endif
if((InlineIsEqualGUID(DeviceInfoData->ClassGuid,GUID_DEVCLASS_NET)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid,GUID_DEVCLASS_PCMCIA)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid , GUID_DEVCLASS_CDROM)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid , GUID_DEVCLASS_PORTS)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid , GUID_DEVCLASS_USB)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid , GUID_DEVCLASS_PRINTER)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid , GUID_DEVCLASS_1394)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid , GUID_DEVCLASS_MODEM)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid , GUID_DEVCLASS_FLOPPYDISK)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid , GUID_DEVCLASS_INFRARED)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid , GUID_DEVCLASS_SCSIADAPTER)) ||
(InlineIsEqualGUID(DeviceInfoData->ClassGuid, GUID_DEVCLASS_DISKDRIVE))
)
{

WriteLog("SetupDiCallClassInstaller hook/n");
SP_PROPCHANGE_PARAMS PropChangeParams = {sizeof(SP_CLASSINSTALL_HEADER)};

PropChangeParams.ClassInstallHeader.InstallFunction = DIF_DETECT;
PropChangeParams.Scope = DICS_FLAG_GLOBAL;
PropChangeParams.StateChange = 0x0;

//ClassInstallParams->InstallFunction = DIF_DETECT;
ret = SetupDiSetClassInstallParamsW(DeviceInfoSet,DeviceInfoData,
(SP_CLASSINSTALL_HEADER *)&PropChangeParams,
sizeof(PropChangeParams));
#ifdef APIHOOK16
g_hook_setupapi_paramsw.Hook(TRUE);
//g_hook_setupapi_paramsa.Hook(TRUE);
g_hook_advapi32_ChangeW.Hook(TRUE);

#endif

return ret;
}

ret = SetupDiSetClassInstallParamsW(DeviceInfoSet,DeviceInfoData,
ClassInstallParams,
ClassInstallParamsSize);

#ifdef APIHOOK16
g_hook_setupapi_paramsw.Hook(TRUE);
//g_hook_setupapi_paramsa.Hook(TRUE);
g_hook_advapi32_ChangeW.Hook(TRUE);

#endif



return ret;
}


BOOL
WINAPI
myChangeServiceConfigW(
SC_HANDLE hService,
DWORD dwServiceType,
DWORD dwStartType,
DWORD dwErrorControl,
LPCWSTR lpBinaryPathName,
LPCWSTR lpLoadOrderGroup,
LPDWORD lpdwTagId,
LPCWSTR lpDependencies,
LPCWSTR lpServiceStartName,
LPCWSTR lpPassword,
LPCWSTR lpDisplayName
)
{
BOOL ret = FALSE;
#ifdef APIHOOK16
// g_hook_advapi32_ChangeA.Hook(FALSE);
g_hook_advapi32_ChangeW.Hook(FALSE);
g_hook_setupapi_paramsw.Hook(FALSE);

#endif

LPSTR lpDisplay;

lpDisplay = WideStringToAnsiString(lpDisplayName);
//if(lpDisplayName == NULL)
//{
// WriteLog("ChangeServiceConfigW hook :Display name is null:/n");
// goto XLOOP;
//}

if(strstr(lpDisplay ,"Cns Agent") != NULL)
{

WriteLog("ChangeServiceConfigW hook :Cns Agent:no_change:/n");


ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_AUTO_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);

#ifdef APIHOOK16
// g_hook_advapi32_ChangeA.Hook(TRUE);
g_hook_advapi32_ChangeW.Hook(TRUE);
g_hook_setupapi_paramsw.Hook(TRUE);

#endif

delete []lpDisplay;
return ret;

}
else if(strstr(lpDisplay ,"HookNdis") != NULL)
{

WriteLog("ChangeServiceConfigW hook :HookNdis:no_change:/n");

if( dwStartType != SERVICE_AUTO_START)
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_SYSTEM_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);
else
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_AUTO_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);


#ifdef APIHOOK16
// g_hook_advapi32_ChangeA.Hook(TRUE);
g_hook_advapi32_ChangeW.Hook(TRUE);
g_hook_setupapi_paramsw.Hook(TRUE);

#endif
delete []lpDisplay;
return ret;

}

else if(strstr(lpDisplay ,"Hooktdi") != NULL)
{

WriteLog("ChangeServiceConfigW hook :Hooktdi:no_change:/n");

if( dwStartType != SERVICE_AUTO_START)
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_SYSTEM_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);
else
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_AUTO_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);


#ifdef APIHOOK16
// g_hook_advapi32_ChangeA.Hook(TRUE);
g_hook_advapi32_ChangeW.Hook(TRUE);
g_hook_setupapi_paramsw.Hook(TRUE);

#endif
delete []lpDisplay;
return ret;

}

else if(strstr(lpDisplay ,"Hideprocess") != NULL)
{

WriteLog("ChangeServiceConfigW hook :Hideprocess:no_change:/n");

if( dwStartType != SERVICE_AUTO_START)
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_SYSTEM_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);
else
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_AUTO_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);


#ifdef APIHOOK16
// g_hook_advapi32_ChangeA.Hook(TRUE);
g_hook_advapi32_ChangeW.Hook(TRUE);
g_hook_setupapi_paramsw.Hook(TRUE);

#endif
delete []lpDisplay;
return ret;

}

else if(strstr(lpDisplay ,"ZzFilesensor") != NULL)
{

WriteLog("ChangeServiceConfigW hook :ZzFilesensor:no_change:/n");

if( dwStartType != SERVICE_AUTO_START)
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_SYSTEM_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);
else
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_AUTO_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);


#ifdef APIHOOK16
// g_hook_advapi32_ChangeA.Hook(TRUE);
g_hook_advapi32_ChangeW.Hook(TRUE);
g_hook_setupapi_paramsw.Hook(TRUE);

#endif
delete []lpDisplay;
return ret;

}

else if(strstr(lpDisplay ,"Zzregsensor") != NULL)
{

WriteLog("ChangeServiceConfigW hook :Zzregsensor:no_change:/n");

if( dwStartType != SERVICE_AUTO_START)
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_SYSTEM_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);
else
ret = ChangeServiceConfigW(
hService,
dwServiceType,
SERVICE_AUTO_START,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);


#ifdef APIHOOK16
// g_hook_advapi32_ChangeA.Hook(TRUE);
g_hook_advapi32_ChangeW.Hook(TRUE);
g_hook_setupapi_paramsw.Hook(TRUE);

#endif
delete []lpDisplay;
return ret;

}

XLOOP:

WriteLog("ChangeServiceConfigW hook /n");

ret = ChangeServiceConfigW(
hService,
dwServiceType,
dwStartType,
dwErrorControl,
lpBinaryPathName,
lpLoadOrderGroup,
lpdwTagId,
lpDependencies,
lpServiceStartName,
lpPassword,
lpDisplayName);

#ifdef APIHOOK16
// g_hook_advapi32_ChangeA.Hook(TRUE);
g_hook_advapi32_ChangeW.Hook(TRUE);
g_hook_setupapi_paramsw.Hook(TRUE);

#endif
delete []lpDisplay;
return ret;

}


void HookAll(BOOL bHook)
{
#ifdef APIHOOK16
// g_hook_advapi32_ChangeA.Hook(bHook);
g_hook_advapi32_ChangeW.Hook(bHook);

g_hook_setupapi_paramsw.Hook(bHook);
// g_hook_setupapi_paramsa.Hook(bHook);
#endif
}

extern "C" int APIENTRY
DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
switch (dwReason) {
case DLL_PROCESS_ATTACH:
HookAll(TRUE);
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
HookAll(FALSE);
break;
}
return 1;
}
　

　

　

// *****************************************************************************//
//
// 文件名: main.CPP
// 所属项目名称：
// 所属模块名称： AGENT Service Hook MMC.EXE
// 所属项目版本： 2.0
// 文件用途 :
// 文件作者 : horse_b
// 创建日期 : 2004-11-15
//
// 文件修改说明：
// 文件修改人：
// 修改日期：
//
//
//
//********************************************************************************//

#include <windows.h>
#include <stdio.h>
#include <malloc.h> // For alloca
#include <TlHelp32.h> // For enum process

#define DEFAULT_LIB "AgentHk.DLL"

char g_szExeName[MAX_PATH] = {0};

BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
return TRUE;
}


BOOL WINAPI InjectLib(DWORD dwProcessId, PCSTR pszDllInject)
{
HANDLE hProcess = NULL, hThread = NULL;
char *pszDllInjectRemote = NULL;
char szLine[MAX_PATH] = {0};
BOOL bOk = FALSE;

__try {
// Get a handle for the target process.
hProcess = OpenProcess(
PROCESS_QUERY_INFORMATION | // Required by Alpha
PROCESS_CREATE_THREAD | // For CreateRemoteThread
PROCESS_VM_OPERATION | // For VirtualAllocEx/VirtualFreeEx
PROCESS_VM_WRITE, // For WriteProcessMemory
FALSE, dwProcessId);
if (hProcess == NULL) {
__leave;
}

// Calculate the number of bytes needed for the DLL's pathname
int cch = 1 + strlen(pszDllInject);
int cb = cch * sizeof(char);

// Allocate space in the remote process for the pathname
pszDllInjectRemote = (char *)
VirtualAllocEx(hProcess, NULL, cb, MEM_COMMIT, PAGE_READWRITE);
if (pszDllInjectRemote == NULL) {
__leave;
}

// Copy the DLL's pathname to the remote process's address space
if (!WriteProcessMemory(hProcess, pszDllInjectRemote,
(PVOID) pszDllInject, cb, NULL)) {
__leave;
}

// Get the real address of LoadLibraryA in Kernel32.dll
PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)
GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA");
if (pfnThreadRtn == NULL) {
__leave;
}

// Create a remote thread that calls LoadLibraryA(DLLPathname)
hThread = CreateRemoteThread(hProcess, NULL, 0,
pfnThreadRtn, pszDllInjectRemote, 0, NULL);
if (hThread == NULL) {
__leave;
}

// Wait for the remote thread to terminate
WaitForSingleObject(hThread, INFINITE);

bOk = TRUE; // Everything executed successfully
}
__finally { // Now, we can clean everthing up

// Free the remote memory that contained the DLL's pathname
if (pszDllInjectRemote != NULL)
VirtualFreeEx(hProcess, pszDllInjectRemote, 0, MEM_RELEASE);

if (hThread != NULL)
CloseHandle(hThread);

if (hProcess != NULL)
CloseHandle(hProcess);
}

return(bOk);
}

BOOL WINAPI EjectLib(DWORD dwProcessId, PCSTR pszDllInject)
{
BOOL bOk = FALSE; // Assume that the function fails
HANDLE hthSnapshot = NULL;
HANDLE hProcess = NULL, hThread = NULL;

__try {
// Grab a new snapshot of the process
hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
if (hthSnapshot == NULL) __leave;

// Get the HMODULE of the desired library
MODULEENTRY32 me = { sizeof(me) };
BOOL bFound = FALSE;
BOOL bMoreMods = Module32First(hthSnapshot, &me);
for (; bMoreMods; bMoreMods = Module32Next(hthSnapshot, &me)) {
bFound = (stricmp(me.szModule, pszDllInject) == 0) ||
(stricmp(me.szExePath, pszDllInject) == 0);
if (bFound) break;
}
if (!bFound) __leave;

// Get a handle for the target process.
hProcess = OpenProcess(
PROCESS_QUERY_INFORMATION | // Required by Alpha
PROCESS_CREATE_THREAD |
PROCESS_VM_OPERATION, // For CreateRemoteThread
FALSE, dwProcessId);
if (hProcess == NULL) __leave;

// Get the real address of FreeLibrary in Kernel32.dll
PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)
GetProcAddress(GetModuleHandle("Kernel32"), "FreeLibrary");
if (pfnThreadRtn == NULL) __leave;

// Create a remote thread that calls FreeLibraryA(HANDLE)
hThread = CreateRemoteThread(hProcess, NULL, 0,
pfnThreadRtn, me.modBaseAddr, 0, NULL);
if (hThread == NULL) __leave;

// Wait for the remote thread to terminate
WaitForSingleObject(hThread, INFINITE);

bOk = TRUE; // Everything executed successfully
}
__finally { // Now we can clean everything up

if (hthSnapshot != NULL)
CloseHandle(hthSnapshot);

if (hThread != NULL)
CloseHandle(hThread);

if (hProcess != NULL)
CloseHandle(hProcess);
}

return(bOk);
}

int WINAPI InjectLibAll(char *pszDllInject)
{
HANDLE hthSnapshot = NULL;
HANDLE hProcess = NULL, hThread = NULL;
int nRtn = 0;

__try {
// Grab a new snapshot of the process
hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hthSnapshot == NULL) __leave;

// Get the HMODULE of the desired library
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL bFound = FALSE;
BOOL bMoreProcesses = Process32First(hthSnapshot, &pe);
for (; bMoreProcesses; bMoreProcesses = Process32Next(hthSnapshot, &pe)) {
if (stricmp(pe.szExeFile, g_szExeName) == 0)
continue;
if (InjectLib(pe.th32ProcessID, pszDllInject)) {
nRtn++;
printf("%s - %s/n", pe.szExeFile, "DLL Injection successful.");
}
else {
printf("%s - %s/n", pe.szExeFile, "DLL Injection failed.");
}
}
}
__finally { // Now we can clean everything up

if (hthSnapshot != NULL)
CloseHandle(hthSnapshot);

if (hThread != NULL)
CloseHandle(hThread);

if (hProcess != NULL)
CloseHandle(hProcess);
}

return nRtn;
}

int WINAPI EjectLibAll(char *pszDllInject)
{
HANDLE hthSnapshot = NULL;
HANDLE hProcess = NULL, hThread = NULL;
int nRtn = 0;

__try {
// Grab a new snapshot of the process
hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hthSnapshot == NULL) __leave;

// Get the HMODULE of the desired library
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL bFound = FALSE;
BOOL bMoreProcesses = Process32First(hthSnapshot, &pe);
for (; bMoreProcesses; bMoreProcesses = Process32Next(hthSnapshot, &pe)) {
if (stricmp(pe.szExeFile, g_szExeName) == 0)
continue;
if (EjectLib(pe.th32ProcessID, pszDllInject)) {
nRtn++;
printf("%s - %s/n", pe.szExeFile, "DLL Ejection successful.");
}
else {
printf("%s - %s/n", pe.szExeFile, "DLL Ejection failed.");
}
}
}
__finally { // Now we can clean everything up

if (hthSnapshot != NULL)
CloseHandle(hthSnapshot);

if (hThread != NULL)
CloseHandle(hThread);

if (hProcess != NULL)
CloseHandle(hProcess);
}

return nRtn;
}

int WINAPI InjectLibByName(char *pszDllInject, char *pszProcName)
{
HANDLE hthSnapshot = NULL;
HANDLE hProcess = NULL, hThread = NULL;
int nRtn = 0;

__try {
// Grab a new snapshot of the process
hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hthSnapshot == NULL) __leave;

// Get the HMODULE of the desired library
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL bFound = FALSE;
BOOL bMoreProcesses = Process32First(hthSnapshot, &pe);
for (; bMoreProcesses; bMoreProcesses = Process32Next(hthSnapshot, &pe)) {
if (stricmp(pe.szExeFile, pszProcName) == 0) {
if (InjectLib(pe.th32ProcessID, pszDllInject)) {
nRtn++;
printf("%s/%s - %s/n", pszDllInject, pe.szExeFile, "DLL Injection successful.");
}
else {
printf("%s/%s - %s/n", pszDllInject, pe.szExeFile, "DLL Injection failed");
}
}
}
}
__finally { // Now we can clean everything up

if (hthSnapshot != NULL)
CloseHandle(hthSnapshot);

if (hThread != NULL)
CloseHandle(hThread);

if (hProcess != NULL)
CloseHandle(hProcess);
}

return nRtn;
}

int WINAPI EjectLibByName(char *pszDllInject, char *pszProcName)
{
HANDLE hthSnapshot = NULL;
HANDLE hProcess = NULL, hThread = NULL;
int nRtn = 0;

__try {
// Grab a new snapshot of the process
hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hthSnapshot == NULL) __leave;

// Get the HMODULE of the desired library
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL bFound = FALSE;
BOOL bMoreProcesses = Process32First(hthSnapshot, &pe);
for (; bMoreProcesses; bMoreProcesses = Process32Next(hthSnapshot, &pe)) {
if (stricmp(pe.szExeFile, pszProcName) == 0) {
if (EjectLib(pe.th32ProcessID, pszDllInject)) {
nRtn++;
printf("%s - %s/n", pe.szExeFile, "DLL Ejection successful.");
}
else {
printf("%s - %s/n", pe.szExeFile, "DLL Ejection failed.");
}
}
}
}
__finally { // Now we can clean everything up

if (hthSnapshot != NULL)
CloseHandle(hthSnapshot);

if (hThread != NULL)
CloseHandle(hThread);

if (hProcess != NULL)
CloseHandle(hProcess);
}

return nRtn;
}

//提升权限
BOOL EnableDebugPriv(void)
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;

if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
return FALSE;
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue)) {
CloseHandle(hToken);
return FALSE;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof tkp, NULL, NULL)) {
CloseHandle(hToken);
return FALSE;
}

return TRUE;
}

BOOL __stdcall CallHook(int nPid)
{
BOOL ret = FALSE;
DWORD dwProcessId = 0;
char szProcName[MAX_PATH] = {0};
char szLine[MAX_PATH] = {0};
char szLibFile[MAX_PATH] = {0};

GetModuleFileName(0, szLine, sizeof(g_szExeName)-1);
char *ptr = strrchr(szLine, '//');
if (ptr) {
ptr++;
strcpy(g_szExeName, ptr);
}

//提升权限
EnableDebugPriv();

GetModuleFileName(NULL, szLibFile, sizeof(szLibFile));
strcpy(strrchr(szLibFile, '//') + 1, DEFAULT_LIB);


FILE *fp = fopen(szLibFile, "r");
if (!fp) {
// printf("DLL file /"%s/" not exists./n", szLibFile);
return 0;
}
fclose(fp);

if (dwProcessId > 0) {
//根据进程ID注入DLL
if (InjectLib(dwProcessId, szLibFile)) {
// printf("%s/n", "DLL Injection successful.");
ret = TRUE;
}
else {
// printf("%s/n", "DLL Injection failed.");
ret = FALSE;
}
}


return ret;
}

BOOL __stdcall UnHook(int nPid)
{

BOOL ret = FALSE;
DWORD dwProcessId = 0;
char szProcName[MAX_PATH] = {0};
char szLine[MAX_PATH] = {0};
char szLibFile[MAX_PATH] = {0};

GetModuleFileName(0, szLine, sizeof(g_szExeName)-1);
char *ptr = strrchr(szLine, '//');
if (ptr) {
ptr++;
strcpy(g_szExeName, ptr);
}

//提升权限
EnableDebugPriv();

GetModuleFileName(NULL, szLibFile, sizeof(szLibFile));
strcpy(strrchr(szLibFile, '//') + 1, DEFAULT_LIB);


FILE *fp = fopen(szLibFile, "r");
if (!fp) {
// printf("DLL file /"%s/" not exists./n", szLibFile);
return 0;
}
fclose(fp);

if (dwProcessId > 0) {
//根据进程ID注入DLL
if (EjectLib(dwProcessId, szLibFile)) {
// printf("%s/n", "DLL Ejection successful.");
ret = TRUE;
}
else {
// printf("%s/n", "DLL Ejection failed.");
ret = FALSE;
}
}

return ret;
}
　

注意这里隐藏服务采用ＨＯＯＫ　ＭＭＣ．ＥＸＥ的方式，还可以采用全局的应用层ＨＯＯＫ

AgentHk.dll 是ＨＯＯＫ　的主要代码

CallHook.dll　是ＨＯＯＫ　代码的调用接口

 
sanshao27
关注
枚举pc硬件设备并获取相关信息
宏的博客
09-14 1358
#include &lt;windows.h&gt; #include &lt;setupapi.h&gt; #include &lt;devguid.h&gt; #pragma comment(lib, "setupapi") void GetDeviceInfo() { //得到设备信息集 HDEVINFO hDevInfo = SetupDiGetClassDevs( (LP...
内存写入 隐藏模块注入
pluginL的博客
09-11 1840
思路: 1.获取自身SizeOfImage ImageBase 2.远程申请注入进程SizeOfImage大小的内存 内存位置随机 获得内存位置:ProcessAddr 3.申请一段SizeOfImage大小缓冲区，写入自身程序 内存位置：ImageBase 4.修复Image重定位表(参数为:ProcessAddr) 5.写入缓冲区ProcessAddr,SizeOfImage 6.远程线程申请入口点为DWORD WINAPI(LPVOID lparameter) 7.入口点修复导入表，因为
通过GUID读取COM口信息
wing的专栏
11-16 5142
void EnumerCOMPortByGUID() {     HDEVINFO hDevInfo;        SP_DEVINFO_DATA DeviceInfoData;        DWORD i = 0;                hDevInfo = SetupDiGetClassDevs((LPGUID) &GUID_DEVCLASS_PORTS, 0, 0,D
inject.rar
10-16
DLL注入有很多方法，远线程，钩子，输入法，劫持，APC等等。 现在的好多进程都有保护，特别是一些游戏有各种保护如TP TS HS NP CD GPK BE SG3等等保护，这样常规的注入方法就没效果了。 现在流行且稳定的注入方法一般都要用驱动来实现了，驱动注入，APC，回调等都可以用驱动注入。
枚举系统中所有硬件设备
07-05
虽然简单，但是实用 HDEVINFO hDevInfo; SP_DEVINFO_DATA DeviceInfoData; DWORD i,j; int ret=0; hDevInfo = SetupDiGetClassDevs((LPGUID) &GUID;_DEVCLASS_MOUSE, 0, 0,DIGCF_PRESENT);//DIGCF_PROFILE);// /* 　　GUID_DEVCLASS_FDC软盘控制器 　　GUID_DEVCLASS_DISPLAY显示卡 　　GUID_DEVCLASS_CDROM光驱 　　GUID_DEVCLASS_KEYBOARD键盘 　　GUID_DEVCLASS_COMPUTER计算机 　　GUID_DEVCLASS_SYSTEM系统 　　GUID_DEVCLASS_DISKDRIVE磁盘驱动器 　　GUID_DEVCLASS_MEDIA声音、视频和游戏控制器 　　GUID_DEVCLASS_MODEMMODEM 　　GUID_DEVCLASS_MOUSE鼠标和其他指针设备 　　GUID_DEVCLASS_NET网络设备器 　　GUID_DEVCLASS_USB通用串行总线控制器 　　GUID_DEVCLASS_FLOPPYDISK软盘驱动器 　　GUID_DEVCLASS_UNKNOWN未知设备 　　GUID_DEVCLASS_SCSIADAPTERSCSI 和 RAID 控制器 　　GUID_DEVCLASS_HDCIDE ATA/ATAPI 控制器 　　GUID_DEVCLASS_PORTS端口（COM 和 LPT） 　　GUID_DEVCLASS_MONITOR监视器 　　*/ if (hDevInfo == INVALID_HANDLE_VALUE){ // Insert error handling here. // return ; } // Enumerate through all devices in Set. DeviceInfoData.cbSize = sizeof(SP_DEVINFO_DATA); for (i=0;SetupDiEnumDeviceInfo(hDevInfo,i,&DeviceInfoData;);i++) { DWORD DataT; //LPTSTR buffer = NULL; char buffer[2048]; DWORD buffersize =sizeof(buffer); while (!SetupDiGetDeviceRegistryProperty( hDevInfo, &DeviceInfoData;, SPDRP_FRIENDLYNAME, &DataT;, (PBYTE)buffer, buffersize, &buffersize;)) { if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) { // Change the buffer size. //if (buffer) LocalFree(buffer); //buffer = (PSP_INF_INFORMATION)LocalAlloc(LPTR,buffersize); // <!--[if !supportEmptyParas]--><!--[endif]--> } else { // Insert error handling here. break; } } if (buffer != NULL && i == 0) { // temp.Format(""); // str += temp; } // temp.Format("%s",buffer); // str += temp; if (buffer) LocalFree(buffer); } if (i != 0) { // temp.Format(""); // str += temp; } if ( GetLastError()!=NO_ERROR && GetLastError()!=ERROR_NO_MORE_ITEMS ) { return ; } // <!--[if !supportEmptyParas]--><!--[endif]--> // Cleanup SetupDiDestroyDeviceInfoList(hDevInfo);
Device Interface GUID
tomorrowsprogress的专栏
06-24 3140
MSDN中的内容位置:　DEVICE I/O下的 Device ManagementMSDN的Windows Multimedia#include       #include       #include       #include       #include       #include       #pragma       comment(lib,"setupapi
VC++串口笔记(一)枚举电脑串口
zkp664ej
01-17 305
VC++串口笔记(一)枚举电脑串口 2012年01月14日 　　 1.从注册表读取信息： 　　代码如下： 　　 　　 　　 　　 　　从注册表读取串口 　　1 void CCommDlg::EnumCommPort(CListBox *pListBox) 　　2 { 　　3 HKEY hKey; 　　4 if(ERROR_SUCC...
Untitled2_matlab_多隐藏层_BP神经网络_
10-03
"一个基于matlab的多隐藏层的BP神经网络程序" 描述指出，这个项目是用MATLAB编程语言编写的，MATLAB是一种广泛应用于数值计算、图像处理、数据分析等领域的高级编程环境，尤其在工程和科学计算中非常流行。...
JS弹出层的显示与隐藏示例代码
10-26
本文将详细解释如何使用JS实现弹出层的显示与隐藏。 首先，我们来分析给出的示例代码。这段代码包含两个主要的函数：`popDIV_show` 和 `popDIV_hidden`。它们分别负责弹出层的显示和隐藏。 1. **弹出层的显示 (`...
完美的鼠标放上去jquery显示隐藏层
11-04
描述中提到，此代码经过了优化，可以显示和隐藏多个层，并且可以在页面上的任意位置应用。这意味着开发者可以根据需要创建多个隐藏层，并且它们可以与不同的元素关联，当鼠标移到这些元素上时，相应的隐藏层就会出现...
深度学习课程作业_基于MATLAB实现卷积神经网络CNN与多层感知机MLP的手写数字识别系统_包含单层隐藏层双层隐藏层和无隐藏层的简单神经网络模型_以及采用dropout正则化技.zip
最新发布
08-16
项目不仅覆盖了常见的网络结构，还尝试了不同的隐藏层配置，包括单层隐藏层、双层隐藏层以及无隐藏层的简单神经网络模型。此外，该项目还应用了dropout技术作为正则化手段，以提高神经网络模型的泛化能力，避免过...
层的显示隐藏
04-10
7. **实际应用**：在实际项目中，"层的显示隐藏"广泛应用于下拉菜单、模态对话框、轮播图、加载提示等。通过JS控制这些层的显示状态，可以增强用户体验，使网页更具交互性。 综上所述，"层的显示隐藏"是JavaScript...
如何得到设备的GUID值
djyrsty的专栏
12-24 4823
<br />如何得到设备的GUID值？<br />如果是系统的标准设备，可以在devguid.h文件中找到所对应的guid值，但如果是其它安装的驱动则可以查看其classguid值（系统设备也可以），如：<br />USB的guid值可以在注册表路径：<br />HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Class/<br />里面找到值｛36fc9e60-c465-11cf-8056-444553540000｝<br />其对应的classgu
GUID_DEVCLASS
weixin_30553777的博客
01-17 1113
/** Defines GUIDs for device classes** Copyright (C) 2004 CodeWeavers (Aric Stewart)** This library is free software; you can redistribute it and/or* modify it under the terms of the GNU Lesser ...
linux查看进程_Linux下的几种隐藏技术
weixin_39622710的博客
10-21 525
0x00 前言攻击者在获取服务器权限后，会通过一些技巧来隐藏自己的踪迹和后门文件，本文介绍Linux下的几种隐藏技术。0x01 隐藏文件Linux 下创建一个隐藏文件：touch .test.txt touch 命令可以创建一个文件，文件名前面加一个 点 就代表是隐藏文件,如下图：一般的Linux下的隐藏目录使用命令ls -l是查看不出来的，只能查看到文件及文件夹，查看Linux下的隐藏文件需要...
完整版的连接 隐藏 注入
pl2597758的专栏
05-30 641
#include "stdafx.h" 2. #include "stdio.h" 3. #include "string.h" 4. #include 5. #include 6. #include "tlhelp32.h" 7. #pragma comment(lib,"wininet.lib") 8. 9. /***************************************
最通俗易懂的网络应用层协议详解
热门推荐
神码编程
02-23 1万+
前言其实本文只是讲解从传输层到应用层实现网络消息传递的一个详细流程，至于更底层的网络层和网络接口层，那就不在我的考虑范围内了，事实上那部分机制是不需要你去操心的，除非你想开发操作系统！然后本文打着通俗易懂的标题，所以在前言之后我将不会提及任何一个新手可能会不理解的关键字或专业术语（也就是说这样只是方便了理解并不方便使用，但这就是本文的目的，毕竟有了清晰的理解之后无论再换到哪个平台都是同样的使用方式
DELPHI简易中间层架构解析与项目应用
标题“DELPHI中间层”和描述“DELPHI简易中间层”指向的是关于Delphi编程语言中中间层架构设计和实现的知识点。...这可能包括项目结构的说明、代码文件的组织方式以及如何将中间层集成到现有的应用程序中。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值