模拟锁定文件

模拟锁定文件的Rring 3下的程序代码,代码来自于看雪中的HWL发表的一份代码中,我仅仅是看了下代码:

#include <stdio.h>

#include <Windows.h>

void GetAllProcessA(int pids[],int *procount)

{

int i=0,c=0;

HANDLE hProcess=0;

for(i=8;i<19996;i+=4)

{

hProcess=OpenProcess(0x10,0,i);

if (hProcess!=0)

{

pids[c]=i;

CloseHandle(hProcess);

c++;

}

}

*procount=c;

}

int main()

{

#define SE_DEBUG_PRIVILEGE 0x14 //DEBUG 权限

//源码中没有__stdcall,所以一直报checkesp.c line 14的错误

typedef long (__stdcall *RTLADJUSTPRIVILEGE)(int, bool, bool, int*);

typedef long (__stdcall *NTDUPLICATEOBJECT)(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,BOOLEAN,ULONG);

int nEn = 0;

int pids[4*260];

int procsnum=0;

char pFile[260];

//得到函数的地址

RTLADJUSTPRIVILEGE getdbg=(RTLADJUSTPRIVILEGE)GetProcAddress(GetModuleHandleW(L"ntdll.dll"),"RtlAdjustPrivilege");

NTDUPLICATEOBJECT NtDuplicateObject=(NTDUPLICATEOBJECT)GetProcAddress(GetModuleHandleW(L"ntdll.dll"),"NtDuplicateObject");

//提升进程权限

getdbg(SE_DEBUG_PRIVILEGE , TRUE, FALSE,&nEn);//SE_DEBUG_PRIVILEGE =20

//getdbg(20,1,0,&bRet);

memset(pids,0,4*260);

memset(pFile,0,260);

printf("Input the file name you want to protect: ");

scanf("%s",pFile);

//新建文件

//#define GENERIC_READ (0x80000000L)

//HANDLE hsFile = CreateFileA(pFile, 0x80000000, 0, 0, 3, 0, 0);

HANDLE hsFile = CreateFileA(pFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

//SetHandleInformation(hsFile,0,2);

SetHandleInformation(hsFile, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE); //#define HANDLE_FLAG_PROTECT_FROM_CLOSE 0x00000002

//得到当前存活的进程id列表和进程数目,

GetAllProcessA(pids,&procsnum);

//遍历当前存活的进程

for(int i=0;i<procsnum;i++)

{

HANDLE htFile=0;

//HANDLE hProcess = OpenProcess(0x1F0FFF, 0, pids[i]);

//#define STANDARD_RIGHTS_REQUIRED (0x000F0000L)

//#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \

0xFFFF)

//#define SYNCHRONIZE (0x00100000L)

//不知道原作者为什么要用这些魔幻数,而不用PROCESS_ALL_ACCESS

HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pids[i]);

if (hProcess!=0)

{

//NtDuplicateObject((HANDLE)-1, hsFile, hProcess, &htFile, 0, 0, 4);

NtDuplicateObject((HANDLE)-1, hsFile, hProcess, &htFile, 0, 0, 4); //DUPLICATE_SAME_ATTRIBUTES = 4

CloseHandle(hProcess);

}

}

getchar();

printf("OK!\n");

getchar();

return 0;

}

代码分析:

遍历当前进程,将文件句柄拷贝到每一个进程中,从而实际锁定文件