进程和线程保护
·
该代码XP不支持
#include <ntifs.h>
#include<ntddk.h>
#define PROCESS_TERMINATE 0x1
HANDLE ObHandleProcess;
HANDLE ObHandleThread;
NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);
typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PULONG DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union
{
LIST_ENTRY HashLinks;
struct
{
PVOID SectionPointer;
ULONG CheckSum;
};
};
union
{
ULONG TimeDateStamp;
PVOID LoadedImports;
};
PULONG * EntryPointActivationContext;
PVOID PatchInformation;
LIST_ENTRY ForwarderLinks;
LIST_ENTRY ServiceTagLinks;
LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
NTSTATUS BypassDriverCheck(IN PDRIVER_OBJECT pDriverObject)
{
PLDR_DATA_TABLE_ENTRY LdrData = (PLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection;
LdrData->Flags |= 0x20;
return STATUS_SUCCESS;
}
OB_PREOP_CALLBACK_STATUS
PreOperateProcessCallBack(
_In_ PVOID RegistrationContext,
_Inout_ POB_PRE_OPERATION_INFORMATION OperationInformation
)
{
PEPROCESS Process;
if (OperationInformation->ObjectType!=*PsProcessType)
{
return OB_PREOP_SUCCESS;
}
Process = OperationInformation->Object;
//过滤对计算器的操作
if (_stricmp(PsGetProcessImageFileName(Process),"calc.exe")==0)
{
//处理创建句柄
if (OperationInformation->Operation==OB_OPERATION_HANDLE_CREATE)
{
if (OperationInformation->Parameters->CreateHandleInformation.DesiredAccess & PROCESS_TERMINATE)
{
OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~PROCESS_TERMINATE;
}
}
//处理复制句柄
if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE)
{
if (OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess & PROCESS_TERMINATE)
{
OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~PROCESS_TERMINATE;
}
}
}
return OB_PREOP_SUCCESS;
}
OB_PREOP_CALLBACK_STATUS
PreOperateThreadCallBack(
_In_ PVOID RegistrationContext,
_Inout_ POB_PRE_OPERATION_INFORMATION OperationInformation
)
{
PEPROCESS Process;
PETHREAD Thread;
if (OperationInformation->ObjectType != *PsThreadType)
{
return OB_PREOP_SUCCESS;
}
Thread = OperationInformation->Object;
Process = IoThreadToProcess(Thread);
//过滤对计算器的操作
if (_stricmp(PsGetProcessImageFileName(Process), "calc.exe") == 0)
{
//处理创建句柄
if (OperationInformation->Operation == OB_OPERATION_HANDLE_CREATE)
{
if (OperationInformation->Parameters->CreateHandleInformation.DesiredAccess & THREAD_TERMINATE)
{
//如果是打开计算器的句柄 不让别人打开
OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~THREAD_TERMINATE;
}
if (OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess & THREAD_SUSPEND_RESUME)
{
//如果是复制计算器的句柄 不让别人打开
OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~THREAD_SUSPEND_RESUME;
}
}
//处理复制句柄
if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE)
{
if (OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess & THREAD_TERMINATE)
{
//如果是复制计算器的句柄 不让别人打开
OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~THREAD_TERMINATE;
}
if (OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess & THREAD_SUSPEND_RESUME)
{
//如果是复制计算器的句柄 不让别人打开
OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~THREAD_SUSPEND_RESUME;
}
}
}
return OB_PREOP_SUCCESS;
}
NTSTATUS EnableProtect(BOOLEAN Enable)
{
NTSTATUS status = STATUS_SUCCESS;
if (Enable)
{
//操作进程相关信息
OB_CALLBACK_REGISTRATION ObCallBackRegisrationProcess = {0};
OB_OPERATION_REGISTRATION OOR_Process = {0};
//操作线程相关信息
OB_CALLBACK_REGISTRATION ObCallBackRegisrationThread= { 0 };
OB_OPERATION_REGISTRATION OOR_Thread = { 0 };
ObCallBackRegisrationProcess.Version = OB_FLT_REGISTRATION_VERSION;
ObCallBackRegisrationProcess.RegistrationContext = NULL;
ObCallBackRegisrationProcess.OperationRegistrationCount = 1;
//指向结构OB_OPERATION_REGISTRATION
ObCallBackRegisrationProcess.OperationRegistration = &OOR_Process;
RtlInitUnicodeString(&ObCallBackRegisrationProcess.Altitude, L"555");
//操作的类型是进程
OOR_Process.ObjectType = PsProcessType;
//句柄的创建和复制
OOR_Process.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
//指定的操作前会调用这个函数
//在这个代码里就是句柄创建和复制之前会调用此函数
OOR_Process.PreOperation = PreOperateProcessCallBack;
status = ObRegisterCallbacks(&ObCallBackRegisrationProcess, &ObHandleProcess);
if(!NT_SUCCESS(status))
{
KdPrint(("进程回调注册失败,错误码:%x\n",status));
return status;
}
else
{
KdPrint(("进程回调注册成功\n"));
}
ObCallBackRegisrationThread.Version = OB_FLT_REGISTRATION_VERSION;
ObCallBackRegisrationThread.RegistrationContext = NULL;
ObCallBackRegisrationThread.OperationRegistrationCount = 1;
//指向结构OB_OPERATION_REGISTRATION
ObCallBackRegisrationThread.OperationRegistration = &OOR_Thread;
RtlInitUnicodeString(&ObCallBackRegisrationThread.Altitude, L"666");
//操作的类型是线程
OOR_Thread.ObjectType = PsThreadType;
//句柄的创建和复制
OOR_Thread.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
//指定的操作前会调用这个函数
//在这个代码里就是句柄创建和复制之前会调用此函数
OOR_Thread.PreOperation = PreOperateThreadCallBack;
status = ObRegisterCallbacks(&ObCallBackRegisrationThread, &ObHandleThread);
if (!NT_SUCCESS(status))
{
KdPrint(("线程回调注册失败,错误码:%x\n", status));
return status;
}
else
{
KdPrint(("线程回调注册成功\n"));
}
}
else
{
//如果已经注册了回调,就删除注册的信息.
if (ObHandleProcess)
{
ObUnRegisterCallbacks(ObHandleProcess);
}
if (ObHandleThread)
{
ObUnRegisterCallbacks(ObHandleThread);
}
}
return status;
}
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
EnableProtect(FALSE);
KdPrint(("驱动卸载成功\n"));
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
NTSTATUS status =STATUS_SUCCESS;
pDriverObject->DriverUnload=DriverUnload;
//ObRegisterCallbacks 要求驱动必须有签名 所以测试的时候可以自己给驱动对象加上标志0x20
BypassDriverCheck(pDriverObject);
EnableProtect(TRUE);
return status;
}
保护进程内存不被读取
#include <ntddk.h>
typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PULONG DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union
{
LIST_ENTRY HashLinks;
struct
{
PVOID SectionPointer;
ULONG CheckSum;
};
};
union
{
ULONG TimeDateStamp;
PVOID LoadedImports;
};
PULONG * EntryPointActivationContext;
PVOID PatchInformation;
LIST_ENTRY ForwarderLinks;
LIST_ENTRY ServiceTagLinks;
LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
NTSTATUS BypassDriverCheck(IN PDRIVER_OBJECT pDriverObject)
{
PLDR_DATA_TABLE_ENTRY LdrData = (PLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection;
LdrData->Flags |= 0x20;
return STATUS_SUCCESS;
}
PVOID pRegistrationHandle;
VOID DriverUnload(
_In_ struct _DRIVER_OBJECT *DriverObject
)
{
KdPrint(("DriverUnload\n"));
// 卸载驱动
if (NULL != pRegistrationHandle)
{
KdPrint(("ObUnRegisterCallbacks\n"));
ObUnRegisterCallbacks(pRegistrationHandle);
}
PDEVICE_OBJECT pDev;
pDev = DriverObject->DeviceObject;
if (NULL != pDev)
{
IoDeleteDevice(pDev); // 删除设备
}
}
#define PROCESS_CREATE_PROCESS (0x80)
UCHAR *
PsGetProcessImageFileName(
__in PEPROCESS Process
);
//extern int* ObTypeIndexTable;
OB_PREOP_CALLBACK_STATUS PreProcessHandle(
_In_ PVOID RegistrationContext,
_Inout_ POB_PRE_OPERATION_INFORMATION OperationInformation
)
{
PVOID hProcess = OperationInformation->Object; // 操作句柄
UCHAR *szImageName = PsGetProcessImageFileName((PEPROCESS)hProcess);
if (0 != strcmp((const char *)szImageName, "calc.exe"))
{
return OB_PREOP_SUCCESS;
}
// 区分操作类型
switch (OperationInformation->Operation)
{
case OB_OPERATION_HANDLE_DUPLICATE:
KdPrint(("OB_OPERATION_HANDLE_DUPLICATE\n"));
break;
case OB_OPERATION_HANDLE_CREATE:
KdPrint(("OB_OPERATION_HANDLE_CREATE\n"));
OperationInformation->Parameters->CreateHandleInformation.DesiredAccess = 0;
break;
}
return OB_PREOP_SUCCESS;
}
VOID PostProcessHandle(
_In_ PVOID RegistrationContext,
_In_ POB_POST_OPERATION_INFORMATION OperationInformation
)
{
}
#pragma code_seg("INIT")
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegisterPath)
{
KdPrint(("DriverEntry\n"));
// 指定驱动卸载函数
pDriverObject->DriverUnload = DriverUnload;
UNICODE_STRING usDeviceName; // 设备对象名称
RtlInitUnicodeString(&usDeviceName, L"\\Device\\ObTestDevice");
PDEVICE_OBJECT pDev;
NTSTATUS status;
status = IoCreateDevice(pDriverObject, 0, &usDeviceName, FILE_DEVICE_UNKNOWN, 0, TRUE, &pDev);
if (!NT_SUCCESS(status))
{
return status;
}
BypassDriverCheck(pDriverObject);
pDev->Flags |= DO_BUFFERED_IO;
OB_OPERATION_REGISTRATION obr;
obr.ObjectType = PsProcessType;
obr.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE; // 创建和复制
obr.PreOperation = PreProcessHandle;
obr.PostOperation = PostProcessHandle;
OB_CALLBACK_REGISTRATION ocr;
ocr.Version = OB_FLT_REGISTRATION_VERSION; // 版本
ocr.RegistrationContext = NULL; // 自定义数据
ocr.OperationRegistrationCount = 1; // 回调函数个数
ocr.OperationRegistration = &obr;
RtlInitUnicodeString(&ocr.Altitude, L"321000"); // 加载顺序
pRegistrationHandle = NULL;
status = ObRegisterCallbacks(&ocr, &pRegistrationHandle);
if (NT_SUCCESS(status))
{
// 注册保护成功
KdPrint(("Protect Success!!!\n"));
}
else
{
// 注册保护失败
KdPrint(("Protect Failure ,status=%x\n", status));
}
return STATUS_SUCCESS;
}
CSDN联合极客时间，共同打造面向开发者的精品内容学习社区，助力成长！
更多推荐
0
0- 0
已为社区贡献2条内容
所有评论(0)