WEB开发网
开发学院软件开发VC WinNT & Win2K下实现进程的完全隐藏 阅读

WinNT & Win2K下实现进程的完全隐藏

 2006-07-19 11:36:57 来源:WEB开发网   
核心提示: 好了,就这么简单,WinNT & Win2K下实现进程的完全隐藏(3),下在给出一个弹出一个MessageBox的实例:// RemoteThread.cpp : Defines the entry point for the console application.//#include

好了,就这么简单,下在给出一个弹出一个MessageBox的实例:

// RemoteThread.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
typedef struct _RemotePara{//参数结构
  char pMessageBox[12];
  DWORD dwMessageBox;
}RemotePara;
//远程线程
DWORD __stdcall ThreadProc (RemotePara *lpPara){
  typedef int (__stdcall *MMessageBoxA)(HWND,LPCTSTR,LPCTSTR,DWORD);//定义MessageBox函数
  MMessageBoxA myMessageBoxA;
  myMessageBoxA =(MMessageBoxA) lpPara->dwMessageBox ;//得到函数入口地址
  myMessageBoxA(NULL,lpPara->pMessageBox ,lpPara->pMessageBox,0);//call
  return 0;
}
void EnableDebugPriv();//提升应用级调试权限
int main(int argc, char* argv[]){
  const DWORD THREADSIZE=1024*4;
  DWORD byte_write;
  EnableDebugPriv();//提升权限
  HANDLE hWnd = ::OpenProcess (PROCESS_ALL_ACCESS,FALSE,992);
  if(!hWnd)return 0;
  void *pRemoteThread =::VirtualAllocEx(hWnd,0,THREADSIZE,MEM_COMMIT| MEM_RESERVE,PAGE_EXECUTE_READWRITE);
  if(!pRemoteThread)return 0;
  if(!::WriteProcessMemory(hWnd,pRemoteThread,&ThreadProc,THREADSIZE,0))
  return 0;
  //再付值
  RemotePara myRemotePara;
  ::ZeroMemory(&myRemotePara,sizeof(RemotePara));
  HINSTANCE hUser32 = ::LoadLibrary ("user32.dll");
  myRemotePara.dwMessageBox =(DWORD) ::GetProcAddress (hUser32 , "MessageBoxA");
  strcat(myRemotePara.pMessageBox,"hello\0");
  //写进目标进程
  RemotePara *pRemotePara =(RemotePara *) ::VirtualAllocEx (hWnd ,0,sizeof(RemotePara),MEM_COMMIT,PAGE_READWRITE);//注意申请空间时的页面属性
  if(!pRemotePara)return 0;
  if(!::WriteProcessMemory (hWnd ,pRemotePara,&myRemotePara,sizeof myRemotePara,0))return 0;
  //启动线程
  HANDLE hThread = ::CreateRemoteThread (hWnd ,0,0,(DWORD (__stdcall *)(void *))pRemoteThread ,pRemotePara,0,&byte_write);
  if(!hThread){
    return 0;
  }
return 0;
}
//提升权限
void EnableDebugPriv( void )
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if ( ! OpenProcessToken( GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
return;
if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue ) ){
CloseHandle( hToken );
return;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if ( ! AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) )
CloseHandle( hToken );
}

上一页  1 2 3 4 5  下一页

Tags:WinNT WinK 实现

编辑录入:爽爽 [复制链接] [打 印]
赞助商链接