vc 實現核心級程序保護

保護核心**

#include "ntddk.h"

#define nt_device_name l"\\device\\protectprocess"

#define dos_device_name l"\\dosdevices\\protectprocess"

#define ioctl_protect_control ctl_code(file_device_unknown, 0x800, method_buffered, file_any_access)

ntstatus dispatchdevicecontrol(in pdevice_object deviceobject,in pirp irp);

void onunload(in pdriver_object driverobject);

#pragma pack(1) //ssdt表的結構

typedef struct servicedescriptorentry servicedescriptortableentry_t, *pservicedescriptortableentry_t;

#pragma pack()

__declspec(dllimport) servicedescriptortableentry_t keservicedescriptortable; //變數名是不能變的,因為是從外部匯入

//這個是查詢某個函式的位址的乙個巨集

#define systemservice(_function) keservicedescriptortable.servicetablebase[*(pulong)((puchar)_function+1)]

ntsysapi ntstatus ntapi zwopenprocess(out phandle processhandle,in access_mask desiredaccess,in pobject_attributes objectattributes,in pclient_id clientid optional);

typedef ntstatus (*zwopenprocess)(out phandle processhandle,in access_mask desiredaccess,in pobject_attributes objectattributes,in pclient_id clientid optional);

zwopenprocess oldzwopenprocess;

long pid = -1;

ntstatus newzwopenprocess(out phandle processhandle,in access_mask desiredaccess,in pobject_attributes objectattributes,in pclient_id clientid optional)

//剩下的交給我們的原函式

nstatus = oldzwopenprocess(processhandle,desiredaccess,objectattributes,clientid);

return status_success; }

void onunload(in pdriver_object driverobject)

}

dbgprint("裝置已經解除安裝\n");

dbgprint("修復ssdt表\n");

(zwopenprocess)(systemservice(zwopenprocess)) = oldzwopenprocess;

dbgprint("驅動解除安裝完畢.\n"); }

ntstatus dispatchdevicecontrol(in pdevice_object deviceobject,in pirp irp)

break;

default:

dbgprint("未知請求包被呼叫\n");

break; }

nstatus = irp->iostatus.status;

iocompleterequest(irp,io_no_increment);

return nstatus; }

ntstatus driverentry(in pdriver_object driverobject,in punicode_string theregistrypath)

rtlinitunicodestring(&devicelinkstring,dos_device_name);

ntstatus=iocreatesymboliclink(&devicelinkstring,&ntdevicename);

if(!nt_success(ntstatus))

driverobject->majorfunction[irp_mj_create] = dispatchdevicecontrol;

driverobject->majorfunction[irp_mj_close] = dispatchdevicecontrol;

driverobject->majorfunction[irp_mj_device_control] = dispatchdevicecontrol;

driverobject->driverunload = onunload;

dbgprint("驅動程式已經啟動\n");

dbgprint("修改ssdt表...\n");

//修改 zwopenprocess 函式位址

oldzwopenprocess =(zwopenprocess)(systemservice(zwopenprocess));

(zwopenprocess)(systemservice(zwopenprocess)) = newzwopenprocess;

dbgprint("驅動程式載入完畢.\n");

return status_success; }

#include

#define buf_size 4096

int main(int argc,char* argv)

::getmodulefilename(0,base,buf_size);

int p = strlen(base);

while(base[p] != '\\')

strncpy(path,base,p+1);

memset(base,0,buf_size);

sprintf(base,"%sinstall.ini",path);

memset(path,0,buf_size);

::getprivateprofilestring("config","path","",path,buf_size,base);

::getprivateprofilestring("config","servicename","",sername,buf_size,base);

::getprivateprofilestring("config","displayname","",disname,buf_size,base);

printf("[*]service name:%s\n",sername);

printf("[*]display name:%s\n",disname);

printf("[*]driver path:%s\n",path);

sh = openscmanager(null,null,sc_manager_all_access);

if (!sh)

if (argc == 2 && !strcmp(argv[1],"install"))

rh = createservice(sh,sername,disname,

service_all_access,

service_kernel_driver, //

service_error_normal,

path,

null,null,null,null,null);

if (!rh)

printf("[-]install service complete...\n");

}else if (argc == 2 && !strcmp(argv[1],"start"))

startservice(rh,null,null);

printf("[-]start service complete...\n");

}else if (argc == 2 && !strcmp(argv[1],"uninstall"))

service_status ss;

controlservice(rh,service_control_stop,&ss);

printf("[-]stop service complete...\n");

deleteservice(rh);

printf("[-]delete service complete...\n"); }

closeservicehandle(rh);

closeservicehandle(sh);

return 1; }

vc 實現核心級程序保護

vc 實現核心級程序保護

SSDT HOOK實現程序保護

驅動實現程序保護

vc 實現核心級程序保護

vc 實現核心級程序保護

SSDT HOOK實現程序保護

驅動實現程序保護

相關推薦