利用Hook API函数OpenProcess与TerminateProcess来防止任务管理器结束进程【转】
思路:其实比较简单,还是利用DLL,首写跟据API函数OpenProcess与TerminateProcess的结构自已编写两个与这两个API一样的函数,再利用GetProcAddress获取系统的那两个API函数入口地址,最后用WriteProcessMemory将你写的函数的地址替换掉原来系统的函数地址。这样所有调用这两系统API都将先执行你的函数。
如果只Hook其中一个函数比如只hook OpenProcess的话那么任务管理器将不能获取到你的进程信息那么会出错。如果只hook TerminateProcess那样也不行,因为一个进程的句柄在本进程与别的进程中是不一样的,所以如果你不知道自已进程在别人进程中的句柄那么是没办法hook TerminateProcess的。
本例中首先利用OpenProcess获取自已在别的进程中的句柄,然后hook TerminateProcess进程监控,如果发现有程序调用TerminateProcess并且所结束的对象正是自已,那么就给出提示窗口。
------------------------------------------------调用部分
unit Unit1; interface uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs, StdCtrls; type TForm1 = class(TForm) Button1: TButton; Button2: TButton; procedure Button1Click(Sender: TObject); procedure Button2Click(Sender: TObject); private { Private declarations } public { Public declarations } end; var Form1: TForm1; procedure StartHook(pid: DWORD); stdcall; external 'hookdll.dll'; procedure EndHook; stdcall; external 'hookdll.dll'; implementation {$R *.dfm} procedure TForm1.Button1Click(Sender: TObject); begin StartHook(GetCurrentProcessId); end; procedure TForm1.Button2Click(Sender: TObject); begin EndHook; end; end.-----------------------------------------------------------------------------------------
DLL文件,全部实现都在这里
--------------------- Hookdll.dpr
library Hookdll; uses SysUtils, Classes, Windows,Dialogs, unitHook in 'unitHook.pas'; const HOOK_MEM_FILENAME = 'tmp.hkt'; var hhk: HHOOK; Hook: array[0..2] of TNtHookClass; //内存映射 MemFile: THandle; startPid: PDWORD; //保存PID fhProcess: THandle; //保存本进程在远程进程中的句柄 //拦截 OpenProcess function NewOpenProcess(dwDesiredAccess: DWORD; bInheritHandle: BOOL; dwProcessId: DWORD): THandle; stdcall; type TNewOpenProcess = function (dwDesiredAccess: DWORD; bInheritHandle: BOOL; dwProcessId: DWORD): THandle; stdcall; begin if startPid^ = dwProcessId then begin Hook[1].UnHook; Result := TNewOpenProcess(Hook[1].BaseAddr)(dwDesiredAccess, bInheritHandle, dwProcessId); fhProcess:=Result; Hook[1].Hook; exit; end; Hook[1].UnHook; Result := TNewOpenProcess(Hook[1].BaseAddr)(dwDesiredAccess, bInheritHandle, dwProcessId); Hook[1].Hook; end; function NewTerminateProcess(hProcess: THandle;uExitCode: UINT): BOOL; Stdcall; type TNewTerminateProcess = function (hProcess: THandle;uExitCode: UINT): BOOL; Stdcall; begin if fhProcess = hProcess then begin showmessage('不准关闭我!'); result := true; exit; end; Hook[2].UnHook; Result := TNewTerminateProcess(Hook[2].BaseAddr)(hProcess, uExitCode ); Hook[2].Hook; end; procedure InitHook; //安装 Hook begin Hook[1] := TNtHookClass.Create('kernel32.dll', 'OpenProcess', @NewOpenProcess); hook[2] := TNtHookClass.Create('kernel32.dll', 'TerminateProcess', @NewTerminateProcess); end; procedure UninitHook; //删除 Hook var I: Integer; begin for I := 0 to High(Hook) do begin FreeAndNil(Hook[I]); end; end; procedure MemShared(); begin MemFile:=OpenFileMapping(FILE_MAP_ALL_ACCESS,False, HOOK_MEM_FILENAME); //打开内存映射文件 if MemFile = 0 then begin MemFile := CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE, 0, 4, HOOK_MEM_FILENAME); end; if MemFile <> 0 then //映射文件到变量 startPid := MapViewOfFile(MemFile,FILE_MAP_ALL_ACCESS,0,0,0); end; //传递消息 function HookProc(nCode, wParam, lParam: Integer): Integer; stdcall; begin Result := CallNextHookEx(hhk, nCode, wParam, lParam); end; //开始HOOK procedure StartHook(pid: DWORD); stdcall; begin startPid^ := pid; hhk := SetWindowsHookEx(WH_CALLWNDPROC, HookProc, hInstance, 0); end; //结束HOOK procedure EndHook; stdcall; begin if hhk <> 0 then UnhookWindowsHookEx(hhk); end; //环境处理 procedure DllEntry(dwResaon: DWORD); begin case dwResaon of DLL_PROCESS_ATTACH: InitHook; //DLL载入 DLL_PROCESS_DETACH: UninitHook; //DLL删除 end; end; exports StartHook, EndHook; begin MemShared; { 分配DLL程序到 DllProc 变量 } DllProc := @DllEntry; { 调用DLL加载处理 } DllEntry(DLL_PROCESS_ATTACH); end.--------------------------- 单元unitHook.pas
unit unitHook; interface uses Windows, Messages, Classes, SysUtils; type //NtHook类相关类型 TNtJmpCode=packed record //8字节 MovEax:Byte; Addr:DWORD; JmpCode:Word; dwReserved:Byte; end; TNtHookClass=class(TObject) private hProcess:THandle; NewAddr:TNtJmpCode; OldAddr:array[0..7] of Byte; ReadOK:Boolean; public BaseAddr:Pointer; constructor Create(DllName,FuncName:string;NewFunc:Pointer); destructor Destroy; override; procedure Hook; procedure UnHook; end; implementation //================================================== //NtHOOK 类开始 //================================================== constructor TNtHookClass.Create(DllName: string; FuncName: string;NewFunc:Pointer); var DllModule:HMODULE; dwReserved:DWORD; begin //获取模块句柄 DllModule:=GetModuleHandle(PChar(DllName)); //如果得不到说明未被加载 if DllModule=0 then DllModule:=LoadLibrary(PChar(DllName)); //得到模块入口地址(基址) BaseAddr:=Pointer(GetProcAddress(DllModule,PChar(FuncName))); //获取当前进程句柄 hProcess:=GetCurrentProcess; //指向新地址的指针 NewAddr.MovEax:=$B8; NewAddr.Addr:=DWORD(NewFunc); NewAddr.JmpCode:=$E0FF; //保存原始地址 ReadOK:=ReadProcessMemory(hProcess,BaseAddr,@OldAddr,8,dwReserved); //开始拦截 Hook; end; //释放对象 destructor TNtHookClass.Destroy; begin UnHook; CloseHandle(hProcess); inherited; end; //开始拦截 procedure TNtHookClass.Hook; var dwReserved:DWORD; begin if (ReadOK=False) then Exit; //写入新的地址 WriteProcessMemory(hProcess,BaseAddr,@NewAddr,8,dwReserved); end; //恢复拦截 procedure TNtHookClass.UnHook; var dwReserved:DWORD; begin if (ReadOK=False) then Exit; //恢复地址 WriteProcessMemory(hProcess,BaseAddr,@OldAddr,8,dwReserved); end; end.
posted on 2010-10-31 21:11 Delphi7456 阅读(8144) 评论(0) 编辑 收藏 举报