1 //process Self-protection, note only X64 WIN7 available2#include <ntddk.h>3 #defineProcess_terminate 14typedefstruct_ldr_data//elements, 0xE0 bytes (sizeof)5 {6 struct_list_entry inloadorderlinks;//2 elements, 0x10 bytes (sizeof)7 struct_list_entry inmemoryorderlinks;//2 elements, 0x10 bytes (sizeof)8 struct_list_entry ininitializationorderlinks;//2 elements, 0x10 bytes (sizeof)9void*dllbase;Tenvoid*entrypoint; One ULONG32 sizeofimage; AUINT8 _padding0_[0x4]; - struct_unicode_string Fulldllname;//3 Elements, 0x10 bytes (sizeof) - struct_unicode_string Basedllname;//3 Elements, 0x10 bytes (sizeof) the ULONG32 Flags; -}ldr_data, *Pldr_data; - - Char*getprocessimagefilename (peprocess Process) + { - Char*FileName; +FileName = (Char*) Process +0x16c; A returnFileName; at } - - - BOOLEAN isprotectedprocessname (peprocess eprocess) - { - Char*name =Getprocessimagefilename (eprocess); in if(!_STRICMP ("Vb.exe", Name)) - return 1; to Else + return 0; - } the * $ ob_preop_callback_status proccessprotectcallback (PVOID regcontext,Panax Notoginseng pob_pre_operation_information poperationinformation) - { the if(Poperationinformation->objecttype! = *Psprocesstype) + { A returnob_preop_success; the } + if(Isprotectedprocessname (peprocess) poperationinformation->Object)) - $ { $ if(Poperationinformation->operation = =ob_operation_handle_create) - { - if((poperationinformation->parameters->createhandleinformation.originaldesiredaccess& theprocess_terminate) = =process_terminate) - {WuyiPoperationinformation->parameters->createhandleinformation.desiredaccess &= ~process_terminate; the } - } Wu if(Poperationinformation->operation = =ob_operation_handle_duplicate) - { About if((poperationinformation->parameters->createhandleinformation.originaldesiredaccess& $process_terminate) = =process_terminate) - { -Poperationinformation->parameters->createhandleinformation.desiredaccess &= ~process_terminate; - } A } + } the returnob_preop_success; - } $ the the NTSTATUS selfprotection () the { theNTSTATUS Obst1 =0; - HANDLE Obhandle; inLarge_integer Callbackcookie = {0 }; the ob_callback_registration Obreg; the ob_operation_registration Opreg; Aboutmemset (&obreg,0,sizeof(Obreg)); theObreg.version =obgetfilterversion (); theObreg.operationregistrationcount =1; theObreg.registrationcontext =NULL; +Rtlinitunicodestring (&obreg.altitude, L"321124"); -Obreg.operationregistration = &Opreg; thememset (&opreg,0,sizeof(&opreg));BayiOpreg.objecttype =Psprocesstype; theOpreg.operations = Ob_operation_handle_create |ob_operation_handle_duplicate; theOpreg.preoperation = (pob_pre_operation_callback) &Proccessprotectcallback; - //protect itself process objects from being opened -Obst1 = Obregistercallbacks (&obreg, &obhandle); the return 0; the } the NTSTATUS DriverEntry (pdriver_object mydriver, punicode_string reg_path) the { - Pldr_data Ldr; theLDR = (pldr_data) mydriver->driversection; theLdr->flags |=0x20; the selfprotection ();94 return 0; the}
Process self-protection for WIN7 X64