Process self-protection for WIN7 X64

1 //process Self-protection, note only X64 WIN7 available2#include <ntddk.h>3 #defineProcess_terminate 14typedefstruct_ldr_data//elements, 0xE0 bytes (sizeof)5 {6     struct_list_entry inloadorderlinks;//2 elements, 0x10 bytes (sizeof)7     struct_list_entry inmemoryorderlinks;//2 elements, 0x10 bytes (sizeof)8     struct_list_entry ininitializationorderlinks;//2 elements, 0x10 bytes (sizeof)9void*dllbase;Tenvoid*entrypoint; One ULONG32 sizeofimage; AUINT8 _padding0_[0x4]; -     struct_unicode_string Fulldllname;//3 Elements, 0x10 bytes (sizeof) -     struct_unicode_string Basedllname;//3 Elements, 0x10 bytes (sizeof) the ULONG32 Flags; -}ldr_data, *Pldr_data; -  - Char*getprocessimagefilename (peprocess Process) + { -     Char*FileName; +FileName = (Char*) Process +0x16c; A     returnFileName; at } -  -  - BOOLEAN isprotectedprocessname (peprocess eprocess) - { -     Char*name =Getprocessimagefilename (eprocess); in     if(!_STRICMP ("Vb.exe", Name)) -         return 1; to     Else +         return 0; - } the  *      $ ob_preop_callback_status proccessprotectcallback (PVOID regcontext,Panax Notoginseng pob_pre_operation_information poperationinformation) - { the     if(Poperationinformation->objecttype! = *Psprocesstype) +     { A         returnob_preop_success; the     } +     if(Isprotectedprocessname (peprocess) poperationinformation->Object)) -      $     { $         if(Poperationinformation->operation = =ob_operation_handle_create) -         { -             if((poperationinformation->parameters->createhandleinformation.originaldesiredaccess& theprocess_terminate) = =process_terminate) -             {WuyiPoperationinformation->parameters->createhandleinformation.desiredaccess &= ~process_terminate; the             } -         } Wu         if(Poperationinformation->operation = =ob_operation_handle_duplicate) -         { About             if((poperationinformation->parameters->createhandleinformation.originaldesiredaccess& $process_terminate) = =process_terminate) -             { -Poperationinformation->parameters->createhandleinformation.desiredaccess &= ~process_terminate; -             } A         } +     } the     returnob_preop_success; - } $  the  the NTSTATUS selfprotection () the { theNTSTATUS Obst1 =0; - HANDLE Obhandle; inLarge_integer Callbackcookie = {0 }; the ob_callback_registration Obreg; the ob_operation_registration Opreg; Aboutmemset (&obreg,0,sizeof(Obreg)); theObreg.version =obgetfilterversion (); theObreg.operationregistrationcount =1; theObreg.registrationcontext =NULL; +Rtlinitunicodestring (&obreg.altitude, L"321124"); -Obreg.operationregistration = &Opreg; thememset (&opreg,0,sizeof(&opreg));BayiOpreg.objecttype =Psprocesstype; theOpreg.operations = Ob_operation_handle_create |ob_operation_handle_duplicate; theOpreg.preoperation = (pob_pre_operation_callback) &Proccessprotectcallback; -     //protect itself process objects from being opened -Obst1 = Obregistercallbacks (&obreg, &obhandle); the     return 0; the } the NTSTATUS DriverEntry (pdriver_object mydriver, punicode_string reg_path) the { - Pldr_data Ldr; theLDR = (pldr_data) mydriver->driversection; theLdr->flags |=0x20; the selfprotection ();94     return 0; the}

Process self-protection for WIN7 X64