Process self-protection for WIN7 X64

Source: Internet
Author: User

1 //process Self-protection, note only X64 WIN7 available2#include <ntddk.h>3 #defineProcess_terminate 14typedefstruct_ldr_data//elements, 0xE0 bytes (sizeof)5 {6     struct_list_entry inloadorderlinks;//2 elements, 0x10 bytes (sizeof)7     struct_list_entry inmemoryorderlinks;//2 elements, 0x10 bytes (sizeof)8     struct_list_entry ininitializationorderlinks;//2 elements, 0x10 bytes (sizeof)9void*dllbase;Tenvoid*entrypoint; One ULONG32 sizeofimage; AUINT8 _padding0_[0x4]; -     struct_unicode_string Fulldllname;//3 Elements, 0x10 bytes (sizeof) -     struct_unicode_string Basedllname;//3 Elements, 0x10 bytes (sizeof) the ULONG32 Flags; -}ldr_data, *Pldr_data; -  - Char*getprocessimagefilename (peprocess Process) + { -     Char*FileName; +FileName = (Char*) Process +0x16c; A     returnFileName; at } -  -  - BOOLEAN isprotectedprocessname (peprocess eprocess) - { -     Char*name =Getprocessimagefilename (eprocess); in     if(!_STRICMP ("Vb.exe", Name)) -         return 1; to     Else +         return 0; - } the  *      $ ob_preop_callback_status proccessprotectcallback (PVOID regcontext,Panax Notoginseng pob_pre_operation_information poperationinformation) - { the     if(Poperationinformation->objecttype! = *Psprocesstype) +     { A         returnob_preop_success; the     } +     if(Isprotectedprocessname (peprocess) poperationinformation->Object)) -      $     { $         if(Poperationinformation->operation = =ob_operation_handle_create) -         { -             if((poperationinformation->parameters->createhandleinformation.originaldesiredaccess& theprocess_terminate) = =process_terminate) -             {WuyiPoperationinformation->parameters->createhandleinformation.desiredaccess &= ~process_terminate; the             } -         } Wu         if(Poperationinformation->operation = =ob_operation_handle_duplicate) -         { About             if((poperationinformation->parameters->createhandleinformation.originaldesiredaccess& $process_terminate) = =process_terminate) -             { -Poperationinformation->parameters->createhandleinformation.desiredaccess &= ~process_terminate; -             } A         } +     } the     returnob_preop_success; - } $  the  the NTSTATUS selfprotection () the { theNTSTATUS Obst1 =0; - HANDLE Obhandle; inLarge_integer Callbackcookie = {0 }; the ob_callback_registration Obreg; the ob_operation_registration Opreg; Aboutmemset (&obreg,0,sizeof(Obreg)); theObreg.version =obgetfilterversion (); theObreg.operationregistrationcount =1; theObreg.registrationcontext =NULL; +Rtlinitunicodestring (&obreg.altitude, L"321124"); -Obreg.operationregistration = &Opreg; thememset (&opreg,0,sizeof(&opreg));BayiOpreg.objecttype =Psprocesstype; theOpreg.operations = Ob_operation_handle_create |ob_operation_handle_duplicate; theOpreg.preoperation = (pob_pre_operation_callback) &Proccessprotectcallback; -     //protect itself process objects from being opened -Obst1 = Obregistercallbacks (&obreg, &obhandle); the     return 0; the } the NTSTATUS DriverEntry (pdriver_object mydriver, punicode_string reg_path) the { - Pldr_data Ldr; theLDR = (pldr_data) mydriver->driversection; theLdr->flags |=0x20; the selfprotection ();94     return 0; the}

Process self-protection for WIN7 X64

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.