Reprint Modify Process Name

First of all, the name of a process may be obtained from the following parts (refer to Xiao Wei's "forgery Process" article): First, eprocess:    1, eprocess-->imagefilename (very commonly used, Where the ice blade gets the name of the process)     2, Eprocess-->seauditprocesscreationinfo->imagefilename (where the task manager gets the name of the process, Ntqueryinformationprocess to get the process name from here)     3, eprocess->sectionobject->segment->controlarea-> Fileobject->filename (Rku to get process name)     4, VAD (data structure for recording user space memory allocation, EXE module of course there is process)   second, peb in:    1, peb-->processparameters-->imagepathname    2, Peb-->processparameters-->commandline     3, Peb-->processparameters-->windowtitle (This place is strange, if the double-click is the EXE shortcut, then the path of the record is a shortcut, or get rid of the good)     4, peb-->ldr-->inloadordermodulelist-> first structure->fulldllname    5, peb-->ldr--> Inloadordermodulelist-> first Structure->basedllname    6, peb-->ldr-->inmemoryordermodulelist-> The first structure->fulldllname (basedllname here seems to be null, regardless of it)     (peb-->ldr--> Ininitializationordermodulelist This table does not seem to have EXE module, also regardless of it)  To get rid of these places can completely change the process name (if not thorough, thank you to add!) ）。 The sample code is as follows (the sample code is tested with Winmine.exe and the platform is XP SP3. Code hard-coded a lot, not strong versatility. Embarrassed):

Fypher

http://hi.baidu.com/nmn714

VOID changename (ULONG pprocess) {

ULONG Peb,processparameters,ldr;

ULONG inloadordermodulelist;

ULONG inmemoryordermodulelist;

ULONG tmp;

Kapc_state KAPC;

Puchar str;

Pwchar Wstr;

Get PEB

peb=* (Pulong) (pprocess + 0x1b0);

Kestackattachprocess ((peprocess) PPROCESS,&KAPC);

__try{

processparameters = * (Pulong) (PEB + 0x010);

Imagepathname

Findandchangeuni (processparameters+0x038);

CommandLine

Findandchangeuni (processparameters+0x040);

WindowTitle

Findandchangeuni (processparameters+0x070);

Ldr

LDR = * (Pulong) (PEB + 0x00c);

Inloadordermodulelist->fulldllname

inloadordermodulelist = * (Pulong) (ldr+0x00c);

Findandchangeuni (inloadordermodulelist+0x024);

Inloadordermodulelist->basedllname

Findandchangeuni (INLOADORDERMODULELIST+0X02C);

Inmemoryordermodulelist->fulldllname

inmemoryordermodulelist = * (Pulong) (ldr+0x014);

Findandchangeuni (inmemoryordermodulelist+0x024);

}__except (1) {

Kdprint (("Exception occured!"));

}

Keunstackdetachprocess (&KAPC);

Eprocess-->imagefilename

Findandchangea (pprocess+0x174,16);

Eprocess-->seauditprocesscreationinfo->imagefilename

Findandchangeuni (* (Pulong) (pprocess + 0x1f4));

Eprocess->sectionobject->segment->controlarea->fileobject->filename

Should use Mmisaddressvalid to verify

tmp=* (Pulong) (pprocess+0x138);

tmp=* (Pulong) (tmp+0x14);

tmp=* (Pulong) tmp;

tmp=* (Pulong) (tmp+0x024);

Findandchangeuni (tmp+0x030);

Vad

Should use Mmisaddressvalid to verify

tmp=* (Pulong) (pprocess+0x11c);

tmp=* (Pulong) (tmp+0x10);

tmp=* (Pulong) (tmp+0x018);

tmp=* (Pulong) (tmp+0x024);

Findandchangeuni (tmp+0x030);

}

The role of Findandchangeuni and Findandchangea is to locate "Winmine.exe" in a string (unicode_string or char) and change it to "Winxxoo.exe". The code is as follows:

Fypher

http://hi.baidu.com/nmn714

VOID Findandchangeuni (ULONG straddr) {

Punicode_string unistr = (punicode_string) straddr;

ULONG len = unistr->length/2;

ULONG MaxLen = unistr->maximumlength/2;

Pwchar str = unistr->buffer;

ULONG i=0;

if (!str | | len<11| | maxlen<11)

Return

for (i=0;i<= len-11;++i) {

if (!_wcsnicmp (str+i,l "Winmine.exe", 11))

Break

}

if (i>len-11)

Return

_asm{

Cli

mov eax, CR0

and eax, not 0x10000

mov cr0, eax

}

STR may be in the PEB, so the try

__try{

Str[i+3]=l ' x ';

Str[i+4]=l ' x ';

Str[i+5]=l ' O ';

Str[i+6]=l ' O ';

}__except (1) {

}

_asm{

mov eax, CR0

or eax,0x10000

MOV cr0,eax

STi

}

}

VOID Findandchangea (ULONG Straddr,ulong len) {

Puchar str = (Puchar) straddr;

ULONG i=0;

if (!str | | len<11)

Return

for (i=0;i<= len-11;++i) {

if (!_strnicmp (Str+i, "Winmine.exe", 11))

Break

}

if (i>len-11)

Return

_asm{

Cli

mov eax, CR0

and eax, not 0x10000

mov cr0, eax

}

STR may be in the PEB, so the try

__try{

str[i+3]= ' x ';

str[i+4]= ' x ';

str[i+5]= ' O ';

str[i+6]= ' O ';

}__except (1) {

}

_asm{

mov eax, CR0

or eax,0x10000

MOV cr0,eax

STi

}

}

Effect:

Reprint Modify Process Name