- Окт 21, 2011
- 828
- 614
- 1,300
Скрытие
Код:
void EraseHeaders(HINSTANCE hModule1)
{
PIMAGE_DOS_HEADER pDoH;
PIMAGE_NT_HEADERS pNtH;
DWORD i, ersize, protect;
if (!hModule1) return;
pDoH = (PIMAGE_DOS_HEADER)(hModule1);
pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule1 + ((PIMAGE_DOS_HEADER)hModule1)->e_lfanew);
ersize = sizeof(IMAGE_DOS_HEADER);
if ( VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect) )
{
for ( i=0; i < ersize; i++ )
*(BYTE*)((BYTE*)pDoH + i) = 0;
}
ersize = sizeof(IMAGE_NT_HEADERS);
if ( pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect) )
{
for ( i=0; i < ersize; i++ )
*(BYTE*)((BYTE*)pNtH + i) = 0;
}
return;
}
typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _ModuleInfoNode
{
LIST_ENTRY LoadOrder;
LIST_ENTRY InitOrder;
LIST_ENTRY MemoryOrder;
HMODULE baseAddress;
unsigned long entryPoint;
unsigned int size;
UNICODE_STRING fullPath;
UNICODE_STRING name;
unsigned long flags;
unsigned short LoadCount;
unsigned short TlsIndex;
LIST_ENTRY HashTable;
unsigned long timestamp;
} ModuleInfoNode, *pModuleInfoNode;
typedef struct _ProcessModuleInfo
{
unsigned int size;
unsigned int initialized;
HANDLE SsHandle;
LIST_ENTRY LoadOrder;
LIST_ENTRY InitOrder;
LIST_ENTRY MemoryOrder;
} ProcessModuleInfo, *pProcessModuleInfo;
#define UNLINK(x) (x).Blink->Flink = (x).Flink; \
(x).Flink->Blink = (x).Blink;
int HideModule( HMODULE hMod )
{
ProcessModuleInfo *pmInfo;
ModuleInfoNode *module;
_asm
{
mov eax, fs:[18h]
mov eax, [eax + 30h]
mov eax, [eax + 0Ch]
mov pmInfo, eax
}
module = (ModuleInfoNode *)(pmInfo->LoadOrder.Flink);
while(module->baseAddress && module->baseAddress != hMod){
module = (ModuleInfoNode *)(module->LoadOrder.Flink);}
if(!module->baseAddress){
return 0;}
UNLINK(module->LoadOrder);
UNLINK(module->InitOrder);
UNLINK(module->MemoryOrder);
UNLINK(module->HashTable);
memset(module->fullPath.Buffer, 0, module->fullPath.Length);
memset(module, 0, sizeof(ModuleInfoNode));
return 1;
}[/SPOILER]
DllMain
[SPOILER]BOOL WINAPI DllMain(HMODULE hDll, DWORD dwReason, LPVOID lpReserved)
{
if (dwReason==DLL_PROCESS_ATTACH)
{
[COLOR="Cyan"][B]DisableThreadLibraryCalls(hDll);
EraseHeaders(hDll);
HideModule(hDll);[/B][/COLOR]
CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)StartHookpDevice,NULL,NULL,NULL);
}
return TRUE;
}[/SPOILER]