熱點推薦:
您现在的位置: 電腦知識網 >> 操作系統 >> Windows系統管理 >> 正文

Win2k下進程不死術

2013-11-11 21:31:31  來源: Windows系統管理 

  此段程序采用公開的 Wink注射遠程線程來保護指定進程始終處於運行狀態
  生成wapexe拷貝到c:\下運行則Wap進程不死
  
  include Wininc
  
  
  model flatstdcall
  data
  
  ProtectkProc proc ProcID: dword
  call GetKnlOpenProcess
  KnlOpenProcess dd ?
  GetKnlOpenProcess:
  pop eax
  call [eax]PROCESS_ALL_ACCESSFALSEProcID
  or eaxeax
  jz short ExitProtectProc
  mov ebxeax
  call GetKnlWaitForSingleObject
  KnlWaitForSingleObject dd ?
  GetKnlWaitForSingleObject:
  pop eax
  call [eax]ebxh
  call GetFileNameAddress
  GetFileNameAddress:
  pop ecx
  add ecxoffset FileNameoffset GetFileNameAddress
  call GetKnlWinExec
  KnlWinExec dd ?
  GetKnlWinExec:
  pop eax
  call [eax]ecx
  ExitProtectProc:
  ret
  ProtectkProc endp
  
  FileName db c:\wapexe
  
  
  KnlOpenProcessStr db OpenProcess
  KnlWaitForObjectStr db WaitForSingleObject
  KnlWinExecStr db WinExec
  
  
 de
  extrn GetProcAddress: proc
  extrn OpenProcess: proc
  extrn FindWindowA: proc
  extrn GetWindowThreadProcessId: proc
  extrn VirtualAllocEx: proc
  extrn VirtualFreeEx: proc
  extrn WriteProcessMemory: proc
  extrn GetCurrentProcessId: proc
  extrn CreateRemoteThread: proc
  extrn GetExitCodeThread: proc
  extrn CloseHandle: proc
  extrn WinExec: proc
  extrn MessageBoxA: proc
  extrn Sleep: proc
  
  
  Start:
  call GetProcAddressehoffset KnlOpenProcessStr
  mov KnlOpenProcesseax
  call GetProcAddressehoffset KnlWaitForObjectStr
  mov KnlWaitForSingleObjecteax
  call GetProcAddressehoffset KnlWinExecStr
  mov KnlWinExeceax
  
  call FindWindowA
  push eax
  call GetWindowThreadProcessIdeaxesp
  call OpenProcessPROCESS_ALL_ACCESSFALSE
  or eaxeax
  jz short OpenProcessError
  mov ebxeax
  call VirtualAllocExebxNULLhMEM_COMMITL h
  or eaxeax
  jz short OpenProcessError
  mov edieax
  push eax
  call WriteProcessMemoryebxediOFF ProtectkProchesp
  call GetCurrentProcessId
  call CreateRemoteThreadebxNULLNULLedieaxNULLesp
  call GetExitCodeThreadeaxesp
  pop eax
  ;call VirtualFreeExebxedihMEM_DECOMMIT
  call CloseHandleebx
  call Sleeph
  call MessageBoxAoffset FileNameoffset FileName
  OpenProcessError:
  ret
  
  end Start
  

From:http://tw.wingwit.com/Article/os/xtgl/201311/8641.html
    推薦文章
    Copyright © 2005-2013 電腦知識網 Computer Knowledge   All rights reserved.