Hook API－之進程保護 ( 积分: 100 )

Hook&nbsp;API－之進程保護<br>http://www.98exe.net/Article/c/2006-04-05/1504.html<br>在網上看到了這一篇文章,按提供的源碼編譯一下該dll,發現裡面用到的ProcessHandleToId,ProcessIdToFileName和PosText函數代碼沒有附上,請問如何解決?或有沒有其他方法能達到同樣的效果?Dll代碼如下:<br>library&nbsp;Dll;<br>uses<br>&nbsp;Windows,&nbsp;SysUtils,&nbsp;&nbsp;Classes;<br><br>const<br>PRG_NAME&nbsp;=&nbsp;'ddos.exe';<br><br>var&nbsp;TerminateProcessNext&nbsp;:&nbsp;function&nbsp;(processHandle,&nbsp;exitCode:&nbsp;dword)&nbsp;:&nbsp;bool;&nbsp;stdcall;<br>NtTerminateProcessNext&nbsp;:&nbsp;function&nbsp;(processHandle,&nbsp;exitCode:&nbsp;dword)&nbsp;:&nbsp;dword;&nbsp;stdcall;<br><br><br>{$R&nbsp;*.res}<br>function&nbsp;ThisIsOurProcess(processHandle:&nbsp;dword)&nbsp;:&nbsp;boolean;<br>var&nbsp;pid&nbsp;:&nbsp;dword;<br>arrCh&nbsp;:&nbsp;array&nbsp;[0..MAX_PATH]&nbsp;of&nbsp;char;<br>begin<br>pid&nbsp;:=&nbsp;ProcessHandleToId(processHandle);<br>result&nbsp;:=&nbsp;(pid&nbsp;&lt;&gt;&nbsp;0)&nbsp;and&nbsp;ProcessIdToFileName(pid,&nbsp;arrCh)&nbsp;and<br>(PosText(PRG_NAME,&nbsp;arrCh)&nbsp;&gt;&nbsp;0);<br>end;&nbsp;&nbsp;<br><br>function&nbsp;TerminateProcessCallback(processHandle,&nbsp;exitCode:&nbsp;dword)&nbsp;:&nbsp;bool;&nbsp;stdcall;&nbsp;&nbsp;<br>begin&nbsp;&nbsp;<br>if&nbsp;ThisIsOurProcess(processHandle)&nbsp;then&nbsp;&nbsp;<br>begin&nbsp;&nbsp;<br>result&nbsp;:=&nbsp;false;&nbsp;&nbsp;<br>SetLastError(ERROR_ACCESS_DENIED);&nbsp;&nbsp;<br>end&nbsp;&nbsp;<br>else&nbsp;&nbsp;<br>result&nbsp;:=&nbsp;TerminateProcessNext(processHandle,&nbsp;exitCode);&nbsp;&nbsp;<br><br>end;&nbsp;&nbsp;<br><br>function&nbsp;NtTerminateProcessCallback(processHandle,&nbsp;exitCode:&nbsp;dword)&nbsp;:&nbsp;dword;&nbsp;stdcall;&nbsp;&nbsp;<br>const&nbsp;STATUS_ACCESS_DENIED&nbsp;=&nbsp;$C0000022;&nbsp;&nbsp;<br>begin&nbsp;&nbsp;<br>if&nbsp;ThisIsOurProcess(processHandle)&nbsp;then&nbsp;&nbsp;<br>begin&nbsp;&nbsp;<br>result&nbsp;:=&nbsp;STATUS_ACCESS_DENIED&nbsp;&nbsp;<br>end&nbsp;&nbsp;<br>else&nbsp;&nbsp;<br>result&nbsp;:=&nbsp;NtTerminateProcessNext(processHandle,&nbsp;exitCode);&nbsp;&nbsp;<br>end;&nbsp;&nbsp;<br><br>begin<br>if&nbsp;GetVersion&nbsp;and&nbsp;$80000000&nbsp;=&nbsp;0&nbsp;then&nbsp;&nbsp;<br>HookAPI(&nbsp;'ntdll.dll',&nbsp;'NtTerminateProcess',&nbsp;@NtTerminateProcessCallback,&nbsp;@NtTerminateProcessNext)<br>else&nbsp;HookAPI('kernel32.dll',&nbsp;'TerminateProcess',&nbsp;@TerminateProcessCallback,&nbsp;@TerminateProcessNext);&nbsp;&nbsp;<br>end.

简单问题复杂化,只要hook枚举进程的api,让它返回的handle不对,那自然就无法用TerminateProcess关闭了。

楼上的能不能说得详细一点？？<br>Hook枚举进程的API，让它返回的Handle不对，那岂不是不光TerminateProcess会被废？

其实可以HOOK&nbsp;CREATEPROCESS这个API的<br>发现不有问题的就不让他CREATE出来

个人认为还是对TerminateProcess进行审查比较好，毕竟你Hook别的常用API都会引起这样那样的问题，比如我曾经Hook过WriteProcessMemory，结果Explorer.exe崩溃。

能否給段代碼呢?<br>謝謝.

在&nbsp;ring3&nbsp;下只要处理得当无论&nbsp;Hook&nbsp;什么&nbsp;API&nbsp;都不会有问题了,甚至&nbsp;Hook&nbsp;CreateFileA&nbsp;也只会使系统超慢.<br><br>Hook&nbsp;枚举进程的&nbsp;API&nbsp;只会使任务管理器看不到你的进程,自然也没办法关闭了.但是原先调用的程序因为拥有PID,不需要重新查询,就不影响使用.

弄了幾天,還是毫無頭緒,能否給段源碼呢,謝謝.

有沒有代碼,拜託...<br>搜索了論壇,但都沒有答案,我用的是XP

这里有写这个函数怎么来的！<br>http://202.197.191.225:8080/chengxuyuan2003/%E6%9D%82%E5%BF%97%E7%94%B5%E5%AD%90%E4%B9%A6/csdn%E5%BC%80%E5%8F%91%E9%AB%98%E6%89%8B11.pdf

多人接受答案了。