WIN下 修改，伪装进程路径。支持XP,WIN7 WIN764

#include "StdAfx.h" #include "ModifyProcessPath.h" namespace MODIFY_PROCESS { wchar_t m_szModulePath[MAX_PATH]; DWORD dwGetModuleFileNameWAddress; DWORD dwModuleBaseAddress; //E9 (目标地址-当前地址 - 5) #pragma pack(1) typedef struct _JMPCODE { BYTE bJmp; DWORD dwAddr; }JMPCODE,*LPJMPCODE; #pragma pack() DWORD WINAPI MGetModuleFileNameW(HMODULE hModule,wchar_t * lpFilename,DWORD nSize); }; using namespace MODIFY_PROCESS; // 为了不影响在进程内使用 GetModuleFileNameW ，故hook之，返回正确的路径。 DWORD WINAPI MODIFY_PROCESS::MGetModuleFileNameW(HMODULE hModule,wchar_t * lpFilename,DWORD nSize) { typedef DWORD(WINAPI *MGetModuleFileNameWT)(HMODULE,LPWCH,DWORD); MGetModuleFileNameWT pMGetModuleFileNameW; pMGetModuleFileNameW = (MGetModuleFileNameWT)dwGetModuleFileNameWAddress; if(hModule == NULL || hModule ==(HMODULE)MODIFY_PROCESS::dwModuleBaseAddress) { StringCbCopyW(lpFilename,nSize,m_szModulePath); return wcslen(m_szModulePath); } return pMGetModuleFileNameW(hModule,lpFilename,nSize); } CModifyProcessPath::CModifyProcessPath() { } BOOL CModifyProcessPath::Create() { ZeroMemory(MODIFY_PROCESS::m_szModulePath,sizeof(MODIFY_PROCESS::m_szModulePath)); MODIFY_PROCESS::dwGetModuleFileNameWAddress=0; MODIFY_PROCESS::dwModuleBaseAddress =(DWORD)GetModuleHandle(NULL); GetModuleFileNameW(NULL,MODIFY_PROCESS::m_szModulePath,MAX_PATH); DWORD lpAPIName = (DWORD)GetProcAddress(LoadLibrary("kernel32.dll"),"GetModuleFileNameW"); if(lpAPIName==NULL) return FALSE; dwGetModuleFileNameWAddress =(DWORD)VirtualAllocEx( (LPVOID)-1, NULL, sizeof(JMPCODE)+sizeof(JMPCODE), MEM_COMMIT, PAGE_EXECUTE_READWRITE); if(dwGetModuleFileNameWAddress ==NULL) return FALSE; //去掉内存保护 可以写入代码 DWORD dwOldProtect=NULL; if(!VirtualProtect((LPVOID)lpAPIName,sizeof(JMPCODE),PAGE_EXECUTE_READWRITE,&dwOldProtect)) return FALSE; //保存前5个字节 BYTE szOldCode[5]; CopyMemory((LPVOID)szOldCode,(LPVOID)lpAPIName,sizeof(szOldCode)); //构建代码 JMPCODE JmpCode; JmpCode.bJmp = 0xE9; //地址计算公式 目标地址-当前地址 - 5 JmpCode.dwAddr = (DWORD)MGetModuleFileNameW - lpAPIName -5; //写代码 CopyMemory((LPVOID)lpAPIName,&JmpCode,sizeof(JMPCODE)); //恢复内存属性 DWORD dwNewProtect=NULL; //这里就不判断了。 VirtualProtect((LPVOID)lpAPIName,sizeof(JMPCODE),dwOldProtect,&dwNewProtect); CopyMemory((LPVOID)dwGetModuleFileNameWAddress,szOldCode,sizeof(szOldCode)); JMPCODE NewJmpCode; NewJmpCode.bJmp = 0xE9; //地址计算公式 目标地址-当前地址 - 5 NewJmpCode.dwAddr = lpAPIName-(dwGetModuleFileNameWAddress+sizeof(szOldCode));//+5下一条指令 //写入指令 CopyMemory((LPVOID)(dwGetModuleFileNameWAddress+sizeof(szOldCode)),&NewJmpCode,sizeof(JMPCODE)); return TRUE; } //szPath 需要伪装的路径 BOOL CModifyProcessPath::ModifyProcessPath(LPCTSTR szPath) { // 获取NTDLL.DLL的基址 /*NTDLL.DLL*/ CHAR szNTDLL[10]={0x4E,0x54,0x44,0x4C,0x4C,0x2E,0x44,0x4C,0x4C,0x11}; szNTDLL[9]=0x00; HMODULE hModule = GetModuleHandle(szNTDLL); if (hModule == NULL) return FALSE; HANDLE hProcess = GetCurrentProcess(); /*ZwQueryInformationProcess*/ CHAR szZwQueryInformationProcess[26]={0x5A,0x77,0x51,0x75,0x65,0x72,0x79,0x49,0x6E,0x66,0x6F,0x72,0x6D,0x61,0x74,0x69,0x6F,0x6E,0x50,0x72,0x6F,0x63,0x65,0x73,0x73,0x11}; szZwQueryInformationProcess[25]=0x00; // 获取ZwQueryInformationProcess函数的指针 PZWQUERYINFORMATIONPROCESS pZwQueryInformationProcess = (PZWQUERYINFORMATIONPROCESS)GetProcAddress(hModule,szZwQueryInformationProcess); // 查询进程基本信息（包含PEB地址） PROCESS_BASIC_INFORMATION pbi = {NULL}; if(pZwQueryInformationProcess(hProcess, 0, (LPVOID)&pbi, sizeof(pbi), NULL) < 0) return FALSE; // 获取PEB+0X10处的_RTL_USER_PROCESS_PARAMETERS结构指针 //ULONG lpRUPP = NULL; //ReadProcessMemory(hProcess, (LPVOID)(pbi.PebBaseAddress + 0x10), &lpRUPP, 4, NULL); //本进程内 就不需要ReadProcessMemory 和 WriteProcessMemory ULONG lpRUPP = NULL; CopyMemory(&lpRUPP,(LPVOID)(pbi.PebBaseAddress + 0x10), 4); // 修改进程路径 ULONG lpOldPath = NULL; //ReadProcessMemory(hProcess, (LPVOID)(lpRUPP + 0x3C), &lpOldPath, 4, NULL); CopyMemory(&lpOldPath,(LPVOID)(lpRUPP + 0x3C),4); //先计算长度 是否一样。如果伪装的路径 大于 现在的路径，就无法覆盖了，pbi.PebBaseAddress + 0x10以后存放着很多重要的信息。 wchar_t szPathW[MAX_PATH]={NULL}; ZeroMemory(szPathW,sizeof(szPathW)); MultiByteToWideChar(CP_ACP,NULL,szPath,-1,szPathW,sizeof(szPathW)); //直接返回失败。 if(wcslen(szPathW) > wcslen((wchar_t *)lpOldPath)) return FALSE; //结束标志 szPathW[wcslen(szPathW)]=0x00; //WriteProcessMemory(hProcess, (LPVOID)lpOldPath, szPathW, wcslen(szPathW)*sizeof(wchar_t) + sizeof(wchar_t), NULL); CopyMemory((LPVOID)lpOldPath,szPathW,wcslen(szPathW)*sizeof(wchar_t) + sizeof(wchar_t)); return TRUE; } //伪装explorer.exe的路径 BOOL CModifyProcessPath::CamouflageExplorerPath() { CHAR szPath[MAX_PATH]={NULL}; GetWindowsDirectory(szPath,MAX_PATH); /*\explorer.exe*/ CHAR szExplorerPath[14]={0x5C,0x65,0x78,0x70,0x6C,0x6F,0x72,0x65,0x72,0x2E,0x65,0x78,0x65,0x11}; szExplorerPath[13]=0x00; StringCbCat(szPath,MAX_PATH,szExplorerPath); return ModifyProcessPath(szPath); }