Ring3挂起进程,跟恢复进程.

Posted 2021-11-26 ibinary

目录

• Ring3挂起进程,跟恢复进程.
  • 一丶简介
  • 二丶代码

Ring3挂起进程,跟恢复进程.

一丶简介

有时候我们做对抗的时候可能会遇到.一个进程常常操作我们.但是我们
可以通过挂起进程来挂起它让它无法操作.当然方法很多.不止这一种.

原理:
原理就是挂起所有线程,我们可以调用NtDLL中低层的函数还挂起进程.
NT 函数
NtSuspendProcess NtResumeProcess 第一个是挂起进程,第二个是恢复进程

二丶代码

#include <Windows.h>
#include <stdio.h>
#include <stdlib.h>

typedef DWORD(WINAPI *NtSuspendProcess)(HANDLE ProcessHandle);
typedef DWORD(WINAPI *NtResumeProcess)(HANDLE hProcess);
NtSuspendProcess m_NtSuspendProcess;
NtResumeProcess   m_NtResumeProcess;


bool AdjustPrivileges() {
    HANDLE hToken = NULL;
    TOKEN_PRIVILEGES tp;
    TOKEN_PRIVILEGES oldtp;
    DWORD dwSize = sizeof(TOKEN_PRIVILEGES);
    LUID luid;

    OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken);


    if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid)) {
        CloseHandle(hToken);
        OutputDebugString(TEXT("提升权限失败,LookupPrivilegeValue"));
        return false;
    }
    ZeroMemory(&tp, sizeof(tp));
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    /* Adjust Token Privileges */
    if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), &oldtp, &dwSize)) {
        CloseHandle(hToken);
        OutputDebugString(TEXT("提升权限失败 AdjustTokenPrivileges"));
        return false;
    }
    // close handles
    CloseHandle(hToken);
    return true;
}

int main()
{
    AdjustPrivileges();

    DWORD processID = 1324;

    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,//暂停时用这个（P.._S.._R..）标志PROCESS_SUSPEND_RESUME
        FALSE, (DWORD)processID);
    HMODULE h_module = LoadLibrary(L"ntdll.dll");
    m_NtSuspendProcess = (NtSuspendProcess)GetProcAddress(h_module, "NtSuspendProcess");
    m_NtSuspendProcess(hProcess);
    /*if (hProcess)
    {
        
        m_NtResumeProcess = (NtResumeProcess)GetProcAddress(h_module, "NtResumeProcess");
        m_NtSuspendProcess = (NtSuspendProcess)GetProcAddress(h_module, "NtSuspendProcess");
        m_NtResumeProcess(hProcess);
    }*/
}