模拟锁定文件

Posted 2020-10-01 yutingliuyl

模拟锁定文件的Rring 3下的程序代码,代码来自于看雪中的HWL发表的一份代码中,我仅仅是看了下代码:

#include <stdio.h>
#include <Windows.h>
void GetAllProcessA(int pids[],int *procount)
{
	int i=0,c=0;
	HANDLE hProcess=0;
	for(i=8;i<19996;i+=4)
	{
		hProcess=OpenProcess(0x10,0,i);
		if (hProcess!=0)
		{
			pids[c]=i;
			CloseHandle(hProcess);
			c++;
		}
	}
	*procount=c;
}
int main()
{
	#define SE_DEBUG_PRIVILEGE 0x14 //DEBUG 权限
	//源码中没有__stdcall,所以一直报checkesp.c  line 14的错误
	typedef long (__stdcall *RTLADJUSTPRIVILEGE)(int, bool, bool, int*);
	typedef long (__stdcall *NTDUPLICATEOBJECT)(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,BOOLEAN,ULONG);
	int nEn = 0;
	int pids[4*260];
	int procsnum=0;
	char pFile[260];
	//得到函数的地址
	RTLADJUSTPRIVILEGE getdbg=(RTLADJUSTPRIVILEGE)GetProcAddress(GetModuleHandleW(L"ntdll.dll"),"RtlAdjustPrivilege");
	NTDUPLICATEOBJECT NtDuplicateObject=(NTDUPLICATEOBJECT)GetProcAddress(GetModuleHandleW(L"ntdll.dll"),"NtDuplicateObject");
	//提升进程权限
	getdbg(SE_DEBUG_PRIVILEGE , TRUE, FALSE,&nEn);//SE_DEBUG_PRIVILEGE =20
	//getdbg(20,1,0,&bRet);
	memset(pids,0,4*260);
	memset(pFile,0,260);
	printf("Input the file name you want to protect: ");
	scanf("%s",pFile);
	//新建文件
	//#define GENERIC_READ                     (0x80000000L)
	//HANDLE hsFile = CreateFileA(pFile, 0x80000000, 0, 0, 3, 0, 0);
	HANDLE hsFile = CreateFileA(pFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	//SetHandleInformation(hsFile,0,2);
	SetHandleInformation(hsFile, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE); //#define HANDLE_FLAG_PROTECT_FROM_CLOSE  0x00000002
	
	//得到当前存活的进程id列表和进程数目,
	GetAllProcessA(pids,&procsnum);
	//遍历当前存活的进程
	for(int i=0;i<procsnum;i++)
	{
		HANDLE htFile=0;
		//HANDLE hProcess = OpenProcess(0x1F0FFF, 0, pids[i]);
		//#define STANDARD_RIGHTS_REQUIRED         (0x000F0000L)
		//#define PROCESS_ALL_ACCESS        (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
		0xFFFF)
		//#define SYNCHRONIZE                      (0x00100000L)
		//不知道原作者为什么要用这些魔幻数,而不用PROCESS_ALL_ACCESS
		HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pids[i]);
		if (hProcess!=0)
		{
			//NtDuplicateObject((HANDLE)-1, hsFile, hProcess, &htFile, 0, 0, 4);
			NtDuplicateObject((HANDLE)-1, hsFile, hProcess, &htFile, 0, 0, 4); //DUPLICATE_SAME_ATTRIBUTES = 4
			CloseHandle(hProcess);
		}
	}
	getchar();
	printf("OK!\n");
	getchar();
	return 0;
}

代码分析:

遍历当前进程,将文件句柄拷贝到每一个进程中,从而实际锁定文件