看了这几次什么威金、熊猫烧香等病毒肆虐后，心中比较郁闷，说实在说这些病毒水平的确不高呀，都是采用改写注册表（而且是个土得不能再土的键值，呵呵）来实现自启动的，感染PE文件的方式更是让人笑掉大牙（拜托先学习一下PE文件头、内存重定位、查找API地址后再编PE病毒吧），本来杀毒软件是可以发现并报警的，但问题是狡猾的病毒在运行时已经把杀毒软件Kill了，于是俺闲着没事编了个程序来保护一下杀毒软件不被杀，原理也很简单，就是HOOK了kernel32.dll中的TerminateProcess函数，抛砖引玉，高手莫笑哈！以下是源代码！masm32编译成一个DLL文件！自已编个文件调用也可，用Rundll32.exe dll.dll,InstallHook调动也可。俺的程序没法上传，打包成了zip文件传在另一处，呵呵。目前仅支持Xp,不支持9X哈。
附件地址：http://b.py99.net/zip/f?v=20072/28945164.zip
.586
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\kernel32.lib
include \masm32\include\user32.inc
includelib \masm32\lib\user32.lib
HOOKAPI struct
a byte ?
PMyapi DWORD ?
d BYTE ?
e BYTE ?
HOOKAPI ends
WriteApi proto :DWORD ,:DWORD,:DWORD,:DWORD
MyAPI proto :DWORD ,:DWORD
GetApi proto :DWORD,:DWORD
.data
hInstance dd 0
WProcess dd 0
hacker HOOKAPI <>
CommandLine LPSTR ?
Papi1 DWORD ?
Myapi1 DWORD ?
ApiBak1 db 10 dup(?)
DllName1 db "kernel32.dll",0
ApiName1 db "TerminateProcess",0
mdb db "下面的程序妄图终止别的进程,要保持阻止吗?",0
.data?
hHook dd ?
hWnd dd ?
.code
DllEntry proc hInst:HINSTANCE, reason:DWORD, reserved1:DWORD
.if reason==DLL_PROCESS_ATTACH
push hInst
pop hInstance
invoke GetCommandLine
mov CommandLine,eax
mov hacker.a,0B8h ;mov eax,
;mov hacker.d PMyapi ;0x000000
mov hacker.d,0FFh ;jmp
mov hacker.e, 0E0h ;eax
invoke GetCurrentProcess ;取进程伪句柄
mov WProcess ,eax
invoke GetApi,addr DllName1,addr ApiName1 ;取API地址
mov Papi1,eax ;保存API地址
invoke ReadProcessMemory,WProcess,Papi1,addr ApiBak1,8,NULL ;备份原API的前8字节
mov hacker.PMyapi,offset MyAPI ;0x0000,这里设置替代API的函数地址
invoke WriteApi,WProcess,Papi1, addr hacker ,size HOOKAPI ;HOOK API
.endif
.if reason==DLL_PROCESS_DETACH
invoke WriteApi,WProcess,Papi1, addr ApiBak1 ,8 ;还原API
.endif
mov eax,TRUE
ret
DllEntry Endp
GetMsgProc proc nCode:DWORD,wParam:DWORD,lParam:DWORD
invoke CallNextHookEx,hHook,nCode,wParam,lParam
mov eax,TRUE
ret
GetMsgProc endp
InstallHook proc
invoke SetWindowsHookEx,WH_GETMESSAGE,addr GetMsgProc,hInstance,NULL
invoke WriteApi,WProcess,Papi1, addr hacker ,sizeof HOOKAPI
mov hHook,eax
ret
InstallHook endp
UninstallHook proc
invoke UnhookWindowsHookEx,hHook
invoke WriteApi,WProcess,Papi1, addr ApiBak1 ,8
ret
UninstallHook endp
GetApi proc DllNameAddress:DWORD,ApiNameAddress:DWORD
invoke GetModuleHandle,DllNameAddress ;取DLL模块句柄
.if eax==NULL
invoke LoadLibrary ,DllNameAddress ;加载DLL
.endif
invoke GetProcAddress,eax,ApiNameAddress ;取API地址
mov eax,eax
ret
GetApi endp
WriteApi proc Process:DWORD ,Papi:DWORD,Ptype:DWORD,Psize:DWORD
LOCAL mbi:MEMORY_BASIC_INFORMATION
LOCAL msize:DWORD
;返回页面虚拟信息
invoke VirtualQueryEx,Process, Papi,addr mbi,SIZEOF MEMORY_BASIC_INFORMATION
;修改为可读写模式
invoke VirtualProtectEx,Process, mbi.BaseAddress,8h,PAGE_EXECUTE_READWRITE,addr mbi.Protect
;开始写内存
invoke WriteProcessMemory,Process, Papi, Ptype,Psize ,NULL
PUSH eax
;改回只读模式
invoke VirtualProtectEx,Process,mbi.BaseAddress,8h,PAGE_EXECUTE_READ,addr mbi.Protect
pop eax
ret
WriteApi endp
;替代的API,参数要和原来一样
MyAPI proc dwa:DWORD , dwb:DWORD
invoke MessageBox, NULL, CommandLine, addr mdb, MB_YESNO ;弹出信息框选择是否阻止
.if eax==7 ;如果选择否
invoke WriteApi,WProcess,Papi1, addr ApiBak1 ,8 ;先还原API
invoke TerminateProcess, dwa, dwb ;再调用API
invoke WriteApi,WProcess,Papi1, addr hacker ,sizeof HOOKAPI ;调用完后再改回来
.endif
mov eax,TRUE
ret
MyAPI endp
End DllEntry
