From e04e70fa3929c2f663a40e114bf207f35523f26d Mon Sep 17 00:00:00 2001 From: UnknownObject <38148526+UnknownObject000@users.noreply.github.com> Date: Thu, 16 Jun 2022 18:50:01 +0800 Subject: [PATCH] Upload File v1.0 --- .../NTV_02_CriticalProcess.sln | 31 ++ .../NTV_02_CriticalProcess.cpp | 316 ++++++++++++++++++ .../NTV_02_CriticalProcess.vcxproj | 149 +++++++++ .../NTV_02_CriticalProcess.vcxproj.filters | 22 ++ .../NTV_02_CriticalProcess.vcxproj.user | 4 + 5 files changed, 522 insertions(+) create mode 100644 NTV_02_CriticalProcess/NTV_02_CriticalProcess.sln create mode 100644 NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.cpp create mode 100644 NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj create mode 100644 NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj.filters create mode 100644 NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj.user diff --git a/NTV_02_CriticalProcess/NTV_02_CriticalProcess.sln b/NTV_02_CriticalProcess/NTV_02_CriticalProcess.sln new file mode 100644 index 0000000..77f3fbe --- /dev/null +++ b/NTV_02_CriticalProcess/NTV_02_CriticalProcess.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.0.32417.34 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NTV_02_CriticalProcess", "NTV_02_CriticalProcess\NTV_02_CriticalProcess.vcxproj", "{003AE8F3-031F-420A-B82F-63DB693610C0}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {003AE8F3-031F-420A-B82F-63DB693610C0}.Debug|x64.ActiveCfg = Debug|x64 + {003AE8F3-031F-420A-B82F-63DB693610C0}.Debug|x64.Build.0 = Debug|x64 + {003AE8F3-031F-420A-B82F-63DB693610C0}.Debug|x86.ActiveCfg = Debug|Win32 + {003AE8F3-031F-420A-B82F-63DB693610C0}.Debug|x86.Build.0 = Debug|Win32 + {003AE8F3-031F-420A-B82F-63DB693610C0}.Release|x64.ActiveCfg = Release|x64 + {003AE8F3-031F-420A-B82F-63DB693610C0}.Release|x64.Build.0 = Release|x64 + {003AE8F3-031F-420A-B82F-63DB693610C0}.Release|x86.ActiveCfg = Release|Win32 + {003AE8F3-031F-420A-B82F-63DB693610C0}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {48414DA4-8B63-443C-B3D4-FBAB90936F49} + EndGlobalSection +EndGlobal diff --git a/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.cpp b/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.cpp new file mode 100644 index 0000000..522e75c --- /dev/null +++ b/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.cpp @@ -0,0 +1,316 @@ +// NTV_02_CriticalProcess.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。 +// + +//系统关键进程的设置、取消、查询演示程序 + +#include +#include +#include +#include +#include +#include + +//准备未定义类型 +enum PROCESSINFOCLASS +{ + ProcessBasicInformation = 0x00, + ProcessQuotaLimits = 0x01, + ProcessIoCounters = 0x02, + ProcessVmCounters = 0x03, + ProcessTimes = 0x04, + ProcessBasePriority = 0x05, + ProcessRaisePriority = 0x06, + ProcessDebugPort = 0x07, + ProcessExceptionPort = 0x08, + ProcessAccessToken = 0x09, + ProcessLdtInformation = 0x0A, + ProcessLdtSize = 0x0B, + ProcessDefaultHardErrorMode = 0x0C, + ProcessIoPortHandlers = 0x0D, + ProcessPooledUsageAndLimits = 0x0E, + ProcessWorkingSetWatch = 0x0F, + ProcessUserModeIOPL = 0x10, + ProcessEnableAlignmentFaultFixup = 0x11, + ProcessPriorityClass = 0x12, + ProcessWx86Information = 0x13, + ProcessHandleCount = 0x14, + ProcessAffinityMask = 0x15, + ProcessPriorityBoost = 0x16, + ProcessDeviceMap = 0x17, + ProcessSessionInformation = 0x18, + ProcessForegroundInformation = 0x19, + ProcessWow64Information = 0x1A, + ProcessImageFileName = 0x1B, + ProcessLUIDDeviceMapsEnabled = 0x1C, + ProcessBreakOnTermination = 0x1D, + ProcessDebugObjectHandle = 0x1E, + ProcessDebugFlags = 0x1F, + ProcessHandleTracing = 0x20, + ProcessIoPriority = 0x21, + ProcessExecuteFlags = 0x22, + ProcessResourceManagement = 0x23, + ProcessCookie = 0x24, + ProcessImageInformation = 0x25, + ProcessCycleTime = 0x26, + ProcessPagePriority = 0x27, + ProcessInstrumentationCallback = 0x28, + ProcessThreadStackAllocation = 0x29, + ProcessWorkingSetWatchEx = 0x2A, + ProcessImageFileNameWin32 = 0x2B, + ProcessImageFileMapping = 0x2C, + ProcessAffinityUpdateMode = 0x2D, + ProcessMemoryAllocationMode = 0x2E, + ProcessGroupInformation = 0x2F, + ProcessTokenVirtualizationEnabled = 0x30, + ProcessConsoleHostProcess = 0x31, + ProcessWindowInformation = 0x32, + ProcessHandleInformation = 0x33, + ProcessMitigationPolicy = 0x34, + ProcessDynamicFunctionTableInformation = 0x35, + ProcessHandleCheckingMode = 0x36, + ProcessKeepAliveCount = 0x37, + ProcessRevokeFileHandles = 0x38, + ProcessWorkingSetControl = 0x39, + ProcessHandleTable = 0x3A, + ProcessCheckStackExtentsMode = 0x3B, + ProcessCommandLineInformation = 0x3C, + ProcessProtectionInformation = 0x3D, + ProcessMemoryExhaustion = 0x3E, + ProcessFaultInformation = 0x3F, + ProcessTelemetryIdInformation = 0x40, + ProcessCommitReleaseInformation = 0x41, + ProcessDefaultCpuSetsInformation = 0x42, + ProcessAllowedCpuSetsInformation = 0x43, + ProcessSubsystemProcess = 0x44, + ProcessJobMemoryInformation = 0x45, + ProcessInPrivate = 0x46, + ProcessRaiseUMExceptionOnInvalidHandleClose = 0x47, + ProcessIumChallengeResponse = 0x48, + ProcessChildProcessInformation = 0x49, + ProcessHighGraphicsPriorityInformation = 0x4A, + ProcessSubsystemInformation = 0x4B, + ProcessEnergyValues = 0x4C, + ProcessActivityThrottleState = 0x4D, + ProcessActivityThrottlePolicy = 0x4E, + ProcessWin32kSyscallFilterInformation = 0x4F, + ProcessDisableSystemAllowedCpuSets = 0x50, + ProcessWakeInformation = 0x51, + ProcessEnergyTrackingState = 0x52, + ProcessManageWritesToExecutableMemory = 0x53, + ProcessCaptureTrustletLiveDump = 0x54, + ProcessTelemetryCoverage = 0x55, + ProcessEnclaveInformation = 0x56, + ProcessEnableReadWriteVmLogging = 0x57, + ProcessUptimeInformation = 0x58, + ProcessImageSection = 0x59, + ProcessDebugAuthInformation = 0x5A, + ProcessSystemResourceManagement = 0x5B, + ProcessSequenceNumber = 0x5C, + ProcessLoaderDetour = 0x5D, + ProcessSecurityDomainInformation = 0x5E, + ProcessCombineSecurityDomainsInformation = 0x5F, + ProcessEnableLogging = 0x60, + ProcessLeapSecondInformation = 0x61, + ProcessFiberShadowStackAllocation = 0x62, + ProcessFreeFiberShadowStackAllocation = 0x63, + MaxProcessInfoClass = 0x64 +}; + +//准备函数指针 +typedef VOID(WINAPI* type_RtlSetProcessIsCritical)(BOOLEAN, PBOOLEAN, BOOLEAN); + +typedef VOID(WINAPI* type_RtlSetThreadIsCritical)(BOOLEAN, PBOOLEAN, BOOLEAN); + +typedef NTSTATUS(__kernel_entry* type_NtQueryInformationProcess)(IN HANDLE, IN PROCESSINFOCLASS, OUT PVOID, IN ULONG, OUT PULONG); + +//准备存储进程信息的类型 +using ProcessInfo = std::vector>; + +//提取SE_DEBUG_PRIVILIEGE +bool GetDebug() +{ + HANDLE hToken; + TOKEN_PRIVILEGES tpNew = { 0 }; + LUID PriviliegeID; + if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) + return false; + LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &PriviliegeID); + tpNew.PrivilegeCount = 1; + tpNew.Privileges[0].Luid = PriviliegeID; + tpNew.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + if (!AdjustTokenPrivileges(hToken, FALSE, &tpNew, NULL, NULL, NULL)) + return false; + else + return true; +} + +//从ntdll.dll加载三个API + +VOID RtlSetProcessIsCritical(BOOLEAN NewValue, PBOOLEAN OldValue, BOOLEAN IsWinlogon) +{ + HMODULE hDll = LoadLibrary(L"ntdll.dll"); + if (hDll == NULL) + return; + type_RtlSetProcessIsCritical func = (type_RtlSetProcessIsCritical)GetProcAddress(hDll, "RtlSetProcessIsCritical"); + if (func != NULL) + { + FreeLibrary(hDll); + return func(NewValue, OldValue, IsWinlogon); + } + else + { + FreeLibrary(hDll); + return; + } +} + +VOID RtlSetThreadIsCritical(BOOLEAN NewValue, PBOOLEAN OldValue, BOOLEAN IsWinlogon) +{ + HMODULE hDll = LoadLibrary(L"ntdll.dll"); + if (hDll == NULL) + return; + type_RtlSetThreadIsCritical func = (type_RtlSetThreadIsCritical)GetProcAddress(hDll, "RtlSetThreadIsCritical"); + if (func != NULL) + { + FreeLibrary(hDll); + return func(NewValue, OldValue, IsWinlogon); + } + else + { + FreeLibrary(hDll); + return; + } +} + +NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength) +{ + HMODULE hDll = LoadLibrary(L"ntdll.dll"); + if (hDll == NULL) + return -1; + type_NtQueryInformationProcess func = (type_NtQueryInformationProcess)GetProcAddress(hDll, "NtQueryInformationProcess"); + if (func != NULL) + { + FreeLibrary(hDll); + return func(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength); + } + else + { + FreeLibrary(hDll); + return -2; + } +} + +//根据API编写设置进程为关键进程代码 +void SetSystemProcess() +{ + RtlSetProcessIsCritical(TRUE, NULL, FALSE); + RtlSetThreadIsCritical(TRUE, NULL, FALSE); + return; +} + +//取消系统关键进程 +void CalcelSystemProcess() +{ + RtlSetProcessIsCritical(FALSE, NULL, FALSE); + RtlSetThreadIsCritical(FALSE, NULL, FALSE); + return; +} + +//检查是否为系统关键进程 +bool IsSystemProcess(DWORD ProcessID) +{ + HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, ProcessID); + if (hProcess == NULL) + return false; + ULONG iRet = 0; + NtQueryInformationProcess(hProcess, ProcessBreakOnTermination, &iRet, sizeof(iRet), NULL); + CloseHandle(hProcess); + return (iRet == 1); +} + +//遍历全部进程查找系统关键进程 +ProcessInfo GetAllSystemProcess() +{ + ProcessInfo info; + HANDLE hProcessSnap = INVALID_HANDLE_VALUE; + PROCESSENTRY32 pe32 = { 0 }; + hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + if (hProcessSnap == INVALID_HANDLE_VALUE) + return info; + pe32.dwSize = sizeof(PROCESSENTRY32); + if (Process32First(hProcessSnap, &pe32)) + { + do + { + if (IsSystemProcess(pe32.th32ProcessID)) + info.push_back({ pe32.szExeFile,pe32.th32ProcessID }); + } while (Process32Next(hProcessSnap, &pe32)); + } + else + { + CloseHandle(hProcessSnap); + return info; + } + CloseHandle(hProcessSnap); + return info; +} + +/* +* 此处UP会编写4个演示用主程序 +* 分别为： +* 1. 设置系统关键进程后直接退出 +* 2. 设置系统关键进程后等待（用于演示任务管理器结束） +* 3. 设置系统关键进程，取消设置系统关键进程，退出 +* 4. 遍历列出所有的系统关键进程 +*/ + + +int main_1() +{ + GetDebug(); + SetSystemProcess(); + return 0; +} + +int main_2() +{ + GetDebug(); + SetSystemProcess(); + getchar(); //使用等待输入来暂停程序运行 + return 0; +} + +int main_3() +{ + GetDebug(); + SetSystemProcess(); + CalcelSystemProcess(); + return 0; +} + +int main_4() +{ + GetDebug(); + ProcessInfo list = GetAllSystemProcess(); + if (list.size() == 0) + printf("未找到任何系统关键进程\n"); + else + { + std::wcout << "Process Name\t\tPID" << std::endl; + for (auto& info : list) + { + std::wcout << info.first << "\t\t" << info.second << std::endl; + } + } + system("pause"); + return 0; +} + +int main() +{ + //main_1(); + //main_2(); + //main_3(); + //main_4(); + return 0; +} \ No newline at end of file diff --git a/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj b/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj new file mode 100644 index 0000000..8fb82a3 --- /dev/null +++ b/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj @@ -0,0 +1,149 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {003ae8f3-031f-420a-b82f-63db693610c0} + NTV02CriticalProcess + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + RequireAdministrator + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + RequireAdministrator + + + + + + + + + \ No newline at end of file diff --git a/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj.filters b/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj.filters new file mode 100644 index 0000000..8307e79 --- /dev/null +++ b/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + 源文件 + + + \ No newline at end of file diff --git a/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj.user b/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj.user new file mode 100644 index 0000000..0f14913 --- /dev/null +++ b/NTV_02_CriticalProcess/NTV_02_CriticalProcess/NTV_02_CriticalProcess.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file