-
源码：用于通过修改SSDT方式实现驱动程序保护的进程
资源介绍
typedef NTSTATUS (*ZWOPENPROCESS)(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId
);
NTSYSAPI
NTSTATUS
NTAPI ZwOpenProcess (
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId
);
ZWOPENPROCESS OldZwOpenProcess;
NTSTATUS NewZwOpenProcess (
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId
)
{
NTSTATUS ntStatus;
ntStatus = ((ZWOPENPROCESS)(OldZwOpenProcess)) (
ProcessHandle,
DesiredAccess,
ObjectAttributes,
ClientId );
if(ClientId->UniqueProcess == (HANDLE)ulPID)
*ProcessHandle = NULL;
return ntStatus;
}