进程自我保护 适用于WIN7 X64

 //进程自我保护，注意只有X64 WIN7可用
 #include <ntddk.h>
 #define PROCESS_TERMINATE 1
 typedef struct _LDR_DATA                                     // 24 elements, 0xE0 bytes (sizeof)
 {
     struct _LIST_ENTRY InLoadOrderLinks;                     // 2 elements, 0x10 bytes (sizeof)
     struct _LIST_ENTRY InMemoryOrderLinks;                   // 2 elements, 0x10 bytes (sizeof)
     struct _LIST_ENTRY InInitializationOrderLinks;           // 2 elements, 0x10 bytes (sizeof)
     VOID*        DllBase;
     VOID*        EntryPoint;
     ULONG32      SizeOfImage;
     UINT8        _PADDING0_[0x4];
     struct _UNICODE_STRING FullDllName;                      // 3 elements, 0x10 bytes (sizeof)
     struct _UNICODE_STRING BaseDllName;                      // 3 elements, 0x10 bytes (sizeof)
     ULONG32      Flags;
 }LDR_DATA, *PLDR_DATA;

 char* GetProcessImageFileName(PEPROCESS Process)
 {
     char *FileName;
     FileName = (char *)Process + 0x16c;
     return FileName;
 }

 BOOLEAN IsProtectedProcessName(PEPROCESS eprocess)
 {
     char *Name = GetProcessImageFileName(eprocess);
     if (!_stricmp("vb.exe", Name))
         return ;
     else
         return ;
 }

 OB_PREOP_CALLBACK_STATUS ProccessProtectCallBack(PVOID RegContext,
     POB_PRE_OPERATION_INFORMATION pOperationInformation)
 {
     if (pOperationInformation->ObjectType != *PsProcessType)
     {
         return OB_PREOP_SUCCESS;
     }
     if (IsProtectedProcessName((PEPROCESS)pOperationInformation->Object))

     {
         if (pOperationInformation->Operation == OB_OPERATION_HANDLE_CREATE)
         {
             if ((pOperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess&
                 PROCESS_TERMINATE) == PROCESS_TERMINATE)
             {
                 pOperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~PROCESS_TERMINATE;
             }
         }
         if (pOperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE)
         {
             if ((pOperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess&
                 PROCESS_TERMINATE) == PROCESS_TERMINATE)
             {
                 pOperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~PROCESS_TERMINATE;
             }
         }
     }
     return OB_PREOP_SUCCESS;
 }

 NTSTATUS SelfProtection()
 {
     NTSTATUS obst1 = ;
     HANDLE obHandle;
     LARGE_INTEGER CallbackCookie = {  };
     OB_CALLBACK_REGISTRATION obReg;
     OB_OPERATION_REGISTRATION opReg;
     memset(&obReg, , sizeof(obReg));
     obReg.Version = ObGetFilterVersion();
     obReg.OperationRegistrationCount = ;
     obReg.RegistrationContext = NULL;
     RtlInitUnicodeString(&obReg.Altitude, L"");
     obReg.OperationRegistration = &opReg;
     memset(&opReg, , sizeof(&opReg));
     opReg.ObjectType = PsProcessType;
     opReg.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
     opReg.PreOperation = (POB_PRE_OPERATION_CALLBACK)&ProccessProtectCallBack;
     //保护自身进程对象不被打开
     obst1 = ObRegisterCallbacks(&obReg, &obHandle);
     return ;
 }
 NTSTATUS DriverEntry(PDRIVER_OBJECT MyDriver, PUNICODE_STRING reg_path)
 {
     PLDR_DATA ldr;
     ldr = (PLDR_DATA)MyDriver->DriverSection;
     ldr->Flags |= 0x20;
     SelfProtection();
     return ;
 }