【转帖】创建SYSTEM用户进程(二)(VB6.0)

阿杰

<p>Option Explicit<br/><br/>Private Declare Function NtCreateProcessEx Lib "NTDLL.DLL" (ByRef ProcessHandle As Long, ByVal AccessMask As Long, ByVal ObjectAttributes As Long, ByVal hParentProcess As Long, ByVal InheritHandles As Long, ByVal hSection As Long, ByVal hDebugPort As Long, ByVal hExceptionPort As Long, ByVal reserv As Long) As Long<br/>Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long<br/>Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long<br/>Private Declare Function OpenProcess Lib "kernel32.dll" (ByVal dwDesiredAccessas As Long, ByVal bInheritHandle As Long, ByVal dwProcId As Long) As Long<br/>Private Const PROCESS_QUERY_INFORMATION As Long = (&amp;H400)<br/>Private Const STANDARD_RIGHTS_REQUIRED As Long = &amp;HF0000<br/>Private Const SYNCHRONIZE As Long = &amp;H100000<br/>Private Const PROCESS_ALL_ACCESS As Long = (STANDARD_RIGHTS_REQUIRED Or SYNCHRONIZE Or &amp;HFFF)<br/>Private Type OBJECT_ATTRIBUTES<br/>&nbsp; &nbsp; Length As Long<br/>&nbsp; &nbsp; RootDirectory As Long<br/>&nbsp; &nbsp; ObjectName As Long<br/>&nbsp; &nbsp; Attributes As Long<br/>&nbsp; &nbsp; SecurityDescriptor As Long<br/>&nbsp; &nbsp; SecurityQualityOfService As Long<br/>End Type<br/><br/>Public gclsHookInfo As clsHookInfo<br/>Public glngProcess As Long<br/>Public glngSystemHandle As Long<br/><br/>Public Function NtCreateProcessExCallback(ByRef ProcessHandle As Long, ByVal AccessMask As Long, ByVal ObjectAttributes As Long, ByVal hParentProcess As Long, ByVal InheritHandles As Long, ByVal hSection As Long, ByVal hDebugPort As Long, ByVal hExceptionPort As Long, ByVal reserv As Long) As Long<br/>&nbsp; &nbsp; Dim hReturn As Long<br/>&nbsp; &nbsp; 'hParentProcess 指定为一个System用户进程的句柄,需要注意的是不要关闭此句柄<br/>&nbsp; &nbsp; gclsHookInfo.HookStatus False<br/>&nbsp; &nbsp; hReturn = NtCreateProcessEx(ProcessHandle, AccessMask, ObjectAttributes, glngSystemHandle, InheritHandles, hSection, hDebugPort, hExceptionPort, reserv)<br/>&nbsp; &nbsp; gclsHookInfo.HookStatus True<br/>&nbsp; &nbsp; NtCreateProcessExCallback = hReturn<br/>End Function<br/><br/>Public Function GetFunAddr(lngFunAddr As Long) As Long<br/>&nbsp; &nbsp; GetFunAddr = lngFunAddr<br/>End Function</p>
<p>本帖来源:<font face="Verdana">http://www.superkill.cn/bbs/dispbbs.asp?boardid=2&amp;Id=3</font></p>