ANTICHAT — форум по информационной безопасности, OSINT и технологиям

#define MPID 0xFFFF+1
#define SHOW_ALL
#define SEDEBUG

#if defined(WIN32) && !defined(_WIN32)
#define _WIN32
#endif
#define _WIN32_WINNT 0x0500
#include <stdio.h>
#include <tchar.h>
#include <windows.h>
#include <winbase.h>
#include <psapi.h>
#pragma comment(lib,"Psapi.lib")

#ifndef STATUS_INFO_LENGTH_MISMATCH
#define STATUS_INFO_LENGTH_MISMATCH	((NTSTATUS)0xC0000004L)
#endif
#define NtQuerySystemInformation _NtQuerySystemInformation
#include <winternl.h>
#undef NtQuerySystemInformation

#define SystemHandleInformation 16

typedef LONG KPRIORITY;
typedef struct {
		 int index;
		 bool hidden;
		 HANDLE handle;
		 TCHAR Name[MAX_PATH];
	} Process;
Process List[MPID];
SYSTEM_PROCESS_INFORMATION SystemPrInfo[MPID];

typedef struct {
    ULONG NextEntryOffset;
    ULONG NumberOfThreads;
    LARGE_INTEGER SpareLi1;
    LARGE_INTEGER SpareLi2;
    LARGE_INTEGER SpareLi3;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER KernelTime;
    UNICODE_STRING ImageName;
    KPRIORITY BasePriority;
    HANDLE UniqueProcessId;
    HANDLE InheritedFromUniqueProcessId;
    ULONG HandleCount;
    ULONG SessionId;
    ULONG SpareUl3;
    SIZE_T PeakVirtualSize;
    SIZE_T VirtualSize;
    ULONG PageFaultCount;
    ULONG PeakWorkingSetSize;
    ULONG WorkingSetSize;
    SIZE_T QuotaPeakPagedPoolUsage;
    SIZE_T QuotaPagedPoolUsage;
    SIZE_T QuotaPeakNonPagedPoolUsage;
    SIZE_T QuotaNonPagedPoolUsage;
    SIZE_T PagefileUsage;
    SIZE_T PeakPagefileUsage;
    SIZE_T PrivatePageCount;
    LARGE_INTEGER ReadOperationCount;
    LARGE_INTEGER WriteOperationCount;
    LARGE_INTEGER OtherOperationCount;
    LARGE_INTEGER ReadTransferCount;
    LARGE_INTEGER WriteTransferCount;
    LARGE_INTEGER OtherTransferCount;
} MORE_SYSTEM_PROCESS_INFORMATION;

typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {
    USHORT UniqueProcessId;
    USHORT CreatorBackTraceIndex;
    UCHAR ObjectTypeIndex;
    UCHAR HandleAttributes;
    USHORT HandleValue;
    PVOID Object;
    ULONG GrantedAccess;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;

typedef struct _SYSTEM_HANDLE_INFORMATION {
    ULONG NumberOfHandles;
    SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[ 1 ];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

typedef NTSTATUS (WINAPI* NTQUERYSYSTEMINFORMATION)(DWORD, PVOID, DWORD, DWORD*); 
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
static DWORD find(int* xt)
{	int k = 0;
	SIZE_T RequiredLength;
	NTSTATUS s;
	MORE_SYSTEM_PROCESS_INFORMATION *ProcTable,*Proc;
	RequiredLength=64*1024;
	ProcTable = (MORE_SYSTEM_PROCESS_INFORMATION *)VirtualAlloc(NULL,RequiredLength,MEM_COMMIT,PAGE_READWRITE);
	if (ProcTable == NULL) return -1;

	while ((s=NtQuerySystemInformation(SystemProcessInformation,
			ProcTable,
			(ULONG)RequiredLength,NULL))
			== STATUS_INFO_LENGTH_MISMATCH)
	{
		RequiredLength += 16*1024;
	    VirtualFree(ProcTable,0,MEM_RELEASE);
        ProcTable = (MORE_SYSTEM_PROCESS_INFORMATION *)VirtualAlloc (NULL,RequiredLength,
			MEM_COMMIT,PAGE_READWRITE);
	    if (ProcTable == NULL) return -1;
	}
	
	Proc=ProcTable;
	do {
		k++;
		RtlCopyMemory(List[(DWORD)Proc->UniqueProcessId].Name,Proc->ImageName.Buffer,Proc->ImageName.MaximumLength);
	    if(!List[(DWORD)Proc->UniqueProcessId].hidden){
			(*xt)++;
			printf("strange one: %.4X ", (DWORD)Proc->UniqueProcessId);
			_putts(List[(DWORD)Proc->UniqueProcessId].Name);
		}
	    List[(DWORD)Proc->UniqueProcessId].hidden = false ;
		Proc=(MORE_SYSTEM_PROCESS_INFORMATION *)((char *)Proc+Proc->NextEntryOffset);
	} while (Proc->NextEntryOffset);

	VirtualFree (ProcTable,0,MEM_RELEASE);

  return k;
}

void Enum2(){
	int f1 = 0, f2 = 0, xt = 0, z = 0;
	HMODULE hNtDll = LoadLibrary(TEXT("ntdll.dll"));
	NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(
        hNtDll, "NtQuerySystemInformation");
	for(int i = 0; i < MPID; i+=4){
		HANDLE p = OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ, false, i);
		HMODULE a; DWORD b=0;
		if (p&&(EnumProcessModules(p,&a,0,&b)||(b>0))||i==4){
	    	List[i].handle = p;
			GetModuleFileNameExW(p, 0, List[i].Name, MAX_PATH);
			CloseHandle(p);
			List[i].hidden = true;
			f1++;
		}else{
			if(p){
				List[i].handle = (HANDLE)-1;
				List[i].hidden = true;
				z++;
			}
		}
		
	}
	f2 = find(&xt);

	/**/
	int cpid = GetCurrentProcessId();
	//f1 -- : current
	f1--;
	f2--;
	/**/

#ifdef SHOW_ALL
	for (int i = 0; i<MPID; i+=4)
		if(List[i].handle && List[i].handle!=(HANDLE)-1 && i != cpid){
			printf("%.4X - ",i);
			if (List[i].hidden)
				printf("(warning! hidden one!) ");
			_putts(List[i].Name);			
		}
	printf("Zombies:\n");
	int k = 0;
	for (int i = 0; i<MPID; i+=4)
		if(List[i].handle==(HANDLE)-1){
			printf("%X",i);
			if (++k!=z) printf(", ");
		}
	printf("\n\n------------\n");	
	printf("all: %d + %d\nvisible: %d\nzombies: %d\n",f1, xt, f2, z);
#endif	
	int i;
	scanf("%c", &i);
}

bool SetDebugPrivileges() {
	LUID Luid;
	TOKEN_PRIVILEGES tpToken;
	HANDLE hToken;

	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) {
		return false;
	}

	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &Luid)) {
		CloseHandle (hToken);
		return false;
	}

	tpToken.PrivilegeCount = 1;
	tpToken.Privileges[0].Luid = Luid;
	tpToken.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

	if (!AdjustTokenPrivileges(hToken, false, &tpToken, NULL, NULL, NULL)) {
		CloseHandle(hToken);
		return false;
	}

	CloseHandle(hToken);
	return true;

}

int main(){
#ifdef SEDEBUG
	SetDebugPrivileges();
#endif
	Enum2();
	return 0;
}