【发布时间】:2015-05-02 22:52:59
【问题描述】:
我一直在尝试解决这些代码堆栈上的问题。我试图在我的可执行文件上阻止注入等。
我这样调用我的函数:
#include "Protect.h"
EL_DenyProcessAccess();
错误 C4430:缺少类型说明符 - 假定为 int。注意:C++ 不支持 default-int
错误 C2146:语法错误:缺少“;”在标识符“EL_DenyProcessAccess”之前
#pragma once
#include "AccCtrl.h"
#include "Aclapi.h"
BOOL EL_FORCEINLINE EL_DenyProcessAccess( void )
{
BYTE abyBuffer[0x200];
PACL pACL;
SID_IDENTIFIER_AUTHORITY stIdentifierAuthority = SECURITY_WORLD_SID_AUTHORITY;
PSID pSid = NULL;
BOOL bRet = FALSE;
DWORD dwSize = 0;
HANDLE hToken = NULL;
HANDLE hProcess = ::GetCurrentProcess();
PTOKEN_USER pUserInfo = NULL;
if( ::AllocateAndInitializeSid( &stIdentifierAuthority, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &pSid ) == FALSE )
goto Cleanup;
if( ::OpenProcessToken( hProcess, TOKEN_QUERY, &hToken ) == FALSE )
goto Cleanup;
::GetTokenInformation( hToken, TokenUser, NULL, NULL, &dwSize );
if( dwSize > 1024 )
goto Cleanup;
pUserInfo = (PTOKEN_USER) ::GlobalAlloc( GPTR, dwSize );
if( pUserInfo == NULL )
goto Cleanup;
if( ::GetTokenInformation( hToken, TokenUser, pUserInfo, dwSize, &dwSize ) == FALSE )
goto Cleanup;
pACL = (PACL) &abyBuffer;
if( ::InitializeAcl( pACL, 0x200, ACL_REVISION ) == FALSE )
goto Cleanup;
// Deny except PROCESS_TERMINATE and PROCESS_SET_SESSIONID
if( ::AddAccessDeniedAce( pACL, ACL_REVISION, PROCESS_CREATE_PROCESS | PROCESS_DUP_HANDLE | PROCESS_VM_WRITE | PROCESS_VM_READ | PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD, pSid ) == FALSE )
goto Cleanup;
// Allow SYNCHRONIZE, PROCESS_QUERY_INFORMATION, PROCESS_SET_INFORMATION, PROCESS_SET_QUOTA and PROCESS_TERMINATE
if( ::AddAccessAllowedAce( pACL, ACL_REVISION, SYNCHRONIZE | PROCESS_QUERY_INFORMATION | PROCESS_SET_INFORMATION | PROCESS_SET_QUOTA | PROCESS_TERMINATE, pUserInfo->User.Sid ) == FALSE )
goto Cleanup;
if( ::SetSecurityInfo( hProcess, SE_KERNEL_OBJECT, PROTECTED_DACL_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, 0, 0, pACL, 0 ) != ERROR_SUCCESS )
goto Cleanup;
bRet = TRUE;
Cleanup:
if ( hToken )
::CloseHandle( hToken );
if ( pSid )
::FreeSid( pSid );
return bRet;
}
我的代码看不到任何错误?
【问题讨论】:
-
是全局范围内的“调用”吗?你能创建一个Minimal, Complete, and Verifiable Example 给我们看吗?与您的问题无关,但在头文件中内联是一个非常庞大的功能。
-
除非将函数的返回值分配给全局变量,否则不能在全局空间中调用函数。
-
@Liveth 你的 C++ 代码看起来很像 C 代码。
-
是的,是 C,我的错。
-
哪里调用函数?它在函数内部吗?它在任何功能之外吗?请创建一个 MCVE 并向我们展示,否则我们只会猜测(我们不喜欢这样做,而是投票结束问题)。
标签: c dll code-injection inject