HOOK了ZwSetInformationFile保护c:\\wenbo.txt文件不被删除
HOOK了NtOpenProcess保护PID大于1000的进程不被结束

//头文件源代码  *.h

#pragma once  
#ifdef __cplusplus
extern "C"
{
#endif
#include <ntddk.h>
#ifdef __cplusplus
}
#endif

#define PageCode code_seg("PAGE")
#define InitCode code_seg("INIT")

typedef struct _SYSTEM_SERVICE_TABLE
{
  PVOID   ServiceTableBase;      // SSDT (System Service Dispatch Table)的基地址
  PULONG  ServiceCounterTableBase;  // 用于checked builds, 包含SSDT中每个服务被调用的次数
  ULONG   NumberOfService;      // 服务函数的个数, NumberOfService*4 就是整个地址表的大小
  ULONG   ParamTableBase;        // SSPT (System Service Parameter Table)的基地址
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE; 

typedef struct _SERVICE_DESCRIPTOR_TABLE
{
  SYSTEM_SERVICE_TABLE   ntoskrnl;  // ntoskrnl.exe的服务函数
  SYSTEM_SERVICE_TABLE   win32k;    // win32k.sys的服务函数,(gdi.dll/user.dll的内核支持)
  SYSTEM_SERVICE_TABLE   NotUsed1;
  SYSTEM_SERVICE_TABLE   NotUsed2;
} SYSTEM_DESCRIPTOR_TABLE, *PSYSTEM_DESCRIPTOR_TABLE;

extern "C" extern PSYSTEM_DESCRIPTOR_TABLE  KeServiceDescriptorTable;

// 根据 Zw_function 获取服务ID
#define SERVICE_ID(_function)    (*(PULONG)((PUCHAR)_function + 1))

// 根据 Zw_function 获取 Nt_function的地址
#define SERVICE_FUNCTION(_function) ((ULONG)KeServiceDescriptorTable->ntoskrnl.ServiceTableBase + 4*SERVICE_ID(_function))
/*
lkd> u ZwOpenProcess
nt!ZwOpenProcess:
80501694 b87a000000      mov     eax,7Ah  ---> ZwOpenProcess+1 = ID
*/
// ------------------------------------------------------
void InitServicesTable();
NTSTATUS HookService(ULONG OldService, ULONG NewService);
NTSTATUS UnHookService(ULONG OldService);
void UnLoad(PDRIVER_OBJECT pDriver);

// ------------------------------------------------------
ULONG OldServiceAddressTable[1024];

bool g_Init=false;

//ULONG NewServiceAddressTable[1024];      // 用户自定义的服务函数地址

//cpp源代码


#include "Rootkits.h"

#pragma PageCode
NTSTATUS CreateMyDriver(PDRIVER_OBJECT pDriver)
{
  UNICODE_STRING DriverName;
  PDEVICE_OBJECT pDev;
  NTSTATUS status;
  RtlInitUnicodeString(&DriverName,L"\\Device\\MyDriver");
  status=IoCreateDevice(pDriver,0,&DriverName,FILE_DEVICE_UNKNOWN,0,true,&pDev);
  if (!NT_SUCCESS(status))
  {
    DbgPrint("创建设备失败");
  }

  UNICODE_STRING SymBoliLinkName;
  RtlInitUnicodeString(&SymBoliLinkName,L"\\??\\SymBoliLinkDevice");
  status=IoCreateSymbolicLink(&SymBoliLinkName,&DriverName);
  if (!NT_SUCCESS(status))
  {
    IoDeleteDevice(pDriver->DeviceObject);
    DbgPrint("创建符号连接失败");
  }

  DbgPrint("创建驱动设备和符号连接成功");

  return STATUS_SUCCESS;
}



void InitServicesTable()
{
  g_Init=true;

  for (ULONG i=0;i<KeServiceDescriptorTable->ntoskrnl.NumberOfService;i++)
  {
    OldServiceAddressTable[i] = *(PULONG)((ULONG)KeServiceDescriptorTable->ntoskrnl.ServiceTableBase + 4*i);
    //  KdPrint(("0x%04X : %08X\n", i, OldServiceAddressTable[i]));
  }
}

VOID WPOFF()
{
  __asm
  {      
    cli
      push eax
      mov eax, cr0
      and eax, not 10000H
      mov cr0, eax
      pop eax

  }
}

// 恢复内存写保护
VOID WPON()
{
  __asm
  {

    push eax
      mov eax, cr0
      or  eax,10000H
      mov cr0,eax
      pop eax
      sti
  }
}



NTSTATUS HookService(ULONG OldService, ULONG NewService)
{
  if (!g_Init)
  {
    KdPrint(("ServiceTalbe Not Init.\n"));
  }


  WPOFF();

  KdPrint(("New Service Address: %08X\n", NewService));
  *(PULONG)SERVICE_FUNCTION(OldService)=NewService;

  WPON();

  return STATUS_SUCCESS;
}

NTSTATUS UnHookService(ULONG OldService)
{
  if (!g_Init)
  {
    return STATUS_UNSUCCESSFUL;
  }
  WPOFF();
  *(PULONG)SERVICE_FUNCTION(OldService)=OldServiceAddressTable[SERVICE_ID(OldService)];
  WPON();
  return STATUS_SUCCESS;
}


////////////////////////////////////////////////HOOK /////////////////////////////////////////////////////////////
extern "C" typedef NTSTATUS (__stdcall *ZWSETINFOMATIONFILE)(
  HANDLE  FileHandle,
  PIO_STATUS_BLOCK  IoStatusBlock,
  PVOID  FileInformation,
  ULONG  Length,
  FILE_INFORMATION_CLASS  FileInformationClass
  );

extern "C" typedef NTSTATUS (__stdcall *NTOPENPROCESS) (
  PHANDLE  ProcessHandle,
  ACCESS_MASK  DesiredAccess,
  POBJECT_ATTRIBUTES  ObjectAttributes,
  PCLIENT_ID  ClientId
  );

extern "C" NTSYSAPI NTSTATUS NTAPI ZwOpenProcess(OUT PHANDLE ProcessHandle,
        IN ACCESS_MASK AccessMask,                                           
        IN POBJECT_ATTRIBUTES ObjectAttributes,                                           
        IN PCLIENT_ID ClientId);

extern "C" NTSTATUS  MyZwSetInformationFile(HANDLE  FileHandle,PIO_STATUS_BLOCK  IoStatusBlock,PVOID  FileInformation,ULONG  Length,FILE_INFORMATION_CLASS  FileInformationClass)
{
  PFILE_OBJECT  pFileObject;

  ZWSETINFOMATIONFILE OldZwSetInfomationFile=(ZWSETINFOMATIONFILE)OldServiceAddressTable[SERVICE_ID(ZwSetInformationFile)];

  NTSTATUS ret=ObReferenceObjectByHandle(FileHandle,GENERIC_READ,*IoFileObjectType,KernelMode,(PVOID*)&pFileObject,0);

  if (NT_SUCCESS(ret))
  {
    UNICODE_STRING uDosName;
    ret=IoVolumeDeviceToDosName(pFileObject->DeviceObject,&uDosName);
    if (NT_SUCCESS(ret))
    {  

      if (wcsstr(pFileObject->FileName.Buffer,L"wenbo.txt") && wcsstr(uDosName.Buffer,L"C:"))
      {
        return STATUS_ACCESS_DENIED;
      }
    }

  }
  ObDereferenceObject(pFileObject);
  return OldZwSetInfomationFile(FileHandle,IoStatusBlock,FileInformation,Length,FileInformationClass);
}

extern "C" NTSTATUS MyNtOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
{
//  __asm int 3;
  ULONG PID;

  NTOPENPROCESS OldNtOpenProcess=(NTOPENPROCESS)OldServiceAddressTable[SERVICE_ID(ZwOpenProcess)];

//  DbgPrint("NtOpenProcess地址是%x",OldNtOpenProcess);

  if (ClientId!=NULL)
  {
    PID=(ULONG)(ClientId->UniqueProcess);
    if (PID>1000)
    {
      return STATUS_ACCESS_DENIED;
    }
  }

  return OldNtOpenProcess(ProcessHandle,DesiredAccess,ObjectAttributes,ClientId);
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////////

void UnLoad(PDRIVER_OBJECT pDriver)
{
  PDEVICE_OBJECT pDev;
  pDev=pDriver->DeviceObject;
  IoDeleteDevice(pDev);

  UNICODE_STRING SymBoliLinkName;
  RtlInitUnicodeString(&SymBoliLinkName,L"\\??\\SymBoliLinkDevice");
  IoDeleteSymbolicLink(&SymBoliLinkName);
  DbgPrint("删除设备和符号连接成功");

  UnHookService((ULONG)ZwSetInformationFile);

  UnHookService((ULONG)NtOpenProcess);
}

#pragma PageCode
#pragma InitCode
extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver,PUNICODE_STRING p)
{
  CreateMyDriver(pDriver);
  pDriver->DriverUnload=UnLoad;

  InitServicesTable();

  HookService((ULONG)ZwSetInformationFile,(ULONG)MyZwSetInformationFile);

  HookService((ULONG)ZwOpenProcess,(ULONG)MyNtOpenProcess);
  return STATUS_SUCCESS;
}


在VM XP虚拟机下测试成功.....