​

​

​

​

​

​

​

​这会禁用电源按钮中的所有电源选项，但不会在 Alt+ F4 中生效。

​

​

​

​

​

​这时候，你可以尝试按下 Ctrl + Alt + Esc ，这将阻止任务管理器的启动。但是这个方法在 Win 10/11 上行不通，挂起进程会导致一切“以管理员身份启动”操作都被阻滞。并且影响 Winlogon 的稳定性。

//...case WM_POWERBROADCAST:{if (wParam == PBT_APMSUSPEND)// 计算机正在挂起break;}case WM_QUERYENDSESSION:{if (lParam == 0)// 计算机正在关闭if ((lParam & ENDSESSION_LOGOFF) == ENDSESSION_LOGOFF)// 正在注销用户break;}
//...

case WM_QUERYENDSESSION:
{if (lParam == 0){ // 计算机正在关机ShutdownBlockReasonCreateW(hwnd, L"Please, don't kill me");}      break;
}

​如果我们不希望其他应用程序在我们的程序响应关机消息前被关闭，我们可以调用 SetProcessShutdownParameters 函数，并将 dwLevel 参数设置为 0x4FF，这对应于系统关机序列的最高优先级。在此函数中，特别注意参数 dwFlags。如果我们将其值更改为 SHUTDOWN_NORETRY，我们的 GUI 应用程序不会阻止关闭。

SetProcessShutdownParameters(0x4FF, 0);// 设置关机列表优先级

//{{NO_DEPENDENCIES}}
// Microsoft Visual C++ generated include file.
// Used by ShutdownBlocker.rc
//
#define IDD_MAINDIALOG                  101
#define IDC_BUTTON_BLOCK                1001
#define IDC_BUTTON_UNBLOCK              1002
#define IDC_STATIC_STATUS               1005// Next default values for new objects
// 
#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS
#define _APS_NEXT_RESOURCE_VALUE        102
#define _APS_NEXT_COMMAND_VALUE         40001
#define _APS_NEXT_CONTROL_VALUE         1006
#define _APS_NEXT_SYMED_VALUE           101
#endif
#endif

// Microsoft Visual C++ generated resource script.
//
#include "resource.h"#define APSTUDIO_READONLY_SYMBOLS
/
//
// Generated from the TEXTINCLUDE 2 resource.
//
#include "afxres.h"/
#undef APSTUDIO_READONLY_SYMBOLS/
// 中文(简体，中国) resources#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)
LANGUAGE LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED
#pragma code_page(936)#ifdef APSTUDIO_INVOKED
/
//
// TEXTINCLUDE
//1 TEXTINCLUDE 
BEGIN"resource.h\0"
END2 TEXTINCLUDE 
BEGIN"#include ""afxres.h""\r\n""\0"
END3 TEXTINCLUDE 
BEGIN"\r\n""\0"
END#endif    // APSTUDIO_INVOKED/
//
// Dialog
//IDD_MAINDIALOG DIALOGEX 0, 0, 344, 188
STYLE DS_SETFONT | DS_NOIDLEMSG | DS_SETFOREGROUND | DS_FIXEDSYS | DS_CENTER | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME
EXSTYLE WS_EX_APPWINDOW
CAPTION "ShutdownBlocker"
FONT 8, "MS Shell Dlg", 400, 0, 0x1
BEGINPUSHBUTTON      "阻止关机",IDC_BUTTON_BLOCK,71,129,93,29PUSHBUTTON      "解除阻止",IDC_BUTTON_UNBLOCK,180,129,93,29CTEXT           "静态",IDC_STATIC_STATUS,100,60,139,20,SS_PATHELLIPSIS | NOT WS_GROUPGROUPBOX        "当前状态",IDC_STATIC,82,48,168,40
END/
//
// DESIGNINFO
//#ifdef APSTUDIO_INVOKED
GUIDELINES DESIGNINFO
BEGINIDD_MAINDIALOG, DIALOGBEGINLEFTMARGIN, 7RIGHTMARGIN, 337TOPMARGIN, 5BOTTOMMARGIN, 181END
END
#endif    // APSTUDIO_INVOKED/
//
// AFX_DIALOG_LAYOUT
//IDD_MAINDIALOG AFX_DIALOG_LAYOUT
BEGIN0
END#endif    // 中文(简体，中国) resources
/#ifndef APSTUDIO_INVOKED
/
//
// Generated from the TEXTINCLUDE 3 resource.
///
#endif    // not APSTUDIO_INVOKED

#include <windows.h>
#include <tchar.h>
#include "resource.h"// 标记是否已经阻止关机，默认为未阻止
BOOL blockedFlag = FALSE;// 调用注册关机阻滞原因的接口
BOOL BlockShutdown(HWND hwnd)
{if (ShutdownBlockReasonCreate(hwnd, L"当前正在保存数据，请勿关机！")){return TRUE;}return FALSE;
}BOOL UnblockShutdown(HWND hwnd)
{if (ShutdownBlockReasonDestroy(hwnd)){return TRUE;}return FALSE;
}INT_PTR CALLBACK MainDialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
{HWND hcurwnd = NULL;switch(uMsg){case WM_INITDIALOG:SetDlgItemTextW(hwndDlg, IDC_STATIC_STATUS, L"未阻止关机");return TRUE;case WM_CLOSE:if (blockedFlag){if (IDYES == MessageBoxW(NULL,L"还未解除阻止，还要继续关闭程序么？",L"提示", MB_YESNO)){if (UnblockShutdown(hwndDlg)){EndDialog(hwndDlg, 0);break;}}else {return 0;}}EndDialog(hwndDlg, 0);break;case WM_QUERYENDSESSION:// 拦截 WM_QUERYENDSESSION 消息if (blockedFlag){return TRUE;}return FALSE;case WM_COMMAND:switch(LOWORD(wParam)){case IDC_BUTTON_BLOCK:if (!blockedFlag){if (BlockShutdown(hwndDlg)){SetDlgItemTextW(hwndDlg, IDC_STATIC_STATUS, L"已经阻止关机");blockedFlag = TRUE;}else{MessageBoxW(hwndDlg,L"阻止关机失败了……", L"提示", MB_OK);}}return TRUE;case IDC_BUTTON_UNBLOCK:if (blockedFlag){if (UnblockShutdown(hwndDlg)){SetDlgItemTextW(hwndDlg, IDC_STATIC_STATUS, L"未阻止关机");blockedFlag = FALSE;}else{MessageBoxW(hwndDlg, L"解除阻止失败了……", L"提示", MB_OK);}}return TRUE;default:return DefWindowProcW(hwndDlg, uMsg, wParam, lParam);}default:return 0;}}int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd
)
{// 设置进程关机优先级SetProcessShutdownParameters(0x4FF, 0);DialogBoxW(hInstance, MAKEINTRESOURCE(IDD_MAINDIALOG),NULL, MainDialogProc);return 0;
}

​这个实例是网络上转载较多的一个，由于来源已经不可考证，所以就暂且当作是开源的，我稍做了改动。

​随后我们通过在 IDA 反汇编，不难定位到如下函数处：

​可以明显地看出关机通过 ExitWindowsEx 实现，在 MSDN 上可以查找到关于这个函数的信息。

​

​（2） NtInitiatePowerAction【睡眠/休眠】

​（3）InitiateShutdownW【关机/重启的高级操作】

​ （4）InitiateSystemShutdownExW【InitiateShutdownW 的扩展】

​（5）此外还有 NtSetSystemPowerState 等强制关机函数：

BOOL SystemPowerdown(IN POWER_ACTION SystemAction, IN SYSTEM_POWER_STATE MinSystemState, IN ULONG dwFlags)
{if (!NtSetSystemPowerState)return FALSE;DWORD dwRet = NtSetSystemPowerState(SystemAction, MinSystemState, dwFlags);if (dwRet == 0)return TRUE;elsereturn FALSE;
}

​在进行内联挂钩的时候，要特别注意多核 CPU 在 Hook & Replace 过程中的影响，因为多个线程有可能"同时"调用同一个函数地址，为了解决这个问题，一个好的做法是在 Inline Hook 的过程中，把当前进程的所有线程都挂起。通过 CreateToolhelp32Snapshot 和 SuspendThread 的配合，在完成 Inline Hook 后再恢复线程。

/*__declspec(naked)*/ void MyExitWindowsEx(){__asm{call testMsgBox;jmp _ExitWindowsExAddTwoByte}
}// 适用于 Win7 上 User32.dll 的内联挂钩
void hook_ExitWindowsEx() {HMODULE hUser32 = GetModuleHandleW(L"user32.dll");char* pOldExitWindowsEx = reinterpret_cast<char*>(GetProcAddress(hUser32, "ExitWindowsEx"));// NOP 掉 5 字节const int iLengthCopy = 7;if (pOldExitWindowsEx != nullptr) {_copyNtShutdownSystem = VirtualAlloc(0, 1024, MEM_COMMIT, PAGE_EXECUTE_READWRITE);char* pNewAddr = reinterpret_cast<char*>(_copyNtShutdownSystem);char* pnop = pOldExitWindowsEx - 5;char aa = *pOldExitWindowsEx;char bb = *(pOldExitWindowsEx + 1);if (static_cast<char>(0x8b) == *pOldExitWindowsEx && static_cast<char>(0xff) == *(pOldExitWindowsEx + 1)) {DWORD oldshutdownProtect = 0;if (VirtualProtect(pOldExitWindowsEx - 5, iLengthCopy, PAGE_EXECUTE_READWRITE, &oldshutdownProtect)) {*pOldExitWindowsEx = static_cast<char>(0xeB); // jmp short*reinterpret_cast<USHORT*>(pOldExitWindowsEx + 1) = static_cast<USHORT>(-0x7); // addr*pnop = static_cast<char>(0xe9); // jmp*reinterpret_cast<int*>(pnop + 1) = reinterpret_cast<int>(MyExitWindowsEx) - reinterpret_cast<int>(pnop + 5); // addr_ExitWindowsExAddTwoByte = pOldExitWindowsEx + 2;VirtualProtect(pOldExitWindowsEx - 5, iLengthCopy, oldshutdownProtect, nullptr);}}}return;
}

#include "detours.h"
#pragma comment(lib, "detours.lib")

PVOID fpExitWindowsEx = NULL;

// 目标函数的定义
typedef BOOL (WINAPI* __funcExitWindowsEx)(_In_ UINT  uFlags,_In_ DWORD dwReason
);// 拦截注销/重启之类的钩子函数
BOOL WINAPI HookedExitWindowsEx(_In_ UINT  uFlags,_In_ DWORD dwReason
);

// 挂钩过程
void StartHookingFunction()
{// 开始事务DetourTransactionBegin();// 更新线程信息  DetourUpdateThread(GetCurrentThread());fpExitWindowsEx =DetourFindFunction("user32.dll","ExitWindowsEx");// 将拦截的函数附加到原函数的地址上,// 这里可以拦截多个函数。DetourAttach(&(PVOID&)fpExitWindowsEx,HookedExitWindowsEx);// 结束事务DetourTransactionCommit();
}

// 脱钩过程
void UnmappHookedFunction()
{//开始事务DetourTransactionBegin();//更新线程信息 DetourUpdateThread(GetCurrentThread());//将拦截的函数从原函数的地址上解除，这里可以解除多个函数。DetourDetach(&(PVOID&)fpExitWindowsEx,HookedExitWindowsEx);//结束事务DetourTransactionCommit();
}

BOOL WINAPI HookedExitWindowsEx(_In_ UINT  uFlags,_In_ DWORD dwReason
)
{WCHAR lpMsg[64]{};WCHAR lpCap[] = L"Windows LogonManager";DWORD Result = 0;/* uFlags == 65536(win8注销)，什么鬼？win 8.1 关机 4268041, 重启 73731, 注销 65536win 7 关机 65545, 重启65539, 注销 65536Vista 开始菜单关机 65545, 注销 65536, 重启 65539（^ 同 Win7）*/switch(uFlags){case 65536:wsprintf(lpMsg, L"正在取消注销计算机的任务计划，请稍后......\n", uFlags);break;case 4268041: case 65545:wsprintf(lpMsg, L"正在取消关闭计算机的任务计划，请稍后......\n", uFlags);break;case 73731: case 65539:wsprintf(lpMsg, L"正在取消重启计算机的任务计划，请稍后......\n", uFlags);break;default:wsprintf(lpMsg, L"正在取消用户发起的电源操作，请稍后......\n未知参数 uFlags [%d]\n", uFlags);break;}// 发出阻滞对话框SvcMessageBox(lpCap, lpMsg, MB_OK | MB_APPLMODAL | MB_ICONINFORMATION, TRUE, Result);SetLastError(995);//995 = 由于线程退出或应用程序请求，I/O 操作已中止。return FALSE;
}

#include <WtsApi32.h>
#pragma comment(lib, "WtsApi32.lib")BOOL SvcMessageBox(LPWSTR lpCap, LPWSTR lpMsg, DWORD style, BOOL bWait, DWORD& result)
{if (NULL == lpMsg || NULL == lpCap)return FALSE;result = 0;DWORD sessionXId = WTSGetActiveConsoleSessionId();return WTSSendMessageW(WTS_CURRENT_SERVER_HANDLE, sessionXId,lpCap, (DWORD)wcslen(lpCap) * sizeof(DWORD),lpMsg, (DWORD)wcslen(lpMsg) * sizeof(DWORD),style, 0, &result, bWait);
}

BOOL APIENTRY DllMain(HMODULE hModule,DWORD  ul_reason_for_call,LPVOID lpReserved
)
{DisableThreadLibraryCalls(hModule);switch (ul_reason_for_call){case DLL_PROCESS_ATTACH:StartHookingFunction();break;case DLL_THREAD_ATTACH:break;case DLL_THREAD_DETACH:break;case DLL_PROCESS_DETACH:UnmappHookedFunction();break;}return TRUE;
}

​这是在 Win 8 的效果：

​使用内联挂钩修改这个函数，在 Win 8 之前的操作系统上普遍适用，但是在 Win 10 / 11 上则起不到作用。起初，我以为是不再使用该函数了，随后，在反汇编中依然可以看到该函数，只不过变成了延迟加载的函数( __imp_ DelayLoadFunction )。延迟调用就是在程序启动时不自动加载函数所在的链接库，而是等到需要使用的时候再加载，也就是说在调用前，程序是没有这个函数的，所以 Detours 挂钩会失效，这时候我们考虑到使用 IAT HOOK 和 Delay IAT Hook 挂钩模块导入表和延迟加载导入表。

#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers
// Windows Header Files#include <Windows.h>
#include <Psapi.h>
#include <Tlhelp32.h>#include <Shlwapi.h>
#include <stdlib.h>
#include <tchar.h>
#include <sddl.h>#pragma comment(lib, "Advapi32.lib")
#pragma comment(lib, "Shlwapi.lib")
#pragma warning(disable:4996)LPVOID _copyNtShutdownSystem = NULL;
LPVOID _ExitWindowsExAddTwoByte = NULL;typedef BOOL(WINAPI* FuncExitWindowsEx)(_In_ UINT uFlags, _In_ DWORD dwReason);
FuncExitWindowsEx _OldExitWindowsEx = NULL;BOOL WINAPI IATHookedFun(_In_ UINT uFlags, _In_ DWORD dwReason) {BOOL bRet = FALSE;static BOOL bNeedWarning = FALSE;if (bNeedWarning) {MessageBoxW(NULL, _TEXT("弹框提示"), _TEXT("提示"), MB_ICONINFORMATION | MB_OK);}// 调用原函数bRet = _OldExitWindowsEx(uFlags, dwReason);if (bRet) {bNeedWarning = TRUE;}return bRet;//return FALSE;
}BYTE* getNtHdrs(BYTE* pe_buffer) {if (pe_buffer == NULL) return NULL;// 将 PE 缓冲区转换为 DOS 头结构IMAGE_DOS_HEADER* idh = (IMAGE_DOS_HEADER*)pe_buffer;// 验证 DOS 头的签名，以确保它是有效的 PE 文件if (idh->e_magic != IMAGE_DOS_SIGNATURE) {return NULL;}// 定义 PE 头允许的最大偏移量const LONG kMaxOffset = 1024;// 获取从 DOS 标头到 PE 标头的偏移量LONG pe_offset = idh->e_lfanew;// 验证到PE头的偏移量是否在允许的范围内if (pe_offset > kMaxOffset) return NULL;// 将偏移后的缓冲区地址转换为指向 PE 头结构体的指针IMAGE_NT_HEADERS32* inh = (IMAGE_NT_HEADERS32*)((BYTE*)pe_buffer + pe_offset);if (inh->Signature != IMAGE_NT_SIGNATURE) return NULL;return (BYTE*)inh;
}IMAGE_DATA_DIRECTORY* getPeDir(PVOID pe_buffer, size_t dir_id) {if (dir_id >= IMAGE_NUMBEROF_DIRECTORY_ENTRIES) return NULL;// 从 PE 缓冲区获取 NT 头结构体的指针BYTE* nt_headers = getNtHdrs((BYTE*)pe_buffer);// 验证是否可以获得 NT 头if (nt_headers == NULL) return NULL;// 指向 PE 文件数据目录的指针IMAGE_DATA_DIRECTORY* peDir = NULL;// 将 NT 头转换为适当的结构体指针IMAGE_NT_HEADERS* nt_header = (IMAGE_NT_HEADERS*)nt_headers;// 获取具有指定 ID 的数据表地址peDir = &(nt_header->OptionalHeader.DataDirectory[dir_id]);if (peDir->VirtualAddress == NULL) {return NULL;}return peDir;
}bool FixDelayIATHook(PVOID modulePtr) {// 获取模块导入表的地址IMAGE_DATA_DIRECTORY* importsDir = getPeDir(modulePtr, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT);if (importsDir == nullptr)return false;size_t maxSize = importsDir->Size;            // 导入表大小size_t impAddr = importsDir->VirtualAddress;  // 导入表首地址// 从 User32.dll 库获取 ExitWindowSex 函数的地址size_t addrExitWindowsEx = reinterpret_cast<size_t>(GetProcAddress(GetModuleHandleW(L"User32"), "ExitWindowsEx"));// 迭代延迟导入描述符for (size_t parsedSize = 0; parsedSize < maxSize; parsedSize += sizeof(IMAGE_DELAYLOAD_DESCRIPTOR)) {IMAGE_DELAYLOAD_DESCRIPTOR* lib_desc = reinterpret_cast<IMAGE_DELAYLOAD_DESCRIPTOR*>(impAddr + parsedSize + reinterpret_cast<ULONG_PTR>(modulePtr));// 检查延迟导入描述符是否为空if (lib_desc->ImportAddressTableRVA == 0 && lib_desc->ImportNameTableRVA == 0)break;// 获取链接库名称LPSTR lib_name = reinterpret_cast<LPSTR>(reinterpret_cast<ULONGLONG>(modulePtr) + lib_desc->DllNameRVA);size_t call_via = lib_desc->ImportAddressTableRVA;size_t thunk_addr = lib_desc->ImportNameTableRVA;// 如果名称表的偏移量为0，使用地址表if (thunk_addr == 0)thunk_addr = lib_desc->ImportAddressTableRVA;// 迭代导入表中的字段for (size_t offsetField = 0, offsetThunk = 0;; offsetField += sizeof(IMAGE_THUNK_DATA), offsetThunk += sizeof(IMAGE_THUNK_DATA)) {IMAGE_THUNK_DATA* fieldThunk = reinterpret_cast<IMAGE_THUNK_DATA*>(reinterpret_cast<size_t>(modulePtr) + offsetField + call_via);IMAGE_THUNK_DATA* orginThunk = reinterpret_cast<IMAGE_THUNK_DATA*>(reinterpret_cast<size_t>(modulePtr) + offsetThunk + thunk_addr);// 检查两个字段是否都为空以退出循环if (fieldThunk->u1.Function == 0 && orginThunk->u1.Function == 0)break;// 检查是否使用序号来获取函数的地址if (orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32 || orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG64) {// 函数的地址也可以通过获取序号的后两个字节来获得size_t addrOld = reinterpret_cast<size_t>(GetProcAddress(LoadLibraryA(lib_name),reinterpret_cast<char*>(orginThunk->u1.Ordinal & 0xFFFF)));continue;}else { // 使用函数名获取函数地址PIMAGE_IMPORT_BY_NAME by_name = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(reinterpret_cast<size_t>(modulePtr) + orginThunk->u1.AddressOfData);LPSTR func_name = reinterpret_cast<LPSTR>(by_name->Name);size_t addrOld = reinterpret_cast<size_t>(GetProcAddress(LoadLibraryA(lib_name), func_name));// 如果函数是“ExitWindowSex”，则执行钩子并解除内存保护if (_stricmp(func_name, "ExitWindowsEx") == 0) {DWORD dOldProtect = 0;size_t* pFuncAddr = reinterpret_cast<size_t*>(&fieldThunk->u1.Function);if (VirtualProtect(pFuncAddr, sizeof(size_t), PAGE_EXECUTE_READWRITE, &dOldProtect)) {fieldThunk->u1.Function = reinterpret_cast<size_t>(IATHookedFun);            // 钩子函数VirtualProtect(pFuncAddr, sizeof(size_t), dOldProtect, &dOldProtect);_OldExitWindowsEx = reinterpret_cast<FuncExitWindowsEx>(addrExitWindowsEx);  // 存储原始函数地址return true;}break;}}}}return true;
}bool FixIATHook(PVOID modulePtr) {// 获取模块导入表的地址IMAGE_DATA_DIRECTORY* importsDir = getPeDir(modulePtr, IMAGE_DIRECTORY_ENTRY_IMPORT);if (importsDir == NULL)return false;// 获取导入表的大小和虚拟地址size_t maxSize = importsDir->Size;size_t impAddr = importsDir->VirtualAddress;// 从 User32 库获取“ExitWindowSex”函数的地址size_t addrExitWindowsEx = (size_t)GetProcAddress(GetModuleHandleW(L"User32.dll"), "ExitWindowsEx");// 迭代导入表中的导入库的描述符for (size_t parsedSize = 0; parsedSize < maxSize; parsedSize += sizeof(IMAGE_IMPORT_DESCRIPTOR)) {// 获取当前导入库的描述符IMAGE_IMPORT_DESCRIPTOR* lib_desc = (IMAGE_IMPORT_DESCRIPTOR*)(impAddr + parsedSize + (ULONG_PTR)modulePtr);if (lib_desc->OriginalFirstThunk == NULL && lib_desc->FirstThunk == NULL)break;// 获取导入库的名称LPSTR lib_name = (LPSTR)((size_t)modulePtr + lib_desc->Name);// 获取 thunks 的调用地址和函数指针size_t call_via = lib_desc->FirstThunk;size_t thunk_addr = lib_desc->OriginalFirstThunk;if (thunk_addr == NULL)thunk_addr = lib_desc->FirstThunk;// 迭代原始 thunk 和 thunk 字段for (size_t offsetField = 0, offsetThunk = 0;; offsetField += sizeof(IMAGE_THUNK_DATA), offsetThunk += sizeof(IMAGE_THUNK_DATA)) {// 获得当前 thunksIMAGE_THUNK_DATA* fieldThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetField + call_via);IMAGE_THUNK_DATA* orginThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetThunk + thunk_addr);// 验证是否已到达 thunks 的结尾if (fieldThunk->u1.Function == 0 && orginThunk->u1.Function == 0)break;PIMAGE_IMPORT_BY_NAME by_name = nullptr;LPSTR func_name = nullptr;size_t addrOld = NULL;// 验证是否按顺序或名称导入函数if (orginThunk->u1.Ordinal & (IMAGE_ORDINAL_FLAG32 | IMAGE_ORDINAL_FLAG64)) {// 按序号导入addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), (char*)(orginThunk->u1.Ordinal & 0xFFFF));continue;}else {// 按名称导入by_name = (PIMAGE_IMPORT_BY_NAME)(size_t(modulePtr) + orginThunk->u1.AddressOfData);func_name = (LPSTR)by_name->Name;addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), func_name);}// HOOKif (strcmpi(func_name, "ExitWindowsEx") == 0) {// 更改为指向钩子函数的地址DWORD dOldProtect = 0;size_t* pFuncAddr = (size_t*)&fieldThunk->u1.Function;if (VirtualProtect(pFuncAddr, sizeof(size_t), PAGE_EXECUTE_READWRITE, &dOldProtect)) {fieldThunk->u1.Function = (size_t)IATHookedFun;  // 钩子函数VirtualProtect(pFuncAddr, sizeof(size_t), dOldProtect, &dOldProtect);_OldExitWindowsEx = (FuncExitWindowsEx)addrExitWindowsEx;  // 存储原始函数地址return true;}}}}return true;
}BOOL APIENTRY DllMain( HMODULE hModule,DWORD  ul_reason_for_call,LPVOID lpReserved) {switch (ul_reason_for_call) {case DLL_PROCESS_ATTACH: {HMODULE exeModule = GetModuleHandleW(NULL);// 调用挂钩过程FixIATHook(exeModule);FixDelayIATHook(exeModule);break;}case DLL_THREAD_ATTACH:break;case DLL_THREAD_DETACH:break;case DLL_PROCESS_DETACH:break;}return TRUE;
}

​5.3 挂钩 InitiateShutdownW 函数(Win 8/8.1)

// 通过调用外部程序实现终止进程，比如taskkill.exe
inline void KillLogonUIProcess()
{WCHAR lpExePath[] = L"cmd.exe /c taskkill /F /IM LogonUI.exe";/* 根据进程名获取任意进程Id */DWORD  pid = 512;HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);/* 创建启动信息结构体 */STARTUPINFOEXW si;/* 初始化结构体 */ZeroMemory(&si, sizeof(si));/* 设置结构体成员 */si.StartupInfo.cb = sizeof(si);SIZE_T lpsize = 0;/* 用微软规定的特定的函数初始化结构体 */InitializeProcThreadAttributeList(NULL, 1, 0, &lpsize);/* 转换指针到正确类型 */char* temp = new char[lpsize];LPPROC_THREAD_ATTRIBUTE_LIST AttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)temp;/* 真正为结构体初始化属性参数 */InitializeProcThreadAttributeList(AttributeList, 1, 0, &lpsize);/* 用已构造的属性结构体更新属性表 */if (!UpdateProcThreadAttribute(AttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &handle, sizeof(HANDLE), NULL, NULL)) {return;}si.lpAttributeList = AttributeList;PROCESS_INFORMATION pi;ZeroMemory(&pi, sizeof(pi));((__CreateProcessAsUserW)fpCreateProcessAsUserW)(NULL, 0, lpExePath, 0, 0, 0, EXTENDED_STARTUPINFO_PRESENT, 0, 0, (LPSTARTUPINFOW)&si, &pi);DeleteProcThreadAttributeList(AttributeList);CloseHandle(pi.hThread);CloseHandle(pi.hProcess);delete[] temp;
}

// 全局变量用于保存进程句柄
HANDLE lpProcessHandle = NULL;// 挂钩 CreateProcessAsUserW 监控进程创建
BOOL WINAPI HookedCreateProcessAsUserW(_In_opt_ HANDLE hToken,_In_opt_ LPCWSTR lpApplicationName,_Inout_opt_ LPWSTR lpCommandLine,_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,_In_ BOOL bInheritHandles,_In_ DWORD dwCreationFlags,_In_opt_ LPVOID lpEnvironment,_In_opt_ LPCWSTR lpCurrentDirectory,_In_ LPSTARTUPINFOW lpStartupInfo,_Out_ LPPROCESS_INFORMATION lpProcessInformation
)
{BOOL ret = FALSE;// 先调用原函数ret = ((__CreateProcessAsUserW)fpCreateProcessAsUserW)(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes,lpThreadAttributes, bInheritHandles, dwCreationFlags,lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);if(lpCommandLine != nullptr)if (wcsstr(lpCommandLine, L"LogonUI.exe"))lpProcessHandle = lpProcessInformation->hProcess;// 保存进程句柄return ret;// 返回函数
}

DWORD WINAPI HookedInitiateShutdownW(_In_opt_   LPWSTR lpMachineName,_In_opt_   LPWSTR lpMessage,_In_       DWORD  dwGracePeriod,_In_       DWORD  dwShutdownFlags,_In_       DWORD  dwReason
)
{WCHAR lpMsg[] = L"正在取消关闭/注销/重启计算机的任务计划，请稍后......";WCHAR lpCap[] = L"Windows LogonManager";DWORD Result = 0;BOOL IsKilled = FALSE;// 发出阻滞对话框SvcMessageBox(lpCap, lpMsg, MB_OK | MB_APPLMODAL | MB_ICONINFORMATION, TRUE, Result);// 尝试结束进程if(lpProcessHandle != INVALID_HANDLE_VALUE)IsKilled = TerminateProcess(lpProcessHandle, 0);if(!IsKilled){KillLogonUIProcess();// 后手，如果前面失败就这个}return ERROR_INVALID_PARAMETER;
}

typedef enum _SHUTDOWN_ACTION
{ShutdownNoReboot,ShutdownReboot,ShutdownPowerOff
} SHUTDOWN_ACTION, * PSHUTDOWN_ACTION;typedef NTSTATUS (NTAPI* __NtShutdownSystem)(SHUTDOWN_ACTION dwAction
);

NTSTATUS NTAPI HookedNtShutdownSystem(SHUTDOWN_ACTION dwAction
)
{return STATUS_INVALID_PARAMETER;
}

C:\Temp>PPLcontrol.exe listPID | Level   | Signer-------+---------+----------------4 | PP  (2) | WinSystem (7)108 | PP  (2) | WinSystem (7)392 | PPL (1) | WinTcb (6)520 | PPL (1) | WinTcb (6)600 | PPL (1) | WinTcb (6)608 | PPL (1) | WinTcb (6)756 | PPL (1) | WinTcb (6)2092 | PP  (2) | WinSystem (7)3680 | PPL (1) | Antimalware (3)5840 | PPL (1) | Antimalware (3)7264 | PPL (1) | Windows (5)9508 | PP  (2) | WinTcb (6)1744 | PPL (1) | Windows (5)[+] Enumerated 13 protected processes.