Win2000/XP下屏蔽CTRL+ALT+DEL的一种方法

思路：修改Winlogon进程中Msgina.dll导出的WlxLoggedOnSAS函数里的一个跳转指令。  
              跳转指令的偏移可以反汇编Msgina.dll的WlxLoggedOnSAS或用SoftIce跟踪出来。  
   
  以下源码在WinXP   Professional   SP1,   Win2000   Professional   SP3,SP4   运行通过：  
   
  Option   Explicit  
  Private   Const   PROCESS_ALL_ACCESS   =   &H1F0FFF  
  Private   Const   SE_DEBUG_NAME   =   "SeDebugPrivilege"  
   
  Private   Type   LUID  
        UsedPart   As   Long  
        IgnoredForNowHigh32BitPart   As   Long  
  End   Type  
   
  Private   Type   LUID_AND_ATTRIBUTES  
        TheLuid   As   LUID  
        Attributes   As   Long  
  End   Type  
   
  Private   Type   TOKEN_PRIVILEGES  
        PrivilegeCount   As   Long  
        TheLuid   As   LUID  
        Attributes   As   Long  
  End   Type  
   
  Private   Declare   Function   GetLastError   Lib   "kernel32"   ()   As   Long  
  Private   Declare   Function   GetCurrentProcess   Lib   "kernel32"   ()   As   Long  
  Private   Declare   Function   OpenProcessToken   Lib   "advapi32"   (ByVal   ProcessHandle   As   Long,   ByVal   DesiredAccess   As   Long,   TokenHandle   As   Long)   As   Long  
  Private   Declare   Function   LookupPrivilegeValue   Lib   "advapi32"   Alias   "LookupPrivilegeValueA"   (ByVal   lpSystemName   As   String,   ByVal   lpName   As   String,   lpLuid   As   LUID)   As   Long  
  Private   Declare   Function   AdjustTokenPrivileges   Lib   "advapi32"   (ByVal   TokenHandle   As   Long,   ByVal   DisableAllPrivileges   As   Long,   NewState   As   TOKEN_PRIVILEGES,   ByVal   BufferLength   As   Long,   PreviousState   As   TOKEN_PRIVILEGES,   ReturnLength   As   Long)   As   Long  
  Private   Declare   Sub   SetLastError   Lib   "kernel32"   (ByVal   dwErrCode   As   Long)  
  Private   Declare   Function   OpenProcess   Lib   "kernel32"   (ByVal   dwDesiredAccess   As   Long,   ByVal   bInheritHandle   As   Long,   ByVal   dwProcessId   As   Long)   As   Long  
  Private   Declare   Function   ReadProcessMemory   Lib   "kernel32"   (ByVal   hProcess   As   Long,   lpBaseAddress   As   Any,   lpBuffer   As   Any,   ByVal   nSize   As   Long,   lpNumberOfBytesWritten   As   Long)   As   Long  
  Private   Declare   Function   WriteProcessMemory   Lib   "kernel32"   (ByVal   hProcess   As   Long,   lpBaseAddress   As   Any,   lpBuffer   As   Any,   ByVal   nSize   As   Long,   lpNumberOfBytesWritten   As   Long)   As   Long  
  Private   Declare   Function   CloseHandle   Lib   "kernel32"   (ByVal   hObject   As   Long)   As   Long  
  Private   Declare   Function   LoadLibrary   Lib   "kernel32"   Alias   "LoadLibraryA"   (ByVal   lpLibFileName   As   String)   As   Long  
  Private   Declare   Function   GetProcAddress   Lib   "kernel32"   (ByVal   hModule   As   Long,   ByVal   lpProcName   As   String)   As   Long  
  Private   Declare   Function   FreeLibrary   Lib   "kernel32"   (ByVal   hLibModule   As   Long)   As   Long  
  Private   Declare   Function   GetModuleHandle   Lib   "kernel32"   Alias   "GetModuleHandleA"   (ByVal   lpModuleName   As   String)   As   Long  
   
  Private   Type   OSVERSIONINFO  
          dwOSVersionInfoSize   As   Long  
          dwMajorVersion   As   Long  
          dwMinorVersion   As   Long  
          dwBuildNumber   As   Long  
          dwPlatformId   As   Long  
          szCSDVersion   As   String   *   128  
  End   Type  
  Private   Declare   Function   GetVersionEx   Lib   "kernel32"   Alias   "GetVersionExA"   (lpVersionInformation   As   OSVERSIONINFO)   As   Long  
   
  Private   m_BuildNumber   As   Long  
   
           
              Private   Sub   AdjustToken()  
   
              ‘********************************************************************  
              ‘*   This   procedure   sets   the   proper   privileges   to   allow   a   log   off   or   a  
              ‘*   shut   down   to   occur   under   Windows   NT.  
              ‘********************************************************************  
   
                    Const   TOKEN_ADJUST_PRIVILEGES   =   &H20  
                    Const   TOKEN_QUERY   =   &H8  
                    Const   SE_PRIVILEGE_ENABLED   =   &H2  
   
                    Dim   hdlProcessHandle   As   Long  
                    Dim   hdlTokenHandle   As   Long  
                    Dim   tmpLuid   As   LUID  
                    Dim   tkp   As   TOKEN_PRIVILEGES  
                    Dim   tkpNewButIgnored   As   TOKEN_PRIVILEGES  
                    Dim   lBufferNeeded   As   Long  
   
                    ‘Set   the   error   code   of   the   last   thread   to   zero   using   the  
                    ‘SetLast   Error   function.   Do   this   so   that   the   GetLastError  
                    ‘function   does   not   return   a   value   other   than   zero   for   no  
                    ‘apparent   reason.  
                    SetLastError   0  
   
                    ‘Use   the   GetCurrentProcess   function   to   set   the   hdlProcessHandle  
                    ‘variable.  
                    hdlProcessHandle   =   GetCurrentProcess()  
   
                    If   GetLastError   <>   0   Then  
                          MsgBox   "GetCurrentProcess   error=="   &   GetLastError  
                    End   If  
   
                    OpenProcessToken   hdlProcessHandle,   _  
                          (TOKEN_ADJUST_PRIVILEGES   Or   TOKEN_QUERY),   hdlTokenHandle  
   
                    If   GetLastError   <>   0   Then  
                          MsgBox   "OpenProcessToken   error=="   &   GetLastError  
                    End   If  
   
                    ‘Get   the   LUID   for   shutdown   privilege  
                    LookupPrivilegeValue   "",   SE_DEBUG_NAME,   tmpLuid  
   
                    If   GetLastError   <>   0   Then  
                          MsgBox   "LookupPrivilegeValue   error=="   &   GetLastError  
                    End   If  
   
                    tkp.PrivilegeCount   =   1         ‘   One   privilege   to   set  
                    tkp.TheLuid   =   tmpLuid  
                    tkp.Attributes   =   SE_PRIVILEGE_ENABLED  
   
                    ‘Enable   the   shutdown   privilege   in   the   access   token   of   this   process  
                    AdjustTokenPrivileges   hdlTokenHandle,   _  
                                                                False,   _  
                                                                tkp,   _  
                                                                Len(tkpNewButIgnored),   _  
                                                                tkpNewButIgnored,   _  
                                                                lBufferNeeded  
   
                    If   GetLastError   <>   0   Then  
                          MsgBox   "AdjustTokenPrivileges   error=="   &   GetLastError  
                    End   If  
   
              End   Sub  
   
  Private   Sub   DisableHotKey(PId   As   Long,   Optional   bDisabled   As   Boolean   =   True)  
          Dim   hHandle   As   Long,   hFunAddr   As   Long  
          Dim   hTagAddr   As   Long  
          Dim   lpBuffer(1)   As   Byte  
          Dim   hProcess   As   Long  
           
  On   Error   GoTo   errhandle  
   
          hHandle   =   GetModuleHandle("msgina.dll")  
          If   hHandle   =   0   Then  
                  hHandle   =   LoadLibrary("msgina.dll")  
                  If   hHandle   =   0   Then   Exit   Sub  
          End   If  
           
          hFunAddr   =   GetProcAddress(hHandle,   "WlxLoggedOnSAS")  
          If   hFunAddr   =   0   Then  
                  FreeLibrary   hHandle  
                  Exit   Sub  
          End   If  
           
           
          If   m_BuildNumber   =   2195   Then  
                  hTagAddr   =   hFunAddr   +   &HDE&  
          ElseIf   m_BuildNumber   =   2600   Then  
                  hTagAddr   =   hFunAddr   +   &HE6&  
          End   If  
           
          Debug.Print   Hex(hHandle),   Hex(hFunAddr),   Hex(hTagAddr)  
           
          hProcess   =   OpenProcess(PROCESS_ALL_ACCESS,   0,   PId)  
          If   hProcess   =   0   Then  
                  Call   AdjustToken  
                  hProcess   =   OpenProcess(PROCESS_ALL_ACCESS,   0,   PId)  
                   
          End   If  
          ReadProcessMemory   hProcess,   ByVal   hTagAddr,   lpBuffer(0),   2,   0  
           
          If   bDisabled   Then  
                  lpBuffer(0)   =   &H74   ‘JE  
          Else  
                  lpBuffer(0)   =   &H75   ‘JNE  
          End   If  
          WriteProcessMemory   hProcess,   ByVal   hTagAddr,   lpBuffer(0),   2,   0  
           
          CloseHandle   hProcess  
           
          Exit   Sub  
  errhandle:  
   
          MsgBox   Err.Description  
  End   Sub  
   
   
  Private   Sub   Command1_Click()  
  On   Error   GoTo   errhandle  
   
          If   m_BuildNumber   <>   0   Then  
                  DisableHotKey   CLng(Text1.Text),   CBool(Check1.Value)  
          End   If  
           
          Exit   Sub  
           
  errhandle:  
          MsgBox   Err.Description  
  End   Sub  
   
  Private   Sub   GetWinVersion()  
          Dim   OSInfo   As   OSVERSIONINFO,   PId   As   String  
          Dim   Ret   As   Long,   strRet   As   String  
       
          OSInfo.dwOSVersionInfoSize   =   Len(OSInfo)  
          Ret   =   GetVersionEx(OSInfo)  
          If   Ret   =   0   Then   MsgBox   "Error   Getting   Version   Information":   Exit   Sub  
          If   OSInfo.dwPlatformId   =   2   Then  
                  m_BuildNumber   =   OSInfo.dwBuildNumber  
          End   If  
  End   Sub  
   
  Private   Sub   Form_Load()  
          GetWinVersion  
  End   Sub