数学建模社区-数学中国
标题:
获得进程的EPROCESS
[打印本页]
作者:
韩冰
时间:
2004-10-9 14:22
标题:
获得进程的EPROCESS
文摘内容:
$ @; @2 t" P# f' N i
--------------------------------------------------------------------------------
/ @0 r* r+ z& I. c/ T+ o8 V0 R9 C% B7 n
文摘出处:http://www.xfocus.net/articles/200406/706.html
7 I$ B3 r$ ~+ i' J7 ^' b0 L
$ K) L8 ^% d) X, u
创建时间:2004-06-01
5 Y6 h. `. _, N6 R' v- x
文章属性:原创
0 P4 Z3 z1 X x) C+ y4 X
文章提交:MustBE (zf35_at_citiz.net)
8 \+ {" c Y$ J) _; j, z6 B
4 |8 Y& g, L7 d' k- D; e+ ?
By [I.T.S]SystEm32
% \+ A: L l5 Y* ~
# L7 p" D5 I+ `9 D/ c* k. i d+ h* }' k
Welcome to our web site http://itaq.ynpc.com/itsbbs/
% l& H* @& w1 L2 {& j( u
4 A; Z9 M/ B8 v1 V% q1 j0 {4 ]
thanks to SobeIt : P
: c) X2 ]4 C5 C
---------------------------------------------------------------------------------------------
; ~( e' Y/ M+ I: v! K: ?6 q3 z
q2 K6 d, c$ c5 |. }! f* t, T; D3 g2 z
每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内.
; {7 x$ t% W4 ~7 D% l- Z- \
. S ^/ x% l9 C5 H
绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表,线性搜索到进程句柄,其指向的内核对象就是EPROCESS。
, S. R# B+ f, Q
9 \0 ~$ J5 o+ ^. ]
ZwQuerySystemInformation函数原形如下
: t; o' h1 }9 w2 ?
/ _- e, p8 n' `' H8 t
NTSYSAPI
7 W# n* c$ {! Z. t* D
NTSTATUS
! ^( W. _2 ~% a7 y: X
NTAPI
+ O: v6 H" y6 W2 v" I
ZwQuerySystemInformation
* w( k# v( C+ `2 O5 J: v* L
(
& G" R! z: d) k4 Q" x
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
" `1 `% n& x4 ^3 h! s$ W
IN OUT PVOID SystemInformation,
9 [1 U7 e: D0 _& x' Y7 Z
IN ULONG SystemInformationLength,
0 u$ t! ?' w& S/ \
OUT PULONG ReturnLength OPTIONAL
* M/ J# X+ @: J9 V7 D- W
);
1 z7 x% m8 V$ I1 U# v: E! K; O
+ f: L/ F) N4 D- T" f
参数意义如下
8 {7 v. l/ d! V+ F, T" ?
" O6 _5 {7 b) a1 } d; ^6 |/ }/ S
SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一
7 O7 m9 t! O4 m
2 [: T5 U9 n2 M+ u. q+ n1 {
SystemInformation:指向一个接受系统信息的缓冲区的指针
* d: {5 t2 G! U' t- V2 _( A4 n
( \. Q5 N# K7 T, g" L0 E
SystemInformationLength:缓冲区长度
$ y( @2 }7 }1 E \
5 c1 `; ?) {( |1 y/ t) a, u
ReturnLength:指向一个接受实际返回字节数的变量,可以为0
4 x0 S5 k. Y3 b& W3 y
% D# x5 o) ~6 a
% t& R* {( v9 h3 E$ N0 {0 f$ }
为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation
* g+ W/ E$ v A& U( `% e5 ~
, k/ ^: W4 F% a- `" Y9 v9 y; j |
SYSTEM_INFORMATION_CLASS的结构如下
; i' n9 ?8 [4 i8 r( X3 A- S- D
+ S0 y8 W* B5 K( l1 {4 x
typedef struct _SYSTEM_HANDLE_INFORMATION
4 z% X6 [3 M9 {! G: u0 q
{
- M* W* d( i6 _0 y
ULONG ProcessId;
- l. i* K6 q+ ~
UCHAR ObjectTypeNumber;
3 {: ^; c1 p& v n
UCHAR Flags;
* C6 F/ m# l. }2 `7 ?) J/ X" A
USHORT Handle;
( [( W! R5 h1 {1 K5 p
PVOID Object;
5 Q( e. k0 w. H% C) Q* C8 X4 K
ACCESS_MASK GrantedAccess;
* a" f% V0 r3 Q& O! R2 e1 }9 o
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
3 V: R7 {5 {2 P0 a. H2 D
, W2 W4 d+ a3 K. k
ProcessId:进程标识符
0 z' g% a+ G! Z; I% Z
6 c+ N4 U! u" }
ObjectTypeNumber;打开的对象的类型
# ^2 ~) o9 a5 [* }) I4 k2 R+ T6 ]
1 W9 ~+ g* `" w# M% Q G) [
Flags:句柄属性标志
+ I* e& l h1 |* I ~. C+ L3 U
, t7 ~1 m' ]0 a* h& {& G) v
Handle:句柄数值,在进程打开的句柄中唯一标识某个句柄
( k% k! i0 |4 }* K9 C
/ N1 p& ^+ d9 P' t$ ^
Object:这个就是句柄对应的EPROCESS的地址
. A8 M3 w! P, ]' i
/ u7 {" c3 k1 C0 l+ _6 S2 \
GrantedAccess:句柄对象的访问权限
+ G- M- a& x! h7 B5 V$ [
8 h/ [5 j- U! r
3 k- y# R7 K& \( \; R
下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp )
* ?; U# S/ K4 O( ~
: ~# n8 z0 }7 U& R1 _
比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄
: N! \: v+ D* h# w" @& C# ^ u
/ i+ e8 x) l1 p o% x% B' Z
怎么会这样?难道程序写错了?*_*
4 |# J! R( B) S: p
7 M8 @# S9 Z/ K W1 M
现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出
5 D# M0 L6 `: r' J, a
7 M' |7 T) Y: O: E) u
:proc -o QQ
( h; M9 P/ c) @ y' f/ S
Process KPEB PID Threads Pri User Time Krnl Time Status
" _5 i9 Y: X) v0 r( `8 S) w
QQ 827CD520 11C 2A 8 00000B90 000008D4 Ready
- ` C# U. a2 {" n: P( {2 y o
. ?8 C* J5 X- u/ M5 [' e; v* ]; u. j6 Q
---- Handle Table Information ----
$ f/ F. { i8 m5 h" Q$ j
. p; x% d& Y9 L( g( f
Handle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590
. E/ @8 v M- g* [
6 S% P7 w! _$ c+ g6 N/ X b3 U/ z4 o# y
Handle Ob Hdr * Object * Type
9 v% m' d9 e/ A' m: {
0000 00000000 00000018 ?
, i0 Z+ w9 @2 d8 H% D8 k
0004 E2DA5E58 E2DA5E70 Section
4 s% v) s6 S* _5 K" O8 L; _: p
0008 FFAB35C8 FFAB35E0 Event
x3 c4 M# a% w! T( v) O2 ?
000C FFAB3B08 FFAB3B20 Event
6 U& Z- E" Q& d/ ?: \! n
0010 85C70188 85C701A0 Event
z; L% [1 }6 D w2 \4 g
0014 81515778 81515790 Directory
+ d7 x l$ U) _4 F& f1 H7 n
0018 FFAB7BB2 FFAB7BCA ?
+ h, f8 ^4 e5 C. K
001C 814A1858 814A1870 Directory
% \2 }) e" G: C$ |* a6 m1 ?3 S
0020 80288C88 80288CA0 Event
5 G$ o6 g' E" P# A7 z9 Q" ^
0024 E2CFE7F9 E2CFE811 ?
5 C3 ?, s8 @+ Y2 o. _
0028 842D7B08 842D7B20 Event
2 k5 K4 E/ ~" a( O/ e$ y+ E
002C 80E9B989 80E9B9A1 ?
* |7 r: ]$ @+ O& Q2 Z1 l5 b
0030 E1372198 E13721B0 Section
0 P b& i% y2 s
0034 814602C0 814602D8 WindowStation
# ^% V3 Q: d4 A$ v6 s$ b9 i
0038 81455CE0 81455CF8 Desktop
1 |- A" G) u5 \& N
003C 814602C0 814602D8 WindowStation
+ ?: K4 c# Y. k* X
0040 E2B3C1A8 E2B3C1C0 Key
# O5 I: E! |! O, b: P
0044 E286D6E8 E286D700 Key
, I2 w7 `" I8 }. U. V: I
0048 E2B3C0E8 E2B3C100 Key
" y) J% t! L# [3 U) u
004C E2B3C068 E2B3C080 Key
+ K, S+ k: {/ n7 e$ M, @5 n
0050 E2BEE688 E2BEE6A0 Key
& b" w9 q( l8 U+ ~0 e( L( B c. ]% w
0054 8147C998 8147C9B0 Directory
) N3 x: i B( _7 h9 i
0058 829D1128 829D1140 Event
$ \* F3 v+ q8 Z1 t' j' H( o
005C 83F991E8 83F99200 Event
) z8 \8 F5 a- `( G
0060 E2BEE608 E2BEE620 Key
9 {7 ~+ i+ j9 b4 C9 \
0064 FFB07568 FFB07580 Event
4 Z6 B- j( j9 P7 z
0068 801747E8 80174800 Event
1 _. x* { ]: M2 l
006C 80174828 80174840 Event
: t- ?' |* o7 I: Q" b
0070 845E8808 845E8820 Event
+ O9 I3 h& q/ I. o
0074 81448798 814487B0 Event
- a# j9 ~" ^% g3 r H+ R- J6 @" Z
0078 E2B9A888 E2B9A8A0 Key
* o) b$ }9 v% j% @% N/ w' }4 w
007C 845E8648 845E8660 Event
7 U- H- L3 @; z5 j2 ]+ I k
0080 FF9E2DB8 FF9E2DD0 Mutant
$ K. g: v; F: `1 W4 F( Y4 H5 P
0084 FF9E2D58 FF9E2D70 Mutant
$ j0 v9 W# [8 Q
0088 83CFC378 83CFC390 Mutant
* Z3 ~6 G2 C8 J5 v4 p: w* G
008C 801749B0 801749C8 File
9 v- p/ l7 z$ z- [( t
0090 E2C48668 E2C48680 Section
1 c5 D7 R! f/ t- A, n# Y) z! ^: o
0094 FF965168 FF965180 Event
+ F# f- N; l& I @
0098 FF9E7D88 FF9E7DA0 Event
- r Z/ I3 ~: }+ f6 r2 B
009C FFAD3DE8 FFAD3E00 Event
) u1 q( n1 I2 I2 w% Z W
00A0 80AD63C8 80AD63E0 Event
& S; {# y0 X; o7 e
00A4 E28073A8 E28073C0 Key
! {; i3 l' ^! T5 D; [6 k! X" N4 v$ j, r; P
00A8 FF955588 FF9555A0 Thread
- @, \, a( I; Y
00AC E2770728 E2770740 Key
% K' ?3 _6 S* D% V& K# |" D
00B0 FF923438 FF923450 Mutant
4 E7 p4 Y8 o+ ^
00B4 FFAE3B38 FFAE3B50 Mutant
2 r6 t# u F# g t- ^- G
00B8 83B80728 83B80740 Event
" S! f i/ [1 U
00BC 83B80668 83B80680 Event
; H( x e5 ^: @" W/ n) |5 }
00C0 E2E3C448 E2E3C460 Section
$ [% T& d1 M S3 W& B
00C4 83776A08 83776A20 Thread
' ?# y; k' _3 b/ c. u3 d$ @
00C8 81489E48 81489E60 Event
5 X: n6 k. x; P. b4 e( O
00CC 83776CC8 83776CE0 Event
" w% w/ S8 j9 ^1 j3 [
00D0 83776C88 83776CA0 Event
, M" m# d# T( \
00D4 83776768 83776780 Event
3 M: d! m5 E/ q( v0 ~# r
00D8 E2837D88 E2837DA0 Key
+ {) m/ B: j. Z/ H1 G
00DC 8146B3A8 8146B3C0 Event
$ l/ F: I+ i" b2 s% H1 S& Y; E8 I
00E0 FF908308 FF908320 Event
7 L3 h9 o" ]: p- X8 T/ G- i% i5 U- |
00E4 81494868 81494880 Event
8 ?4 V# e5 K! X( M. l0 e$ N6 X6 @
00E8 FF9064C8 FF9064E0 Event
% y# Z! I% [ D" [
00EC FF908FC8 FF908FE0 Event
! ]$ m* r$ R6 _% O' g# C* K
00F0 FF908F88 FF908FA0 Event
?7 P- M T- ], `. _0 p
00F4 FF955588 FF9555A0 Thread
- U7 p& e: G( T
00F8 FF908F48 FF908F60 Event
, g/ p* \4 z4 Y1 q, S& U; Q
00FC E2CB1558 E2CB1570 Port
{4 K8 L: k" s4 e: \. F$ p( T
0100 FF90A2C8 FF90A2E0 IoCompletion
! m4 `7 @& g5 y. J8 |& h; d
0104 E2CFE708 E2CFE720 Port
7 D/ w% b; t' `% c/ F* F( r# `
0108 FF90A2C8 FF90A2E0 IoCompletion
$ D7 f4 s* o8 \5 ~4 y$ @2 ]' W
010C 837762A8 837762C0 Thread
) J) m2 B3 Z1 Z& }2 A
0110 8103BBC8 8103BBE0 Event
4 l/ ^6 E) x( O
0114 813DBDB8 813DBDD0 Event
: P& Y" r7 d+ w! Z% L
0118 FF814788 FF8147A0 Event
7 ]' V. H6 Y3 z& t. h) i
011C E1358DA8 E1358DC0 Key
' T' N3 c6 m: _& r( x2 j. d" E5 q
0120 E2CFC428 E2CFC440 Key
0 z( y& j* C5 T. r$ q
0124 8103B9C8 8103B9E0 Event
% d2 J# g' y* O9 J
0128 E2C9A968 E2C9A980 Key
7 R, M# w: Z+ K! q
012C 83B34E88 83B34EA0 Event
8 b1 O" x3 p+ j. W$ L8 C9 o4 Y
0130 E2CFD948 E2CFD960 Key
. v) A$ C t* w, F+ x! j' ?
0134 83B34E08 83B34E20 Event
6 _1 R( E0 C* F% k8 `% l! J4 W
....
4 z# m0 \2 s* X' ?8 l
.....................省略
# W2 z' U+ d) m1 P) W$ W& n! k U! O/ R
) e; U$ v0 L/ A: {
看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢?
6 H) U/ B- }* [# h2 q( y3 Z* N+ Z
5 C4 l4 s, y& H' [# e, C. C, @/ f
想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此
! r4 |7 X& `9 [; b
% T7 v0 P9 Y+ I6 q- n0 r& A4 `
可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路
. b( S4 K: I. Q: |% h& j# o, q" z
% _& A+ p! I: D& F7 h& R V
后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需.
) S- F# g0 y3 a' A
# @% H9 y" t/ E4 |$ V; {: J" D
果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS
5 b# C7 x5 R7 P/ M% V/ s
. ?8 d: Q: N1 I
修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程
% s1 Q! g4 j3 P: y
* x" I7 z) O g/ Z
#include
2 i3 k3 l8 u L3 S; b& L
#include
, a6 Z% m$ _. x
#include
5 ^: @* X. h4 t/ @5 r% C
#include
; T$ v m, O; h O
A# o4 y! R4 I" n7 c. Y/ v0 d5 S
/*
0 M! Z5 I8 f0 M7 d( I& F
* you''ll find a list of NTSTATUS status codes in the DDK header
3 P# @2 \0 X. M4 t* Q& H+ @
* ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\)
: z% u" D5 Z+ T$ @2 ?3 e
*/
* G* c+ P' h& U5 a! X! Z2 k
#define NT_SUCCESS(status) ((NTSTATUS)(status)>=0)
+ @! p/ J- g$ K6 ~3 {- w
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
& T1 Y# Q- I2 v3 Z9 W
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
3 U, y' r/ Z5 `3 Y3 }. q1 C$ l
& d( d4 {. L# n
/*
+ [/ S* U3 [& v
*************************************************************************
) k. B% t3 r) R3 T* f. K' |
* ntddk.h
3 J: i& P: Z; F* @
*/
" ?& |1 u: R. _9 h
typedef LONG NTSTATUS;
. ]0 Z, _* p/ ?/ H9 ~
typedef ULONG ACCESS_MASK;
5 B2 W0 w. n( M1 g/ v# ]7 M* k
/*
" y/ k2 d: A2 U. Q+ P) K
* ntdef.h
6 s8 ?2 _" G8 ?0 j8 q
*************************************************************************
( }: o3 W) c4 K' x* G5 g& R
*/
( f6 e0 f- o# a5 Y7 m* S
4 I3 U4 W+ {5 m' M" Y' O) |
/*
. g# e. F7 j5 [- M
*************************************************************************
% H; Q4 l" V' C* r0 z& c& j# {( K
* <> - Gary Nebbett
6 T3 E+ t6 i! A# y. M% Q' k
*/
, a9 x$ J; C; n8 W; R
: R; d7 e: B/ I4 t u9 h! J; i
typedef enum _SYSTEM_INFORMATION_CLASS
1 U4 d' v' V2 K! W8 X W
{
) Y( C& S6 q& s- Q. R4 R5 C
SystemHandleInformation = 16
* O r9 E$ @5 f0 n3 h- G
} SYSTEM_INFORMATION_CLASS;
4 Q% p3 p7 Y3 R) U
: p& F$ ~- L' h+ q2 V; _3 l2 Q, k
/*
( A+ T5 i/ M: J
*Information Class 16
( c, u t6 m% ?- Y! _
*/
3 O/ b% i) R" P. `, D
typedef struct _SYSTEM_HANDLE_INFORMATION
3 _/ M+ d' f* D6 x6 X. x) \* l9 Q
{
. G }3 P3 C) R8 k& t
ULONG ProcessId;
; i2 i: |" I# D
UCHAR ObjectTypeNumber;
! A- d; V) j) }/ a1 t6 L
UCHAR Flags;
4 _5 S. U& x* V3 ~
USHORT Handle;
' T' m$ q/ _' C
PVOID Object;
) P; r+ t6 g7 U6 i' w0 {& b0 P) C
ACCESS_MASK GrantedAccess;
/ P& p) x) h, O9 b
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
* j1 t3 z- u) T; _# \' f
, `+ I* C3 u; r; _/ b
#define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; }
" ~+ b- a, R; E8 N
/*
- U& U) w! G7 W7 ?/ A1 `
*************************************************************************
$ u5 ]: D4 f! v5 U3 o+ a" I
* <> - Gary Nebbett
" K/ Z0 R3 t* d0 D& R# p* P0 h
*************************************************************************
4 ^; {/ ` r1 h: c, h& l* b
*/
: l& Y. S7 ~& \7 U
typedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status );
' ~6 t0 @$ d. |9 F3 l2 M( [2 _& K
typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL );
" s. e+ c7 a0 A( K# A
/************************************************************************
/ K; _& H! S8 E8 }3 }: ]9 {- `
* *
3 J3 A- i l. T" [, u
* Function Prototype *
. h. z; R# Z( W0 P' P
* *
( V8 L1 U" r- G6 Q7 l; }
************************************************************************/
) i$ T' m) n# O' P
: L* b7 }! A+ i# |! ^4 z& C
static DWORD GetEprocessFromPid ( ULONG PID );
' I* S" t9 e; X
static BOOL LocateNtdllEntry ( void );
& H' ]. U' E }- A
0 g {# w5 [( t9 w, u% w' I
- A0 K1 O4 n# E5 _1 O% |% `
/************************************************************************
; p4 E) C2 C5 }
* *
: G6 q6 A/ A6 [5 i+ T
* Static Global Var *
) u8 i* X* q+ n& D# f. D
* *
( t" B2 i; e8 \# e, \
************************************************************************/
. ]. s1 O% G8 g) k% N3 [
3 Q( F1 c$ ?" n- B6 H5 m( p0 w6 h$ V$ Q/ \
static RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL;
6 Y8 T% E" | y% w5 Y
static ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL;
- `" U7 U2 \2 C) U7 }, G+ W
/ o7 w% o* v: E, b$ h4 Z5 U
static HMODULE hModule = NULL;
3 f: I, e* ^3 B+ G- `
/************************************************************************/
/ J* {$ |" M5 k2 r" u- @
0 _- M% I" i0 K. ~" u2 O
0 N! y. J: }! S' H2 e8 {
static DWORD GetEprocessFromPid ( ULONG PID )
; w! P+ s9 G4 s# [
{
3 u7 S. m! i, h: e9 c, m9 B# \, y) }
NTSTATUS status;
/ C0 A0 A2 A6 s
PVOID buf = NULL;
/ n: P, I% z+ j" ~; Q
ULONG size = 1;
! r2 f+ r! T0 Y4 m6 K1 T0 G7 M
ULONG NumOfHandle = 0;
5 ~: z$ S) q/ e) M7 Y
ULONG i;
, c4 O" T4 V6 L
PSYSTEM_HANDLE_INFORMATION h_info = NULL;
2 v' p$ r$ U/ F: D
$ v3 s% c" _8 b- F% U
for ( size = 1; ; size *= 2 )
, O7 K+ ^ B, F8 C, x& }
{
1 C! I, w, P, d V) ^' ]
if ( NULL == ( buf = calloc( size, 1 ) ) )
+ h6 `! t, a+ _1 `
{
1 b( Z. j9 k$ w d2 j0 l: {
fprintf( stderr, "calloc( %u, 1 ) failed\n", size );
9 p$ e" v: A! a3 t7 T# O) s+ c2 a
goto GetEprocessFromPid_exit;
6 p2 v0 Y& b) M6 }* g
}
/ t" y2 ]+ k5 r F* {' J
status = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL );
( E% ~, F4 C* [- S1 J, M
if ( !NT_SUCCESS( status ) )
1 L! P! w' Q! c
{
! x# ~/ D$ h$ O
if ( STATUS_INFO_LENGTH_MISMATCH == status )
( A0 ]/ v8 Q, P9 e _$ f
{
' w' _* h1 O1 D+ L! a
free( buf );
% x/ ?; g8 I0 @5 z
buf = NULL;
* v' U& e7 C6 O6 R/ `: d
}
. f3 g% s% d( f( G% | C
else
- h% s. `; U$ a7 A
{
& s. m7 J- S5 ~/ o K [" i t9 `) c
printf( "ZwQuerySystemInformation() failed");
3 t2 T$ k( S% S# U: K6 x
goto GetEprocessFromPid_exit;
' N% s. m4 Z( ~' ?( o: K: T
}
9 _9 \5 T g1 R" B5 Y |
}
; M- ^7 z; }, g& `6 \1 C9 ?) s
else
; r0 O( U; B9 F3 ~! G+ h4 J! C1 k
{
" u1 C/ M8 l! O; N/ G
break;
* }. D( i# G/ A( Z4 G A5 n
}
: A5 n: z c$ N1 W
} /* end of for */
1 U9 j) U- U. |. [! I& n8 m$ S7 j
; f- E5 `, v2 e/ V
//返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组
8 k9 R3 X7 ]2 `* |% I7 Z! V- B
NumOfHandle = (ULONG)buf;
/ l) s4 X$ L/ D" a
5 p& x) H2 @3 |! e# `
h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4);
- G2 ?8 w* Z: r6 E1 C
+ r3 `7 b' s/ n6 x
for(i = 0; i {
; [* }/ L) S# e+ z; Q
if( ( h_info
.ProcessId == PID )&&( h_info
.ObjectTypeNumber == 5 ))//&&( h_info
.Handle==0x3d8 ) )
& ]1 I$ ^9 l# Z% S3 Y- }$ q. o
{
& r; x, J8 I! p) P; i" d
printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info
.Handle,h_info
.Object);
/ s. K; `/ J! ~6 ?$ c
return((DWORD)(h_info
.Object));
: x9 ~. }% `. g+ H2 V
}
3 r/ u, W$ U; L! i
}
6 O) T2 u4 [5 S* h
GetEprocessFromPid_exit:
7 f* c$ Y# Y0 z/ e
if ( buf != NULL )
' Z; b' ^0 i7 k, h# G
{
& o+ l5 Z+ i J$ ^) o) ]) E
free( buf );
, @6 d/ f& C8 |3 Q
buf = NULL;
/ f, z% Q+ y! Z0 C2 o
}
3 I) }3 _( o; C9 B" c$ f# J: U
return(FALSE);
7 P* B& J( ~5 [$ ^" [
}
1 m( X7 G& H/ ]) D: F1 R4 B
. ^( }3 Z' }0 e; m J$ t2 p j7 l
) W7 A2 {9 X" c6 V) Q, T+ m+ O
/*
- g9 r; x- S$ X: Z
* ntdll.dll
5 r* T7 i& o# Z1 V' A
*/
0 ^2 a7 \8 X) n3 z" A# S5 t
static BOOL LocateNtdllEntry ( void )
k! k3 x0 p: W2 o
{
& ^) M9 I$ a G% u0 P6 n3 y
BOOL ret = FALSE;
4 [+ H6 t9 d/ @( a. v& c
char NTDLL_DLL[] = "ntdll.dll";
% g: d! Z$ s# t$ Y& b# p# T
HMODULE ntdll_dll = NULL;
. k$ B! Z5 ~; @6 K! l! b" g
: j4 k1 A: B; l" E- J7 C* @
8 k' O! i1 n; }5 \4 K$ L
if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL )
) D5 Q% M8 Z. f, d
{
+ G9 _% d- {/ `" {& Y9 F7 g1 o
printf( "GetModuleHandle() failed");
# K& y9 z$ y+ H2 G. `3 W. k
return( FALSE );
% E1 m# H: |' S( h9 d P# k
}
. n0 G8 D8 m9 ~8 j3 w8 f& B0 t/ `
if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) )
' }: w- {$ u$ e6 P
{
8 C- y! I j- N% z+ O
goto LocateNtdllEntry_exit;
, h5 Y* r1 \) x" Z. @6 Q, E$ u
}
$ [5 t# F5 M4 R% \, k% l8 r- C
ret = TRUE;
+ i) ^( p/ z1 b
0 t; C$ `9 R9 Z9 ~1 m
LocateNtdllEntry_exit:
4 ^7 c& Z( c8 ~, O2 ], K
. |8 T; M1 p3 s
if ( FALSE == ret )
6 s) r+ W* |& r2 {5 U4 {; w
{
4 ]# y6 z! I; E3 G0 V* r0 }3 G; H
printf( "GetProcAddress() failed");
8 \) E2 @4 D! M; w" d
}
# Q8 p" {# J* o$ l0 u
ntdll_dll = NULL;
* v8 ]) y- q" U& g& Q
return( ret );
% v8 h4 X5 k5 H9 s' m
} /* end of LocateNtdllEntry */
6 T$ J0 j2 \6 j3 M0 N% G6 C, a
6 L' ]4 @0 r, V; A5 [: h% q0 n
8 ?& N/ s+ a+ D7 k
int main(int argc,char **argv)
9 L( [* k$ W" h3 C" I4 j
{
! i2 z) ^. m% F6 s# Q
, Z) S+ h$ s6 J) |/ N
LocateNtdllEntry( );
4 B% [ t7 }* c. z# J& r* l3 ]/ P
* \5 s+ l( a, m; z) M& ~. K
//打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5
. `9 v6 ?8 ~9 B2 c+ j
OpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() );
, Y5 l5 H% ]! _- N
' S, J$ R; T! R, G+ x( z9 b
DWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() );
1 h% r4 W# V6 e" z! C! s* V8 J
& |+ E ^9 q9 B9 \5 c, A( l
printf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr);
1 v/ y; o( g* [
4 q8 c- R& K# D" o
return TRUE;
9 |2 @6 D9 l) g) W* i
}
欢迎光临 数学建模社区-数学中国 (http://www.madio.net/)
Powered by Discuz! X2.5