数学建模社区-数学中国
标题:
获得进程的EPROCESS
[打印本页]
作者:
韩冰
时间:
2004-10-9 14:22
标题:
获得进程的EPROCESS
文摘内容:
+ M* s' q% E1 L! u2 n- h1 N% I$ x4 ^6 v
--------------------------------------------------------------------------------
( F% c( f" ?6 {3 Y$ Y
文摘出处:http://www.xfocus.net/articles/200406/706.html
+ H" L2 j5 C8 c/ L* ~
8 s* @. X* _* Y* N7 m8 ~" J
创建时间:2004-06-01
4 }1 f! G9 Q$ U9 x, l
文章属性:原创
) G- e2 ^5 C: C1 `" `- G
文章提交:MustBE (zf35_at_citiz.net)
: _! s. j4 S+ i4 D1 [) v
9 z+ u3 N3 t I% Z2 _# `9 [( U" r, @
By [I.T.S]SystEm32
5 v# m" c% ?/ H# n/ h7 R
I- c5 f& k+ o* `' p
Welcome to our web site http://itaq.ynpc.com/itsbbs/
! U0 {( l N6 j0 i; M( P* I- f
+ M4 ~4 g2 U9 Y" q# ?
thanks to SobeIt : P
6 W' }+ K6 z f T/ G$ q6 p
---------------------------------------------------------------------------------------------
' O: {5 k" _6 K# r
1 L8 K3 X, H5 J1 K4 [
每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内.
6 c4 V/ p2 }* `. k
& Z, O" O5 j4 _( j& e& q2 Y
绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表,线性搜索到进程句柄,其指向的内核对象就是EPROCESS。
8 C/ B0 ^) l4 V* ^- z
- x5 K+ S5 v- F( Q# z4 }0 a3 i9 y# ^
ZwQuerySystemInformation函数原形如下
( y+ h4 l# `( D7 S. m# l, Z8 V
8 B& m4 B% f: ]' f% v
NTSYSAPI
% e) K6 ^9 R# I
NTSTATUS
6 F2 \/ p, T7 g8 B2 t; M
NTAPI
& F" R! h+ L: v0 _
ZwQuerySystemInformation
1 c- s8 o; Q5 C \8 M) A
(
8 U' c* s& o0 K# _) H1 o
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
: n" o) G% Y3 d
IN OUT PVOID SystemInformation,
& a& [+ o) Q" s; f0 ~, |$ f
IN ULONG SystemInformationLength,
) |: \' {9 P4 k8 D4 i7 _
OUT PULONG ReturnLength OPTIONAL
# B" c' X" e( t6 ]3 y3 _+ u
);
/ V4 U1 K" Z8 `' P& Z3 X
* @5 \: F& ?& B% o0 L. R5 L0 N" s1 s
参数意义如下
! p# L% \5 {* D5 D1 }2 ~" \, t
' ?! y& S! [+ j: F2 z! V
SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一
. q8 B" \, u H
0 Z6 g: e9 }/ ]
SystemInformation:指向一个接受系统信息的缓冲区的指针
* u: w1 J$ q. y8 v5 w; [! H2 L- C
+ o& r7 H# R3 d+ y" S1 S$ k
SystemInformationLength:缓冲区长度
; \! ^( P6 n7 N! f6 [$ r5 D/ b
e0 J* F; G7 B: m: q( H
ReturnLength:指向一个接受实际返回字节数的变量,可以为0
& F, {: l# j) k0 G, Z1 P
4 q' }; S& Y# a$ k; b. B% R* U
' _& U: I* V6 A' \# Z! q
为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation
A/ `( t1 S* G/ P- E
; p, K& k! V" a
SYSTEM_INFORMATION_CLASS的结构如下
1 |4 z+ V& p0 S, ]$ a) U' Y
; @6 ]6 I8 n! I3 ^/ [' h
typedef struct _SYSTEM_HANDLE_INFORMATION
( [( O" Q9 P1 J V; d2 t
{
6 Q, j" g3 u3 P* U% P/ ~/ c
ULONG ProcessId;
# @3 l. O( V0 A& v) C4 s
UCHAR ObjectTypeNumber;
& D* T5 W/ `- B/ k0 L
UCHAR Flags;
& U) S5 u* S2 F5 A' _
USHORT Handle;
" j D5 r1 b2 l; l6 c# C
PVOID Object;
5 `: E# c3 u& L) {( g+ S$ y5 y
ACCESS_MASK GrantedAccess;
) ^" F# d! h8 M! f
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
: n! U) {) v/ g/ N/ X* K
) a: j% @/ z! ^1 Z- e
ProcessId:进程标识符
$ I8 \# h3 p: `* q! D
1 q% t; M) V w3 c
ObjectTypeNumber;打开的对象的类型
' A2 G4 t; `: u5 g( f
1 Z, t% ?' \# c9 Q, m$ M3 n
Flags:句柄属性标志
+ W8 I. N M, x2 |+ d0 @) k
% T' M' E: ~& N' K
Handle:句柄数值,在进程打开的句柄中唯一标识某个句柄
; I6 o0 W6 ]: i1 I
' S9 M& G) Y8 Z" W3 o B
Object:这个就是句柄对应的EPROCESS的地址
; U( D( \# A& Q6 u% n: c$ l
3 \6 y- L" t2 Y8 g, h' b4 Q
GrantedAccess:句柄对象的访问权限
( r: H& |2 c% _# I& e
|0 P- S6 @) G$ I
% g2 A7 l5 H2 r/ M$ z, t0 k
下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp )
4 ~* p0 { _$ m% l7 y
* y1 K4 w& |, x1 B
比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄
& Q# l( g# m4 Q2 N
, G: u+ [# ^& H9 Q% [
怎么会这样?难道程序写错了?*_*
8 e& @8 o- b- x/ w
# C' h1 d6 d. H, ]
现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出
5 r9 j! k1 u# M
2 l" ?) V! q" G0 Y c+ R1 I
:proc -o QQ
# |' G2 _4 M& U" P4 `: e
Process KPEB PID Threads Pri User Time Krnl Time Status
7 q' m" C$ I$ a6 V, U
QQ 827CD520 11C 2A 8 00000B90 000008D4 Ready
0 f8 t; H! ?, K: i7 x: v
# n$ s1 x) z& H" X
---- Handle Table Information ----
6 H- U4 }" k: M3 R& X$ v0 Q, E- S
# Q7 k1 G+ n9 a9 {
Handle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590
- U7 `& B8 Y* ~( q* x/ x& [+ |5 b! p
2 p# x. T! C8 @, \* B0 {$ h6 n
Handle Ob Hdr * Object * Type
5 u" s* v5 z- _; Q5 J, V
0000 00000000 00000018 ?
% O5 ^7 [/ C9 R K2 [, q' B) f
0004 E2DA5E58 E2DA5E70 Section
1 n4 s, r0 x& l* T
0008 FFAB35C8 FFAB35E0 Event
; u4 O& G e+ Z" h* o( s3 `" V2 x
000C FFAB3B08 FFAB3B20 Event
$ [% J6 {; D3 c" _2 s
0010 85C70188 85C701A0 Event
+ \' Q B7 ?* L! j2 q9 j
0014 81515778 81515790 Directory
8 R( H* Y' ~ F+ a G! q
0018 FFAB7BB2 FFAB7BCA ?
$ C j/ }) W7 a+ p3 U6 F
001C 814A1858 814A1870 Directory
2 D5 w- t; y' U
0020 80288C88 80288CA0 Event
" [* \# b4 D3 R: k; M% w
0024 E2CFE7F9 E2CFE811 ?
% [6 I& A- t+ T% c
0028 842D7B08 842D7B20 Event
) u$ X& i K: H* K
002C 80E9B989 80E9B9A1 ?
# e" w1 E) ?2 l3 [7 T9 h0 C
0030 E1372198 E13721B0 Section
& g( T. N8 b$ {
0034 814602C0 814602D8 WindowStation
* s; h# E z% n, e) b
0038 81455CE0 81455CF8 Desktop
) c, D, d) ~2 {9 J8 q% R7 a0 k! G: a
003C 814602C0 814602D8 WindowStation
. s; b7 a- C/ g! q" m$ Y6 w2 o
0040 E2B3C1A8 E2B3C1C0 Key
" c9 Z: j2 S& |; Z
0044 E286D6E8 E286D700 Key
( W/ K! O5 r& p9 q! ^
0048 E2B3C0E8 E2B3C100 Key
& A% ]9 q ~1 Z- f H C
004C E2B3C068 E2B3C080 Key
% l# C( O* @* ]: L4 C
0050 E2BEE688 E2BEE6A0 Key
& ^% L& m- P1 J1 q4 Q% O
0054 8147C998 8147C9B0 Directory
6 e, G4 ], {$ v$ ~7 t
0058 829D1128 829D1140 Event
3 h0 m+ u8 P; O8 l0 u
005C 83F991E8 83F99200 Event
) _; q7 q& N) O) N! s+ P
0060 E2BEE608 E2BEE620 Key
. p% x! P! h2 h9 U7 l$ Z
0064 FFB07568 FFB07580 Event
* j- y9 l" T+ O6 U3 ~, ?, ?
0068 801747E8 80174800 Event
- P( v2 y% O7 W- t$ w. ^
006C 80174828 80174840 Event
5 c. c+ s+ `$ C1 L; G: E5 }
0070 845E8808 845E8820 Event
& Y& V5 l A# w, G+ h1 s+ R$ S
0074 81448798 814487B0 Event
% H& B3 l0 B; W: _% ]
0078 E2B9A888 E2B9A8A0 Key
( |! B Y9 O. s
007C 845E8648 845E8660 Event
6 q# `6 V) e% P) F0 J. P. V" o! ^
0080 FF9E2DB8 FF9E2DD0 Mutant
5 X6 z0 w- F7 _+ l
0084 FF9E2D58 FF9E2D70 Mutant
' \8 ~( T8 z9 h2 ]! S
0088 83CFC378 83CFC390 Mutant
/ N* q9 K4 O& r9 y, v
008C 801749B0 801749C8 File
3 z. ?! G# L3 I- Y5 z, H
0090 E2C48668 E2C48680 Section
% o- J1 i+ ]' j F
0094 FF965168 FF965180 Event
; [' U) Q/ n& W6 Y& T+ E
0098 FF9E7D88 FF9E7DA0 Event
, F# \9 v6 f' j1 [; x
009C FFAD3DE8 FFAD3E00 Event
( v. s; [" X/ W [ c1 { o, A
00A0 80AD63C8 80AD63E0 Event
, a# t" d. c" |
00A4 E28073A8 E28073C0 Key
7 ~. b0 W2 }/ v5 a# L
00A8 FF955588 FF9555A0 Thread
" I- e. e5 a/ [
00AC E2770728 E2770740 Key
/ V0 ?5 G5 N* S4 C3 w/ p
00B0 FF923438 FF923450 Mutant
% {' _! ]+ W( U8 B
00B4 FFAE3B38 FFAE3B50 Mutant
1 T1 C$ m- U2 m. l; D0 t
00B8 83B80728 83B80740 Event
7 h" g% @' p& U {/ E E# a
00BC 83B80668 83B80680 Event
( w4 f+ c3 f' Z. i% E1 s3 W
00C0 E2E3C448 E2E3C460 Section
6 M/ S6 r8 k! X* u
00C4 83776A08 83776A20 Thread
1 V( X5 [* }$ U4 K2 ~, l
00C8 81489E48 81489E60 Event
' ]& @: T1 p a5 K: s! N$ ^5 _# {/ |
00CC 83776CC8 83776CE0 Event
$ Y" _; z! @- l g! l) U
00D0 83776C88 83776CA0 Event
0 \; j& Z+ b h j8 H
00D4 83776768 83776780 Event
$ J! E6 H7 U6 A! e5 _& y
00D8 E2837D88 E2837DA0 Key
4 T/ `" c7 n, O4 D) T
00DC 8146B3A8 8146B3C0 Event
5 ?8 V ?% |1 ?3 X
00E0 FF908308 FF908320 Event
8 {1 |; B- g+ `. a% x: t" Q' B; U& T
00E4 81494868 81494880 Event
: R2 E. B/ a" Q' J, a
00E8 FF9064C8 FF9064E0 Event
3 ~, x$ Z, w% D( ~8 ^ ^
00EC FF908FC8 FF908FE0 Event
1 `2 f% `9 |, t {
00F0 FF908F88 FF908FA0 Event
: {5 j- J: T; f" K3 f1 m
00F4 FF955588 FF9555A0 Thread
' F+ ^. s+ \( n5 Z+ T( K6 A
00F8 FF908F48 FF908F60 Event
4 W: s) w+ g7 G3 K
00FC E2CB1558 E2CB1570 Port
# i1 W+ f- j+ L" k' k5 f3 F% z! b7 l
0100 FF90A2C8 FF90A2E0 IoCompletion
6 J, h5 x; c9 G" G) q9 M
0104 E2CFE708 E2CFE720 Port
- N: y0 {) d. a ^
0108 FF90A2C8 FF90A2E0 IoCompletion
/ a0 l7 m. f* l9 {0 }
010C 837762A8 837762C0 Thread
3 T. ?! M/ }5 R' F; z+ _% ^$ H" G
0110 8103BBC8 8103BBE0 Event
! [) \5 S! a1 Q
0114 813DBDB8 813DBDD0 Event
0 f8 f6 J) R2 j0 I! Q/ v' k
0118 FF814788 FF8147A0 Event
( ^: @; Y- n+ R1 {
011C E1358DA8 E1358DC0 Key
3 G" u' t( u& M1 A, ~
0120 E2CFC428 E2CFC440 Key
3 t. X4 [8 |1 u4 W, p* _
0124 8103B9C8 8103B9E0 Event
& l' e6 {# N) X
0128 E2C9A968 E2C9A980 Key
4 e$ t+ `; t0 K
012C 83B34E88 83B34EA0 Event
7 T4 {. o: g' B1 _$ O) n7 L- t
0130 E2CFD948 E2CFD960 Key
; m5 Y0 z$ D+ ?- H' Y, E9 a# z
0134 83B34E08 83B34E20 Event
$ d' W% u/ o7 g8 J8 J0 E( }3 @
....
2 ~7 `' k$ m$ W& h( k
.....................省略
( V6 b D- d% F& ^4 m
; z# b6 o6 W4 D6 b2 _! g/ g0 s
看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢?
# q( S! v: [7 z; ^/ n C" u
* g ~& {# V6 i+ ~7 O) i% `. {( f
想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此
( W% n( s2 n: }! X
7 J+ p' S# i! z6 E
可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路
! x, a# t: ~. x
! R U! e4 M$ ], A
后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需.
, R0 j+ Q9 K' R
( m; T4 L. @" ]4 w& i u
果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS
% ^3 E, B" ]& k2 g. x& [
" {( L; e# n" W! B% z6 k- b. O1 D: a
修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程
- C X& Z0 Q7 { w3 F
7 [6 P1 X0 B# g, g
#include
! w: m! T" ^9 y, l7 y9 r
#include
" o( x5 M$ C) |3 {4 o/ k
#include
$ z. {( R q* E/ y, f( E7 s
#include
( S* v" |9 Q, }9 }
. y" u. r; Z1 R
/*
, J+ n7 a+ P+ L$ d U3 x
* you''ll find a list of NTSTATUS status codes in the DDK header
( V2 G8 R, Z( |; F8 F
* ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\)
: N3 U$ f+ G0 G' Y
*/
: P$ Z! m0 f. H& ], j& ?- f( h
#define NT_SUCCESS(status) ((NTSTATUS)(status)>=0)
% \7 y9 [/ Y7 t, i
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
+ ~; y0 O9 }) Y
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
8 ?+ X) Q; S( l6 k$ f& U
+ r2 J) B* A/ e8 _# w
/*
7 K7 j9 ^, h) u$ \ z" r7 {
*************************************************************************
1 a6 y1 a) {& e- ^# w: j8 d' E5 k
* ntddk.h
# s8 M* T( n5 }0 S4 V2 ~( J- f4 o( U. c5 w
*/
" b* ^6 ?$ }8 D. ^
typedef LONG NTSTATUS;
, U% |- W, ~8 M! R5 P2 j" u
typedef ULONG ACCESS_MASK;
" G) u7 T" t+ K) o* c6 k' {) ^
/*
: o' i3 r$ }* L) @$ e
* ntdef.h
3 b$ _/ [$ S& R
*************************************************************************
: E* n3 |/ I- I6 W. f
*/
/ S" _/ G, B, k$ U: x
; N" x1 u) f6 l
/*
# f8 v4 Y3 n2 k6 }% t0 F! D
*************************************************************************
$ P' h) Y8 H: C2 q. F
* <> - Gary Nebbett
+ _. `% B' P) a6 H: J4 V
*/
/ l' ?4 t3 d& m& I
3 q2 n* X7 a4 h3 g6 B
typedef enum _SYSTEM_INFORMATION_CLASS
' e5 @& y- }( e% L( `7 _% `
{
% u. B+ J5 |. v& s# M1 V5 S: h
SystemHandleInformation = 16
" a/ G& W/ B. p4 N$ x* ~
} SYSTEM_INFORMATION_CLASS;
0 [. W6 ~4 f, S# R( D+ h# D, K
8 H' d+ ^* z: b! x: W* `- f, {$ J
/*
2 H6 y/ f8 i' @5 ^+ ]
*Information Class 16
' Y* h/ h( W# h6 C& Q" ~3 O5 Z
*/
: z+ f( U" `4 v: P% X1 t
typedef struct _SYSTEM_HANDLE_INFORMATION
: E7 G8 r' J' B, I m
{
. a3 I/ m+ P/ m y+ m
ULONG ProcessId;
- q! m5 W7 A& M {. B- Z
UCHAR ObjectTypeNumber;
) W8 w0 Q. n" e) r8 X% Q- T
UCHAR Flags;
9 m& e) E0 e- v* o. @
USHORT Handle;
# x- Z1 r8 \, T! x4 M/ L& Y! e3 I6 s
PVOID Object;
2 u7 O% ^* L! L1 M
ACCESS_MASK GrantedAccess;
$ R4 M% E& O7 f1 _* F$ n* }
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
2 x7 M; ]" B' t6 f- e$ a
, c# o4 D8 a$ a1 p
#define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; }
0 a1 d1 ?" M/ ]- u! E5 ]
/*
) O: r8 B& g. R" l8 |% ~6 T- o0 N7 t2 a
*************************************************************************
# V$ Z+ q1 M% P8 d
* <> - Gary Nebbett
" f% d5 H& s+ M9 r, _0 c; Z2 }
*************************************************************************
* n3 d# |% R! e
*/
+ m1 a2 {0 l" G/ s& }
typedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status );
$ t0 R% H1 t) u. c
typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL );
# @2 x. A# n, S# c. G( _2 h
/************************************************************************
2 V) m; Z- L3 v6 \
* *
. I- B$ N5 h# H7 h- l" }
* Function Prototype *
8 n* j* t( R9 f/ I x1 O
* *
4 P' g8 \2 {% m8 R* H. m
************************************************************************/
# K) h9 Y# [% W$ z) z+ J- E* I
5 S9 q6 X$ f$ q$ {! A# k# D
static DWORD GetEprocessFromPid ( ULONG PID );
+ | Q6 J# z* \/ k( p& I. R$ m
static BOOL LocateNtdllEntry ( void );
* f+ e9 k i9 |% K7 i7 h% B
9 B9 i; Z3 R' |* F' ?
: x! ~$ q; ]" U0 H9 u" q
/************************************************************************
- M# {* j. t/ [
* *
@6 Y. H6 s Y) f
* Static Global Var *
. j* T" l* N8 P0 ]
* *
& g `. ?. v; [) a4 Q9 D
************************************************************************/
) V% W+ C/ Q, c. Q
) s& K# k. f7 I( n* \2 C
static RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL;
8 i# Z# a, h" f0 y6 H
static ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL;
+ a T! b- I, {9 }! }8 S
9 I: B2 ]; Y8 N$ S, q# C
static HMODULE hModule = NULL;
9 n$ i7 {. R1 u" s: q0 W C: A$ F/ v
/************************************************************************/
: h6 S8 J/ R% ]$ m* B
$ G+ Q! z* e7 W+ A
0 A% f/ M; y# ?4 n5 }9 D; J4 V' E
static DWORD GetEprocessFromPid ( ULONG PID )
) R$ ~3 z+ t/ W5 @% s/ a4 }' W
{
- O3 M2 r; }& @1 c
NTSTATUS status;
: V7 Z/ ]6 J5 |1 w' F& [0 V$ f
PVOID buf = NULL;
( g, S1 V5 W( |6 p. m
ULONG size = 1;
* p) b4 I4 {! x5 G! w
ULONG NumOfHandle = 0;
' L' Y/ V: Q* Z( [ W$ X8 G
ULONG i;
$ N4 D- K) k5 N8 z( F
PSYSTEM_HANDLE_INFORMATION h_info = NULL;
/ i @) ?0 Y) e- o8 d
# [# [1 H0 f+ L: ]! d
for ( size = 1; ; size *= 2 )
8 R P! Z h/ y
{
4 y. i; p0 n* o6 i, q b
if ( NULL == ( buf = calloc( size, 1 ) ) )
: G9 _' M7 h1 A* r- F" }3 s
{
8 p& i: N4 n- m8 A; ?7 \
fprintf( stderr, "calloc( %u, 1 ) failed\n", size );
4 _3 I* v3 v I* y5 S i7 C
goto GetEprocessFromPid_exit;
5 ?0 Y" F) a( N3 ~
}
& }9 b; y+ f& v7 D$ }) ^
status = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL );
* } ?9 c2 f; | n
if ( !NT_SUCCESS( status ) )
4 Z" k0 W4 A6 ^ x- A6 {8 [
{
5 t, w6 x2 Q6 x
if ( STATUS_INFO_LENGTH_MISMATCH == status )
( S* b0 s7 ?9 K7 c" \
{
+ h8 \ C5 ^2 m \1 R* F
free( buf );
% u: J; ?0 m" n" F2 x- B- K$ Q) Y
buf = NULL;
( b8 T' E& {4 i N) S
}
6 T: c. O: \8 m4 U0 c$ ?9 f
else
$ J9 ?' @/ Y) S7 K& `
{
* V* V: r9 R) {: a1 A
printf( "ZwQuerySystemInformation() failed");
% T2 {$ K% @4 w9 a
goto GetEprocessFromPid_exit;
9 k; r) T) o. J" g8 v+ {' X* |
}
- {$ w/ ]% H l7 o
}
% F! [/ `; B/ R. k& u* z
else
. n3 e4 F1 X' w
{
# J& S9 ], }7 C6 r
break;
5 ], I7 |# H% D, p: D/ K& j
}
0 D' S( U# m* R% c2 U6 C) v0 K+ z4 Z
} /* end of for */
; v* g8 U9 c& p4 [' p
6 W7 ^1 D; U4 l/ b' V. [* p% y1 u, V
//返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组
; e4 Q3 \2 \. @4 I7 F1 ]1 o
NumOfHandle = (ULONG)buf;
4 Y5 a2 P) U5 @, I- H& D
5 f* Q/ z8 U- ]5 x& v* P/ T
h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4);
* m+ C9 K# ?0 u! Z- y
+ R6 e; O' o" o+ [7 j% U
for(i = 0; i {
! i o: {( W5 Y) y v3 ^8 I
if( ( h_info
.ProcessId == PID )&&( h_info
.ObjectTypeNumber == 5 ))//&&( h_info
.Handle==0x3d8 ) )
V1 W# i8 A' C: Z
{
6 U) L' U6 ]- S4 Y. H; ^
printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info
.Handle,h_info
.Object);
, w4 [1 I k8 j. E# a* N1 q* b0 K
return((DWORD)(h_info
.Object));
2 o l. T3 Y; I9 t
}
8 K* I, x; t6 L
}
/ _( r+ U- |) Q6 x( ?
GetEprocessFromPid_exit:
* N. ]2 Z1 o3 B9 B0 C3 V
if ( buf != NULL )
5 c6 l) B$ O' y# Y9 o
{
) C# d+ y8 h& b: b( o
free( buf );
& \$ R+ x% Q& e0 H4 n. {3 z* `( [
buf = NULL;
; F( H* \, l* s3 ~# Y
}
- y3 S8 l* V* |. b' }! J9 M& d; D
return(FALSE);
+ {. W9 f' v2 k& i4 E8 L) x
}
, M& M- W# }7 B1 \) i: z& h
$ \- D' V; `. k5 l8 K: Z7 ?* y
. l' h* }( N/ s9 Q% B
/*
( J9 D7 W8 s8 N5 \6 a' b5 c
* ntdll.dll
, P7 _# T$ Z5 x9 {$ e
*/
3 o! G: I6 u4 ^7 @( O& G
static BOOL LocateNtdllEntry ( void )
! z) Z' U# G; A6 h5 k8 F- ~* m
{
3 b3 R# K8 R! S/ Q, h
BOOL ret = FALSE;
2 }, v- R5 G4 g- p
char NTDLL_DLL[] = "ntdll.dll";
9 W: D2 R' T1 ^: v' f: o
HMODULE ntdll_dll = NULL;
. \ j+ K+ s- J
2 }0 W* {5 E5 j. T# {1 @* V" @" T7 a
, V1 b' ]. l5 g" L6 g
if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL )
: z- r4 l7 m- f! Z; ?
{
2 P! j3 Q) c c. R, p
printf( "GetModuleHandle() failed");
" s) M7 Q4 k) D5 `* I9 r
return( FALSE );
( x: k( i: g& c4 J
}
% U, ~1 w& {1 v! Y# ?4 x
if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) )
* w! t3 K# v3 h$ \6 l
{
, n3 Z1 q% o6 H; R
goto LocateNtdllEntry_exit;
) P3 C& F6 Y+ n# P( I
}
" a; J- K4 a4 j- G
ret = TRUE;
% ^2 o3 a+ _6 ]: j( o: [
; ~+ N) o" c: e6 M
LocateNtdllEntry_exit:
$ g1 }$ [: Y& T
4 Z( Q1 \$ I# ~0 \& [! \$ G4 T# O
if ( FALSE == ret )
8 \9 Q+ n- [6 L& J+ ]3 C
{
: U& o0 P3 T* e
printf( "GetProcAddress() failed");
6 P* |% k4 q0 N
}
b) C& A) g6 ]5 T" h) j- b" I
ntdll_dll = NULL;
$ u' @' f5 M6 B8 _- T
return( ret );
$ t) ~! l$ C) p h6 E
} /* end of LocateNtdllEntry */
4 N, `4 t5 c' R1 \0 w
& V/ m! o2 E" ^) L g$ `8 d" j8 }
: ?. h# y1 k7 i/ D9 Z9 U, I7 D1 f
int main(int argc,char **argv)
- s P. L/ g' U8 B5 i2 q
{
+ r; H% j$ k% M5 V2 q
. Q: \: B. B- F( F; R2 k
LocateNtdllEntry( );
, X) u+ v3 |$ H
9 d9 n6 [" u+ _" y. ^7 `; j
//打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5
- t; `8 ?2 [/ r8 J0 `
OpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() );
% z# ^# P6 k5 N& y5 k
" K' i8 _! ^- [9 K7 E( f: H
DWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() );
. ?+ X' N" C9 A" ^- k
& y& s7 m1 f& {% h- L/ D I
printf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr);
# Y8 Y: ^4 F3 F9 x, p
" [) f: \4 |1 M- g" h0 [
return TRUE;
+ _& w- w$ N9 Y. t
}
欢迎光临 数学建模社区-数学中国 (http://www.madio.net/)
Powered by Discuz! X2.5