获得进程的EPROCESS

韩冰

文摘内容： -------------------------------------------------------------------------------- 文摘出处：http://www.xfocus.net/articles/200406/706.html 9 q. ?! l( ]9 G6 W( a 创建时间：2004-06-01 文章属性：原创 文章提交：MustBE (zf35_at_citiz.net) By [I.T.S]SystEm32 : n- X( ^: m( p1 |( }: P5 l+ D Welcome to our web site http://itaq.ynpc.com/itsbbs/ thanks to SobeIt : P --------------------------------------------------------------------------------------------- $ B/ O! |$ b1 |+ B 每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. 7 X( v7 \+ a0 H; q- }( {8 R 5 p1 r3 \$ D0 K6 u& ~绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 ZwQuerySystemInformation函数原形如下 - q* T V; m! g3 x; f+ D" w0 ~0 ANTSYSAPI 4 {6 s' t% }, }! \0 f" x! G& u3 nNTSTATUS NTAPI 1 ?: n# M% t" O% o. _1 AZwQuerySystemInformation 1 Y$ t& J0 f( {( B( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, : k( @, W: J( U0 c, X M- B; b) CIN OUT PVOID SystemInformation, * K) J C& a. j( p0 QIN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL 8 `* E9 o* W* P); / J# r2 s9 i7 `2 {: `6 G 7 ?" s/ J" W( d/ H- K; r参数意义如下 SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 9 b V) m3 Y; R0 m- L 3 J, Y) f3 n% C# A" cSystemInformation:指向一个接受系统信息的缓冲区的指针 9 v* R; P2 w* y) p! sSystemInformationLength:缓冲区长度 ReturnLength:指向一个接受实际返回字节数的变量,可以为0 ( \8 X# U/ o1 x, E9 f& f8 D; z, P % G( b; \/ N+ L0 E6 Q# V为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation SYSTEM_INFORMATION_CLASS的结构如下 ; H v: _. P, i% q! \3 |typedef struct _SYSTEM_HANDLE_INFORMATION { + H; o' E* `+ G) {, [% ~ {1 x- xULONG ProcessId; UCHAR ObjectTypeNumber; UCHAR Flags; ; E! n+ X" I8 b: H0 q, @5 CUSHORT Handle; % w* _. J3 [( c# r% MPVOID Object; 0 v% P9 K: g. UACCESS_MASK GrantedAccess; / H4 h9 o" b" u# x4 p6 }" ?) n} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; ) f2 o" R$ f! y' { r - Z& T, D* F* _8 Y$ N) e" m9 @% I+ iProcessId:进程标识符 ObjectTypeNumber;打开的对象的类型 1 N, {% ]- U. ^! y5 b2 L & U3 k9 X+ X4 P" ~( pFlags:句柄属性标志 4 f1 F& w! k3 Q3 J6 IHandle:句柄数值,在进程打开的句柄中唯一标识某个句柄 & `( w; o* a& P1 n4 xObject:这个就是句柄对应的EPROCESS的地址 " |$ A D5 n* H% ?% t+ s/ g' p 8 [! h, G0 S* f' D7 x F4 J1 FGrantedAccess:句柄对象的访问权限 ; _1 l; k% l+ S下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) ; Q: P. Y+ G0 f& G+ J- s & K) }* h- L! G+ K比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 怎么会这样?难道程序写错了?*_* 6 o5 ^6 r/ _0 n$ [" K) Q现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 # B2 p& V3 a' O. y* T4 W :proc -o QQ Process KPEB PID Threads Pri User Time Krnl Time Status & K. t4 u3 |9 X1 h5 V) cQQ 827CD520 11C 2A 8 00000B90 000008D4 Ready 7 O. s! ^4 _! f8 k2 t---- Handle Table Information ---- - o# u7 h9 D2 C; gHandle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 9 t8 Q9 C9 r& Y. M. q) l 7 C, B. M+ J7 V6 C# qHandle Ob Hdr * Object * Type - s2 S1 C1 ]3 @0000 00000000 00000018 ? 0004 E2DA5E58 E2DA5E70 Section 8 G0 q4 ?+ Z# |: u$ {0008 FFAB35C8 FFAB35E0 Event 000C FFAB3B08 FFAB3B20 Event 0010 85C70188 85C701A0 Event 0014 81515778 81515790 Directory " o+ W P. g( ~( E1 |0018 FFAB7BB2 FFAB7BCA ? 001C 814A1858 814A1870 Directory . U# p7 }# g1 l9 n& L3 ^/ J- d& Y& u0020 80288C88 80288CA0 Event + \$ ~4 j- ]$ ^& q4 `& _0024 E2CFE7F9 E2CFE811 ? 0028 842D7B08 842D7B20 Event 002C 80E9B989 80E9B9A1 ? + V$ |5 e- O7 [/ B0030 E1372198 E13721B0 Section ( L6 _ ~2 w$ b/ F% }0034 814602C0 814602D8 WindowStation - Q; @ |6 ^9 L( ]2 |) V( o( ~& w0038 81455CE0 81455CF8 Desktop 003C 814602C0 814602D8 WindowStation 0040 E2B3C1A8 E2B3C1C0 Key 0044 E286D6E8 E286D700 Key 0048 E2B3C0E8 E2B3C100 Key 9 w: s+ ]" @1 L2 a4 b004C E2B3C068 E2B3C080 Key # L4 f/ R( I/ S* D* n4 z+ L0050 E2BEE688 E2BEE6A0 Key # l0 B, ?3 M$ {6 O7 D0054 8147C998 8147C9B0 Directory 3 g% n- P1 K5 \; x0058 829D1128 829D1140 Event $ y4 ]# i' N7 _* z. g005C 83F991E8 83F99200 Event }% ?, P- }" g$ ]' A0060 E2BEE608 E2BEE620 Key : V& W1 C- c, v2 `& ~0064 FFB07568 FFB07580 Event 0068 801747E8 80174800 Event 006C 80174828 80174840 Event 2 i- Y& J1 S& M) x' i+ a6 s0070 845E8808 845E8820 Event 0074 81448798 814487B0 Event 0078 E2B9A888 E2B9A8A0 Key 6 N! f& n2 R2 t2 ~- |1 U" `# S+ U007C 845E8648 845E8660 Event ) }6 x. [& f' U0080 FF9E2DB8 FF9E2DD0 Mutant 0084 FF9E2D58 FF9E2D70 Mutant 6 s& f$ d$ E- u# S$ P; `0088 83CFC378 83CFC390 Mutant 8 y. \' Z2 `' T5 k7 i8 r! B$ M008C 801749B0 801749C8 File 0090 E2C48668 E2C48680 Section 6 @: u* G2 J! f* Y% o% A0094 FF965168 FF965180 Event 0098 FF9E7D88 FF9E7DA0 Event 009C FFAD3DE8 FFAD3E00 Event 00A0 80AD63C8 80AD63E0 Event 7 }. X" G7 @3 T2 w00A4 E28073A8 E28073C0 Key 00A8 FF955588 FF9555A0 Thread ' ]$ ?9 M) o8 O" o6 {00AC E2770728 E2770740 Key ( p: y7 G* v& R$ Z% m4 q8 u6 |, B00B0 FF923438 FF923450 Mutant 00B4 FFAE3B38 FFAE3B50 Mutant 00B8 83B80728 83B80740 Event ! S1 P, [( |; O8 I) z) [# D: \00BC 83B80668 83B80680 Event " n. j+ {( p6 q2 [, x00C0 E2E3C448 E2E3C460 Section 00C4 83776A08 83776A20 Thread 1 d+ z5 g0 X# K4 ]00C8 81489E48 81489E60 Event 00CC 83776CC8 83776CE0 Event " m8 V H0 H% z* Z00D0 83776C88 83776CA0 Event 00D4 83776768 83776780 Event ~) R, _& m3 ]4 [9 j" {3 h00D8 E2837D88 E2837DA0 Key 00DC 8146B3A8 8146B3C0 Event 4 U5 a" Y5 G$ A4 }, K* B00E0 FF908308 FF908320 Event 00E4 81494868 81494880 Event # P5 T# j4 d; _6 p8 c* h00E8 FF9064C8 FF9064E0 Event 9 J; U" O* H- C& {3 a8 N8 E" s00EC FF908FC8 FF908FE0 Event 8 G8 \0 M$ t! b. t4 P( n00F0 FF908F88 FF908FA0 Event 00F4 FF955588 FF9555A0 Thread % a: m% f& R, R M00F8 FF908F48 FF908F60 Event 00FC E2CB1558 E2CB1570 Port 0100 FF90A2C8 FF90A2E0 IoCompletion 0104 E2CFE708 E2CFE720 Port 0108 FF90A2C8 FF90A2E0 IoCompletion : ~1 U' A# ^* e+ j {+ Q: r010C 837762A8 837762C0 Thread 0110 8103BBC8 8103BBE0 Event 0114 813DBDB8 813DBDD0 Event 4 U7 [. b |- ^5 `9 M/ O0118 FF814788 FF8147A0 Event 011C E1358DA8 E1358DC0 Key 0120 E2CFC428 E2CFC440 Key 0124 8103B9C8 8103B9E0 Event . l9 A& ? f; \* I0 l7 ~1 `0128 E2C9A968 E2C9A980 Key 6 }2 `/ C+ N$ T+ c7 j' ?012C 83B34E88 83B34EA0 Event " E }: i% N; a8 s, K3 Q0 }- c. o0130 E2CFD948 E2CFD960 Key 0134 83B34E08 83B34E20 Event .... .....................省略 看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? 4 s# @, N4 ?/ m+ ~/ a想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 9 L; J! W/ v# d( W" o, M 可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 / P; i( R$ m7 Q6 }! W3 P2 n后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. 0 X9 ~- h* c4 N+ l果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS 4 G# l7 ~) ?7 a$ p # \2 }/ x; c0 V: A" a$ R1 V修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 " S. |+ k0 |3 T7 a+ H5 O* B* J n #include / ^+ ^+ c( M& H2 r! w; `0 t#include #include 0 X5 g% A1 b. {7 T; t5 ~#include " D& b7 C p3 G8 }6 ]) @- ]7 X# A ! @7 h8 U) [$ r9 a) s0 m/* * you''ll find a list of NTSTATUS status codes in the DDK header & m( Z- X9 c4 z( V6 L7 l* ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) 5 b0 G" t3 | b8 s) H' H/ ~*/ 5 e: ~7 L: v; c- ^. i& A8 [#define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) 0 O* i+ Z4 ?' D9 y. b /* ************************************************************************* , {6 X1 i d, e$ O0 o$ m* ntddk.h */ typedef LONG NTSTATUS; 0 ]0 E+ F* I0 e$ {* ^: }typedef ULONG ACCESS_MASK; /* * ntdef.h ************************************************************************* : d* g( x/ ]! P4 S. f4 q*/ + V- w# [5 ~0 O0 F7 u( e $ ]: j3 F2 i! K# C5 S; A& R/* ************************************************************************* * <> - Gary Nebbett : f2 f* j2 O, C*/ # n x( A2 K0 Z3 I8 n# N- N: W typedef enum _SYSTEM_INFORMATION_CLASS { $ k4 P# K: k# OSystemHandleInformation = 16 } SYSTEM_INFORMATION_CLASS; , j, U- z+ h4 ]$ n /* + \5 w" B% I1 T# `6 w2 {, |+ K- w*Information Class 16 */ typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG ProcessId; . z$ u% p& x0 v" N& [6 rUCHAR ObjectTypeNumber; , q( u3 r- v) oUCHAR Flags; # W7 L H/ A4 q' PUSHORT Handle; PVOID Object; 4 @# Q) b3 O4 n& G, Y+ y2 |ACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; 5 h4 i6 m+ n, o#define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } /* ************************************************************************* * <> - Gary Nebbett ************************************************************************* */ typedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); % b8 G4 z n2 {2 w( h* r" Vtypedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); /************************************************************************ ) o6 ~7 N5 b- F! F" m* * * u3 }5 z- ^' X# n* Function Prototype * , b8 K2 j s: g& Q' t I7 X9 C0 K* * * }9 n3 s$ u U0 ?, q; e+ S************************************************************************/ static DWORD GetEprocessFromPid ( ULONG PID ); 2 M5 f3 ]4 ], P5 t. Xstatic BOOL LocateNtdllEntry ( void ); /************************************************************************ , x0 p# Y7 U$ J8 `/ H3 L* * ; e' F! N. \# N3 f) e* Static Global Var * 6 E. a4 F8 L, r4 D# J* * 8 a* W) x) \3 ^- N$ z************************************************************************/ static RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; static ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; static HMODULE hModule = NULL; /************************************************************************/ 9 u2 r1 c7 C" y4 K0 I4 _- Q static DWORD GetEprocessFromPid ( ULONG PID ) ! B7 w+ `7 N2 U1 n{ 9 R' p5 y+ \; N$ O3 P6 M. t- @NTSTATUS status; 1 e) ]0 \1 T* R! ?/ ^ SPVOID buf = NULL; 6 x) I4 h3 a$ ] d6 a. r2 {3 }ULONG size = 1; + R9 G5 |. R. s0 x2 I! E5 iULONG NumOfHandle = 0; : Q. D9 q$ m, L. i$ sULONG i; ; S U; E" i+ |6 U. BPSYSTEM_HANDLE_INFORMATION h_info = NULL; 5 w$ J4 E1 G, T) u! t for ( size = 1; ; size *= 2 ) { . ^8 |3 b' p v, ^" Kif ( NULL == ( buf = calloc( size, 1 ) ) ) { 9 }' T* Q- R+ j5 j1 q Qfprintf( stderr, "calloc( %u, 1 ) failed\n", size ); & e7 ]. Z# L _, [$ Xgoto GetEprocessFromPid_exit; } status = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); if ( !NT_SUCCESS( status ) ) { ( m. I: u$ u) `1 Z7 X$ t8 v9 [if ( STATUS_INFO_LENGTH_MISMATCH == status ) { free( buf ); 1 T# u4 ]- z U. {- [- m& O* obuf = NULL; } else { printf( "ZwQuerySystemInformation() failed"); goto GetEprocessFromPid_exit; 0 _2 H/ k7 T) ]7 L} } else - R/ {! U: ~- R+ V6 ~/ o# Y7 b, Y! E$ X{ 1 }0 W/ O& Y& X* T. ?7 rbreak; , V$ y2 Y- ^: Y& W% u- d} ; q: N4 D6 Y) ^# ]} /* end of for */ //返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 NumOfHandle = (ULONG)buf; . D/ T9 `" {' b+ [3 }% K9 u( O 5 L8 {9 a c- g# g* Y6 A! b/ T8 g6 Eh_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); a+ N0 G: u: E/ r+ wfor(i = 0; i { ( f0 N5 o( Q9 @2 S; W: @if( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) { ' H: T# M5 M* G% v# Z5 r3 rprintf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); 7 {2 P- y: H4 I Nreturn((DWORD)(h_info.Object)); } } GetEprocessFromPid_exit: : J4 r5 h3 [+ \. Fif ( buf != NULL ) D, e5 t* X) C1 M{ - O m) Y$ A9 F) _) L$ q0 B8 b, Efree( buf ); 4 _0 a; `; ?: U# ~1 f! d c1 lbuf = NULL; } return(FALSE); } ( E7 h( F" }7 U/* 8 ~/ j6 K: i% A7 k* ntdll.dll */ static BOOL LocateNtdllEntry ( void ) { BOOL ret = FALSE; & [$ Z' x) ^$ _9 u1 Kchar NTDLL_DLL[] = "ntdll.dll"; # {- e$ @& C# E: U0 F( vHMODULE ntdll_dll = NULL; 7 ?9 Z$ b7 b$ L$ X% u7 F( H if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) { : T- b' [0 j( e2 |printf( "GetModuleHandle() failed"); 0 B; L0 j: e4 Q) ereturn( FALSE ); } if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) { goto LocateNtdllEntry_exit; 1 J) w1 X2 \9 c} 4 ~; J, `6 w6 p4 o" o# Z' E" dret = TRUE; 3 i4 j2 M: F! s6 z \% u1 e' e# c* j& o+ b& Y; |LocateNtdllEntry_exit: 1 @' T+ y$ ^+ I M2 B4 a- ~ : Z+ k% u4 e0 Y6 Y1 fif ( FALSE == ret ) : L3 F- R+ h2 U9 v. |; T{ 5 G5 d( r. d1 T* D* n/ d* Iprintf( "GetProcAddress() failed"); / }% B- T7 s: h4 D: L} % h: m: j2 T" x: O! K3 K9 }+ ]ntdll_dll = NULL; . D m' {+ A1 G5 Sreturn( ret ); 2 a, K& i7 p+ k4 ]( k7 w} /* end of LocateNtdllEntry */ 9 Q7 J1 M3 c1 J& m0 g( a( B" [int main(int argc,char **argv) ! y9 T9 F: v/ c7 r, P' Z6 F{ ) G4 ^# I5 {8 C4 D9 r1 o LocateNtdllEntry( ); 8 o. R9 U5 _7 X2 Y& b' l4 A, O ]$ P" X H V; p, m' v//打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 OpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); & @0 {5 X$ J/ _DWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); printf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); / m/ i0 i: K* d+ N; `0 l return TRUE; }