获得进程的EPROCESS

韩冰

文摘内容： ( a: c0 l! l) Q8 M; }: u6 N-------------------------------------------------------------------------------- 文摘出处：http://www.xfocus.net/articles/200406/706.html 创建时间：2004-06-01 文章属性：原创 文章提交：MustBE (zf35_at_citiz.net) 4 ^; ]) ^! e F( ~9 L ( \2 T! O0 B' M9 Y, X' v p& |0 P7 ABy [I.T.S]SystEm32 4 B, }5 O$ g% I; D: n Welcome to our web site http://itaq.ynpc.com/itsbbs/ + Q$ V( n" Y4 i1 m& ^. _# v - }9 b. {! s/ x% }7 }thanks to SobeIt : P 2 S) s6 [0 c6 i6 `' {! ~--------------------------------------------------------------------------------------------- 3 Y- _' j7 c% Z9 l. [2 H + `- g. j: l) |# m每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. & L7 f2 D; D7 p, a( M 绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 , Y/ _, s% Q# ?/ l4 |% g+ q # u: ?8 b! T2 O! K! A: v( F5 {& FZwQuerySystemInformation函数原形如下 2 J# y7 W1 n: z; W NTSYSAPI ' Q$ f$ K' Y7 _NTSTATUS NTAPI ZwQuerySystemInformation * r: @/ I8 |( j& e( @( ' O' f" y7 [7 I- h( [7 ZIN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, ' T P6 H5 i6 t/ [/ A1 A2 |IN ULONG SystemInformationLength, " W+ J# w" C4 y- ]" x) N2 vOUT PULONG ReturnLength OPTIONAL ); 9 P" T7 ~. P! ?! M 参数意义如下 . D r y" E7 j' b$ L; _ ; R5 a( Q- a1 T/ C( B Q( @SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 SystemInformation:指向一个接受系统信息的缓冲区的指针 # j( ^: R, V, m, a& y/ k SystemInformationLength:缓冲区长度 0 g5 B) X7 O& A4 y& o0 ]# ] ReturnLength:指向一个接受实际返回字节数的变量,可以为0 & ~/ l; V: m& ~% j/ L# \2 s q 为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation SYSTEM_INFORMATION_CLASS的结构如下 ! I- u/ p, Q. q. j% H$ P4 {9 U# rtypedef struct _SYSTEM_HANDLE_INFORMATION 1 e9 y* O( K5 t9 K8 t3 ^1 V{ * ~* S. B: E- T4 h8 q5 U$ ]/ @ULONG ProcessId; 5 ` U, {* o" q2 L& y rUCHAR ObjectTypeNumber; UCHAR Flags; . x4 R! S# x" ?! b, SUSHORT Handle; s( U/ b) J7 B7 L& c' T5 kPVOID Object; $ P8 \1 {5 ?" I- OACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; . \! L) _$ y. N4 Y1 Y. A' M, ? ProcessId:进程标识符 " `" a' i. E, Q! u" P1 l ObjectTypeNumber;打开的对象的类型 & o7 c7 J) g' B8 F. Q4 K 5 T- f# }. l5 s M' |Flags:句柄属性标志 8 h I/ `* s" `& Z u3 B# | Handle:句柄数值,在进程打开的句柄中唯一标识某个句柄 6 C$ b; x t% z5 X" M/ r5 ?" t Object:这个就是句柄对应的EPROCESS的地址 & J( Z! o! V$ d0 O A ( ]3 H% g. ^9 _ U! X- CGrantedAccess:句柄对象的访问权限 ( h* d( r! E% W+ g1 W2 J0 n c; k: Y5 r1 s- K* l 下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) 1 T( v0 `: w! _ S- R9 T+ ~比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 6 ` j1 u' s# k2 e1 R9 G 1 D% k+ ^& f, K8 R* D# x, J怎么会这样?难道程序写错了?*_* # F0 H' t, I* q5 P, R: M& H& z8 D$ n 2 k* `9 D% e9 F* [8 @1 h9 F现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 ( k% I* W7 ?$ L; j X. Q :proc -o QQ # _! m' Z, l) q1 }Process KPEB PID Threads Pri User Time Krnl Time Status QQ 827CD520 11C 2A 8 00000B90 000008D4 Ready ---- Handle Table Information ---- 5 n3 b4 N9 A8 c, wHandle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 Handle Ob Hdr * Object * Type 0000 00000000 00000018 ? : ~# ?* h. W \, D; o" c9 F6 H0004 E2DA5E58 E2DA5E70 Section 0008 FFAB35C8 FFAB35E0 Event 0 M' X" ?. E; v, j0 |000C FFAB3B08 FFAB3B20 Event 0010 85C70188 85C701A0 Event 2 J' E1 P; z) R) X0014 81515778 81515790 Directory * T3 D4 b6 w- e: k9 Z* U0018 FFAB7BB2 FFAB7BCA ? 001C 814A1858 814A1870 Directory $ t7 `" I& @) l) H0020 80288C88 80288CA0 Event ! s/ V; a! y3 _( q) l; Y0024 E2CFE7F9 E2CFE811 ? 0028 842D7B08 842D7B20 Event $ x( e: o4 T% B: f/ h+ Y002C 80E9B989 80E9B9A1 ? 0 S+ H, c% ~: A' P- T5 r1 H( d; K0030 E1372198 E13721B0 Section 9 S; q& R# J9 Y8 H5 @0034 814602C0 814602D8 WindowStation 0038 81455CE0 81455CF8 Desktop 3 E4 W W R) y3 [& [2 ^& j# D003C 814602C0 814602D8 WindowStation % s5 m3 z. h' J) J; X: R0040 E2B3C1A8 E2B3C1C0 Key 0044 E286D6E8 E286D700 Key 0048 E2B3C0E8 E2B3C100 Key 6 r9 x, v4 T% F0 P$ P004C E2B3C068 E2B3C080 Key : ]) B8 L8 \# J& {0050 E2BEE688 E2BEE6A0 Key # T/ b: D4 l1 C$ {9 u0054 8147C998 8147C9B0 Directory 0058 829D1128 829D1140 Event 005C 83F991E8 83F99200 Event 0060 E2BEE608 E2BEE620 Key 7 Q1 U% n+ Q1 I, a6 | j. _' A0064 FFB07568 FFB07580 Event 0068 801747E8 80174800 Event ' l' w8 ^+ K/ K7 ^* \006C 80174828 80174840 Event 3 M, {% N( D3 R' w, }0070 845E8808 845E8820 Event 7 {, b1 P+ v- e* i: O7 D4 Q0074 81448798 814487B0 Event + P6 c9 C7 Y9 j: ?7 I0078 E2B9A888 E2B9A8A0 Key 007C 845E8648 845E8660 Event ) n8 l# J& d s9 f% h x; p0080 FF9E2DB8 FF9E2DD0 Mutant 0084 FF9E2D58 FF9E2D70 Mutant 0088 83CFC378 83CFC390 Mutant 008C 801749B0 801749C8 File 0090 E2C48668 E2C48680 Section 0094 FF965168 FF965180 Event 0098 FF9E7D88 FF9E7DA0 Event 009C FFAD3DE8 FFAD3E00 Event ) d* o5 H; H) N, ^4 M1 d* q00A0 80AD63C8 80AD63E0 Event 00A4 E28073A8 E28073C0 Key ' U7 I/ X% T/ S- v8 l9 X( w00A8 FF955588 FF9555A0 Thread , H: t0 w8 k; I, O00AC E2770728 E2770740 Key 00B0 FF923438 FF923450 Mutant / y3 e9 N" G3 V00B4 FFAE3B38 FFAE3B50 Mutant 4 }- u! }, w9 w2 A* t00B8 83B80728 83B80740 Event * `& \5 {1 H7 W00BC 83B80668 83B80680 Event 00C0 E2E3C448 E2E3C460 Section & u( ?- ` G& ?. q( T G$ d00C4 83776A08 83776A20 Thread 4 I ]6 c$ G0 l) U00C8 81489E48 81489E60 Event 0 X& |& ]( E) Q0 P9 |6 Z! Y1 L00CC 83776CC8 83776CE0 Event 00D0 83776C88 83776CA0 Event 9 G y0 x/ r: v! W# D% D" v; M5 g a" u00D4 83776768 83776780 Event 1 P |/ t. M( |00D8 E2837D88 E2837DA0 Key 00DC 8146B3A8 8146B3C0 Event 00E0 FF908308 FF908320 Event ' c6 p8 u' o, E. A00E4 81494868 81494880 Event ( o- }( a% g- m! N* g00E8 FF9064C8 FF9064E0 Event Q7 W2 g, M- O7 P00EC FF908FC8 FF908FE0 Event 00F0 FF908F88 FF908FA0 Event 00F4 FF955588 FF9555A0 Thread F$ c0 v# e# J1 n" q00F8 FF908F48 FF908F60 Event $ {/ m7 S, d* F- t6 p* K: |00FC E2CB1558 E2CB1570 Port . I' P8 B+ n6 T0100 FF90A2C8 FF90A2E0 IoCompletion 1 D7 {" I6 }" I1 c& C2 b) t0104 E2CFE708 E2CFE720 Port ( f) d0 f a; Z0108 FF90A2C8 FF90A2E0 IoCompletion * E& P3 S2 {) Z) x7 n8 a0 \6 o8 M010C 837762A8 837762C0 Thread 4 ~* y* O2 W, ^* ]5 v# w0110 8103BBC8 8103BBE0 Event 0114 813DBDB8 813DBDD0 Event 0118 FF814788 FF8147A0 Event * h# Z k) n8 T% _2 `011C E1358DA8 E1358DC0 Key 0120 E2CFC428 E2CFC440 Key 6 I& Q7 ~9 x% B# R6 R4 n. P0124 8103B9C8 8103B9E0 Event 0128 E2C9A968 E2C9A980 Key 012C 83B34E88 83B34EA0 Event 0130 E2CFD948 E2CFD960 Key 6 ]- E6 @3 Y/ |+ U7 O# M& I3 ^0134 83B34E08 83B34E20 Event .... 5 [5 B8 p5 P3 h% p+ l.....................省略 . O0 W& `: N# j; @8 q! y" h看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? ' c( y5 s5 S$ r8 m 3 t7 y: T9 q, f& ]想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 2 e* N3 G3 p& r, A+ N' ~ 9 }2 i* s1 E) c$ v6 w后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. 果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS 修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 / y3 w' w; Z+ ~! |" @ #include $ N/ A5 U% \# Y! ~$ c k#include #include #include 4 j! T$ ]. L. g5 t0 A* } /* * you''ll find a list of NTSTATUS status codes in the DDK header 5 ]8 F1 K$ J) }; j' h1 P* ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) " O2 R" P, J+ K7 |2 \# D7 }! R*/ . b- r% A R. H2 V' I8 e/ P& U3 R#define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) - g$ D( [5 ]( L" ^+ o9 J+ A#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) /* ************************************************************************* * ntddk.h */ I$ _7 w/ V& B; P; z4 y3 S8 R; utypedef LONG NTSTATUS; 1 L: i' V7 T' Atypedef ULONG ACCESS_MASK; 8 w! h; l. Z" | W: h' o/* * ntdef.h ************************************************************************* 8 h- S# b- _. n1 D( R*/ 2 j) g- x5 U9 u7 [+ a5 ^/* ************************************************************************* * <> - Gary Nebbett */ ! _0 Y' I( ~- l4 J1 u+ @9 e* l4 dtypedef enum _SYSTEM_INFORMATION_CLASS 0 Z- @* o; D' F' W{ 5 C" c4 B* b- n9 I; z" mSystemHandleInformation = 16 # {* g: H: J9 h} SYSTEM_INFORMATION_CLASS; /* 1 u7 H, p+ N+ i! \( y/ \*Information Class 16 */ typedef struct _SYSTEM_HANDLE_INFORMATION ' C; H& k) l$ g0 s k- j) ]{ - P/ Y+ {+ |4 d* `, _ULONG ProcessId; UCHAR ObjectTypeNumber; 5 t, p: x$ Q1 d/ @UCHAR Flags; USHORT Handle; - r0 o: a& Z4 T* i3 B$ s; ], U! `" ]PVOID Object; 7 q9 f" X& f5 C& M+ ZACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; : i% L5 R) d$ K, m2 n: I #define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } 1 S! Q/ z, I2 y/ E9 S B( J. c' L/* ************************************************************************* + ^4 {+ N: c5 e4 n K* <> - Gary Nebbett ************************************************************************* */ typedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); 0 G& s1 w1 r# s5 v+ ]typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); ( d+ N. y! t% n* S8 R3 ^/************************************************************************ * * 8 |! y8 u( E. K5 {* Function Prototype * , y: y( u+ A& C; ^* * , q1 M' O4 `" q+ s************************************************************************/ static DWORD GetEprocessFromPid ( ULONG PID ); static BOOL LocateNtdllEntry ( void ); 1 _8 F3 A, A! x' S /************************************************************************ * * * Static Global Var * * * ! y- G, @ @* z( n% C, ^) v************************************************************************/ ' c9 p* w/ F% ]3 E+ dstatic RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; & T' {$ x6 ], c! x8 rstatic ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; ) e- c" V3 |' H: c% Y# d5 @) i% L ! v1 ~: d# |6 Sstatic HMODULE hModule = NULL; /************************************************************************/ ) x/ I: [' g% k0 C7 C( G# u( j 2 J5 G# N- H4 \ ' x) `, t3 v# O( f# @/ qstatic DWORD GetEprocessFromPid ( ULONG PID ) { 7 M5 o6 t, Y2 n- Y- Q4 F/ p2 JNTSTATUS status; PVOID buf = NULL; ) d e$ r9 ?2 Q2 HULONG size = 1; ULONG NumOfHandle = 0; ULONG i; PSYSTEM_HANDLE_INFORMATION h_info = NULL; 6 O1 G4 l; R* E1 c& g/ h for ( size = 1; ; size *= 2 ) 2 y+ i" y8 H" P1 \5 o{ if ( NULL == ( buf = calloc( size, 1 ) ) ) / C$ w5 |! A+ T1 |! L* Q{ fprintf( stderr, "calloc( %u, 1 ) failed\n", size ); goto GetEprocessFromPid_exit; # p8 L' n5 H4 m} & O, E. Y4 Q9 h) [/ f' x* bstatus = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); if ( !NT_SUCCESS( status ) ) { 3 w( R j. \0 f. h1 c; p$ xif ( STATUS_INFO_LENGTH_MISMATCH == status ) ) H4 x( ]# W- m% s8 k5 W- r& f{ * _: t, O, U( F0 J1 u* Tfree( buf ); buf = NULL; , B7 D5 l5 f! c5 p} # T- B7 \; ]! M' v5 C$ X* q" d, delse , K8 U. o- _5 ?{ : O2 [' R: m) ~1 ?- [, _printf( "ZwQuerySystemInformation() failed"); goto GetEprocessFromPid_exit; 0 A0 u5 n1 l! k1 D$ P) s( ]} ( m( |$ c& g) h3 c3 |% F- E4 i} else { break; " L% V' ]0 U8 o} 5 v) [( J% N+ i; Q& ~& W( R# k3 z} /* end of for */ 2 v: x6 u& n6 q" d/ A! b//返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 NumOfHandle = (ULONG)buf; h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); / |1 L8 ]+ u; F' }, a8 ^ for(i = 0; i { 9 W, Q: J& T, \if( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) { printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); ) m) J( Y k' t, s0 s7 Zreturn((DWORD)(h_info.Object)); } } / v, X0 y% C8 o" WGetEprocessFromPid_exit: if ( buf != NULL ) ! z& t$ O4 c9 B/ Y1 [{ 6 C! ~! a8 |8 Z$ w/ _free( buf ); buf = NULL; } 6 R3 Z% `- @3 zreturn(FALSE); } / u0 t6 ]& _2 W1 c( G ( g2 j# U8 ]! v. [) [/* * ntdll.dll * m( `3 Z4 U! u5 t*/ ) a, y% Z6 w- `1 [7 T8 v2 o! E9 gstatic BOOL LocateNtdllEntry ( void ) { 5 ^, s5 X7 s9 i0 `; {# [ J0 @2 \BOOL ret = FALSE; 1 v# T' f7 |, k6 b1 o3 L3 [1 n% v }char NTDLL_DLL[] = "ntdll.dll"; % F% p) e' D8 h! E' ]HMODULE ntdll_dll = NULL; % g" ]6 M, t% K+ a0 kif ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) " m4 ^& ]/ M9 Y" }7 U' z! W! {{ ; c w3 |/ v- j2 X' ~+ L9 D/ R% Xprintf( "GetModuleHandle() failed"); # Z0 M! D: j+ F5 ?return( FALSE ); , i9 |& G+ X8 D7 X} if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) ( R5 u- {" _4 _{ goto LocateNtdllEntry_exit; } + |! d& d% G% N* w$ O1 y( jret = TRUE; / b# Q/ W2 N) Z G: |+ r' {) l5 [8 |. ELocateNtdllEntry_exit: % ]3 C9 g; b- M4 E2 x if ( FALSE == ret ) { printf( "GetProcAddress() failed"); * ]6 C9 T9 n7 a# J2 C} ntdll_dll = NULL; return( ret ); , P4 f3 V; ], L! I} /* end of LocateNtdllEntry */ }4 Y, }1 ?6 p/ v/ _. ?! z V . ]) E. S0 |# \ _ wint main(int argc,char **argv) & Q" Q; v% K' a2 Z( f9 e; h5 o{ LocateNtdllEntry( ); 2 z! r) S/ S2 l( p$ N! P . H C) a3 k* w//打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 0 j w" w4 ?1 R" W4 c, aOpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); * r2 |9 E6 y4 }$ N5 iDWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); + s% w e1 ~8 d2 E$ n ! B; U6 |0 ?$ P. h! Uprintf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); , N( d5 _# H' _, O" H! v% k; R return TRUE; }