获得进程的EPROCESS

韩冰

文摘内容： -------------------------------------------------------------------------------- 文摘出处：http://www.xfocus.net/articles/200406/706.html 1 L8 ~9 F7 E2 _7 x6 w) r& b: g 7 m {% `% G* u9 ]" Z创建时间：2004-06-01 4 M) b/ o4 p7 d5 |文章属性：原创 9 a9 G- ^1 A g& U文章提交：MustBE (zf35_at_citiz.net) + d0 [- p3 W5 J2 e/ {3 A By [I.T.S]SystEm32 2 F/ {. n+ s% \, _* R# { Welcome to our web site http://itaq.ynpc.com/itsbbs/ 1 G+ p( f+ v2 k2 [' u thanks to SobeIt : P ! x) v( ]3 n/ l s--------------------------------------------------------------------------------------------- 4 j4 {' O' P- l/ F( D ( Z- x' }" ?/ L: T( B每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. 绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 ( e% |- a5 R5 }- H , n# p) i- ~; ~, I5 O, S% vZwQuerySystemInformation函数原形如下 NTSYSAPI ; R2 ^! t3 H) |NTSTATUS NTAPI ZwQuerySystemInformation , e% T9 i# R8 |: f1 T z9 Y( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, 8 i, S6 n4 F1 ]* I9 b3 EIN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ' i1 j/ W. @8 a$ ^4 H: _) l); : y3 ]7 x1 Y0 Z: E ( x; p3 q/ B% D8 Y参数意义如下 # v/ v( y8 E- j- R. ] SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 + B$ }' J, ^+ B7 m+ X6 aSystemInformation:指向一个接受系统信息的缓冲区的指针 SystemInformationLength:缓冲区长度 1 r6 ?4 g8 P3 ~4 N+ ]! t5 nReturnLength:指向一个接受实际返回字节数的变量,可以为0 / H9 v( X) x4 i+ Q+ O9 u' k 为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation # z* V! d' {( C7 ^5 @4 c6 v5 h SYSTEM_INFORMATION_CLASS的结构如下 typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG ProcessId; UCHAR ObjectTypeNumber; UCHAR Flags; USHORT Handle; PVOID Object; ACCESS_MASK GrantedAccess; ; G$ I# ]+ c3 b1 ^" K3 s} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; ProcessId:进程标识符 3 L/ n7 |0 F9 s- f9 G) c ObjectTypeNumber;打开的对象的类型 / w& t; W! E7 n- n b O8 b 3 ]- Q4 Z9 P, `8 r! K0 ^Flags:句柄属性标志 - L1 C: R! l9 Z/ B( { Handle:句柄数值,在进程打开的句柄中唯一标识某个句柄 % A% v7 R, n1 w# |8 aObject:这个就是句柄对应的EPROCESS的地址 4 n7 \: l8 B* G8 K GrantedAccess:句柄对象的访问权限 u9 Y% z" y2 Q& c 下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) ! K$ b3 Y1 d0 c比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 2 b- X! q, q) A" R怎么会这样?难道程序写错了?*_* 9 t4 J9 a3 S$ H9 w现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 :proc -o QQ Process KPEB PID Threads Pri User Time Krnl Time Status & ]6 C6 X9 f4 c5 N! ?QQ 827CD520 11C 2A 8 00000B90 000008D4 Ready ( n& G- j$ w8 I/ w' ]' K9 `---- Handle Table Information ---- Handle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 0 V. z3 J9 `. P) }) s3 Y+ l% c 4 D6 F8 B- b; b7 _9 ?0 X( SHandle Ob Hdr * Object * Type ; m2 Z6 z/ U: j5 \8 g3 M6 C0000 00000000 00000018 ? 0004 E2DA5E58 E2DA5E70 Section 7 p% h3 E: T& j6 `- R# W' ^1 i0008 FFAB35C8 FFAB35E0 Event 000C FFAB3B08 FFAB3B20 Event 0010 85C70188 85C701A0 Event & S& `! K- b1 B4 j+ M0 \( H r z/ e0014 81515778 81515790 Directory 0018 FFAB7BB2 FFAB7BCA ? 0 b0 P1 d2 `( n001C 814A1858 814A1870 Directory 4 T& i$ a5 T3 Q3 y4 _0020 80288C88 80288CA0 Event 7 _9 s# Q& G% x: I5 o0 J8 ^6 ?+ d0 k0024 E2CFE7F9 E2CFE811 ? + P4 ?. Q7 q$ Q. f& X( j0028 842D7B08 842D7B20 Event ; K9 i: o/ _: l3 }$ M) v002C 80E9B989 80E9B9A1 ? ; E8 O4 K Z! D0030 E1372198 E13721B0 Section 7 t' z! _. t" B; M7 X0034 814602C0 814602D8 WindowStation $ G8 Z: R0 k2 x0038 81455CE0 81455CF8 Desktop 003C 814602C0 814602D8 WindowStation 8 t: U+ j' m" G" O) d9 q% P8 U0040 E2B3C1A8 E2B3C1C0 Key 0044 E286D6E8 E286D700 Key 0048 E2B3C0E8 E2B3C100 Key ( X, o3 \0 g3 O0 ~/ d004C E2B3C068 E2B3C080 Key ' F& E! B# N V: \. \" X! u* C0050 E2BEE688 E2BEE6A0 Key 0054 8147C998 8147C9B0 Directory # n/ G: }7 _4 U# x! o/ ^. f4 h% w0058 829D1128 829D1140 Event 005C 83F991E8 83F99200 Event 0060 E2BEE608 E2BEE620 Key 0064 FFB07568 FFB07580 Event 0068 801747E8 80174800 Event 3 R: N# `* L- ]* S h! @006C 80174828 80174840 Event : P) k7 m4 D+ V/ m( V( g. ^; T0 |0070 845E8808 845E8820 Event ' e2 p2 U9 B' R! O0074 81448798 814487B0 Event 0078 E2B9A888 E2B9A8A0 Key q& v) V3 j" g% L) ?+ E$ ^007C 845E8648 845E8660 Event 0080 FF9E2DB8 FF9E2DD0 Mutant 0084 FF9E2D58 FF9E2D70 Mutant ! w8 I* \- a) {# C! G- X# ~5 Q0088 83CFC378 83CFC390 Mutant 008C 801749B0 801749C8 File 0090 E2C48668 E2C48680 Section 2 r4 j0 x) `" X6 w& n0094 FF965168 FF965180 Event 3 e' x w0 z5 a0098 FF9E7D88 FF9E7DA0 Event 009C FFAD3DE8 FFAD3E00 Event . U0 B% S! K* Y" K, ^% X00A0 80AD63C8 80AD63E0 Event 00A4 E28073A8 E28073C0 Key . p) g2 o, `5 w# P* L! l; k8 M00A8 FF955588 FF9555A0 Thread 2 J) Q3 P9 p3 p8 Y* ?00AC E2770728 E2770740 Key 00B0 FF923438 FF923450 Mutant 00B4 FFAE3B38 FFAE3B50 Mutant 00B8 83B80728 83B80740 Event 0 e0 L* f5 b9 z00BC 83B80668 83B80680 Event 7 l, S: E4 j2 n3 x- h6 x7 B00C0 E2E3C448 E2E3C460 Section 6 ]7 R7 {9 I7 R) w) E00C4 83776A08 83776A20 Thread - e9 D- a6 _6 o9 N8 l% s00C8 81489E48 81489E60 Event 00CC 83776CC8 83776CE0 Event 00D0 83776C88 83776CA0 Event 00D4 83776768 83776780 Event ' j9 m( Y5 `0 C( ?7 ?' R' c, b% X00D8 E2837D88 E2837DA0 Key 00DC 8146B3A8 8146B3C0 Event 9 I9 i" w" @: e' }00E0 FF908308 FF908320 Event 00E4 81494868 81494880 Event 00E8 FF9064C8 FF9064E0 Event 00EC FF908FC8 FF908FE0 Event 00F0 FF908F88 FF908FA0 Event ) b& }, q( w6 c! n/ X+ J3 q8 O" }00F4 FF955588 FF9555A0 Thread 00F8 FF908F48 FF908F60 Event ( V$ x/ }2 }7 y# K00FC E2CB1558 E2CB1570 Port q6 p$ S7 H9 B# L7 w: r0100 FF90A2C8 FF90A2E0 IoCompletion / t% f" m0 [' v5 u2 v' o/ E0104 E2CFE708 E2CFE720 Port 5 x- U/ D) \' j7 L P( ?0108 FF90A2C8 FF90A2E0 IoCompletion 6 H$ r& ]& L/ [010C 837762A8 837762C0 Thread ! c0 W& K5 W! j0 n: V0110 8103BBC8 8103BBE0 Event ! T2 L0 v l" ~+ S% u( N5 i4 h1 r0114 813DBDB8 813DBDD0 Event 0118 FF814788 FF8147A0 Event 011C E1358DA8 E1358DC0 Key 7 i5 l& M3 U- w0120 E2CFC428 E2CFC440 Key ) U4 R$ q5 y7 f2 M u, O0124 8103B9C8 8103B9E0 Event 1 P0 a$ @, z, M3 i0128 E2C9A968 E2C9A980 Key $ u' t( E) p: i4 }012C 83B34E88 83B34EA0 Event 8 }, f% } h' F& l( p4 }0130 E2CFD948 E2CFD960 Key 0134 83B34E08 83B34E20 Event .... & {, k3 _1 D1 w7 F% _. _/ \) L2 E5 Z.....................省略 * F" k+ l7 p$ q8 h4 C. p3 F( K9 t 看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? 想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 1 z! N' O: B0 _. Z 可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 6 q, k3 E: H! q# L+ H2 ?3 x1 F ( n7 D3 D1 I7 H2 B, L. [( `后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. - Q- b$ ?7 O6 ^, E: u果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS 5 G1 `: p+ ^1 u6 D9 k4 }/ [修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 % j. t4 n6 s# F" l, u$ i) Y# L, ~) ? % L( p- I$ a3 ^$ q+ l#include #include #include : b* z. I: f% C: t! d#include ( ~3 Q. c2 H9 N; i- `, t' F /* * you''ll find a list of NTSTATUS status codes in the DDK header * ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) */ 7 W Q, `& l+ k1 e% v7 q#define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) ( i* U. a& O9 Y9 \% K1 B- f+ ?( @#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) /* ************************************************************************* * ntddk.h */ typedef LONG NTSTATUS; 8 F. w4 C% d8 r5 ytypedef ULONG ACCESS_MASK; /* * I9 z9 O/ \/ M3 s* ntdef.h ************************************************************************* */ /* ************************************************************************* * <> - Gary Nebbett */ typedef enum _SYSTEM_INFORMATION_CLASS { SystemHandleInformation = 16 } SYSTEM_INFORMATION_CLASS; $ K; j2 D) B1 v6 Y# f: h /* *Information Class 16 7 E8 T4 g) D+ o% j3 s( {*/ e/ ]. ~ ?: Y: G' [: D. x4 }typedef struct _SYSTEM_HANDLE_INFORMATION * | \; J# J1 n{ ULONG ProcessId; ; }7 c/ B9 K- x' hUCHAR ObjectTypeNumber; ! J# d* m. ~; @UCHAR Flags; USHORT Handle; # W( y1 e8 ^) M6 X \' _$ pPVOID Object; , o6 ?8 U6 i/ G& i) zACCESS_MASK GrantedAccess; # W# J" p0 B4 @8 H* @& v+ B} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; % C3 x, [* c- G d# _ #define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } /* ************************************************************************* * <> - Gary Nebbett ************************************************************************* */ typedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); 8 G$ y* \* e- ~/ a7 ` U" t P; G/************************************************************************ * * * Function Prototype * 3 V% j3 U' Z9 e( b z- I* * 9 d( v! `) j9 w3 P! N************************************************************************/ ( F& x& b9 F4 i/ }7 R 0 u% `7 r: H5 H+ tstatic DWORD GetEprocessFromPid ( ULONG PID ); % |& S/ M% e B$ K3 k5 Ustatic BOOL LocateNtdllEntry ( void ); 1 F6 O6 ^1 `# O" Z' {) u ! k3 f' l, K9 u' Z8 ^) h # E* b' A1 S6 Z f w/************************************************************************ 7 H! q0 p& J7 G* * ) K* y# w' |; `$ a' `7 N' ^* Static Global Var * : y) |- `* i* L. q* k1 q$ D* * ************************************************************************/ % N8 T: X/ d n- Hstatic RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; static ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; & O# R- h/ j& V. y6 U; o8 U8 l f: O: d* f) _) I# V Nstatic HMODULE hModule = NULL; / N% E5 N7 t8 g; I/************************************************************************/ y- s+ o: J. |( b+ X+ y& J static DWORD GetEprocessFromPid ( ULONG PID ) { & n/ J2 t, Y" ?1 b5 yNTSTATUS status; PVOID buf = NULL; ULONG size = 1; . N v1 b6 \) p3 o3 A4 ^ULONG NumOfHandle = 0; & d1 y, ~; \- RULONG i; PSYSTEM_HANDLE_INFORMATION h_info = NULL; 5 n' {7 p% b, L2 Q! Z' t & G; z6 s' e/ _' Qfor ( size = 1; ; size *= 2 ) { if ( NULL == ( buf = calloc( size, 1 ) ) ) { 0 a& ~3 R- C9 g8 Y9 I' {fprintf( stderr, "calloc( %u, 1 ) failed\n", size ); goto GetEprocessFromPid_exit; } status = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); ( G2 ~1 D/ }9 S- U* A- }2 vif ( !NT_SUCCESS( status ) ) 7 L8 l1 V* @6 t8 x( j: R{ if ( STATUS_INFO_LENGTH_MISMATCH == status ) : f; E4 {- z c; ^7 Z1 [ L{ free( buf ); buf = NULL; 2 A( b, Q5 @/ F! ~# d} else { 7 T: Y7 L) Z( k6 |' Jprintf( "ZwQuerySystemInformation() failed"); goto GetEprocessFromPid_exit; } * @$ [& T- D4 X4 U: Z} else { break; } # V; s7 O- z$ t' u5 i$ c/ ~} /* end of for */ 6 H: w s5 J- S # S \3 @ k6 R! q& y$ d1 B2 x//返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 1 `7 T& a- t; D& s3 f, CNumOfHandle = (ULONG)buf; " h* Z, M p$ b/ ^h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); - O! g- ~, u! N$ Y- r6 f' yfor(i = 0; i { ! v+ u1 @" z, x2 Y4 Y$ iif( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) + y' Y L" p5 |4 K! F{ printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); return((DWORD)(h_info.Object)); : \: w C) F, o& a: G; g5 O7 T} } GetEprocessFromPid_exit: if ( buf != NULL ) { 3 t, X1 h( p3 Q8 q+ gfree( buf ); buf = NULL; ; x% _! m; K4 \: d, b1 m% r} # N2 Y5 g# x& L8 preturn(FALSE); / c! A+ x8 u' |$ g} /* * ntdll.dll */ static BOOL LocateNtdllEntry ( void ) N, a% ~- o G: |* }0 s0 Q8 F{ / K# z/ Z0 I- h5 |8 v6 rBOOL ret = FALSE; char NTDLL_DLL[] = "ntdll.dll"; HMODULE ntdll_dll = NULL; $ R; Y& y; X0 ?2 N9 y! x if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) { ! e. l& W- O* }7 a$ \printf( "GetModuleHandle() failed"); return( FALSE ); ! }. }$ ~* J9 X6 r- G% b} * R% v" s5 e5 \5 _8 ]( x iif ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) { ( t$ \2 t( u/ A0 e. L# M i4 {goto LocateNtdllEntry_exit; * e9 i% h5 ^$ T4 R" R% P} ret = TRUE; - ]4 {8 z; K8 l2 W5 k2 T & K3 U/ t2 G0 F! y" M5 U; ?. u' t: ELocateNtdllEntry_exit: 7 _2 j8 k8 c5 Sif ( FALSE == ret ) { printf( "GetProcAddress() failed"); } 3 b0 J' x5 `9 kntdll_dll = NULL; ) z' z7 {- U/ Ereturn( ret ); 6 K# M2 r; z1 q* Q" a6 f7 R" c} /* end of LocateNtdllEntry */ ; h j2 L3 E5 ~* b# E8 D2 h | int main(int argc,char **argv) { 7 V* I1 [' [ y/ }+ I. k0 [- E( m LocateNtdllEntry( ); . F* [7 r% `1 M' Y, v//打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 & P g. i7 ^/ } v+ S% I- S+ pOpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); 4 }: M; _( A* C3 d$ w) i 2 A, U$ C; I/ f/ D( y. |) S2 \# \" c# PDWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); 2 `7 O" s1 Y* u7 V * o; S" U6 H6 \- m, l3 dprintf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); return TRUE; }