获得进程的EPROCESS

韩冰

文摘内容： -------------------------------------------------------------------------------- / n+ j$ A% {4 ^& E0 b/ u! q. H1 Z4 _文摘出处：http://www.xfocus.net/articles/200406/706.html + O" h A$ A$ M) t# f创建时间：2004-06-01 文章属性：原创 文章提交：MustBE (zf35_at_citiz.net) 1 ~+ p- h5 W4 ^ By [I.T.S]SystEm32 Welcome to our web site http://itaq.ynpc.com/itsbbs/ 4 F/ q% y# K5 I+ y ; `3 w% k- H6 w" ithanks to SobeIt : P --------------------------------------------------------------------------------------------- 1 `3 @& X8 g0 ?( p5 [+ g& `+ @, i每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. % ^) S) T6 V; }5 S & L7 C% k* F8 U! B绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 5 F6 d: T. G. i4 E9 l; t ~ ZwQuerySystemInformation函数原形如下 4 d: i- `. ^# v3 }* Q . e4 I c( z7 U9 jNTSYSAPI 2 |; Q4 B* [' U' a" {% z7 C, B: o% ^NTSTATUS NTAPI ZwQuerySystemInformation ( , P% P) K2 \; N; n. k8 WIN SYSTEM_INFORMATION_CLASS SystemInformationClass, $ q5 F- ~3 j& K NIN OUT PVOID SystemInformation, 7 Z) e7 {7 Y% j9 E0 X5 ZIN ULONG SystemInformationLength, , }2 x* e' I. g0 JOUT PULONG ReturnLength OPTIONAL 2 T8 @9 O2 S" L2 W! V$ X); 3 m" ^2 s; {- ? 参数意义如下 1 h' o) E! n. G' ^$ ` & T8 c" D7 q% v7 o$ h1 x, A! P& K5 RSystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 SystemInformation:指向一个接受系统信息的缓冲区的指针 SystemInformationLength:缓冲区长度 : N% i# B7 y* I: G0 B' j ) E8 ^+ T7 n6 a; F$ A. g* z% e5 \ReturnLength:指向一个接受实际返回字节数的变量,可以为0 9 S8 D+ I4 r: ~% V ! b6 r* \: @- e; \' v L* B; p为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation $ q0 m3 u! w* bSYSTEM_INFORMATION_CLASS的结构如下 typedef struct _SYSTEM_HANDLE_INFORMATION { " T9 ^" V Q* V [' r) N yULONG ProcessId; , S0 U j- t* r8 ]1 @UCHAR ObjectTypeNumber; UCHAR Flags; 1 m; N7 h( \/ |; h! ^$ @" ]USHORT Handle; PVOID Object; ACCESS_MASK GrantedAccess; & Q; \9 e' l8 n: _% Y} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; ! F, T' E. w0 \0 A. y 6 B A" L6 h( |+ i1 x& p+ x" {! nProcessId:进程标识符 ObjectTypeNumber;打开的对象的类型 8 t# _ w. r; Y* G1 I% w 7 f1 k( J& X4 J: T2 Y7 c F; B! mFlags:句柄属性标志 ]! _ w; _3 ? : `" _5 b: v/ O, Y. ^! lHandle:句柄数值,在进程打开的句柄中唯一标识某个句柄 9 h' P/ t% Q0 {6 u4 x Object:这个就是句柄对应的EPROCESS的地址 ! I1 `0 C/ B6 V8 k, N. t& Q 9 x& U2 f* p* z0 A- eGrantedAccess:句柄对象的访问权限 / I: O2 C: W+ L# I- U/ o; B 7 \2 U/ _/ H; w# e下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) 7 _- E6 h D) k9 R2 C) \! `5 L ( J. h+ \7 O! X6 Q5 @8 h' e" |比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 怎么会这样?难道程序写错了?*_* % j) ?2 b" ~! K2 g1 q" {$ l 现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 6 ~3 ]- J8 N8 ^:proc -o QQ 4 p9 q8 v; [( c( j! F& M# yProcess KPEB PID Threads Pri User Time Krnl Time Status QQ 827CD520 11C 2A 8 00000B90 000008D4 Ready ; Y0 G! G& M; H# a# e! d$ \ ---- Handle Table Information ---- Handle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 5 R7 U, o! v9 a' N2 [0 @Handle Ob Hdr * Object * Type 0000 00000000 00000018 ? 4 H7 r( }& d& m5 [; |0004 E2DA5E58 E2DA5E70 Section 2 y6 v+ @& x5 P% z4 z0008 FFAB35C8 FFAB35E0 Event 000C FFAB3B08 FFAB3B20 Event 0010 85C70188 85C701A0 Event 0014 81515778 81515790 Directory 7 p8 ?6 q- I3 z+ E. H" w# i9 s+ e0018 FFAB7BB2 FFAB7BCA ? 001C 814A1858 814A1870 Directory ' O- z- x: X% y7 m! E# L+ h e) S! [/ u0020 80288C88 80288CA0 Event 0024 E2CFE7F9 E2CFE811 ? 8 K2 Z4 ^6 @6 x% w0028 842D7B08 842D7B20 Event ' o8 t! ]5 ?7 |, N, L3 J002C 80E9B989 80E9B9A1 ? 0030 E1372198 E13721B0 Section 0034 814602C0 814602D8 WindowStation 0038 81455CE0 81455CF8 Desktop 9 L5 l$ l' H; l9 Y; n" c1 J+ y B003C 814602C0 814602D8 WindowStation 0040 E2B3C1A8 E2B3C1C0 Key 0044 E286D6E8 E286D700 Key 9 H) b% R4 l2 b% b) ^* s) d0048 E2B3C0E8 E2B3C100 Key / n/ e! K) E% X004C E2B3C068 E2B3C080 Key 0050 E2BEE688 E2BEE6A0 Key * S) G0 P) ~/ ^# y0054 8147C998 8147C9B0 Directory 5 M8 E( T, O5 m9 F0058 829D1128 829D1140 Event 1 F6 @* P: G' p/ [$ k f005C 83F991E8 83F99200 Event - W$ e& N/ A/ V$ _, T4 t0060 E2BEE608 E2BEE620 Key 0064 FFB07568 FFB07580 Event ' L, c2 L% _1 d' A0068 801747E8 80174800 Event 8 f3 T( Q1 c: J$ [2 E p! B' h006C 80174828 80174840 Event ! P9 v9 N4 R8 O4 L% S. R0070 845E8808 845E8820 Event F' u! O' T- Q- y2 T9 A7 e+ C0074 81448798 814487B0 Event 3 R# ~. I) B' V, A+ [# [0078 E2B9A888 E2B9A8A0 Key $ J- |2 ?; V$ Z% e5 W007C 845E8648 845E8660 Event - f" C8 R8 `! C, G0 k7 J0 u$ j0080 FF9E2DB8 FF9E2DD0 Mutant 0084 FF9E2D58 FF9E2D70 Mutant & n) f( i# i* A8 m( n- B3 I" f0088 83CFC378 83CFC390 Mutant 008C 801749B0 801749C8 File 0 I) |' P9 V1 j. P5 ]0090 E2C48668 E2C48680 Section " E4 f6 K2 L" O1 H2 j0094 FF965168 FF965180 Event 0098 FF9E7D88 FF9E7DA0 Event " H4 o0 u9 m6 F& I2 |009C FFAD3DE8 FFAD3E00 Event 00A0 80AD63C8 80AD63E0 Event 00A4 E28073A8 E28073C0 Key 00A8 FF955588 FF9555A0 Thread 00AC E2770728 E2770740 Key " p% h( l# d- T" i& q2 @% V3 A00B0 FF923438 FF923450 Mutant 00B4 FFAE3B38 FFAE3B50 Mutant 00B8 83B80728 83B80740 Event 00BC 83B80668 83B80680 Event 00C0 E2E3C448 E2E3C460 Section 00C4 83776A08 83776A20 Thread : a/ b, O7 E' l+ A5 \00C8 81489E48 81489E60 Event 2 ]& b; h, F0 f8 Z$ W5 L# N00CC 83776CC8 83776CE0 Event , ^# J' o6 l# f# D: q00D0 83776C88 83776CA0 Event . x5 I4 g# o1 ?+ ~: D00D4 83776768 83776780 Event 00D8 E2837D88 E2837DA0 Key 9 a( N& f' @! L2 Q7 i, x8 y7 t8 e00DC 8146B3A8 8146B3C0 Event 2 ]3 x1 Z, l3 i; [7 P00E0 FF908308 FF908320 Event 00E4 81494868 81494880 Event 00E8 FF9064C8 FF9064E0 Event 00EC FF908FC8 FF908FE0 Event 6 h" X: }4 X, p$ n. ]00F0 FF908F88 FF908FA0 Event 00F4 FF955588 FF9555A0 Thread 2 G0 R+ L5 [/ C; V, G00F8 FF908F48 FF908F60 Event " u7 B; C- c s4 ^00FC E2CB1558 E2CB1570 Port 2 [% | m7 U) F$ S, u! o; x0100 FF90A2C8 FF90A2E0 IoCompletion 0104 E2CFE708 E2CFE720 Port * Q% R8 d; d5 E0108 FF90A2C8 FF90A2E0 IoCompletion 010C 837762A8 837762C0 Thread % L1 u$ R5 G! X9 l0 P% z8 z6 }2 M' b0110 8103BBC8 8103BBE0 Event 0114 813DBDB8 813DBDD0 Event ) g8 \3 V% Y0 E4 p5 {# l# |! S. h0118 FF814788 FF8147A0 Event 011C E1358DA8 E1358DC0 Key 0120 E2CFC428 E2CFC440 Key W, A' z( M; B- t5 O( b0124 8103B9C8 8103B9E0 Event 5 g" f! _9 l# m& O) Q0128 E2C9A968 E2C9A980 Key 012C 83B34E88 83B34EA0 Event 0130 E2CFD948 E2CFD960 Key - Q5 a( v+ J" O0 i0134 83B34E08 83B34E20 Event 4 T2 q5 t" b$ A7 g8 t" ?1 B.... .....................省略 看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? 想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 + s2 L6 l2 w6 `" G, o( S可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 ' |2 _* z4 S. N2 L( y5 v后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. - m, o( ?5 ~3 H! R 9 [; |. S4 G, q% H7 Z果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS 7 ^* Y! Y' o A! \修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 . P+ k2 j5 b, f7 `4 |0 f, l#include #include 8 W& i' g3 _( |$ _) ?3 _0 x( j#include ( k0 S/ e" X6 s, Y8 H#include /* * you''ll find a list of NTSTATUS status codes in the DDK header 4 |2 K8 M% K) C* \2 G* ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) ! Y0 J" P) w* @7 u4 t2 d*/ . ]- E/ y" r. _: d; H#define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) /* ************************************************************************* * ntddk.h - D) _9 _# h# t$ Z' i1 ?*/ ) U! m( K. E! jtypedef LONG NTSTATUS; ( m6 G, D! z: E% x: E$ Gtypedef ULONG ACCESS_MASK; 0 s4 s+ I/ n* }& h# J/* $ ]6 j U8 m. r4 i1 ?* X* ntdef.h " _. g u& V* {6 \************************************************************************* */ & l: @5 D C7 c& x/* ************************************************************************* ( l' M) A+ v6 z9 A1 U6 y2 i" g* <> - Gary Nebbett - R1 |2 ?) x7 e$ [( Y" s9 d*/ 4 T3 `6 a2 |5 A( P! v8 w 5 O8 h2 H8 t3 ]" |typedef enum _SYSTEM_INFORMATION_CLASS { 1 D! [3 V7 B$ m9 U: ~, N* ~. W3 XSystemHandleInformation = 16 ( \( |9 l- Z& Q: o} SYSTEM_INFORMATION_CLASS; $ G; B( T! i5 W( P+ y" a% H+ e /* 9 d1 j- y2 ^) R, a: C*Information Class 16 ; r2 Q d# E4 [: H: M+ x% t2 @+ h+ }*/ typedef struct _SYSTEM_HANDLE_INFORMATION { 3 o) E1 U" ?1 R& b( B" M q4 S4 YULONG ProcessId; 2 ], c5 C {! M6 {6 _6 t+ K# rUCHAR ObjectTypeNumber; UCHAR Flags; USHORT Handle; 9 M& {. x$ z" h ?' u- _# bPVOID Object; ) A- t0 u7 s5 ] z6 tACCESS_MASK GrantedAccess; + I6 [$ `3 k# }1 ]} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; , g8 x# F8 x& U! @6 J( O #define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } /* . @ i5 }2 T# e/ C************************************************************************* * <> - Gary Nebbett % e( N. I7 u E, n6 T2 n************************************************************************* */ 1 {, S3 B0 w; K; X! s( s; `typedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); /************************************************************************ ( m3 {' G- `+ ]0 L# ~7 y6 T! j0 Z* * n4 b" A& F% Q9 L* @* Function Prototype * % y6 J) S' J# W! e+ G* * " h5 W7 j0 z! I6 X' a************************************************************************/ . n5 B# b* g# j, o! Pstatic DWORD GetEprocessFromPid ( ULONG PID ); static BOOL LocateNtdllEntry ( void ); + I, G0 D( l, G& q6 Y , ^. }6 \! {6 e' m3 x, v/************************************************************************ * * * Static Global Var * " _3 B- U1 N" |4 ?! ?6 `: w% D' k* * ************************************************************************/ ! j. m7 a O V* \1 d; z4 H% y static RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; 6 n. U# W) w" x" }9 {" u6 ]1 t3 Astatic ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; , v& Z# z4 ]6 H4 _ static HMODULE hModule = NULL; / M: c& i4 {" `- }/ ?% P, H0 Z/************************************************************************/ U$ c% a+ _# ]# i8 U' S$ H static DWORD GetEprocessFromPid ( ULONG PID ) / p: @. c; ~$ B* `/ ~5 J% a{ / N5 l0 c( K& N1 V/ s$ A: w# MNTSTATUS status; PVOID buf = NULL; ULONG size = 1; % k* X* z4 l. ]& aULONG NumOfHandle = 0; ULONG i; 6 s# r; [' m6 k% i1 \PSYSTEM_HANDLE_INFORMATION h_info = NULL; ! @" I9 C1 c( |9 Z/ f9 l for ( size = 1; ; size *= 2 ) / Q4 o) I" R5 D+ ]3 R2 }{ . c" j& t) Z. U! g. L. N: pif ( NULL == ( buf = calloc( size, 1 ) ) ) { fprintf( stderr, "calloc( %u, 1 ) failed\n", size ); goto GetEprocessFromPid_exit; } ) H3 @! B; ?' h6 n2 E! `status = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); if ( !NT_SUCCESS( status ) ) { if ( STATUS_INFO_LENGTH_MISMATCH == status ) 6 E& w8 ~ p& ` `{ free( buf ); / g7 p; B) F5 Z7 f+ N& F8 Z& Bbuf = NULL; 2 ~; I) \* Y5 C& E} else { printf( "ZwQuerySystemInformation() failed"); D7 e) X5 x u+ @, l0 U+ qgoto GetEprocessFromPid_exit; } 0 p; _/ X4 K$ _/ e" w} else ! v1 \5 m9 k. ~9 z5 X8 N, c; F/ Y{ $ n6 a6 i" R( o: u) gbreak; } . ^5 y1 u5 O% [6 Z& G} /* end of for */ 7 |. K/ C! G# _& g# u 3 T* s/ Q" W8 B9 P5 Z! A" p//返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 7 {' k) s6 z; V" f, TNumOfHandle = (ULONG)buf; # X8 _- F: @7 g: z ; f1 H- y: z& ~0 s3 Dh_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); " Q7 Y- U- R ]/ s( L D for(i = 0; i { if( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) , o- B/ ]- {) m0 b. K D2 ^, X{ printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); 0 |5 [5 B0 p- ?2 Mreturn((DWORD)(h_info.Object)); % @$ u( r" J! u" g1 o} } GetEprocessFromPid_exit: if ( buf != NULL ) - h* E7 u5 Z/ F, y& T" @) R{ free( buf ); , c9 z6 U3 L& ^; ?8 n& S1 Ubuf = NULL; $ E ?: b& D' y5 E4 X} ) N3 T& H8 x: Z! t% |* @return(FALSE); & ]$ N; O$ b9 n- ~; ? B$ ^2 i- o- X} 6 \$ M) G6 O9 V( ^ /* * ntdll.dll */ static BOOL LocateNtdllEntry ( void ) : F0 p+ ~" i! H% ?9 f0 R6 l5 M* ` m{ BOOL ret = FALSE; char NTDLL_DLL[] = "ntdll.dll"; : `' U2 z b) S/ U2 f; w9 m% pHMODULE ntdll_dll = NULL; 5 B s* L' V, A/ {' \2 Z ) b A, m& B% C& M; W1 E- k * i2 X; T) ^7 W* ?" J* cif ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) { ; k8 v& t/ h# Pprintf( "GetModuleHandle() failed"); ! u" n' ~. u% E, P- c7 Hreturn( FALSE ); 4 T" d, e* g$ d# B9 T} if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) 4 c7 a, O6 w% m, X{ 0 ]( H4 U1 i# n1 q/ v9 V1 ogoto LocateNtdllEntry_exit; } ret = TRUE; LocateNtdllEntry_exit: 4 [5 @+ e8 L' [2 Z# b1 K! U if ( FALSE == ret ) + O) e* G; M Q{ 7 t8 H- X( G: z% T6 h9 Kprintf( "GetProcAddress() failed"); 5 ]( q' K5 |: D2 y7 V( g0 U; Y} ntdll_dll = NULL; " Z3 y( {0 {# y- Q0 q( o8 Ireturn( ret ); } /* end of LocateNtdllEntry */ 1 R) b: @& r" h1 Q2 F! pint main(int argc,char **argv) { LocateNtdllEntry( ); $ ?4 `6 ?/ e) E8 `1 @+ {; @ 1 |. ], ? c7 Q9 g; E. m' N$ e: B//打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 OpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); DWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); printf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); 1 d% F$ O. k9 j. N* p: j7 \7 U A7 f4 m return TRUE; }