获得进程的EPROCESS

韩冰

文摘内容： ) [8 c* a- N w: i$ d# v4 K5 g-------------------------------------------------------------------------------- $ @4 l4 K2 ^: _( ^( G文摘出处：http://www.xfocus.net/articles/200406/706.html . X5 o+ b" q! N* i2 O: |: E ! K# S6 S( A8 }$ x8 r5 k! o H1 t创建时间：2004-06-01 : Z( n, G! z9 L0 [' W) M {$ T1 K文章属性：原创 2 M+ l; r5 l; F0 i文章提交：MustBE (zf35_at_citiz.net) & O9 M. J9 F+ ~! ?7 [By [I.T.S]SystEm32 2 N' r- \2 ~+ k2 a) ~2 ~. _5 _% X 3 }4 o3 c) o1 P6 q. |6 |0 C1 CWelcome to our web site http://itaq.ynpc.com/itsbbs/ : O! k$ J( z8 o+ o, z! s G- \thanks to SobeIt : P 7 K0 h0 h% E/ e--------------------------------------------------------------------------------------------- 0 V+ p( E5 ~' Q# n) R) a7 Z每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. + y# R& R: ?* A% P绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 ZwQuerySystemInformation函数原形如下 ' j3 W- x5 @ v NTSYSAPI $ X5 J( I( ?* [5 y+ h3 c/ [NTSTATUS 4 J# m& H/ X& Q8 fNTAPI ) Z2 W4 d5 D5 ]$ H! mZwQuerySystemInformation 5 u D4 Q# N9 o3 }( 9 q% F0 y4 N kIN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, |! G" Y u, D, B; t5 XIN ULONG SystemInformationLength, ( \4 s- x* l6 b0 P5 ^OUT PULONG ReturnLength OPTIONAL " e) v- v# Y" f! K! I); 4 R) [( P4 r* l- V# i参数意义如下 * y$ Y: J/ O2 S* ]# l( ~# ~/ ^SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 # ~+ s3 I5 w V% R. j: L# _8 I; | SystemInformation:指向一个接受系统信息的缓冲区的指针 8 M; M0 j( M' p! W0 P. w- v SystemInformationLength:缓冲区长度 . n$ z: M) h/ p8 ^% v # r; U1 z' L1 `ReturnLength:指向一个接受实际返回字节数的变量,可以为0 2 u" S! p5 R3 D. [ ' J P; ]# M; Q+ E5 O4 i为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation SYSTEM_INFORMATION_CLASS的结构如下 0 F( D3 h, ]: S* L5 ytypedef struct _SYSTEM_HANDLE_INFORMATION ) R1 b, e7 m6 ?1 o: x0 n4 Z{ 2 E( t# k& e! p+ H4 q) GULONG ProcessId; + }/ @1 v$ b0 U# zUCHAR ObjectTypeNumber; : H g4 x8 d9 f F0 B' k8 aUCHAR Flags; ( O* l8 v( \: {USHORT Handle; 3 s' \# b; Q9 z, fPVOID Object; ACCESS_MASK GrantedAccess; 4 f1 u% Q4 r. W$ p} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; ProcessId:进程标识符 H0 d: p- @( L5 R5 Y ObjectTypeNumber;打开的对象的类型 & \: x. ^0 b/ i4 h9 p0 T& [' X Flags:句柄属性标志 * c4 Z3 ^; f2 V: Z% b' J+ i0 I9 NHandle:句柄数值,在进程打开的句柄中唯一标识某个句柄 Object:这个就是句柄对应的EPROCESS的地址 ) _4 B3 J/ _, ~# n6 }8 k5 u0 lGrantedAccess:句柄对象的访问权限 & c+ K6 A/ s; ^1 S, _ / ]) x+ d% Y3 Y$ I- D下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) : Y: ~* o1 D" ]3 Q/ @* _ , o4 e7 ~: T& |! }# D5 H比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 , z8 n+ d- w# Y & f( ~) ?. c7 n; o" x怎么会这样?难道程序写错了?*_* 现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 :proc -o QQ Process KPEB PID Threads Pri User Time Krnl Time Status ! W/ c1 I" h7 Q5 XQQ 827CD520 11C 2A 8 00000B90 000008D4 Ready . A; ]1 m+ ]& m$ ` h, r 1 n' p& J% N }( n$ P0 b---- Handle Table Information ---- / W0 \8 S* P7 v4 v5 Y* U / M+ \: s6 k5 d1 v4 ]Handle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 9 T z H$ x D& h$ d# e4 M " i7 q$ O; @8 W$ T; EHandle Ob Hdr * Object * Type ; l8 _- v. }/ |% J% c3 f2 h0000 00000000 00000018 ? + h# X( X/ a$ J) M- V4 m/ `2 l0004 E2DA5E58 E2DA5E70 Section 9 w8 i0 w/ V# X% M4 x/ z" s0008 FFAB35C8 FFAB35E0 Event 000C FFAB3B08 FFAB3B20 Event 2 p5 E$ t# q( s+ q0010 85C70188 85C701A0 Event 0014 81515778 81515790 Directory 0018 FFAB7BB2 FFAB7BCA ? 001C 814A1858 814A1870 Directory # c% Y; Q0 }6 {6 [( ]9 W) }2 D0020 80288C88 80288CA0 Event 0024 E2CFE7F9 E2CFE811 ? 0028 842D7B08 842D7B20 Event 002C 80E9B989 80E9B9A1 ? 0030 E1372198 E13721B0 Section 0034 814602C0 814602D8 WindowStation 0038 81455CE0 81455CF8 Desktop 003C 814602C0 814602D8 WindowStation 0040 E2B3C1A8 E2B3C1C0 Key 5 K% o6 M/ ~2 Z& ~+ q, C. k0044 E286D6E8 E286D700 Key 0048 E2B3C0E8 E2B3C100 Key 004C E2B3C068 E2B3C080 Key ' g( p2 ]) {" ]3 R" \2 |0050 E2BEE688 E2BEE6A0 Key 8 ~9 x- V. D8 `( M7 A! I0054 8147C998 8147C9B0 Directory 0058 829D1128 829D1140 Event 9 ^4 j1 H$ N3 Y+ X3 I005C 83F991E8 83F99200 Event * E+ H* `/ w7 D' d$ v0060 E2BEE608 E2BEE620 Key : ~: A: }) M4 _# t$ t- {0064 FFB07568 FFB07580 Event " O5 @8 A! Q! {4 u: B) h0068 801747E8 80174800 Event 006C 80174828 80174840 Event 0070 845E8808 845E8820 Event 1 H# E& L k9 x/ z# a) X7 ?0074 81448798 814487B0 Event 0078 E2B9A888 E2B9A8A0 Key 007C 845E8648 845E8660 Event 0080 FF9E2DB8 FF9E2DD0 Mutant 0084 FF9E2D58 FF9E2D70 Mutant % j+ W7 D/ x3 B" ~: b, W+ l0088 83CFC378 83CFC390 Mutant 008C 801749B0 801749C8 File 0090 E2C48668 E2C48680 Section 0094 FF965168 FF965180 Event 0098 FF9E7D88 FF9E7DA0 Event 009C FFAD3DE8 FFAD3E00 Event 00A0 80AD63C8 80AD63E0 Event ; K3 X" J# s& i- s, T00A4 E28073A8 E28073C0 Key * L4 C9 A+ M* ?6 K9 p" G00A8 FF955588 FF9555A0 Thread e6 N9 n* P/ }2 Y* Y5 ^$ L- z00AC E2770728 E2770740 Key 00B0 FF923438 FF923450 Mutant , a0 }- B |1 R" l, _00B4 FFAE3B38 FFAE3B50 Mutant $ J7 Z2 Y+ z8 ~3 o0 h: v g00B8 83B80728 83B80740 Event . T) ]: q. r5 F" b, N5 a% R) m8 q: h00BC 83B80668 83B80680 Event 00C0 E2E3C448 E2E3C460 Section $ L* g9 p ]1 k9 S+ U5 T00C4 83776A08 83776A20 Thread 1 K# H8 q2 }. }8 m& v00C8 81489E48 81489E60 Event 00CC 83776CC8 83776CE0 Event ! b9 G2 o. S' v- [) h- {3 a5 m3 e( H00D0 83776C88 83776CA0 Event 00D4 83776768 83776780 Event + ?# v9 w$ h$ g) x) f5 V. p, I+ B00D8 E2837D88 E2837DA0 Key 9 i2 h* c, @8 V8 f( R; i: G4 Y00DC 8146B3A8 8146B3C0 Event # `: c7 D; r- e+ g+ {' e' Z00E0 FF908308 FF908320 Event 00E4 81494868 81494880 Event ( e' r. [& v4 I$ Q00E8 FF9064C8 FF9064E0 Event 00EC FF908FC8 FF908FE0 Event 1 C" r- l! {% Y8 ~0 d00F0 FF908F88 FF908FA0 Event V0 a- |, B# S& B8 ?00F4 FF955588 FF9555A0 Thread 00F8 FF908F48 FF908F60 Event 00FC E2CB1558 E2CB1570 Port + Z+ h1 l2 E$ @# z0100 FF90A2C8 FF90A2E0 IoCompletion 0104 E2CFE708 E2CFE720 Port w6 G+ K* o3 A1 r0108 FF90A2C8 FF90A2E0 IoCompletion 010C 837762A8 837762C0 Thread ; h! T) @. q( o% w. j2 C5 q0 {0110 8103BBC8 8103BBE0 Event / @( @; N7 g1 p* \" z0114 813DBDB8 813DBDD0 Event 0118 FF814788 FF8147A0 Event 011C E1358DA8 E1358DC0 Key 0120 E2CFC428 E2CFC440 Key 0124 8103B9C8 8103B9E0 Event ( t3 {# L. S$ Y! r+ w0128 E2C9A968 E2C9A980 Key 9 Q& {- P* h C! q4 \+ K/ C" q }) {, o2 F012C 83B34E88 83B34EA0 Event 0130 E2CFD948 E2CFD960 Key + z, r- a' ]# H x0134 83B34E08 83B34E20 Event 8 b0 B, g9 _7 {% q8 W.... + d* U3 o$ X* D4 B.....................省略 看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? % c$ j$ g" z- z1 A' k/ m7 V想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 6 r+ H2 R4 s% z. t G6 Z: i- n后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. 6 ^" n/ k" }* o; ?4 h9 f果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS 修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 ! i& Z* p Z7 z. H' R4 E 2 q- H: X0 j# C# q/ j" C7 {#include + ]: E9 A7 w! }' @5 m1 t5 V#include 8 p. W0 t/ Y$ B- y: o# R% X* o#include #include + N& r/ [, |, T, @, T/* + f5 q7 b& P3 q; n7 B8 R1 C& P( Y9 i* you''ll find a list of NTSTATUS status codes in the DDK header * ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) */ #define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) 3 A7 `! a A4 M5 c- ]#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) # n' Y2 Q% r0 H6 r( ]- R /* % f7 R" D$ o1 e3 `************************************************************************* O1 f1 D9 b. R2 d$ w* ntddk.h */ typedef LONG NTSTATUS; typedef ULONG ACCESS_MASK; /* , T( u' g; H) d Q- a" X e; D n* ntdef.h ************************************************************************* , m' a \9 ]) ?. w$ L9 [*/ /* ************************************************************************* * <> - Gary Nebbett " k; C# z: s6 u( `! z- m2 b*/ & J/ k- Q) D# B1 e: ~% [ 9 O" ]4 t& d! F; I; Qtypedef enum _SYSTEM_INFORMATION_CLASS { SystemHandleInformation = 16 } SYSTEM_INFORMATION_CLASS; / C4 o6 k8 r4 o/* " w- D2 a2 }# f*Information Class 16 */ 5 r d, H( `- T/ H+ U; i5 O6 mtypedef struct _SYSTEM_HANDLE_INFORMATION { ULONG ProcessId; UCHAR ObjectTypeNumber; ( l- P, d9 t0 Y1 y. {UCHAR Flags; 6 Y5 c3 d6 H3 X. c V' |2 cUSHORT Handle; - B+ \+ w4 L! ePVOID Object; ) ~- l6 R# k r+ b' nACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; #define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } 4 a4 f5 A4 F2 x U/* ************************************************************************* # @3 B/ c+ n5 W3 \0 R! ]* <> - Gary Nebbett ************************************************************************* # c+ M/ Q! r. K% m* I% i8 k# E*/ typedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); 6 [ e* _( L0 c; C0 _/************************************************************************ * * 2 ?7 |6 |+ S/ r- O* Function Prototype * * * + Q) E3 J3 H! {% f% e" v7 b************************************************************************/ . z3 G8 |: f8 v/ _, [0 k static DWORD GetEprocessFromPid ( ULONG PID ); static BOOL LocateNtdllEntry ( void ); % s2 _+ m; j j2 P% J 1 E- x" p2 W; l. Z* @; ], y /************************************************************************ * * * Static Global Var * * * ************************************************************************/ 4 G5 L/ ^/ _: r, G5 v1 s static RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; static ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; , F4 Q' F. K3 C4 z5 ]( H$ T0 D $ M( @1 i% E; ~static HMODULE hModule = NULL; /************************************************************************/ ) J" N% G) C# Y$ s; c 3 _$ {& P, ~3 R; L: p . ^. S, z7 V7 c/ A' |4 jstatic DWORD GetEprocessFromPid ( ULONG PID ) - g! o( `9 `# L6 q T. A) b+ {{ ' Q' H6 O% `) E" g5 M! sNTSTATUS status; PVOID buf = NULL; ULONG size = 1; * b9 F% B: g- ]ULONG NumOfHandle = 0; 7 Z) u( `6 i) G! G9 H6 a VULONG i; PSYSTEM_HANDLE_INFORMATION h_info = NULL; : C" b! m9 B) r* w* c4 h' S c/ }- Cfor ( size = 1; ; size *= 2 ) - x0 }) e1 [( Z$ M) V4 t0 f{ 5 E F# V. V1 t2 U& Y. N8 y5 Kif ( NULL == ( buf = calloc( size, 1 ) ) ) - N: \% t. n$ j0 S2 Z- n7 s{ 4 h! V4 f$ b' m% N5 jfprintf( stderr, "calloc( %u, 1 ) failed\n", size ); ' h! d4 b( h; e; Z' v7 F& Ngoto GetEprocessFromPid_exit; } 1 {) g9 X( ^& w$ `2 g9 nstatus = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); 2 P7 p5 W$ E; }, T, v( oif ( !NT_SUCCESS( status ) ) { if ( STATUS_INFO_LENGTH_MISMATCH == status ) { free( buf ); buf = NULL; } 9 o" r. l' k' W* E0 r% C4 Selse 8 l" m4 ]- J! g1 Q1 Q- C{ printf( "ZwQuerySystemInformation() failed"); ; q/ t* t* i! J$ o; \5 ]5 t# K& rgoto GetEprocessFromPid_exit; } * t. L" I; ]7 x} 6 }& _, i& r R0 {/ p0 u- L( ~: Gelse { , \% c, N; G5 s% t5 ~break; 2 S8 G0 E) e: r3 P8 l8 p8 N! x# [} } /* end of for */ " h& p$ r! s+ B! j- o //返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 NumOfHandle = (ULONG)buf; 3 f4 I6 O: P+ ]1 t: t h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); 4 |1 @/ n$ C! T" b. X2 X) f1 w$ B 6 t1 t0 k5 A5 B. G3 [6 q5 ufor(i = 0; i { 2 K$ r, q' ]" s5 E2 iif( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) 8 Q2 a b! e+ }{ printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); 6 b- J# {( p3 L) u( Y8 zreturn((DWORD)(h_info.Object)); ' Q/ |) N7 ]: G# A. N} } GetEprocessFromPid_exit: * B# R' N: e T1 c. a8 ?if ( buf != NULL ) : q2 d4 A j' |$ E9 p2 A{ & L! B) e) W. ufree( buf ); 0 l" g# ?; A6 _. S: [8 xbuf = NULL; } % t8 k' K ]# z2 k) s" |return(FALSE); } # ~! O$ M. o7 Q( q$ O& `& r /* , s+ g+ o3 \& C2 `* ntdll.dll . u8 K+ j0 _ x, B) _' z4 a*/ static BOOL LocateNtdllEntry ( void ) , w' F9 P( q$ _7 y8 t- r N{ % K# e+ F1 J9 d# H5 [- BBOOL ret = FALSE; char NTDLL_DLL[] = "ntdll.dll"; HMODULE ntdll_dll = NULL; # `7 B- B& M* X* p7 ?' m 3 W' G$ `* P9 d+ ]- W1 f+ `if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) ; r; h' K+ ~5 Q U9 _& F% d9 c{ printf( "GetModuleHandle() failed"); return( FALSE ); } 6 A) g% {7 B( L( Z* Z% kif ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) |$ J' C" J* L' G5 D' D{ q, p; k1 b# F; ^8 _+ sgoto LocateNtdllEntry_exit; } - }- }+ D& `4 R" v/ ^2 |( ~, |ret = TRUE; A! C2 C: P7 w+ T+ T l LocateNtdllEntry_exit: ( |) k' S2 R- d7 i0 m9 A9 tif ( FALSE == ret ) ) A0 j8 o: k' x3 _{ : _5 M6 I. O) K; T) Yprintf( "GetProcAddress() failed"); } 4 t- E/ c7 t" U: T' Z& sntdll_dll = NULL; return( ret ); ; G# ^+ q6 u. P( q$ V} /* end of LocateNtdllEntry */ ) b, B" V! `: {4 K( f! } int main(int argc,char **argv) 9 n/ Q6 ~ S& D/ \0 }9 a( z7 C{ - F v9 s" o6 Q* I+ e ! e0 R" d! L5 R" V4 c# ZLocateNtdllEntry( ); 5 Z# F( @& F# O5 H% J8 s! {, O/ a//打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 OpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); DWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); * q9 X- b- b' Qprintf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); return TRUE; & k; S; k+ u. ?+ w" M7 o}