获得进程的EPROCESS

韩冰

文摘内容： -------------------------------------------------------------------------------- 文摘出处：http://www.xfocus.net/articles/200406/706.html 4 z& m) Y" g4 U# m1 Z% u/ d & o5 z" p1 i- D4 z创建时间：2004-06-01 文章属性：原创 # P; D( c5 }6 M% c文章提交：MustBE (zf35_at_citiz.net) : I. }! ]$ @# O) N( W) ]' G: S6 FBy [I.T.S]SystEm32 i, h3 j1 G. AWelcome to our web site http://itaq.ynpc.com/itsbbs/ 3 s0 T. J3 k6 k- |0 s , a# u- o( g9 F' ethanks to SobeIt : P --------------------------------------------------------------------------------------------- ( K& _0 I2 }" o 每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. 2 e+ F6 a2 O. K3 A 绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 # j! w6 C& O& i% E* t+ k ZwQuerySystemInformation函数原形如下 " ~6 M. G# D9 |$ f NTSYSAPI NTSTATUS NTAPI & O: K3 p0 a9 `3 X7 v5 kZwQuerySystemInformation 2 |( i" H* F& S' A( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, 3 X6 c* t L1 y. Q% E7 @IN OUT PVOID SystemInformation, ' j1 T% s" X! w. {) V' D( vIN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); " y$ e% X( h, j8 A, k 参数意义如下 ' E: o d3 y# D9 g/ m ! O8 h2 L0 L) e7 }& z, o0 I e8 }SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 h: M5 b9 X( @: H9 O/ ~# o+ a9 Y) a 2 _# ^; Y9 R( pSystemInformation:指向一个接受系统信息的缓冲区的指针 ! m# Z1 d- ~# V$ u! ^' {9 h2 {( \ SystemInformationLength:缓冲区长度 $ z9 d- q/ d" \8 iReturnLength:指向一个接受实际返回字节数的变量,可以为0 6 n/ E) g# c- s& q1 Q. m/ a为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation SYSTEM_INFORMATION_CLASS的结构如下 2 D- A' @; h7 K3 N6 I typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG ProcessId; ; d4 w9 s# P+ }7 HUCHAR ObjectTypeNumber; UCHAR Flags; ~+ y( y8 f; s) A+ OUSHORT Handle; $ \' F' r b, j$ K' EPVOID Object; # P( l% I; N! F8 sACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; ProcessId:进程标识符 , ]9 @# d, ^$ ~7 J# Q( i 7 x" Z6 z) e _' z: c. t6 c7 ]ObjectTypeNumber;打开的对象的类型 2 e4 @/ Q) a" ]; L, m2 ?) ~ $ o& V! i2 u4 P' F- K, C$ e! S& jFlags:句柄属性标志 Handle:句柄数值,在进程打开的句柄中唯一标识某个句柄 Object:这个就是句柄对应的EPROCESS的地址 / t- |: n S! K GrantedAccess:句柄对象的访问权限 8 K: h% H! A0 e% G3 o & c; E) |) Z! } $ ~- x# V% [/ o- R/ p下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) 9 L p+ e9 F9 X8 O* Z 比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 怎么会这样?难道程序写错了?*_* . d% `3 I' |) a9 H8 X 9 l) v, `8 I* f, s' J- ~现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 :proc -o QQ . M! b% I y j; ^0 F4 bProcess KPEB PID Threads Pri User Time Krnl Time Status ( b3 Q; P2 h% k' }' dQQ 827CD520 11C 2A 8 00000B90 000008D4 Ready ; G+ E2 H% p" }3 g+ f7 j+ X: Z" G% e3 S 6 E$ z5 c9 u. v- s- n0 f% N---- Handle Table Information ---- 4 @8 e) K- u5 k7 y" ?) J2 c4 VHandle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 Handle Ob Hdr * Object * Type 0000 00000000 00000018 ? 0004 E2DA5E58 E2DA5E70 Section 0008 FFAB35C8 FFAB35E0 Event 000C FFAB3B08 FFAB3B20 Event 0010 85C70188 85C701A0 Event " {- w5 V6 v' G" T% [- t0014 81515778 81515790 Directory * g; q7 K0 W1 x! A1 V, y0018 FFAB7BB2 FFAB7BCA ? 001C 814A1858 814A1870 Directory % O8 b1 k7 |% z8 A3 p0020 80288C88 80288CA0 Event 0024 E2CFE7F9 E2CFE811 ? 9 J' F2 e$ P V% [0028 842D7B08 842D7B20 Event 002C 80E9B989 80E9B9A1 ? ' m2 S' ?" Q& l& {1 [7 ^0030 E1372198 E13721B0 Section 4 T/ J' ~& e m2 _ T; B2 ^* x+ |0034 814602C0 814602D8 WindowStation 0038 81455CE0 81455CF8 Desktop - L8 c4 f! [6 B7 ?( n) n003C 814602C0 814602D8 WindowStation $ n% i, H4 ~* R: P* f4 l; x0040 E2B3C1A8 E2B3C1C0 Key 0044 E286D6E8 E286D700 Key 0 [; c# n- }% r# p' c" b0048 E2B3C0E8 E2B3C100 Key ; W! ?2 Y$ i3 u2 J: [- U, F004C E2B3C068 E2B3C080 Key - w% K$ A/ i7 p" z. N) Y# p8 I0050 E2BEE688 E2BEE6A0 Key 1 t- [0 r( Y, @0054 8147C998 8147C9B0 Directory 0058 829D1128 829D1140 Event # @; r$ ?% @1 X6 g z: N005C 83F991E8 83F99200 Event 0060 E2BEE608 E2BEE620 Key ) d6 E) A7 t4 ]" O3 C! \" k2 O1 f0064 FFB07568 FFB07580 Event / z9 B0 ]: S$ Q0068 801747E8 80174800 Event 5 x# t; j6 K$ d1 H7 d4 T006C 80174828 80174840 Event 0070 845E8808 845E8820 Event 0074 81448798 814487B0 Event 0078 E2B9A888 E2B9A8A0 Key ( d% b& h* o3 Y; _7 H2 p! v% _# c007C 845E8648 845E8660 Event 0080 FF9E2DB8 FF9E2DD0 Mutant $ u* g2 N/ y' M1 {9 Y0 \3 T0084 FF9E2D58 FF9E2D70 Mutant 0088 83CFC378 83CFC390 Mutant 008C 801749B0 801749C8 File # D" p! \ ^) K7 e0090 E2C48668 E2C48680 Section . n5 K; r/ _5 i- W0094 FF965168 FF965180 Event 0098 FF9E7D88 FF9E7DA0 Event ! q( V7 E* Y# N; e009C FFAD3DE8 FFAD3E00 Event ; H! ]; G7 q- T+ k) z9 X00A0 80AD63C8 80AD63E0 Event : T; F6 A: Z; G' {! T; Z( P00A4 E28073A8 E28073C0 Key ! U: s+ h7 y0 ]) ^5 O1 E) L00A8 FF955588 FF9555A0 Thread 00AC E2770728 E2770740 Key . s* q1 b3 `2 c00B0 FF923438 FF923450 Mutant 00B4 FFAE3B38 FFAE3B50 Mutant 7 r; r; I' g! M00B8 83B80728 83B80740 Event 9 A; g, O: y7 {00BC 83B80668 83B80680 Event 6 A. x$ m8 b: b+ d00C0 E2E3C448 E2E3C460 Section 00C4 83776A08 83776A20 Thread 00C8 81489E48 81489E60 Event 2 l' C, i5 g% n4 [' [7 ~00CC 83776CC8 83776CE0 Event + O5 }+ p) O. \! _ c/ J. w2 ]00D0 83776C88 83776CA0 Event 00D4 83776768 83776780 Event 00D8 E2837D88 E2837DA0 Key 3 }, z% L- |2 {% x, \% x# a+ `: \/ I00DC 8146B3A8 8146B3C0 Event # [. e. s. B- W00E0 FF908308 FF908320 Event 00E4 81494868 81494880 Event 00E8 FF9064C8 FF9064E0 Event ! @4 f' \8 A; }00EC FF908FC8 FF908FE0 Event 00F0 FF908F88 FF908FA0 Event 00F4 FF955588 FF9555A0 Thread 00F8 FF908F48 FF908F60 Event . Y0 [1 R1 e" _00FC E2CB1558 E2CB1570 Port , @/ Q. Z+ ~; g1 K0100 FF90A2C8 FF90A2E0 IoCompletion 0104 E2CFE708 E2CFE720 Port ! P ~# I/ U1 e6 H5 s- p0108 FF90A2C8 FF90A2E0 IoCompletion % a6 G" R: x D+ ]! Y010C 837762A8 837762C0 Thread 0110 8103BBC8 8103BBE0 Event 5 p9 ^; ]: e# N% R3 s0114 813DBDB8 813DBDD0 Event 0118 FF814788 FF8147A0 Event 011C E1358DA8 E1358DC0 Key 0120 E2CFC428 E2CFC440 Key 0124 8103B9C8 8103B9E0 Event * m; K* D# {. o7 k/ B$ q4 v0128 E2C9A968 E2C9A980 Key 012C 83B34E88 83B34EA0 Event 0130 E2CFD948 E2CFD960 Key 6 m% ^3 r6 {3 s7 W: S; L0134 83B34E08 83B34E20 Event . b S" Q' h; L.... .....................省略 2 b {. J: }' |. T R6 {6 S看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? 想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 ; h6 g" i. D# E# `' W5 p' o ! q0 g! C4 |% Y可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 0 f* v, i/ M# l t. F9 k7 k1 W 后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. 3 P( U; e7 P/ U果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS . [; j% Z, y* W( q# p! f; \( \- M 修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 & B1 ~$ h' ~% A' y/ D#include #include #include 6 z0 R4 v7 I2 R. G/ ]+ o#include ( _- l: Y- p: ^/* * you''ll find a list of NTSTATUS status codes in the DDK header * ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) */ #define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) ' _$ G6 K' L1 C+ N9 o6 |1 h# R#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) 4 a* ?& v! c2 c6 j7 K% a* u) G# ] ' X* [. \( k G% ]8 A/* 4 R' [; h O$ w- f; m( X- @************************************************************************* * ntddk.h ) b3 [' `4 ]8 V+ ]) w8 l*/ / i6 v1 _0 ~3 x6 s+ P0 ~2 Ctypedef LONG NTSTATUS; typedef ULONG ACCESS_MASK; /* 3 m8 E/ s6 \6 U! O* ntdef.h 1 P2 m% R! g6 A' Y8 e) M" D, H2 w************************************************************************* ! f0 w! c! z, d$ i3 g$ T0 B) @*/ 9 P; ?7 V _2 ^ B$ |6 j. X% P C0 ?/* & M) ^, ?0 v. ~2 Z3 ^( h4 d************************************************************************* * <> - Gary Nebbett */ : |3 m4 J! j+ k, V* j& [+ Dtypedef enum _SYSTEM_INFORMATION_CLASS { - s L* N6 a. E) g* LSystemHandleInformation = 16 1 ^: e- e( @! a} SYSTEM_INFORMATION_CLASS; /* 0 l: L8 A/ \& W*Information Class 16 */ : {" w+ t* O* ]0 X; z/ Stypedef struct _SYSTEM_HANDLE_INFORMATION ; e' H2 X% G4 i; y{ ULONG ProcessId; # K0 |! o( ]1 r" x0 h' \0 I, G" T iUCHAR ObjectTypeNumber; UCHAR Flags; % l- `9 |1 B" hUSHORT Handle; 3 ?! }' L. @1 x0 {: r7 i5 A" sPVOID Object; ACCESS_MASK GrantedAccess; ) o) ?5 i/ B# w% j( z' y} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; 5 l7 G4 p; f r& M7 V #define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } * F5 w' `6 j* i/* ************************************************************************* * <> - Gary Nebbett ************************************************************************* # e' X a2 g3 H K) }* N*/ typedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); % J a" Q- w0 ^3 d; G/************************************************************************ * * ; j* |& H7 L" ?& k4 s* Function Prototype * * * ************************************************************************/ static DWORD GetEprocessFromPid ( ULONG PID ); " E* d+ k# `$ ustatic BOOL LocateNtdllEntry ( void ); " D4 F; L3 S4 x; k$ `) a ' `9 Z+ `# x- G0 C7 h! S " j! i0 H) Y7 d( S" w, D/************************************************************************ 7 O3 \$ R4 E" u+ R+ ?. `6 S& X* * * Static Global Var * ' ?4 I. M* c: T' f, z* * % y% Q7 T# F+ Y/ Q1 L9 P* ?************************************************************************/ static RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; static ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; ) o5 \9 E& ]6 @static HMODULE hModule = NULL; : k W+ h" g0 K: i8 M3 r) n7 k0 n/************************************************************************/ 2 Q9 b& S) P" `- E5 \ static DWORD GetEprocessFromPid ( ULONG PID ) 1 r# r' n1 T# Z1 ^{ - @: m/ p( E7 B9 O! SNTSTATUS status; PVOID buf = NULL; ULONG size = 1; ULONG NumOfHandle = 0; ULONG i; 6 E% ]; c7 V- c" Z% t2 ePSYSTEM_HANDLE_INFORMATION h_info = NULL; 9 q" Z, q3 d5 J$ f9 ] for ( size = 1; ; size *= 2 ) { if ( NULL == ( buf = calloc( size, 1 ) ) ) { fprintf( stderr, "calloc( %u, 1 ) failed\n", size ); 6 h4 A. t5 H% i5 L3 W$ j" D0 k; v8 rgoto GetEprocessFromPid_exit; ! Q* j& B+ m0 D- Q& _} status = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); $ Y6 W+ Y# z8 U. Q/ _if ( !NT_SUCCESS( status ) ) 3 j% Y% t+ t4 M! a9 A9 y{ if ( STATUS_INFO_LENGTH_MISMATCH == status ) ) Q* P3 w! {/ u1 C( v* X{ free( buf ); 4 p0 q1 r! X5 d, X- B+ Ubuf = NULL; ) W; R: J/ V% `, V8 y S} * `) L j: l5 |4 t4 N5 Y- y( helse % U- O7 d- d, t8 U, [0 [{ printf( "ZwQuerySystemInformation() failed"); goto GetEprocessFromPid_exit; [5 ~; c7 [9 d( M# a: j} 3 b$ I! p8 [8 A- k4 D* ]} else * Z F) j! ?! x& J/ B{ ' z; \- M6 X8 E4 \break; ) e7 }6 Q: W3 W9 j: ~' k2 p& c} 2 } W3 i, K5 }. w" `1 w} /* end of for */ . ?! p8 @* M$ d! w! O; \/ [' Z7 K//返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 NumOfHandle = (ULONG)buf; h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); for(i = 0; i { / T0 U+ E$ \$ L3 h& j* `if( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) % z( E8 O9 M1 x{ 7 D& g6 s8 K) hprintf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); ) s+ x4 u( y2 d" T ~return((DWORD)(h_info.Object)); ( n1 C/ O8 K) G$ ~0 z1 C7 ~$ k} } GetEprocessFromPid_exit: % U2 I" Z2 Q; ^' hif ( buf != NULL ) { free( buf ); buf = NULL; } return(FALSE); ( @* k1 z4 j: B: g. r# t: p, O} % f, l/ W" V% K0 y' g! l5 ?$ y2 R 5 J) k7 a. K3 @6 T- n/ S % K: G' e) `& V! i+ g. `/* * ntdll.dll ( @, E/ o! M9 r8 C3 r# Q/ `*/ 9 Z- }. P# n/ @8 z" y; gstatic BOOL LocateNtdllEntry ( void ) + W( g/ e6 u# n5 U. ^* X; ?; O* E{ $ O5 W0 M0 U. j- H0 J e8 iBOOL ret = FALSE; char NTDLL_DLL[] = "ntdll.dll"; HMODULE ntdll_dll = NULL; " A2 b" q# e) s7 n9 ~ if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) { 4 M2 |* s3 N' C: {printf( "GetModuleHandle() failed"); 5 R8 K; u& P; ]2 U' H4 x9 _9 Y. rreturn( FALSE ); } 9 h% f: G8 r4 A& E; F; v, ]if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) { ' S% a4 M$ Z4 |2 | ~5 K7 H6 ^goto LocateNtdllEntry_exit; } ret = TRUE; LocateNtdllEntry_exit: / Z) {9 L1 |: \ " V3 v4 z8 c; M# a! O# K. _if ( FALSE == ret ) - Z0 X$ S" x5 v' F1 |' J2 r5 B{ printf( "GetProcAddress() failed"); 0 @; Q4 ^% T4 B1 w( p} , y1 C* o& f3 [3 ^, i9 ~4 W% `7 @/ j5 antdll_dll = NULL; return( ret ); } /* end of LocateNtdllEntry */ 4 x* X6 K4 A* l0 T) u# ^0 M int main(int argc,char **argv) { 7 F# b/ W4 T$ F% U, c _) c) r % Y5 Y5 l: T) c$ o. i( O0 W$ \LocateNtdllEntry( ); - E1 i8 D6 i+ j//打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 ( h Q: N% }# i8 C$ ~* N5 kOpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); * t3 ^% U) ^+ v$ ~9 I' B9 NDWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); . ~) ~# q$ ` B+ M4 f" ] printf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); ) m8 @ k6 j5 V# g return TRUE; }