获得进程的EPROCESS

韩冰

文摘内容： -------------------------------------------------------------------------------- 文摘出处：http://www.xfocus.net/articles/200406/706.html 创建时间：2004-06-01 3 X; O' A4 U& y4 h: s6 y文章属性：原创 文章提交：MustBE (zf35_at_citiz.net) By [I.T.S]SystEm32 Welcome to our web site http://itaq.ynpc.com/itsbbs/ 1 t0 b$ W$ a- n; M - [' t: u8 e4 f* Kthanks to SobeIt : P ' ^9 }" f2 D" S: j--------------------------------------------------------------------------------------------- , Q: A* c4 B3 Q5 ?1 @ 每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. % \5 ~( @5 [2 `9 T( `绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 ZwQuerySystemInformation函数原形如下 NTSYSAPI ! {6 j! m$ n, \2 T. s8 s( ZNTSTATUS ' f6 Z, m5 u9 U' l+ c/ yNTAPI ZwQuerySystemInformation ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, ) x3 Y- N) v, ^/ u8 U: u8 L9 bIN ULONG SystemInformationLength, ) v, E8 s0 u7 e7 O2 B8 iOUT PULONG ReturnLength OPTIONAL ); 参数意义如下 + G1 |4 q$ K* F3 J1 o7 U; t e SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 SystemInformation:指向一个接受系统信息的缓冲区的指针 ! |# i$ o5 c) Y5 Q9 w 4 f8 R3 A# Z4 W, H3 U* @* {" q0 d/ o2 fSystemInformationLength:缓冲区长度 , Y% b$ l6 N% O$ a4 fReturnLength:指向一个接受实际返回字节数的变量,可以为0 5 X: A H( A' V/ m: T9 T' k/ J; E0 [1 N为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation & T6 U1 M5 l4 E0 H% V7 z9 hSYSTEM_INFORMATION_CLASS的结构如下 ) t: n2 y; [% P* T7 j$ U typedef struct _SYSTEM_HANDLE_INFORMATION % J- L& `' \5 t, {: s& x% j' k{ ULONG ProcessId; UCHAR ObjectTypeNumber; UCHAR Flags; " b" o0 D# c/ g, |USHORT Handle; PVOID Object; ACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; ProcessId:进程标识符 # J$ h7 x- H+ @0 _6 R" a ObjectTypeNumber;打开的对象的类型 1 k+ `2 h* X9 v Flags:句柄属性标志 5 _$ ^* j# b4 J2 q% l % M/ V9 C7 N% ?" I6 m; {! [ VHandle:句柄数值,在进程打开的句柄中唯一标识某个句柄 Object:这个就是句柄对应的EPROCESS的地址 GrantedAccess:句柄对象的访问权限 5 G. Z" D5 R/ T. V% Y/ m2 p下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) 比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 ) g: J6 D8 I; l& q6 } Z% k怎么会这样?难道程序写错了?*_* 现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 * P7 ]- n6 [: t( o2 l :proc -o QQ - \0 H# T4 b. N& }Process KPEB PID Threads Pri User Time Krnl Time Status QQ 827CD520 11C 2A 8 00000B90 000008D4 Ready / f7 t- z2 {$ Z: E1 D# u2 M ---- Handle Table Information ---- 3 u8 }$ h. [- Q% D: y( h 8 W$ }# x) \4 o# a* S1 i# H! MHandle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 1 d% y& _/ E& `7 P; a/ H6 f' I Handle Ob Hdr * Object * Type % p q; |5 Z1 I6 e* F0000 00000000 00000018 ? K/ ?# f: G9 v7 U& B3 W0004 E2DA5E58 E2DA5E70 Section 0008 FFAB35C8 FFAB35E0 Event ' {2 `. F& q# n000C FFAB3B08 FFAB3B20 Event ! n! k% G" s1 l5 t, T2 u( W0010 85C70188 85C701A0 Event 9 Q! ]1 g4 d; d0014 81515778 81515790 Directory : E$ i4 ]( d. L: r+ d( h" G8 q* q0018 FFAB7BB2 FFAB7BCA ? ) z1 I% D( m# j: {001C 814A1858 814A1870 Directory 0020 80288C88 80288CA0 Event 0024 E2CFE7F9 E2CFE811 ? 0028 842D7B08 842D7B20 Event 002C 80E9B989 80E9B9A1 ? ) B W: b1 n% _7 \; ?0030 E1372198 E13721B0 Section ' q1 w" w* A2 W; w+ I) w; N6 V3 s' W0034 814602C0 814602D8 WindowStation ) M2 t8 k2 c/ Q: Y! o& f0038 81455CE0 81455CF8 Desktop 8 S6 k* Q9 O9 y( G" N: g6 s k003C 814602C0 814602D8 WindowStation 0 ~9 t+ |2 t: S: `& g0040 E2B3C1A8 E2B3C1C0 Key 0044 E286D6E8 E286D700 Key 0048 E2B3C0E8 E2B3C100 Key 004C E2B3C068 E2B3C080 Key 0050 E2BEE688 E2BEE6A0 Key 5 ^' ]; @% R! h! `$ i0054 8147C998 8147C9B0 Directory 0058 829D1128 829D1140 Event 0 T4 m( \0 Z9 x4 d; n0 ]005C 83F991E8 83F99200 Event 0060 E2BEE608 E2BEE620 Key 0064 FFB07568 FFB07580 Event J" b( h2 g6 D0068 801747E8 80174800 Event 2 y5 F0 L& i& X, x$ w; b0 ]: L006C 80174828 80174840 Event 0070 845E8808 845E8820 Event - m, o" ?4 Y% K7 C$ K6 k) B4 h0074 81448798 814487B0 Event 0078 E2B9A888 E2B9A8A0 Key 007C 845E8648 845E8660 Event 0080 FF9E2DB8 FF9E2DD0 Mutant 0084 FF9E2D58 FF9E2D70 Mutant 0088 83CFC378 83CFC390 Mutant + [3 W+ c; }! r008C 801749B0 801749C8 File 8 G0 A" k$ O! g' v& y3 C1 v0090 E2C48668 E2C48680 Section 0094 FF965168 FF965180 Event * }! I( p4 ~% y0098 FF9E7D88 FF9E7DA0 Event 7 |9 _5 V/ V+ Y7 Y+ W/ i" W009C FFAD3DE8 FFAD3E00 Event 00A0 80AD63C8 80AD63E0 Event 00A4 E28073A8 E28073C0 Key ) |" Z# k1 `4 A2 ]2 W) w00A8 FF955588 FF9555A0 Thread 00AC E2770728 E2770740 Key 6 a4 i+ L0 o/ T$ K$ }# L0 u& q5 r00B0 FF923438 FF923450 Mutant 00B4 FFAE3B38 FFAE3B50 Mutant 0 j# n. }7 v1 W* ?00B8 83B80728 83B80740 Event & A2 c- Y) F5 v+ A7 c$ H9 u00BC 83B80668 83B80680 Event 8 _& v/ l3 n5 K* v' Y00C0 E2E3C448 E2E3C460 Section 00C4 83776A08 83776A20 Thread 00C8 81489E48 81489E60 Event / k5 h/ _. h# i K" P; N/ M00CC 83776CC8 83776CE0 Event 00D0 83776C88 83776CA0 Event * W: _' F5 b% d/ t2 V7 x, v3 B1 X! i- P00D4 83776768 83776780 Event 00D8 E2837D88 E2837DA0 Key 00DC 8146B3A8 8146B3C0 Event 4 A* D0 L: {" k00E0 FF908308 FF908320 Event + F# m7 X3 y; }0 P00E4 81494868 81494880 Event 2 T9 I$ U. ~9 }0 [$ K$ a00E8 FF9064C8 FF9064E0 Event 6 h; i" ^2 [# O( v00EC FF908FC8 FF908FE0 Event : Y! \5 E# u- r. g; k& _00F0 FF908F88 FF908FA0 Event 00F4 FF955588 FF9555A0 Thread 00F8 FF908F48 FF908F60 Event 1 n) C, r v; t6 \8 w9 c! r00FC E2CB1558 E2CB1570 Port ' A+ p, V9 Z. D/ ~) F; E* O3 m0100 FF90A2C8 FF90A2E0 IoCompletion 0104 E2CFE708 E2CFE720 Port * b5 W+ n; r6 Y0108 FF90A2C8 FF90A2E0 IoCompletion 010C 837762A8 837762C0 Thread 0110 8103BBC8 8103BBE0 Event 0114 813DBDB8 813DBDD0 Event 0118 FF814788 FF8147A0 Event 011C E1358DA8 E1358DC0 Key + m+ G" A: U8 V0 y; M" F0120 E2CFC428 E2CFC440 Key % ]4 {8 |/ ?! P9 d0124 8103B9C8 8103B9E0 Event 0128 E2C9A968 E2C9A980 Key 9 i4 C v/ o! ^* T2 Z012C 83B34E88 83B34EA0 Event , P+ x. n5 n% ?" c! T: k0130 E2CFD948 E2CFD960 Key % ]; M# {. v; p. V0134 83B34E08 83B34E20 Event 4 F c+ P4 U$ \% j2 n& k ]. }.... 9 h- O3 p$ N+ L Q; e+ T.....................省略 $ e$ t+ R: ~$ G8 R# M& d看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? ( ?+ M) ^2 r' B2 Q想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 . {1 k) T2 c) ~6 s 后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. 3 [2 Z' H% W7 R $ l& ~+ W9 B8 v/ `" \3 G/ L" v, Z果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS + Y7 ]7 e, N Y. q4 b' M3 b ' ~; C* X4 W) u修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 #include $ H8 |7 ]6 M4 _4 M#include #include #include , k* @# j# y8 F3 o) Z$ L. X2 K/* * you''ll find a list of NTSTATUS status codes in the DDK header ! ?/ a+ @' d# X9 C% j0 X% L1 w* ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) D3 g6 v8 H& H*/ #define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) & `8 E9 \6 j* |4 S9 v& N- A( X& e#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) . m) y( ?$ L3 u, e- P7 |0 b#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) # Y" s; C0 r5 l V k* w' k) U4 M3 Q- c* G/* ************************************************************************* 7 G' r; q; r2 k% n( D1 W* ntddk.h + Q6 v( Z9 i& m*/ typedef LONG NTSTATUS; typedef ULONG ACCESS_MASK; /* * ntdef.h 7 J$ F" Y% k! V************************************************************************* 8 }( Q& l' x/ k- y* z C*/ $ w; ?+ q3 e4 c) }% y R \/* % J3 o" |( v) M+ C8 m) J5 I# v************************************************************************* & u E0 x- k7 j- M6 O# ~- F) r* <> - Gary Nebbett " H9 C4 O% _0 B0 {( X5 V& b4 X- w*/ ; f$ d( N. M; x i2 A4 b " o, B" O% W2 y2 mtypedef enum _SYSTEM_INFORMATION_CLASS { 2 y I" k+ k9 L/ vSystemHandleInformation = 16 * n2 }# u" d8 {& q} SYSTEM_INFORMATION_CLASS; 2 ^2 g8 C# N1 I* b0 `: ? | + w' A: y! v5 ^# t! e8 Z/* , z( _: j" Z6 f- U9 t& f/ O4 v*Information Class 16 * u9 o% D, X. X$ S% t1 o. k% i*/ * Q3 N% {4 g* K2 m9 L- Q4 ltypedef struct _SYSTEM_HANDLE_INFORMATION { ULONG ProcessId; UCHAR ObjectTypeNumber; UCHAR Flags; ; Y3 {8 Y( E+ D- H4 \USHORT Handle; ; |# t% C* Z+ K, ZPVOID Object; ACCESS_MASK GrantedAccess; / w0 W, s: h( f} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; & b) R- M: u& B. ?! Y #define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } /* / t& h6 L, y( ^1 Y************************************************************************* * <> - Gary Nebbett ************************************************************************* : }6 F( U% Y4 ], `*/ 4 }& \* p: Y! F% `8 Otypedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); 1 }- q6 v* z9 G& H% }' Ztypedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); /************************************************************************ * * * Function Prototype * * * / |/ S+ R7 h, _' Q+ r************************************************************************/ 8 f6 w$ g1 t9 ~; S# \+ _- S' A( J ]static DWORD GetEprocessFromPid ( ULONG PID ); ) }1 W3 s$ d2 kstatic BOOL LocateNtdllEntry ( void ); * ^3 _2 H6 P9 @( x1 }6 U % o6 p: x* t3 A) a$ `3 p1 { % O; ]7 Z1 w$ k& h/************************************************************************ * * % ]& y' f3 _1 `! ~' M* Static Global Var * ! D4 \% n5 S9 N+ p* * ; u9 y+ S; Y& C) C) m' R; k************************************************************************/ # R m( ~+ ?& y. j3 a6 a 1 A: Y! r5 d) |2 R4 \static RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; static ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; x5 D: c; i1 ?; h: `6 S% R5 hstatic HMODULE hModule = NULL; /************************************************************************/ 1 `3 y m+ _% |9 O7 b! f6 x9 J5 Vstatic DWORD GetEprocessFromPid ( ULONG PID ) 2 h3 \/ d, S- p' A{ ' R3 A/ a) N/ p" K0 M; fNTSTATUS status; , y- O$ @' T1 U5 VPVOID buf = NULL; ULONG size = 1; ULONG NumOfHandle = 0; 3 @ S' u' L J P6 D% ^% x8 V, PULONG i; PSYSTEM_HANDLE_INFORMATION h_info = NULL; , }, p" I% X3 }/ E8 o1 Y! O; }for ( size = 1; ; size *= 2 ) { if ( NULL == ( buf = calloc( size, 1 ) ) ) & ]& h3 F: i' O, c m* S{ fprintf( stderr, "calloc( %u, 1 ) failed\n", size ); - [% F w K2 W4 D, rgoto GetEprocessFromPid_exit; % y4 ^ E6 @- {( M1 r# J" r% O} status = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); if ( !NT_SUCCESS( status ) ) ; f3 C3 P- k; f{ if ( STATUS_INFO_LENGTH_MISMATCH == status ) 4 g( x" A5 s( |7 B9 P. S# ^{ : W* ~( z9 i2 I. ^2 P1 p' H# tfree( buf ); # C$ _# e3 f: q9 ?1 l5 vbuf = NULL; + y z7 k$ y. |* M} else { O6 F# R0 D$ `& A( tprintf( "ZwQuerySystemInformation() failed"); goto GetEprocessFromPid_exit; } . r3 n8 k" i) \5 Q2 J8 A$ N} else 5 m8 {! q0 P, S' F6 J) f{ break; : |1 U+ i- l* V S/ M, e} } /* end of for */ //返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 NumOfHandle = (ULONG)buf; & _" d4 Z. O6 V1 k1 ? 0 U* m' t( r* g1 O- sh_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); 1 X/ X( [( N" v6 d7 H1 P) { for(i = 0; i { if( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) { / ~' T9 ]: H! e$ D* e1 R+ y' sprintf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); return((DWORD)(h_info.Object)); } - ~, t1 |$ ? `4 K z} / K+ B1 V. `; pGetEprocessFromPid_exit: 9 W l7 r2 Y; ]) vif ( buf != NULL ) { H! r+ V2 d# F& W7 mfree( buf ); buf = NULL; } return(FALSE); } . o7 g9 S9 m% S# `2 g 1 i( ?. w; E% m- V' M" G; V/* 5 D$ O: A8 d5 R6 @% C6 V* ntdll.dll , H* k- W) u* W1 u9 ~*/ 8 x* _! w3 n1 p2 A7 y4 o6 ostatic BOOL LocateNtdllEntry ( void ) 8 w3 W! P! D& |{ BOOL ret = FALSE; 6 C1 X6 \; Q# R; ?char NTDLL_DLL[] = "ntdll.dll"; ! b. o' B3 U' E2 m" }3 J& L& {HMODULE ntdll_dll = NULL; / x2 e) [( p7 B9 N" ~ t) z" }2 h0 b4 d7 A- k2 }if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) { printf( "GetModuleHandle() failed"); 8 L( ^4 E* j( A8 w7 t/ p, Z) ]return( FALSE ); } 7 p6 W c' h" `* l4 e: Z9 Oif ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) { / r5 `) q& s: K8 rgoto LocateNtdllEntry_exit; ( S4 q7 Z7 n2 i2 n} ret = TRUE; X* A- q4 I& ~. A5 E% MLocateNtdllEntry_exit: % H8 x( V. W' L , t1 b! N0 @% z7 b/ x. rif ( FALSE == ret ) / d3 J& l( o- H5 z0 i: R' J{ printf( "GetProcAddress() failed"); } ntdll_dll = NULL; 5 j3 C2 p, T. P; _% Q$ oreturn( ret ); % m6 z3 A/ [% B4 k% \" T% v& {} /* end of LocateNtdllEntry */ & H0 I" d" d3 U+ [* e int main(int argc,char **argv) { ' [7 l: W" A* ?( ?$ f' h9 h" R ' e# W. q& m# `* {# xLocateNtdllEntry( ); + y! t5 b. h- Q//打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 * @: ]/ b( @) G: {$ M1 |OpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); DWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); 4 Z( U% y, s7 |3 O printf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); $ S9 L7 I/ d+ u0 g1 y* Xreturn TRUE; }