获得进程的EPROCESS

韩冰

文摘内容： -------------------------------------------------------------------------------- % Q* Q+ l A& |- ?文摘出处：http://www.xfocus.net/articles/200406/706.html + _+ }# ^: f+ r/ K0 s a6 A4 x5 D* e% i& N7 ~/ u- i8 I创建时间：2004-06-01 文章属性：原创 ( g W; M, v0 y+ k$ c2 l' Q8 H5 X- b文章提交：MustBE (zf35_at_citiz.net) By [I.T.S]SystEm32 0 o @0 C. W" G0 d5 e) f: r Welcome to our web site http://itaq.ynpc.com/itsbbs/ 4 d/ C5 b/ X9 `+ {) s thanks to SobeIt : P --------------------------------------------------------------------------------------------- 每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. 绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 , U; N6 w! O \7 e( e 9 u6 N2 ~7 D* |; y* A: _. JZwQuerySystemInformation函数原形如下 NTSYSAPI NTSTATUS NTAPI ) W8 E- T6 R7 C* i( wZwQuerySystemInformation ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ( Z0 H9 Q% B0 Y); + C: _, f8 y2 T 参数意义如下 / I. Q; z; v, V" a) K- z SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 & U b( m5 ^4 a% _ SystemInformation:指向一个接受系统信息的缓冲区的指针 6 |* R% X" V" G) rSystemInformationLength:缓冲区长度 ReturnLength:指向一个接受实际返回字节数的变量,可以为0 为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation 2 e# p& M7 ?' l( `8 S9 QSYSTEM_INFORMATION_CLASS的结构如下 4 w6 e* ]( x ?% Y2 i6 I* T5 B3 u 7 {! H6 n; m) b: q' N+ ctypedef struct _SYSTEM_HANDLE_INFORMATION 6 J& w) v X3 T+ Q{ 3 p3 W/ X$ @; c9 H" r7 GULONG ProcessId; $ u7 ^$ @" r% u2 fUCHAR ObjectTypeNumber; * W5 R$ W4 ] q# D8 zUCHAR Flags; USHORT Handle; & n K7 t1 Y6 ?6 h: d# M' k' VPVOID Object; 7 g5 Q3 u. i5 J& C6 k9 AACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; ' l. o2 _. A+ P+ A ( o- W4 z% x* j! qProcessId:进程标识符 ) `% e! l9 Q4 r- c3 k+ q8 A) w 2 V/ s; U* [% F3 V! b$ w9 mObjectTypeNumber;打开的对象的类型 4 S' y; b& ^2 D3 q$ e" x& r4 v ( o P; R b$ A& h4 @1 s: \2 L, T5 E0 i8 g+ yFlags:句柄属性标志 Handle:句柄数值,在进程打开的句柄中唯一标识某个句柄 * D3 s3 w( l4 w w$ ` & p9 G" z3 I% a* t* D2 u- n4 XObject:这个就是句柄对应的EPROCESS的地址 7 z3 Y/ o4 v2 \, ZGrantedAccess:句柄对象的访问权限 8 X4 k% j( a# a) Z 7 k8 F( v2 N9 V* `- `; _* W \/ M 下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) 8 R$ U2 s8 Y6 T, F2 p3 ]. m; N$ ]比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 . F4 R2 Y+ H, a) d* m3 c0 A$ b 怎么会这样?难道程序写错了?*_* " N8 Q% `' I" Y& J0 g现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 3 Z' i2 b, l, _& L2 {. F' a:proc -o QQ Process KPEB PID Threads Pri User Time Krnl Time Status QQ 827CD520 11C 2A 8 00000B90 000008D4 Ready ---- Handle Table Information ---- ) r. ?2 j2 l7 V- v7 H; l 0 S3 ~' ]* w8 O G1 ^; SHandle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 Handle Ob Hdr * Object * Type 8 t! h, i8 N7 ~0000 00000000 00000018 ? / _8 ~- y. R$ R0004 E2DA5E58 E2DA5E70 Section 0008 FFAB35C8 FFAB35E0 Event 000C FFAB3B08 FFAB3B20 Event # H: S- z2 U; v9 M" c. A0010 85C70188 85C701A0 Event 0014 81515778 81515790 Directory 0018 FFAB7BB2 FFAB7BCA ? 2 X: R5 Y6 Q( I' p. j8 r5 V001C 814A1858 814A1870 Directory ( l. {: }3 M$ J( }% R& O4 _0020 80288C88 80288CA0 Event 0024 E2CFE7F9 E2CFE811 ? 0028 842D7B08 842D7B20 Event 3 q% a. ]1 V" i+ P- _% L002C 80E9B989 80E9B9A1 ? 0030 E1372198 E13721B0 Section 0034 814602C0 814602D8 WindowStation 0038 81455CE0 81455CF8 Desktop 003C 814602C0 814602D8 WindowStation 0040 E2B3C1A8 E2B3C1C0 Key 0044 E286D6E8 E286D700 Key 0048 E2B3C0E8 E2B3C100 Key 004C E2B3C068 E2B3C080 Key % s' u- z/ j; H. z* o* ?0050 E2BEE688 E2BEE6A0 Key - M" @% C1 R- }0054 8147C998 8147C9B0 Directory 3 Z0 D: b# u) R; |: k0058 829D1128 829D1140 Event 005C 83F991E8 83F99200 Event 0060 E2BEE608 E2BEE620 Key & ]; u1 I+ t: i0064 FFB07568 FFB07580 Event . W' x$ { @/ C3 X6 q9 H0068 801747E8 80174800 Event ; q& ]9 o g( I, y- R+ W006C 80174828 80174840 Event 7 e o, z) I$ }& `0070 845E8808 845E8820 Event , O2 V# K& @2 |- C1 t" R/ D0074 81448798 814487B0 Event % t. {. G p" Y$ l0078 E2B9A888 E2B9A8A0 Key 007C 845E8648 845E8660 Event " o6 @5 Q9 H2 n0 u: s' O2 Y0080 FF9E2DB8 FF9E2DD0 Mutant 0084 FF9E2D58 FF9E2D70 Mutant 0088 83CFC378 83CFC390 Mutant \, H Q+ ]7 f7 A008C 801749B0 801749C8 File " |; n9 `7 c' ~( g: a0090 E2C48668 E2C48680 Section / G8 E3 U5 b E. ?' I+ m6 F2 P0094 FF965168 FF965180 Event 0098 FF9E7D88 FF9E7DA0 Event 009C FFAD3DE8 FFAD3E00 Event 00A0 80AD63C8 80AD63E0 Event 00A4 E28073A8 E28073C0 Key 0 a) V7 c9 l0 @/ i# W7 Y# f00A8 FF955588 FF9555A0 Thread * d9 E' K5 R* @" ]00AC E2770728 E2770740 Key * Y& d. L, _4 h: R$ m4 K9 q$ o00B0 FF923438 FF923450 Mutant ' s7 j" _, q$ ]7 r; Y( |00B4 FFAE3B38 FFAE3B50 Mutant 5 l: e% l# s7 G8 L( v00B8 83B80728 83B80740 Event 00BC 83B80668 83B80680 Event / i( ] I3 b* S) h% d& x00C0 E2E3C448 E2E3C460 Section ) v& \0 x. g0 O! I' N* H00C4 83776A08 83776A20 Thread 5 n9 g* g/ O7 N1 p+ l( T00C8 81489E48 81489E60 Event 00CC 83776CC8 83776CE0 Event 00D0 83776C88 83776CA0 Event 00D4 83776768 83776780 Event 5 \+ \9 G# h& c0 e+ e00D8 E2837D88 E2837DA0 Key * w4 p) i. C7 b% v9 e00DC 8146B3A8 8146B3C0 Event 8 w" Z0 s1 S2 y7 ^# E( X1 i% a00E0 FF908308 FF908320 Event 00E4 81494868 81494880 Event 00E8 FF9064C8 FF9064E0 Event # U' p0 X' K1 w: ]00EC FF908FC8 FF908FE0 Event 00F0 FF908F88 FF908FA0 Event / B; N) y: O6 e" d00F4 FF955588 FF9555A0 Thread 00F8 FF908F48 FF908F60 Event 00FC E2CB1558 E2CB1570 Port 0100 FF90A2C8 FF90A2E0 IoCompletion * q2 R6 K: V" U$ Q& Q* {0104 E2CFE708 E2CFE720 Port 0108 FF90A2C8 FF90A2E0 IoCompletion 010C 837762A8 837762C0 Thread 0110 8103BBC8 8103BBE0 Event 0114 813DBDB8 813DBDD0 Event $ W1 ~" q X! F0118 FF814788 FF8147A0 Event 011C E1358DA8 E1358DC0 Key # v. H0 r! f8 s+ |1 c- N0120 E2CFC428 E2CFC440 Key 0124 8103B9C8 8103B9E0 Event 0128 E2C9A968 E2C9A980 Key 012C 83B34E88 83B34EA0 Event 8 Q# Q- x6 p2 h+ I: }2 C9 t* m9 s0130 E2CFD948 E2CFD960 Key 0134 83B34E08 83B34E20 Event . I6 @% q$ L" v.... ' p% R! G, s" O+ E3 V# b.....................省略 4 G8 L0 r' o* m6 M4 L: ~; I# P! j! g 看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? 3 H: [! |* G+ H3 p' a想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 ) t& S+ h$ t# x3 {后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. 3 {1 j' o* b; s! W+ M 果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS : e# X9 d% b' H S/ V* \ 修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 ; e Q' \4 w/ u$ J #include 9 S1 ?1 a4 G l5 Z#include 0 V* V$ e1 M/ k" ~! `#include & r' H- X- Q! ~+ [1 W: _ Y' H! f#include 2 Z3 W' b x0 c& f ; r# w/ w$ _ O( _0 u o) Q/* * you''ll find a list of NTSTATUS status codes in the DDK header * ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) & u* U. ?2 f! j6 `*/ #define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) 8 p. p! A2 {7 o : H6 u+ y6 Q8 g9 h/* ************************************************************************* * ntddk.h */ typedef LONG NTSTATUS; $ y+ U7 R" B4 @2 d+ [typedef ULONG ACCESS_MASK; 0 ~4 H; i# J% a6 ?/* , y1 l* |7 b4 t: b* ntdef.h ************************************************************************* 9 g3 U* ~+ D1 m& U# h$ u* u*/ /* 7 k% J2 z" m1 [ W7 M, O************************************************************************* * <> - Gary Nebbett - `% A/ i e) z5 x*/ typedef enum _SYSTEM_INFORMATION_CLASS & H/ z$ d. w* D' m% z. J( z! g{ ! y) M, d' O# gSystemHandleInformation = 16 } SYSTEM_INFORMATION_CLASS; - l( Y' a5 K: c' y( h# |6 `8 G- X /* - p( ?$ U! e, R A, a*Information Class 16 3 Y" p2 I( q3 E' v+ ^/ Y*/ typedef struct _SYSTEM_HANDLE_INFORMATION % k- x5 x+ P# K/ J" X* {/ D{ - ^! w, V! _: P2 _/ |! {ULONG ProcessId; UCHAR ObjectTypeNumber; UCHAR Flags; USHORT Handle; 6 b! W" @" i3 h" q9 p/ UPVOID Object; ACCESS_MASK GrantedAccess; 3 V# X- H/ x& ]/ F} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; ! B" W* [, `9 o#define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } /* " X8 n% j( M) f5 T) ]************************************************************************* . K) f* ~, i& \. n* d* <> - Gary Nebbett 0 o# W0 o7 x9 _- y************************************************************************* */ - s0 @( M$ {0 V& g. s4 a% v* Etypedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); 9 D# M- ~' N# M) {/************************************************************************ * * # @1 h6 G! `) E8 _* Function Prototype * * * ************************************************************************/ $ S& G* L. {; d! `# a* t9 e4 L# X static DWORD GetEprocessFromPid ( ULONG PID ); 9 G- [% X F, `9 Cstatic BOOL LocateNtdllEntry ( void ); 0 a$ }1 q8 O6 B8 S5 @5 U ; p: }( ^$ a. L- J& n/************************************************************************ ; x6 k/ M- g" |+ R4 i& M* * & k! i, ?, v% L( V! Q4 i# O d3 c* Static Global Var * ; d2 \9 U- U# J) C. c* * ' E4 }% K$ i: R************************************************************************/ 5 J z7 ?4 W5 {6 w static RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; / \+ h' u) ?$ |% `; kstatic ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; 0 q" Y- ~" l$ |- G3 ~ static HMODULE hModule = NULL; /************************************************************************/ - T$ Q2 u. g* d' g) Z4 _ static DWORD GetEprocessFromPid ( ULONG PID ) { 7 s" t L. V0 e3 V( I6 {; INTSTATUS status; PVOID buf = NULL; ULONG size = 1; ULONG NumOfHandle = 0; 2 g9 g- S5 N) ?3 g3 P& e$ RULONG i; $ x5 V0 m" R9 V# A! YPSYSTEM_HANDLE_INFORMATION h_info = NULL; ! Q N9 a& N, f3 D4 m, p 2 }; w- j( [: u8 W' A) Dfor ( size = 1; ; size *= 2 ) { if ( NULL == ( buf = calloc( size, 1 ) ) ) ! `6 Y; {1 r6 w6 a3 R G& f9 B+ E{ & v2 B( o# l$ E0 U* Z/ [fprintf( stderr, "calloc( %u, 1 ) failed\n", size ); # p( W' l/ ^7 a$ o$ }% Wgoto GetEprocessFromPid_exit; ! S' l/ e% B# |: A* g} 8 s: y+ L' \$ }2 Lstatus = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); if ( !NT_SUCCESS( status ) ) { if ( STATUS_INFO_LENGTH_MISMATCH == status ) { ( `& M$ g6 H, N7 W7 }# Lfree( buf ); 0 c# H3 e2 Z5 d+ \- |buf = NULL; ! c6 [/ ^! J [2 _6 N' d. \} else { : ?$ S- Q" `! j/ xprintf( "ZwQuerySystemInformation() failed"); goto GetEprocessFromPid_exit; 4 L( F, @& H" I6 |3 K} : c% p2 m: g3 y$ C, J; {# S" _& W} else { break; } 3 q5 c( ]( N7 V# S Y2 z/ O2 R o} /* end of for */ 8 u" `5 l& Q/ Z* k / D& w8 h( w( U- H, B0 j2 k//返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 & |% ?2 Y O$ t' N! |* N; J, ANumOfHandle = (ULONG)buf; + f4 A7 a C( G( f0 L3 w 4 u6 E- V% Z! ^8 {h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); % b' j; s. s4 v: y1 G$ r" Z7 [ & A1 B. Q8 @* ?: B& b. ufor(i = 0; i { % n; E% j& [8 s5 i# Qif( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) { printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); return((DWORD)(h_info.Object)); } } / ^& R" R+ x( B0 y9 i+ DGetEprocessFromPid_exit: 3 s: x% ^& n4 d3 dif ( buf != NULL ) 7 A4 ?; ?) R1 E2 I* u* _4 c{ ; G5 s3 k! L, L4 H# J9 Nfree( buf ); buf = NULL; : I# Y$ O% R' n2 a6 I9 j) V} return(FALSE); 7 s8 G# z+ {$ z3 j( B' [; b} 9 w. h3 [3 v1 o/* * ntdll.dll 4 l. H) Y; _5 \ t3 k L" a2 Q*/ , a4 [& O& R& I+ @6 F2 Y! X! u" @static BOOL LocateNtdllEntry ( void ) : j9 S! h2 [1 a" ]{ BOOL ret = FALSE; / F2 \- b1 l4 s9 e) uchar NTDLL_DLL[] = "ntdll.dll"; % o/ e7 w0 R: I* C* l- |HMODULE ntdll_dll = NULL; 4 v" q3 r+ ?7 Z! j/ c2 b' J5 { if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) 4 S/ V8 O* m) i7 z- R{ $ _/ T. {' l) _3 s \# X5 [/ bprintf( "GetModuleHandle() failed"); ' q+ {* w: i$ n0 ~, @. creturn( FALSE ); } if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) 2 s& {8 {) V/ M" H: P- F{ goto LocateNtdllEntry_exit; : U* ]' \% p: |) U1 `} ret = TRUE; LocateNtdllEntry_exit: 5 j+ [5 k X$ z/ Q k3 }if ( FALSE == ret ) 0 N' s, c9 \8 S, D; Y8 w1 @{ $ [+ N% \/ e! k- @( V2 kprintf( "GetProcAddress() failed"); : P5 w- i; y, @% L# h9 e5 g} ntdll_dll = NULL; return( ret ); } /* end of LocateNtdllEntry */ ; W. U. H& Y+ y. p int main(int argc,char **argv) ! c9 {0 [0 X! ]. Y p7 a0 |' I{ % t+ H! \7 ^6 A' n6 D: h% ]- w - u# p) r, a& t; Y3 }6 _LocateNtdllEntry( ); 1 ~4 X/ p1 x2 W4 l& o7 u; `0 u- V U, h //打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 . y& F* J4 W3 {1 T, W8 K% ^; a$ o) G6 IOpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); / u) ~( w9 K% e7 t- VDWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); ) r3 v8 T1 V" Lprintf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); 9 a9 _) L0 |( i& n) Z, o6 v8 B- \( |' _ return TRUE; ) |, O6 m. z6 U! A7 y4 Y* f}