获得进程的EPROCESS

韩冰

文摘内容： -------------------------------------------------------------------------------- ' P0 p0 L8 J4 T/ L/ y- W% C' \' [( j文摘出处：http://www.xfocus.net/articles/200406/706.html 7 P2 v0 b5 u0 \+ v% X; M( i创建时间：2004-06-01 文章属性：原创 文章提交：MustBE (zf35_at_citiz.net) By [I.T.S]SystEm32 - s( k& ~# |5 E. O4 M1 I& |8 X0 P ) T6 H7 h; H! U8 m' C0 CWelcome to our web site http://itaq.ynpc.com/itsbbs/ ' P( N/ c' A/ y! u1 A thanks to SobeIt : P : _1 n) ?* S& c& B--------------------------------------------------------------------------------------------- 9 N" @2 k. `6 a- W2 u# e h0 f 每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. " O: b1 k6 H P4 o& ]5 Y( ]绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 ; q$ I; i5 E5 ?+ Q3 X, U$ NZwQuerySystemInformation函数原形如下 NTSYSAPI NTSTATUS 8 Q9 \( E, b6 z% ^' KNTAPI ZwQuerySystemInformation ( ! L$ D* o* u7 i) x, t# z6 f& ]1 SIN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); 参数意义如下 & ^, f( y( T7 B. w9 W$ n7 ` SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 + U2 J R! D9 t' l: a; W ; O8 ~/ m t( hSystemInformation:指向一个接受系统信息的缓冲区的指针 5 t8 Z4 b6 n4 N+ K- d6 i5 k SystemInformationLength:缓冲区长度 ' l4 n( a( M! e2 x, J ReturnLength:指向一个接受实际返回字节数的变量,可以为0 , l/ ]6 d/ H, \9 t, s2 S 6 N# S- C& x4 N; V% `/ ^) ?. t 1 J" _, r( e" x9 ]. e为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation SYSTEM_INFORMATION_CLASS的结构如下 typedef struct _SYSTEM_HANDLE_INFORMATION { : F6 M9 T$ ^0 W$ N6 [ULONG ProcessId; UCHAR ObjectTypeNumber; 7 \2 U: h. ?: U. XUCHAR Flags; * q1 F' Y3 [8 a/ z& VUSHORT Handle; - I/ b# O4 c3 _PVOID Object; ; s$ f+ G3 V. k" V' B+ G. UACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; ' _) F1 U1 N/ D# V/ M/ _" ? : I2 S4 N8 w9 @, {: PProcessId:进程标识符 & m: B% }! a5 s% d& W" B5 C+ _ , E( @4 D4 F/ SObjectTypeNumber;打开的对象的类型 . ^! }9 z5 _8 [* L$ G6 w Flags:句柄属性标志 # F% m' o; u* N1 Z Handle:句柄数值,在进程打开的句柄中唯一标识某个句柄 3 u* {% H1 R+ V7 I. A Object:这个就是句柄对应的EPROCESS的地址 0 }6 ~/ J) g& i* u6 O; A6 E - h& y' \) k6 ?! k- E, U4 ZGrantedAccess:句柄对象的访问权限 " D+ N4 X( ^3 I$ _/ i7 o ; l. V( f/ P4 j& N 下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) 比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 ' d i; Q! c* b. f9 G 8 b" Y' o+ {* h0 s0 z+ a' {怎么会这样?难道程序写错了?*_* # m& n2 B, x K, P. n( v; a现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 * Z! a5 K$ A+ ]* e$ U :proc -o QQ ' ?- e8 B, u6 t2 u! FProcess KPEB PID Threads Pri User Time Krnl Time Status 9 E8 u i! ^& \QQ 827CD520 11C 2A 8 00000B90 000008D4 Ready & m& G8 ?8 _& C6 N7 o1 O$ K% x* g / H) g3 m. x, g, Z---- Handle Table Information ---- Handle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 5 y0 L4 L% Q/ B$ @/ U2 C9 l Handle Ob Hdr * Object * Type 0000 00000000 00000018 ? 0004 E2DA5E58 E2DA5E70 Section 0008 FFAB35C8 FFAB35E0 Event 000C FFAB3B08 FFAB3B20 Event 0010 85C70188 85C701A0 Event + S( P) l. u- N( P$ o7 O0014 81515778 81515790 Directory 9 {! c) |7 [- M( Q t) a0018 FFAB7BB2 FFAB7BCA ? 001C 814A1858 814A1870 Directory 0020 80288C88 80288CA0 Event 0024 E2CFE7F9 E2CFE811 ? 6 M) W3 |# q" K: F& W0028 842D7B08 842D7B20 Event , g) X% z1 H7 d7 _! w' Q* e002C 80E9B989 80E9B9A1 ? 7 M* J$ e& v4 A( u% r0030 E1372198 E13721B0 Section ( Y. v+ o X" j0034 814602C0 814602D8 WindowStation 2 r' b! Y* Q* [$ u: m& Q0038 81455CE0 81455CF8 Desktop 003C 814602C0 814602D8 WindowStation / z/ d! f# @/ d1 \0040 E2B3C1A8 E2B3C1C0 Key . _. _8 m* W- y4 ]$ U' E* k5 F0044 E286D6E8 E286D700 Key ' x" Q) D, c) P' J* e3 y" Z! \# u0048 E2B3C0E8 E2B3C100 Key 004C E2B3C068 E2B3C080 Key & F( D N' C/ N. |* ]0050 E2BEE688 E2BEE6A0 Key 0054 8147C998 8147C9B0 Directory 0058 829D1128 829D1140 Event 005C 83F991E8 83F99200 Event 0060 E2BEE608 E2BEE620 Key 2 C2 ~7 G# c. Z' B0064 FFB07568 FFB07580 Event 5 C" {) V! U! n" N0068 801747E8 80174800 Event + w. Q4 b2 k V* v# k8 V006C 80174828 80174840 Event ' u5 y: ]" }2 x) W# M8 E A. p0070 845E8808 845E8820 Event 0074 81448798 814487B0 Event ( c3 r/ e" O, s. l+ H& q9 Y0078 E2B9A888 E2B9A8A0 Key % t z* m3 F' [+ p! X' Q% R, B007C 845E8648 845E8660 Event 0080 FF9E2DB8 FF9E2DD0 Mutant 0084 FF9E2D58 FF9E2D70 Mutant 0088 83CFC378 83CFC390 Mutant * _0 Q* h% ]0 E; E008C 801749B0 801749C8 File , G% W+ x m5 a7 r, x; X! x0090 E2C48668 E2C48680 Section 0094 FF965168 FF965180 Event 0098 FF9E7D88 FF9E7DA0 Event 009C FFAD3DE8 FFAD3E00 Event 9 U! ^+ ?) N0 j6 f00A0 80AD63C8 80AD63E0 Event 00A4 E28073A8 E28073C0 Key 00A8 FF955588 FF9555A0 Thread 3 g2 N2 G, V d& e' O00AC E2770728 E2770740 Key 5 }, z7 E9 z" Q- [ i& V00B0 FF923438 FF923450 Mutant 00B4 FFAE3B38 FFAE3B50 Mutant " n$ |( c' T7 \, m00B8 83B80728 83B80740 Event 2 O! A' C' D+ c3 S00BC 83B80668 83B80680 Event " }; r' X+ X1 X3 @) a6 @% _0 `- h0 D7 ~00C0 E2E3C448 E2E3C460 Section % V9 I- \4 d# E' E00C4 83776A08 83776A20 Thread ( }# C" N8 I* o5 @00C8 81489E48 81489E60 Event + x) x, V) r+ K% e! d4 w5 }: N5 c00CC 83776CC8 83776CE0 Event 00D0 83776C88 83776CA0 Event V1 Q0 o% v; R- Z- {' X00D4 83776768 83776780 Event 00D8 E2837D88 E2837DA0 Key 3 ?, ?/ ^0 U- E00DC 8146B3A8 8146B3C0 Event ' b9 o& k, I n3 O: c# F: N00E0 FF908308 FF908320 Event 00E4 81494868 81494880 Event 00E8 FF9064C8 FF9064E0 Event ' b' Y7 F; i# \9 T3 f {# U00EC FF908FC8 FF908FE0 Event " T' a, _+ m$ r* k00F0 FF908F88 FF908FA0 Event 00F4 FF955588 FF9555A0 Thread - \9 v: \" O9 l; P# F7 O00F8 FF908F48 FF908F60 Event 00FC E2CB1558 E2CB1570 Port 0100 FF90A2C8 FF90A2E0 IoCompletion $ S9 A' [: ^* ]3 ]- G0104 E2CFE708 E2CFE720 Port " M% C9 s$ f% O# Z0108 FF90A2C8 FF90A2E0 IoCompletion ; @& i7 H8 \$ H010C 837762A8 837762C0 Thread 0110 8103BBC8 8103BBE0 Event 0114 813DBDB8 813DBDD0 Event 0118 FF814788 FF8147A0 Event 011C E1358DA8 E1358DC0 Key 4 N" v% [8 `1 v8 q0120 E2CFC428 E2CFC440 Key / P1 \1 i7 T( q; F3 n0124 8103B9C8 8103B9E0 Event 0128 E2C9A968 E2C9A980 Key $ v. u9 x! o$ T- p3 x0 y" f012C 83B34E88 83B34EA0 Event 4 a4 D4 N: n+ P0130 E2CFD948 E2CFD960 Key 3 m, @3 D; n% p1 z0 P0134 83B34E08 83B34E20 Event ( X, \+ W# Q0 b6 [7 a4 J, n4 P.... + M9 T3 n5 I9 Q9 L/ b.....................省略 7 T, E% F% |* n, p/ |看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? - E" |7 r. K3 r o7 m) `) `" k5 ~ / O4 e7 j/ L3 Z$ H" `2 R8 w. Z) z+ P6 g想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 . h' B1 C8 }' X0 g后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. . H5 Z) b2 ^! ?9 f. m5 B: s果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS 修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 #include #include #include 6 v# T! W& u9 o6 z3 b- n7 H/ O#include / T6 m! l% F9 P) s6 ~/* * you''ll find a list of NTSTATUS status codes in the DDK header : M9 {( y9 h+ F) T# m8 |* ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) 2 J. I! ?7 ~$ [*/ #define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) 2 K4 X3 Y3 B6 s# w; K#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) 0 m2 u3 m- i% K/ l3 c3 m#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) ( r8 D7 u N0 O7 V 3 R8 \+ R. Y5 T6 ^* ~+ _1 b' _/* ************************************************************************* 4 t6 L- O# }9 k. v+ Y: a* ntddk.h " d/ x" g+ }. _( n; c*/ typedef LONG NTSTATUS; , B, y5 X n: S. {, r$ mtypedef ULONG ACCESS_MASK; /* # f! X6 v1 h% X$ k, x B- W5 l* ntdef.h ************************************************************************* */ # f1 ], R2 F' R/ n0 Z/* 7 }) b: }: F0 @; u' ]$ F1 D************************************************************************* ' R& t! g0 ]; g- @4 h* w* <> - Gary Nebbett */ 2 f' j7 A# C7 |! u8 B: V2 z Q typedef enum _SYSTEM_INFORMATION_CLASS { SystemHandleInformation = 16 } SYSTEM_INFORMATION_CLASS; ' R$ i+ J/ J% K5 k3 l /* *Information Class 16 / v: I4 V! }( b% Z* ^*/ typedef struct _SYSTEM_HANDLE_INFORMATION . k1 u: U- k9 u# j' i8 Y/ {2 @{ . q7 j' ~$ F9 MULONG ProcessId; . N( R! ]+ @1 N GUCHAR ObjectTypeNumber; UCHAR Flags; USHORT Handle; : C4 Z0 Q' k% F. D5 IPVOID Object; ACCESS_MASK GrantedAccess; + {+ I. S4 `) Q2 ]) w/ ~1 L} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; 1 Q, t0 Z% a$ R' @) `( @7 d6 R#define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } /* " K$ z! R5 L; U! M' P************************************************************************* * <> - Gary Nebbett ************************************************************************* * ?# [) D7 M9 S, i: N9 d7 I*/ 1 C. Y4 R$ @+ _" N2 @3 ?6 Ttypedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); & d) g% Y0 I$ a/ Ztypedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); /************************************************************************ * * * Function Prototype * : C) Q8 H* Y0 L% H; b( [7 M2 f, k* * ( `+ @5 E4 q$ y3 {************************************************************************/ static DWORD GetEprocessFromPid ( ULONG PID ); static BOOL LocateNtdllEntry ( void ); % `# n3 o' I; d& P- b /************************************************************************ , _- y# _' U) [* S# x* * * Static Global Var * / ^ h; W5 B. C3 N B1 H* * , t3 m5 v" A. y4 A* y9 q************************************************************************/ static RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; ! h2 |; _6 I7 b7 E- D9 Y6 ?1 d7 Dstatic ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; + [) L9 C2 @1 @" astatic HMODULE hModule = NULL; /************************************************************************/ 0 v" E% [0 U3 q+ i3 |, [1 s. ^ D static DWORD GetEprocessFromPid ( ULONG PID ) { NTSTATUS status; ; ~& E4 C" z. l: EPVOID buf = NULL; ULONG size = 1; ) x& T7 g% J7 I" J/ j# ~ULONG NumOfHandle = 0; 3 B3 G' L6 O9 U2 \; I% I4 BULONG i; 9 C" ]* ?# n8 w. ?9 y3 LPSYSTEM_HANDLE_INFORMATION h_info = NULL; . y: ^, T5 ^# Y ]( F I( Z3 X; Z2 [- ufor ( size = 1; ; size *= 2 ) 3 f9 L( G3 z9 V. g; _8 ~; @{ 0 F! e, f9 Q5 O2 |3 Qif ( NULL == ( buf = calloc( size, 1 ) ) ) 7 B4 w+ A& {9 N {{ fprintf( stderr, "calloc( %u, 1 ) failed\n", size ); # J4 C7 M! K2 n$ X1 pgoto GetEprocessFromPid_exit; } ( r$ a& X. Y' w6 ]% K6 _status = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); 8 D. `7 I" w! h3 A( v& Vif ( !NT_SUCCESS( status ) ) { , r6 w/ ?) q9 }% Q7 a. Fif ( STATUS_INFO_LENGTH_MISMATCH == status ) { 6 _; n2 l6 s1 g4 Ufree( buf ); . {: |* I D7 |; I% r* }- D" a; Xbuf = NULL; } else # R% B w A6 w8 s3 v. s- h{ 8 E- N3 T/ r7 E7 r b$ Qprintf( "ZwQuerySystemInformation() failed"); & l% X T& M( G% Q" Kgoto GetEprocessFromPid_exit; } } * _! |8 C% J! lelse { 4 s4 y- \ B1 r' t6 G/ ^break; } } /* end of for */ 0 u0 w5 X k* I7 r! m: x5 \//返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 NumOfHandle = (ULONG)buf; # Y2 P2 P% z* U2 ^3 v: Q h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); 0 ~( `: `" O; @# o; y2 | for(i = 0; i { if( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) 3 }: _" E* D- X& W) m{ printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); return((DWORD)(h_info.Object)); 4 Q- t, x* C r3 L} * m4 `8 Y/ Y9 Q$ S. M} GetEprocessFromPid_exit: if ( buf != NULL ) 8 v8 i8 I' k1 d. `; }; B{ free( buf ); 5 U; @7 e D2 D! j' }8 Dbuf = NULL; \6 n9 m6 d- z9 C4 u1 \& S} return(FALSE); } /* * ntdll.dll */ static BOOL LocateNtdllEntry ( void ) 5 `( V" `: D! J2 @( i1 Q{ + S: M# D, w) f7 x1 g' p% ABOOL ret = FALSE; 6 i8 E$ k z+ {5 y$ z" O+ Bchar NTDLL_DLL[] = "ntdll.dll"; HMODULE ntdll_dll = NULL; 0 f1 J. l! ?3 u; y: ] # A# {- n& a; N; o6 |6 Q% Nif ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) * g; @: H1 Q7 ?5 }, |6 ]& z{ printf( "GetModuleHandle() failed"); 6 w! O2 Q9 [6 c1 h2 Oreturn( FALSE ); } 3 S. \+ y) j5 }' u4 i' t4 Yif ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) 8 I; t% ]5 R# K% ^{ 6 j- z5 L7 P' k# {goto LocateNtdllEntry_exit; } ret = TRUE; / y* D" R, q4 b0 } ` # ?' w# Q# ]+ Q/ \3 [6 \! }LocateNtdllEntry_exit: ; q* c' U' x# W M# I% C* E! K' J & E% i; `) S! ]- oif ( FALSE == ret ) { printf( "GetProcAddress() failed"); } 8 D; ^$ O8 u( x1 Y4 Yntdll_dll = NULL; 4 r0 Y" q* f# I! X+ u" `% l. t0 B# rreturn( ret ); 8 x6 y' B8 |( d6 |7 m- V} /* end of LocateNtdllEntry */ ! |& ]& N+ g& _# R& _) n# N9 m( X+ W int main(int argc,char **argv) { 1 ?( s/ ?1 G/ B, y3 ^1 ~ 7 Y8 v" [1 I; X0 N7 ZLocateNtdllEntry( ); //打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 OpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); 3 Q* I. ^4 J$ [* [ DWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); printf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); return TRUE; 2 N, K$ E6 b: R; d: t}