获得进程的EPROCESS

韩冰

文摘内容： 5 p7 ?- m; Q( F, I! }9 d& T0 z-------------------------------------------------------------------------------- 3 H& c7 r! X& V4 \8 T3 J, p文摘出处：http://www.xfocus.net/articles/200406/706.html 创建时间：2004-06-01 6 s! f6 B( Y, `2 F文章属性：原创 文章提交：MustBE (zf35_at_citiz.net) 0 X3 c- b+ u }/ X& mBy [I.T.S]SystEm32 8 k* ]5 H! t I* U $ W& z/ P, ]6 {9 X( p5 H. q: ^; R' gWelcome to our web site http://itaq.ynpc.com/itsbbs/ thanks to SobeIt : P # B/ o# d1 L7 T9 V& Y9 i) y! E--------------------------------------------------------------------------------------------- 每个Windows进程都有一个相对应的执行体进程(EPROCESS,也就是KTEB),EPROCESS不仅包括了进程的许多属性,还包扩了许多指向其他数据结构的指针,其中包含了大量有用的信息.本文仅讲述如何获得特定进程对应的EPROCESS,EPROCESS的作用及数据结构不在本文讨论范围之内. 绿盟高手flier在他的文章中提到,使用ZwQuerySystemInformation函数获取所有核心句柄表，线性搜索到进程句柄，其指向的内核对象就是EPROCESS。 ZwQuerySystemInformation函数原形如下 4 I9 V2 {# F$ ?+ l$ B1 P/ V NTSYSAPI NTSTATUS ' N4 E3 C3 c: R, k2 _NTAPI ZwQuerySystemInformation 7 e: A$ E: @) M4 p9 y! f. l( 9 N" E4 \, h, n8 Z% H& YIN SYSTEM_INFORMATION_CLASS SystemInformationClass, 2 y6 H/ X6 g1 n1 O! a }$ q- [% Y+ NIN OUT PVOID SystemInformation, + O/ x2 b, c: z8 v, KIN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ' @+ u" |' G8 W+ b; ~" O); 3 P4 G* K# l$ U 4 W/ m; o& r& L2 R$ ?+ k7 V参数意义如下 9 o. `, d$ _4 M0 r7 k& o+ o SystemInformationClass:被查询的系统信息的类型,SYSTEM_INFORMATION_CLASS的枚举类型之一 ( @/ k' R1 {0 g0 z4 o4 K' }$ E5 | $ \3 [, F9 ]' BSystemInformation:指向一个接受系统信息的缓冲区的指针 + m& `# ]3 b$ V- {7 E- r2 {8 j7 e5 R SystemInformationLength:缓冲区长度 ( H' u' a. t9 p2 X* O6 _' g+ n1 S, F9 r ) N! m1 s- M( s q" x/ e: l/ ]ReturnLength:指向一个接受实际返回字节数的变量,可以为0 6 `4 A5 ~2 m7 B, g1 |7 | 为了获取EPROCESS,我们使用SYSTEM_HANDLE_INFORMATION作为第一参数来调用 ZwQuerySystemInformation 8 ~ ^; E3 t0 E4 H0 m- q SYSTEM_INFORMATION_CLASS的结构如下 typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG ProcessId; , c6 h+ _9 J( s: e% n1 X9 pUCHAR ObjectTypeNumber; 7 x$ h% v6 ?" Z4 L2 CUCHAR Flags; 5 x! D3 i n+ K/ @& e2 C: m- z; v3 {5 xUSHORT Handle; PVOID Object; * _$ P# u$ d7 v! R% L% rACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; " w! E, u% q* o$ m ; t; l C6 x3 S/ nProcessId:进程标识符 ObjectTypeNumber;打开的对象的类型 6 w- e7 r- z: h/ e* @ Flags:句柄属性标志 Handle:句柄数值,在进程打开的句柄中唯一标识某个句柄 Object:这个就是句柄对应的EPROCESS的地址 & V( S4 k1 d/ T! N, S GrantedAccess:句柄对象的访问权限 - @2 C" v; m% O' w& y, C7 y8 \ . q( ^5 X5 J& N( b+ u! f7 i' f6 m$ { 下面我写了一个小程序来获得EPROCESS( GetKTEB.cpp ) " e# L2 w4 U8 G' Y Z. A8 j 比较faint的是程序写好后发现并未如预期般获得EPROCESS,通过调试发现ZwQuerySystemInformation()返回的进程的句柄中并没有进程本身的句柄 2 Q2 }/ s# \- j( M2 |# G8 Q- `$ S 怎么会这样?难道程序写错了?*_* 现在只好靠SoftICE给出答案了,CTRL+D唤出SoftICE,随便选了个进程--QQ,让我们来看看SoftICE的输出 ) s$ B. d3 ?! G:proc -o QQ Process KPEB PID Threads Pri User Time Krnl Time Status QQ 827CD520 11C 2A 8 00000B90 000008D4 Ready : A/ b4 _ Z2 c ---- Handle Table Information ---- Handle Table: FFAD93C8 Handle Array: E2BEB000 Entries: 590 Handle Ob Hdr * Object * Type 0000 00000000 00000018 ? 0004 E2DA5E58 E2DA5E70 Section ! D, Y- j2 X/ I4 y0008 FFAB35C8 FFAB35E0 Event S& m+ `/ R0 A! K: I000C FFAB3B08 FFAB3B20 Event 0010 85C70188 85C701A0 Event # E. j. C7 y' y% {0014 81515778 81515790 Directory 0018 FFAB7BB2 FFAB7BCA ? 001C 814A1858 814A1870 Directory % Q' {( w, ?' C9 o' E! d0020 80288C88 80288CA0 Event 6 L o( ?8 {1 b0024 E2CFE7F9 E2CFE811 ? # B2 T8 K: s6 U; D1 }7 ~" B5 `0 n1 ~+ y* h0028 842D7B08 842D7B20 Event 002C 80E9B989 80E9B9A1 ? 0030 E1372198 E13721B0 Section 0034 814602C0 814602D8 WindowStation 0038 81455CE0 81455CF8 Desktop 4 `1 |! f4 W& F* g* D b# \003C 814602C0 814602D8 WindowStation 0040 E2B3C1A8 E2B3C1C0 Key 2 [" i! x q5 j r$ H g+ @/ I. A0044 E286D6E8 E286D700 Key 4 I% M; d4 P% \# \! @0048 E2B3C0E8 E2B3C100 Key $ U! Q5 m% T+ H" F& H; h$ V+ s/ |004C E2B3C068 E2B3C080 Key ' m5 u1 Y! z) ?$ c2 O/ ]' k( S( _0050 E2BEE688 E2BEE6A0 Key 0054 8147C998 8147C9B0 Directory ' a/ R' U5 w6 ^3 T# v0058 829D1128 829D1140 Event + Z0 a/ g+ n, N0 M$ [( d U& S) u005C 83F991E8 83F99200 Event 0060 E2BEE608 E2BEE620 Key 0064 FFB07568 FFB07580 Event 6 c4 p: L( B" h# B8 V0068 801747E8 80174800 Event : c9 \, j* n; R. s }006C 80174828 80174840 Event 0070 845E8808 845E8820 Event & c/ y( Q& w" U5 J# T# L0074 81448798 814487B0 Event 4 l) U; ^9 G' T8 g" u0078 E2B9A888 E2B9A8A0 Key 1 O' s% \3 ^& E007C 845E8648 845E8660 Event 0080 FF9E2DB8 FF9E2DD0 Mutant 0084 FF9E2D58 FF9E2D70 Mutant 8 U* u" {9 b% }* y# l/ H# S* H0088 83CFC378 83CFC390 Mutant 008C 801749B0 801749C8 File 0090 E2C48668 E2C48680 Section 0094 FF965168 FF965180 Event 0098 FF9E7D88 FF9E7DA0 Event v8 F: S7 Z+ ], x+ i" K# a* b009C FFAD3DE8 FFAD3E00 Event 00A0 80AD63C8 80AD63E0 Event 00A4 E28073A8 E28073C0 Key 00A8 FF955588 FF9555A0 Thread - s0 U+ _" s! ~; o00AC E2770728 E2770740 Key & _3 u3 e. q: `. j7 ]$ r0 y @4 S00B0 FF923438 FF923450 Mutant $ {5 L' c5 B; ~$ A8 \00B4 FFAE3B38 FFAE3B50 Mutant 6 [- ]% q. e" u u) O7 }00B8 83B80728 83B80740 Event b. Q2 E( v1 j" l9 E4 P00BC 83B80668 83B80680 Event ( F9 \) n1 l8 i. k: M5 V00C0 E2E3C448 E2E3C460 Section 00C4 83776A08 83776A20 Thread 2 I# Z$ N+ t, w* o, s, ]00C8 81489E48 81489E60 Event 9 l# \7 Z3 x( J00CC 83776CC8 83776CE0 Event 00D0 83776C88 83776CA0 Event 00D4 83776768 83776780 Event & k. ]6 F8 b8 f& W6 W1 s00D8 E2837D88 E2837DA0 Key 5 ^( A9 c" T/ Y2 x00DC 8146B3A8 8146B3C0 Event 2 H2 R: [+ n' E/ ^% T00E0 FF908308 FF908320 Event 00E4 81494868 81494880 Event 00E8 FF9064C8 FF9064E0 Event ?, N# N" q. \* _/ d2 u) d00EC FF908FC8 FF908FE0 Event # G! C3 Q* w* |00F0 FF908F88 FF908FA0 Event 00F4 FF955588 FF9555A0 Thread # b8 W' P% { ] b5 @2 o00F8 FF908F48 FF908F60 Event # t( \9 c- C8 |; X3 N00FC E2CB1558 E2CB1570 Port / z' Y/ M) J/ A! w0100 FF90A2C8 FF90A2E0 IoCompletion 8 `6 z2 ?4 Y. y6 R0104 E2CFE708 E2CFE720 Port 0108 FF90A2C8 FF90A2E0 IoCompletion 010C 837762A8 837762C0 Thread & p S' L8 Z* [& @0110 8103BBC8 8103BBE0 Event 0114 813DBDB8 813DBDD0 Event 6 F/ Y$ ^# h/ k0118 FF814788 FF8147A0 Event 011C E1358DA8 E1358DC0 Key 0120 E2CFC428 E2CFC440 Key 9 h' K0 Z2 b: W7 j- w6 [3 G) T2 K5 r; [0124 8103B9C8 8103B9E0 Event 3 C- n, P, O, s8 x7 d; L0128 E2C9A968 E2C9A980 Key 012C 83B34E88 83B34EA0 Event : K5 \& y7 M' E( n/ Z+ ?# ~0130 E2CFD948 E2CFD960 Key 0134 83B34E08 83B34E20 Event & v+ f5 @+ v, ]" |5 H Z: V" K.... $ A6 f& U- m$ ]/ A/ \* c2 ?3 i.....................省略 看了一阵,确实没有QQ本身进程的Handle,那么怎么办呢? / R1 n- d; R" a3 _& Z; `& A + }0 m* Y, N* }$ `5 W+ m* H) P) Q想了一会儿...既然Win32子系统是由CSRSS.EXE来管理的,那么用户创建的进程的句柄应该在CSRSS.EXE里面找得到,用SoftICE验证后发现确实如此 ) k0 e5 s E7 h. q8 W7 l! w可是这没办法得到指定进程的句柄,和我所需相去甚远,只有另选它路 - h) G( J, x' @1 D7 O 后来总算想到解决办法,既然没有进程的句柄,那就创建一个吧,OpenProcess()这个函数可以打开一个进程的句柄,正合所需. 果然加上这么一句后,ZwQuerySystemInformation()获得了EPROCESS 9 H6 ?; Y4 W9 x) o- k! R修改好的程序代码如下,获得本身进程的EPROCESS地址,稍作修改可获取任意进程 + [0 C' C4 R3 H! K6 D#include #include : p+ q, p0 {( E+ N#include #include $ ?* F S% F7 Q/ g/* 6 L# F8 E+ F8 M* f1 O* you''ll find a list of NTSTATUS status codes in the DDK header * l$ l) F N. {6 W* ntstatus.h (\WINDDK\2600.1106\inc\ddk\wxp\) */ #define NT_SUCCESS(status) ((NTSTATUS)(status)>=0) #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) % Q* k! c/ `9 A7 }1 Z#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) * _, z: X6 P& M, C/* 0 W" S4 ^4 [4 ?8 j, e4 d) h% i6 {$ Y************************************************************************* ( K/ l- f4 J4 s7 [" a0 D5 a* ntddk.h ! V6 Z+ X2 k4 q1 `*/ typedef LONG NTSTATUS; typedef ULONG ACCESS_MASK; /* $ z P- ]/ @9 W* a4 ?/ c* ntdef.h ************************************************************************* 5 C" h, P0 n# q. \( D*/ 1 a5 |% o% B2 v$ S3 r! d 0 h; B# P1 E8 I- k7 {) V* Z3 i* f/ n) g/* 0 \) P: g2 V3 a: r5 U% c1 E; X! W************************************************************************* % w5 c$ [# Z+ G" }* <> - Gary Nebbett */ + t" K& r& e8 R( z4 T* P0 Htypedef enum _SYSTEM_INFORMATION_CLASS { * D0 Q! S: i: `% b& q, sSystemHandleInformation = 16 + I, {7 c+ @/ _) g} SYSTEM_INFORMATION_CLASS; 7 E( `/ u1 Y5 ^. f X# u6 |# j+ U4 C /* & m* v# i+ F) ]3 M! A*Information Class 16 9 M, r! x" D. o: E y% k*/ typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG ProcessId; UCHAR ObjectTypeNumber; UCHAR Flags; USHORT Handle; ( k" i! y$ B/ j9 K; d- o; k. ?PVOID Object; ACCESS_MASK GrantedAccess; + Q& {$ R8 X- I} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; " G3 |! _) G) } 9 x6 @4 i8 K' ` V/ j1 N#define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } /* ************************************************************************* 1 W5 k' i+ F& @! o. ` M* <> - Gary Nebbett ************************************************************************* */ typedef ULONG ( __stdcall *RTLNTSTATUSTODOSERROR ) ( IN NTSTATUS Status ); typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL ); - g# e( x) S0 U! k& ~) N* T* ~; m+ b/************************************************************************ 1 V" r! O0 b* r) C0 @5 e9 F* * * Function Prototype * * * 8 V+ y. ` O! M/ v$ j************************************************************************/ static DWORD GetEprocessFromPid ( ULONG PID ); static BOOL LocateNtdllEntry ( void ); + J- \; y. x" U9 |4 O* \ : q7 d/ B% }) ~9 y& @4 Q/************************************************************************ * * * Static Global Var * ?# s5 a& Q- f7 U4 ]* * ************************************************************************/ : C- Y, c. l& x! J2 N5 g, astatic RTLNTSTATUSTODOSERROR RtlNtStatusToDosError = NULL; ) z; b+ b7 h4 A8 ~# c/ U& S4 }static ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL; 4 V& N( B; o1 O, F2 istatic HMODULE hModule = NULL; /************************************************************************/ : N3 X" a/ B9 p% F5 m. g " D2 h/ ]; G1 ` K* m( ~ static DWORD GetEprocessFromPid ( ULONG PID ) { & W! M% i1 M% S) rNTSTATUS status; 2 C: ]3 l+ @( v9 W; w! kPVOID buf = NULL; + X. x5 J$ D, b5 z* SULONG size = 1; ULONG NumOfHandle = 0; ULONG i; PSYSTEM_HANDLE_INFORMATION h_info = NULL; : H4 R0 v8 |2 ^- R0 T ?# I# f6 `1 c 8 \/ N7 C7 A- L$ [9 k# efor ( size = 1; ; size *= 2 ) { if ( NULL == ( buf = calloc( size, 1 ) ) ) , ^0 w+ V$ @+ q{ fprintf( stderr, "calloc( %u, 1 ) failed\n", size ); goto GetEprocessFromPid_exit; } ' x; W' R; n: B! U, bstatus = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL ); if ( !NT_SUCCESS( status ) ) { * m1 _" a1 j% mif ( STATUS_INFO_LENGTH_MISMATCH == status ) ! d( @4 H4 U! H5 A{ - n% V* T5 u2 P( K) x$ dfree( buf ); buf = NULL; 1 w$ {+ s) F9 A} 2 |1 K" D2 C) n9 z6 p$ A8 welse ; c( m# o, l1 Q( v{ printf( "ZwQuerySystemInformation() failed"); 7 D0 w7 w* H n0 j8 V& J& [goto GetEprocessFromPid_exit; } 0 i2 r8 F3 }) f, n/ k) a( p} . z' d+ A5 n/ B# @9 h( yelse 3 O4 [& z$ z9 d* K{ ' p# G3 K0 r3 e) g& N1 U! N2 abreak; ! R6 a+ [ I6 }9 m3 r} } /* end of for */ //返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组 NumOfHandle = (ULONG)buf; 1 g* s! J6 m6 w( G, ?. I6 | 0 ?2 r2 N$ O+ B7 q5 l' kh_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4); ! g k' t' x- e5 r+ ?1 D+ U# D: t for(i = 0; i { if( ( h_info.ProcessId == PID )&&( h_info.ObjectTypeNumber == 5 ))//&&( h_info.Handle==0x3d8 ) ) " g- ^, F: v5 J. w% z{ printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info.Handle,h_info.Object); return((DWORD)(h_info.Object)); $ o+ P" T9 y0 g} 3 l- \# t) k3 r6 y+ C# ^} : H( i5 Z4 `: NGetEprocessFromPid_exit: 1 n. D/ y1 V# u" ?3 v* m6 wif ( buf != NULL ) { ) m9 A% ]! W; Q4 |; S7 Xfree( buf ); * a [3 k1 L/ J( I1 i& Jbuf = NULL; : C3 m6 C" O4 c6 i( r} return(FALSE); } 0 c* @+ c' d' v, j* p & I% v& ~; F) K+ [# G3 s1 i 6 v; x/ L, l: L/* : u1 F5 i8 W$ v) X7 ?" @( q; o8 B* ntdll.dll # z' H; ]7 @* U S' Z*/ static BOOL LocateNtdllEntry ( void ) " N( z- i2 S0 K/ g% j2 d' [# U. t{ ) q4 v/ @/ A$ s* W! ?BOOL ret = FALSE; 8 x3 ^4 N2 _$ U! a+ v- ]char NTDLL_DLL[] = "ntdll.dll"; HMODULE ntdll_dll = NULL; 3 X+ B; x( I T1 _& y 0 r( g. W1 i6 S& I1 E2 |- iif ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL ) 9 ?- a( D" K" x{ printf( "GetModuleHandle() failed"); & Z* `$ i3 A$ N3 {" oreturn( FALSE ); } if ( !( ZwQuerySystemInformation = ( ZWQUERYSYSTEMINFORMATION )GetProcAddress( ntdll_dll, "ZwQuerySystemInformation" ) ) ) 7 a+ V7 i7 [, e( O' G, F6 F0 U% _{ goto LocateNtdllEntry_exit; % t. k$ U' g# O1 B0 u0 c} C, T% Z( C1 v% u! a) m% O- Y# aret = TRUE; V# X$ F: O2 B1 _ H7 S4 cLocateNtdllEntry_exit: 9 V- V/ S+ `; J' qif ( FALSE == ret ) { ' k+ U2 l5 M6 x. L5 ]; w( Cprintf( "GetProcAddress() failed"); } ntdll_dll = NULL; 5 F2 [9 A q9 d" t6 H* ]5 Breturn( ret ); } /* end of LocateNtdllEntry */ 8 E( v7 _0 Y& F+ f0 Q% p6 ~int main(int argc,char **argv) , p" }) |+ F- J, |$ q u{ ; L; A& P+ Y: J 9 u" R; d) ~/ Q& o6 yLocateNtdllEntry( ); //打开自身句柄,这样才能在handle列表中找到自己,PROCESS 对应 ObjectTypeNum 为5 9 j# X% |6 Y( A/ O+ J4 pOpenProcess( PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId() ); 6 {) @( f' s4 Y2 t ]DWORD Addr = GetEprocessFromPid( (DWORD)GetCurrentProcessId() ); printf("result: Current EPROCESS''s Address is 0x%x \n\r",Addr); 8 C) T5 S4 W3 Qreturn TRUE; 5 A- A" o {* e; O) B}