内核遍历r3进程模块,获取信息(32,64,WoW64)

忘是亡心i 2022-07-15 13:26 522阅读 0赞

没什么技术含量,只是突然用到了,然后写出来,又突然想到看雪了,然后又发上来,  
一想到长期潜水,看帖不回就羞愧的不要不要的 ![恐怖!][eek.gif] ;  
  
  
//通过进程PID来获取目标模块路径;  
NTSTATUS GetModulesPathByProcessID (IN HANDLE ProcessId, IN WCHAR\* ModuleName, OUT WCHAR\* ModulesPath) \{   
 typedef PPEB (\_\_stdcall \* pfn\_PsGetProcessPeb) (PEPROCESS pEProcess);  
 typedef PPEB32 (\_\_stdcall \* pfn\_PsGetProcessWow64Process) (PEPROCESS Process);  
 NTSTATUS nStatus;  
 KAPC\_STATE KAPC = \{ 0 \};  
 PEPROCESS pEProcess = NULL; //EPROCESS结构指针;  
 PPEB pPEB = NULL; //PEB结构指针;  
 UNICODE\_STRING uniFunctionName; //查找的函数名称;  
 PLDR\_DATA\_TABLE\_ENTRY pLdrDataEntry = NULL; //LDR链表入口;  
 PLIST\_ENTRY pListEntryStart = NULL; //链表头节点、尾节点;  
 PLIST\_ENTRY pListEntryEnd = NULL;  
 //函数指针;  
 pfn\_PsGetProcessPeb PsGetProcessPeb = NULL;  
 //获取进程的EPROCESS结构指针;  
 nStatus = PsLookupProcessByProcessId (ProcessId, &pEProcess);  
 if (!NT\_SUCCESS (nStatus)) \{   
 return STATUS\_UNSUCCESSFUL;  
 \}  
 //查找函数地址;  
 RtlInitUnicodeString (&uniFunctionName, L"PsGetProcessPeb");  
 PsGetProcessPeb = (pfn\_PsGetProcessPeb) (SIZE\_T)MmGetSystemRoutineAddress (&uniFunctionName);  
 pPEB = PsGetProcessPeb (pEProcess);  
 KeStackAttachProcess (pEProcess, &KAPC);  
 pListEntryStart = pPEB->Ldr->InMemoryOrderModuleList.Flink;  
 pListEntryEnd = pPEB->Ldr->InMemoryOrderModuleList.Flink;  
 do \{//输出DLL全路径;  
 pLdrDataEntry = (PLDR\_DATA\_TABLE\_ENTRY)CONTAINING\_RECORD (pListEntryStart, LDR\_DATA\_TABLE\_ENTRY, InMemoryOrderLinks);  
 //KdPrint (("module:%wZ\\n", &pLdrDataEntry->BaseDllName));  
 if (\_wcsicmp (pLdrDataEntry->BaseDllName.Buffer, ModuleName) == 0) \{   
 wcscpy (ModulesPath, pLdrDataEntry->FullDllName.Buffer);  
 goto end;  
 \}  
 pListEntryStart = pListEntryStart->Flink;  
 \} while (pListEntryStart != pListEntryEnd);  
\#ifdef \_AMD64\_// 或wow64进程;  
 PPEB32 pPEB32 = NULL; //PEB结构指针;  
 PLDR\_DATA\_TABLE\_ENTRY32 pLdrDataEntry32 = NULL; //LDR链表入口;  
 PLIST\_ENTRY32 pListEntryStart32 = NULL; //链表头节点、尾节点;  
 PLIST\_ENTRY32 pListEntryEnd32 = NULL;  
 //函数指针;  
 pfn\_PsGetProcessWow64Process PsGetProcessWow64Process = NULL;  
 RtlInitUnicodeString (&uniFunctionName, L"PsGetProcessWow64Process");  
 PsGetProcessWow64Process = (pfn\_PsGetProcessWow64Process) (SIZE\_T)MmGetSystemRoutineAddress (&uniFunctionName);  
 //获取PEB指针  
 pPEB32 = PsGetProcessWow64Process (pEProcess);  
 pListEntryStart32 = (PLIST\_ENTRY32) (((PEB\_LDR\_DATA32\*)pPEB32->Ldr)->InMemoryOrderModuleList.Flink);  
 pListEntryEnd32 = (PLIST\_ENTRY32) (((PEB\_LDR\_DATA32\*)pPEB32->Ldr)->InMemoryOrderModuleList.Flink);  
 do \{//输出DLL全路径;  
 pLdrDataEntry32 = (PLDR\_DATA\_TABLE\_ENTRY32)CONTAINING\_RECORD (pListEntryStart32, LDR\_DATA\_TABLE\_ENTRY32, InMemoryOrderLinks);  
 //KdPrint (("wow64:%ws\\n", pLdrDataEntry32->BaseDllName.Buffer));  
 if (\_wcsicmp ((WCHAR\*)pLdrDataEntry32->BaseDllName.Buffer, ModuleName) == 0) \{   
 wcscpy (ModulesPath, (WCHAR\*)pLdrDataEntry32->FullDllName.Buffer);  
 goto end;  
 \}  
 pListEntryStart32 = (PLIST\_ENTRY32)pListEntryStart32->Flink;  
 \} while (pListEntryStart32 != pListEntryEnd32);  
\#endif  
end:  
 KeUnstackDetachProcess (&KAPC);  
 ObDereferenceObject (pEProcess);  
 return STATUS\_SUCCESS;  
\}  
  
  
  
  
  
附上用到的几个结构  
typedef struct \_PEB \{   
 UCHAR InheritedAddressSpace;  
 UCHAR ReadImageFileExecOptions;  
 UCHAR BeingDebugged;  
 UCHAR Spare;  
 PVOID Mutant;  
 PVOID ImageBaseAddress;  
 PPEB\_LDR\_DATA Ldr;  
 PRTL\_USER\_PROCESS\_PARAMETERS ProcessParameters;  
 PVOID SubSystemData;  
\} PEB, \*PPEB;  
//专为WoW64准备;  
typedef struct \_PEB32 \{   
 UCHAR InheritedAddressSpace;  
 UCHAR ReadImageFileExecOptions;  
 UCHAR BeingDebugged;  
 UCHAR Spare;  
 ULONG Mutant;  
 ULONG ImageBaseAddress;  
 ULONG/\*PPEB\_LDR\_DATA32\*/ Ldr;  
\} PEB32, \*PPEB32;  
  
typedef struct \_PEB\_LDR\_DATA \{   
 ULONG Length;  
 UCHAR Initialized;  
 PVOID SsHandle;  
 LIST\_ENTRY InLoadOrderModuleList;  
 LIST\_ENTRY InMemoryOrderModuleList;  
 LIST\_ENTRY InInitializationOrderModuleList;  
 PVOID EntryInProgress;  
\} PEB\_LDR\_DATA, \*PPEB\_LDR\_DATA;  
//专为WoW64准备;  
typedef struct \_PEB\_LDR\_DATA32 \{   
 ULONG Length;  
 UCHAR Initialized;  
 ULONG SsHandle;  
 LIST\_ENTRY32 InLoadOrderModuleList;  
 LIST\_ENTRY32 InMemoryOrderModuleList;  
 LIST\_ENTRY32 InInitializationOrderModuleList;  
 ULONG EntryInProgress;  
\} PEB\_LDR\_DATA32, \*PPEB\_LDR\_DATA32;  
  
typedef struct \_LDR\_DATA\_TABLE\_ENTRY \{   
 LIST\_ENTRY InLoadOrderLinks;  
 LIST\_ENTRY InMemoryOrderLinks;  
 LIST\_ENTRY InInitializationOrderLinks;  
 PVOID DllBase;  
 PVOID EntryPoint;  
 ULONG SizeOfImage;  
 UNICODE\_STRING FullDllName;  
 UNICODE\_STRING BaseDllName;  
 ULONG Flags;  
 USHORT LoadCount;  
 USHORT TlsIndex;  
 LIST\_ENTRY HashLinks;  
 PVOID SectionPointer;  
 ULONG CheckSum;  
 ULONG TimeDateStamp;  
 PVOID LoadedImports;  
 PVOID EntryPointActivationContext;  
 PVOID PatchInformation;  
 LIST\_ENTRY ForwarderLinks;  
 LIST\_ENTRY ServiceTagLinks;  
 LIST\_ENTRY StaticLinks;  
 PVOID ContextInformation;  
 PVOID OriginalBase;  
 LARGE\_INTEGER LoadTime;  
\} LDR\_DATA\_TABLE\_ENTRY, \*PLDR\_DATA\_TABLE\_ENTRY;  
//专为WoW64准备;  
typedef struct \_LDR\_DATA\_TABLE\_ENTRY32 \{   
 LIST\_ENTRY32 InLoadOrderLinks;  
 LIST\_ENTRY32 InMemoryOrderLinks;  
 LIST\_ENTRY32 InInitializationOrderLinks;  
 ULONG DllBase;  
 ULONG EntryPoint;  
 ULONG SizeOfImage;  
 UNICODE\_STRING32 FullDllName;  
 UNICODE\_STRING32 BaseDllName;  
 ULONG Flags;  
 USHORT LoadCount;  
 USHORT TlsIndex;  
 LIST\_ENTRY32 HashLinks;  
 ULONG SectionPointer;  
 ULONG CheckSum;  
 ULONG TimeDateStamp;  
 ULONG LoadedImports;  
 ULONG EntryPointActivationContext;  
 ULONG PatchInformation;  
 LIST\_ENTRY32 ForwarderLinks;  
 LIST\_ENTRY32 ServiceTagLinks;  
 LIST\_ENTRY32 StaticLinks;  
 ULONG ContextInformation;  
 ULONG OriginalBase;  
 LARGE\_INTEGER LoadTime;  
\} LDR\_DATA\_TABLE\_ENTRY32, \*PLDR\_DATA\_TABLE\_ENTRY32;

[eek.gif]: /images/20220715/a0cde98cf78c418b9cd6dee54c4ca42b.png