Ring3句柄表的枚举
NTSTATUS WINAPI NtQuerySystemInformation(
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
_Inout_ PVOID SystemInformation,
_In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength
);
typedef enum _SYSTEM_INFORMATION_CLASS {
SystemBasicInformation,
SystemProcessorInformation,
SystemPerformanceInformation,
SystemTimeOfDayInformation,
SystemPathInformation,
SystemProcessInformation,
SystemCallCountInformation,
SystemDeviceInformation,
SystemProcessorPerformanceInformation,
SystemFlagsInformation,
SystemCallTimeInformation,
SystemModuleInformation,
SystemLocksInformation,
SystemStackTraceInformation,
SystemPagedPoolInformation,
SystemNonPagedPoolInformation,
SystemHandleInformation,
SystemObjectInformation,
SystemPageFileInformation,
SystemVdmInstemulInformation,
SystemVdmBopInformation,
SystemFileCacheInformation,
SystemPoolTagInformation,
SystemInterruptInformation,
SystemDpcBehaviorInformation,
SystemFullMemoryInformation,
SystemLoadGdiDriverInformation,
SystemUnloadGdiDriverInformation,
SystemTimeAdjustmentInformation,
SystemSummaryMemoryInformation,
SystemMirrorMemoryInformation,
SystemPerformanceTraceInformation,
SystemObsolete0,
SystemExceptionInformation,
SystemCrashDumpStateInformation,
SystemKernelDebuggerInformation,
SystemContextSwitchInformation,
SystemRegistryQuotaInformation,
SystemExtendServiceTableInformation,
SystemPrioritySeperation,
SystemVerifierAddDriverInformation,
SystemVerifierRemoveDriverInformation,
SystemProcessorIdleInformation,
SystemLegacyDriverInformation,
SystemCurrentTimeZoneInformation,
SystemLookasideInformation,
SystemTimeSlipNotification,
SystemSessionCreate,
SystemSessionDetach,
SystemSessionInformation,
SystemRangeStartInformation,
SystemVerifierInformation,
SystemVerifierThunkExtend,
SystemSessionProcessInformation,
SystemLoadGdiDriverInSystemSpace,
SystemNumaProcessorMap,
SystemPrefetcherInformation,
SystemExtendedProcessInformation,
SystemRecommendedSharedDataAlignment,
SystemComPlusPackage,
SystemNumaAvailableMemory,
SystemProcessorPowerInformation,
SystemEmulationBasicInformation,
SystemEmulationProcessorInformation,
SystemExtendedHandleInformation,
SystemLostDelayedWriteInformation,
SystemBigPoolInformation,
SystemSessionPoolTagInformation,
SystemSessionMappedViewInformation,
SystemHotpatchInformation,
SystemObjectSecurityMode,
SystemWatchdogTimerHandler,
SystemWatchdogTimerInformation,
SystemLogicalProcessorInformation,
SystemWow64SharedInformation,
SystemRegisterFirmwareTableInformationHandler,
SystemFirmwareTableInformation,
SystemModuleInformationEx,
SystemVerifierTriageInformation,
SystemSuperfetchInformation,
SystemMemoryListInformation,
SystemFileCacheInformationEx,
MaxSystemInfoClass // MaxSystemInfoClass should always be the last enum
} SYSTEM_INFORMATION_CLASS;
typedef enum OBJECT_INFORMATION_CLASS
{
ObjectBasicInformation,
ObjectNameInformation,
ObjectTypeInformation,
ObjectTypesInformation,
ObjectHandleFlagInformation,
ObjectSessionInformation,
MaxObjectInfoClass
}OBJECT_INFORMATION_CLASS;
typedef
struct _USER_DATA_
{
HANDLE HandleValue;
uint32_t GrantedAccess = 0;//要求
uint32_t Flags = 0;
ULONG64 ObjectValue;
std::wstring ObjectTypeName;//类型
std::wstring ObjectName;//对象名字
SECTION_INFORMATION SectionInfo;
}USER_DATA, *PUSER_DATA;
接下来是枚举的代码过程:其中有注释
if ((ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID)) == NULL)
{
return Status;
}
if (__NtQuerySystemInformation==NULL||__NtDuplicateObject==NULL||__NtQueryObject==NULL||__NtQuerySection==NULL)
{
goto Exit;
}
BufferData = (uint8_t*)VirtualAlloc(NULL, BufferLength, MEM_COMMIT/*物理页属性*/, PAGE_READWRITE);
if (BufferData = NULL)
{
goto Exit;
}
Status = __NtQuerySystemInformation(SystemHandleInformation, BufferData, BufferLength, &ReturnLength);
//得到系统信息
while (Status == STATUS_INFO_LENGTH_MISMATCH)
{
BufferLength *= 2;
VirtualFree(BufferData, 0, MEM_RELEASE);
BufferData = (uint8_t*)VirtualAlloc(NULL, BufferLength, MEM_COMMIT, PAGE_READWRITE);
Status = __NtQuerySystemInformation(SystemHandleInformation, BufferData, BufferLength, &ReturnLength);
}
//列表获得句柄
SE_SYSTEM_EHT_INFORMATION_T* SystemEHTInfo = (SE_SYSTEM_EHT_INFORMATION_T*)BufferData;//模板定义记笔记
for (ULONG i = 0; i < SystemEHTInfo->ItemCount; i++)
{
if (SystemEHTInfo->Items[i].ProcessID != ProcessID)
{
continue;
}
//拷贝
Status = __NtDuplicateObject(ProcessHandle, reinterpret_cast<HANDLE>(SystemEHTInfo->Items[i].HandleValue/*获得句柄所以 这样*/),
GetCurrentProcess()/*给到当前*/, &DuplicatedHandle, 0, 0, DUPLICATE_SAME_ACCESS);//拷贝
if (!NT_SUCCESS(Status))
{
continue;
}
//还是结构体模板
//对象信息获得
ObjectTypeInfo = (OBJECT_TYPE_INFORMATION_T*)malloc(0x1000);
Status = __NtQueryObject(DuplicatedHandle, ObjectTypeInformation, ObjectTypeInfo, 0x1000, &ReturnLength);
if (!NT_SUCCESS(Status))
{
CloseHandle(DuplicateHandle);
continue;
}
ObjectNameInfo = malloc(0x1000);
Status = __NtQueryObject(DuplicatedHandle, ObjectNameInformation, ObjectNameInfo, 0x1000, &ReturnLength);
if (!NT_SUCCESS(Status))
{
if (Status==STATUS_INFO_LENGTH_MISMATCH)
{
ObjectNameInfo = realloc(ObjectNameInfo, ReturnLength);
Status = __NtQueryObject(DuplicatedHandle, ObjectNameInformation, ObjectNameInfo, ReturnLength/*这儿有点意思*/, &ReturnLength);
if (!NT_SUCCESS(Status))
{
goto Exit;
}
}
else
{
goto Exit;
}
}
ObjectName = *(_UNICODE_STRING_T<WCHAR*>*)ObjectNameInfo;
//赋值到用户上
v1.HandleValue = reinterpret_cast<HANDLE>(SystemEHTInfo->Items[i].HandleValue);
v1.GrantedAccess = SystemEHTInfo->Items[i].GrantedAccess;
v1.Flags = SystemEHTInfo->Items[i].Flags;
v1.ObjectValue = SystemEHTInfo->Items[i].ObjectValue;
//类型状态赋值
if (ObjectTypeInfo->ObjectTypeName.BufferLength)
v1.ObjectTypeName = (wchar_t*)ObjectTypeInfo->ObjectTypeName.BufferData;
if (ObjectName.BufferLength)
v1.ObjectName = ObjectName.BufferData;
if (_wcsicmp(v1.ObjectTypeName.c_str(), L"Section") == 0)
{
SECTION_BASIC_INFORMATION_T SectionBasicInfo = { 0 };
//结构提函数
Status = __NtQuerySection(DuplicatedHandle, SectionBasicInformation, &SectionBasicInfo,
(ULONG)sizeof(SectionBasicInfo), NULL);
if (NT_SUCCESS(Status))
{
v1.SectionInfo.SectionSize = SectionBasicInfo.SectionSize/*T*/.QuadPart;
v1.SectionInfo.SectionAttributes = SectionBasicInfo.Attributes;
}
}
ProcessHandleInfo.push_back(v1);
Ring3句柄表的枚举的更多相关文章
- Win8下枚举任意进程的句柄表。。。(VB6 Code)
添加一个Command1.一个List1,代码: Private Type PROCESS_HANDLE_TABLE_ENTRY_INFO HandleValue As Long HandleCoun ...
- 驱动开发:内核枚举PspCidTable句柄表
在上一篇文章<驱动开发:内核枚举DpcTimer定时器>中我们通过枚举特征码的方式找到了DPC定时器基址并输出了内核中存在的定时器列表,本章将学习如何通过特征码定位的方式寻找Windows ...
- EPROCESS 进程/线程优先级 句柄表 GDT LDT 页表 《寒江独钓》内核学习笔记(2)
在学习笔记(1)中,我们学习了IRP的数据结构的相关知识,接下来我们继续来学习内核中很重要的另一批数据结构: EPROCESS/KPROCESS/PEB.把它们放到一起是因为这三个数据结构及其外延和w ...
- 【旧文章搬运】Windows句柄表分配算法分析(一)
原文发表于百度空间,2009-03-30========================================================================== 阅读提示: ...
- Windbg调试(关于句柄表的获取,32位)
今天利用Windbg(x86)进行了获得句柄表的调试,从中获益良多,对调试步骤和按键又一次进行了熟悉,对于句柄表页的概念更是得到了进一步的清晰认识.windbg调试和句柄表不熟悉的朋友可以借鉴我的调试 ...
- win32进程概念之句柄表,以及内核对象.
句柄表跟内核对象 一丶什么是句柄表什么是内核对象. 1.句柄表的生成 我们知道.我们使用CreateProcess 的时候会返回一个进程句柄.以及线程句柄. 其实在调用CreateProcess的时候 ...
- Windows进程的内核对象句柄表
当一个进程被初始化时,系统要为它分配一个句柄表.该句柄表只用于内核对象 ,不用于用户对象或GDI对象. 创建内核对象 当进程初次被初始化时,它的句柄表是空的.然后,当进程中的线程调用创建内核对象的函数 ...
- 扫描系统句柄表(WIN7 x86)(附录源码)
PspCidTable存放着系统中所有的进程和线程对象,其索引也就是进程ID(PID)或线程ID(TID).先通过它来看看windbg里的HANDLE_TABLE结构: 可以看到地址 0x83f41b ...
- 【旧文章搬运】Windows句柄表分配算法分析(实验部分)
原文发表于百度空间,2009-03-31========================================================================== 理论结合实 ...
随机推荐
- Neo4j学习笔记(2)——数据索引
和关系数据库一样,Neo4j同样可以创建索引来加快查找速度. 在关系数据库中创建索引需要索引字段和指向记录的指针,通过索引可以快速查找到表中的行. 在Neo4j中,其索引是通过属性来创建,便于快速查找 ...
- MicroPython可视化编程开发板—TurnipBit自制MP3教程实例
转载请以链接形式注明文章来源(MicroPythonQQ技术交流群:157816561,公众号:MicroPython玩家汇) 当前我们都生活在一个有声有色的社会当中,欣赏美丽的景色,享受动人的音乐, ...
- onoffswitch-checkbox
@foreach (EmailSubscription es in Model) { if(true){ <div class="onoffswitch"> ...
- webapi框架搭建-依赖注入之autofac
前言 c#的依赖注入框架有unity.autofac,两个博主都用过,感觉unity比较简单而autofac的功能相对更丰富(自然也更复杂一点),本篇将基于前几篇已经创建好的webapi项目,引入au ...
- 搭建LNMP;搭建WIKI
#!/bin/bash#lnmp搭建#搭建WIKI 1.系统检测,系统环境优化 搭建版本: nginx-1.8.1.tar.gzmysql-5.5.32-linux2.6-x86_64.tar.gzl ...
- duilib基本流程
duilib的基本流程如上图,通过解析一个xml文件,将文件中的内容渲染为窗口界面,这个解析过程由WindowImplBase类来完成. 基本框架如下: 1. 首先在公共头文件中加入如下内容: #in ...
- MariaDB的"response time"插件
"响应时间"是衡量数据库性能的常用指标.在MariaDB中可以使用插件"QUERY_RESPONSE_TIME"来获取查询时间区间的统计信息. // 安装插 件 ...
- 表迁移工具的选型-xtrabackup的使用
1.1. 场景 有的时候test人员可能需要在测试库上比较新的数据,这时候只能是从生产库上面去那了.如果是小表还好实用mysqldump/mysqlpump就可以轻松的解决.但是,如果遇到了大表这将是 ...
- TextView 的新特性,Autosizing 到底是如何实现的? | 源码分析
一.前言 Hi,大家好,我是承香墨影! 前两天聊了一下 Autosizing 的使用,反映还不错.毕竟是这种能解决实际问题的新 Api,确实在需要的时候,用起来会很顺手. 简单回顾一下,Autosiz ...
- css的学习笔记
CSS3有哪些新特性? 1. CSS3实现圆角(border-radius),阴影(box-shadow), 2. 对文字加特效(text-shadow.),线性渐变(gradient),旋转(tra ...