Windows Kennel-通过名字查进程EPROCESS

原创

franket

发布于 2020-05-10 05:31:14

13.4K00

代码可运行

文章被收录于专栏：技术杂记技术杂记

运行总次数：0

代码可运行

1.先通过ActiveProcessLinks遍历

2.设置桩点，保证循环一遍就结束

3.通过PsGetProcessImageFileName来获取名字

代码如下：

UCHAR *PsGetProcessImageFileName(__in PEPROCESS eprocess);//导出下使用.
NTSTATUS LookupProcessByName(IN PCHAR pcProcessName,
							 OUT PEPROCESS *pEprocess)
{
	PEPROCESS pCurEprocess = NULL;
	PEPROCESS pNextEprocess = NULL;//做为一个标记，表示循环了一圈
	PLIST_ENTRY	pListActiveProcess = NULL;
	ULONG offset = 0;//ActiveProcessLinks的偏移值
	ULONG uLoopNum = 0;//查找的循环次数
	RTL_OSVERSIONINFOEXW osver = {sizeof(RTL_OSVERSIONINFOEXW)};
	char *lpszAttackProName = NULL;
 
 
	if (!ARGUMENT_PRESENT(pcProcessName)
		||!ARGUMENT_PRESENT(pEprocess))
	{
		KdPrint(("[LookupProcessByName]--invalid para\n"));
		return STATUS_INVALID_PARAMETER;
	}
 
	if (KeGetCurrentIrql()>PASSIVE_LEVEL)
	{
		KdPrint(("[LookupProcessByName]--invalid irql\n"));
		return STATUS_UNSUCCESSFUL;
	}
 
	if (STATUS_SUCCESS != RtlGetVersion((PRTL_OSVERSIONINFOW)&osver))
	{
		KdPrint(("[LookupProcessByName]--RtlGetVersion fail\n"));
		return STATUS_UNSUCCESSFUL;
	}
 
	// 仅对xp测试，自己扩展
	if (5 == osver.dwMajorVersion
		&&1 == osver.dwMinorVersion)
	{
		offset = 0x88;//可通过windbg查看eprocess中的偏移
	}
 
	if (0 == offset)
	{
		KdPrint(("[LookupProcessByName]--unknow os\n"));
		return STATUS_UNSUCCESSFUL;
	}
 
	// 遍历链表查询
	pCurEprocess = PsGetCurrentProcess();
	pNextEprocess = pCurEprocess;
 
	__try
	{
		while (TRUE)
		{
			// TODO.做想做的事吧...
			lpszAttackProName = (char *)PsGetProcessImageFileName(pCurEprocess);
			if (lpszAttackProName
				&& strlen(lpszAttackProName) == strlen(pcProcessName))
			{
				if (0 == _stricmp(lpszAttackProName, pcProcessName))
				{
					KdPrint(("[LookupProcessByName]--find\n"));
					*pEprocess = pCurEprocess;
					return STATUS_SUCCESS;
				}
			}
 
 
			//出口
			if (uLoopNum>=1
				&&pNextEprocess == pCurEprocess)
			{
				KdPrint(("[LookupProcessByName]--loop end\n"));
				*pEprocess = 0x00000000;
				return STATUS_NOT_FOUND;
			}
 
			pListActiveProcess = (PLIST_ENTRY)((ULONG)pCurEprocess+offset);//注意大括号，不用大括号会出错的
			(ULONG)pCurEprocess = (ULONG)pListActiveProcess->Flink;//pCurEprocess临时表示了前一个Active process
			(ULONG)pCurEprocess = (ULONG)pCurEprocess - offset;//对应的Eprocess基址
			KdPrint(("[LookupProcessByName]--pCurEprocess：%08x\n", pCurEprocess));
			uLoopNum ++;//循环次数+1
 
		}
 
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		KdPrint(("[LookupProcessByName]--execption:%08x--end\n", GetExceptionCode()));
		*pEprocess = 0x00000000;
		return STATUS_NOT_FOUND;
	}
}