今日一天！驱动下的进程枚举

wl1383838438 · 发表于 2020-3-1 22:22:34

本帖最后由 wl1383838438 于 2020-3-1 22:24 编辑

#include "ntddk.h"

typedef enum _SYSTEM_INFORMATION_CLASS {
SystemBasicInformation, // 0
SystemProcessorInformation, // 1
SystemPerformanceInformation, // 2
SystemTimeOfDayInformation, // 3
SystemNotImplemented1, // 4
SystemProcessesAndThreadsInformation, // 5
SystemCallCounts, // 6
SystemConfigurationInformation, // 7
SystemProcessorTimes, // 8
SystemGlobalFlag, // 9
SystemNotImplemented2, // 10
SystemModuleInformation, // 11
SystemLockInformation, // 12
SystemNotImplemented3, // 13
SystemNotImplemented4, // 14
SystemNotImplemented5, // 15
SystemHandleInformation, // 16
SystemObjectInformation, // 17
SystemPagefileInformation, // 18
SystemInstructionEmulationCounts, // 19
SystemInvalidInfoClass1, // 20
SystemCacheInformation, // 21
SystemPoolTagInformation, // 22
SystemProcessorStatistics, // 23
SystemDpcInformation, // 24
SystemNotImplemented6, // 25
SystemLoadImage, // 26
SystemUnloadImage, // 27
SystemTimeAdjustment, // 28
SystemNotImplemented7, // 29
SystemNotImplemented8, // 30
SystemNotImplemented9, // 31
SystemCrashDumpInformation, // 32
SystemExceptionInformation, // 33
SystemCrashDumpStateInformation, // 34
SystemKernelDebuggerInformation, // 35
SystemContextSwitchInformation, // 36
SystemRegistryQuotaInformation, // 37
SystemLoadAndCallImage, // 38
SystemPrioritySeparation, // 39
SystemNotImplemented10, // 40
SystemNotImplemented11, // 41
SystemInvalidInfoClass2, // 42
SystemInvalidInfoClass3, // 43
SystemTimeZoneInformation, // 44
SystemLookasideInformation, // 45
SystemSetTimeSlipEvent, // 46
SystemCreateSession, // 47
SystemDeleteSession, // 48
SystemInvalidInfoClass4, // 49
SystemRangeStartInformation, // 50
SystemVerifierInformation, // 51
SystemAddVerifier, // 52
SystemSessionProcessesInformation // 53
} SYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_THREAD_INFORMATION {
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitchCount;
LONG State;
LONG WaitReason;
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;

typedef struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryDelta;//构成结构系列的偏移量也就是下一个进程
ULONG ThreadCount;//线程的数目
ULONG Reserved1[6];// 暂时未知
LARGE_INTEGER CreateTime;//创建时间
LARGE_INTEGER UserTime;//用户模式的CPU时间
LARGE_INTEGER KernelTime;//内核模式下的时间
UNICODE_STRING ProcessName;//进程的名称
KPRIORITY BasePriority;//进程的优先权
ULONG ProcessId;//进程的标识符
ULONG InheritedFromProcessId;//父进程的标识符
ULONG HandleCount;//句柄数目
ULONG Reserved2[2];//
VM_COUNTERS VmCounters;//虚拟存储器的机构
IO_COUNTERS IoCounters;//io计数器
//SYSTEM_THREAD_INFORMATION Threads[1];//进程相关的线程结构数组这里我们不使用
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID SystemInformation,//‎要检索的系统信息的类型。此参数可以是‎ SYSTEM_INFORMATION_CLASS enumeration type.
IN ULONG SystemInformationLength,//系统信息‎‎参数指向的缓冲区的大小（以字节为单位）
OUT PULONG  ReturnLength//‎指向函数写入所请求信息的实际大小的位置的可选指针。
//如果该大小小于或等于‎‎System 信息长度‎‎参数，则函数将信息复制到 System 信息缓冲区中;否则，
//该函数将信息复制到‎‎System 信息‎‎缓冲区中。否则，它将返回 NTSTATUS 错误代码，
//并在‎‎ReturnLength‎‎中返回接收请求的信息所需的缓冲区大小。‎
);
//--------------------------------------------------------------

//-----------------------------------------------------------------
NTSTATUS Ring0EnumProcess()
{
ULONG cbuffer = 0x8000;//0x是十六进制的意思
PVOID pBuffer = NULL;
NTSTATUS Status;
PSYSTEM_PROCESS_INFORMATION pInfo;
do
{
//‎ExAllocatePool‎‎分配指定类型的池内存，
//并返回指向已分配块的指针-‎如果空闲池中没有足够的内存来满足请求，
//‎‎则释放分配池‎‎将返回‎‎NULL。‎‎否则，例程将返回指向已分配的内存的指针。‎
pBuffer = ExAllocatePool(NonPagedPool, cbuffer);//参数2指定要分配的字节数。‎
if (pBuffer == NULL)
{
return 1;
}
Status = ZwQuerySystemInformation(SystemProcessesAndThreadsInformation, pBuffer, cbuffer, NULL);//函数的原型在93行定义查询的结果在pBuffer中保存
//通过下断点跟踪发现查询的结果会在pBuffer中该参数在138行中被转为pInfo = (PSYSTEM_PROCESS_INFORMATION)pBuffer;，并且在循环中枚举所有进程信息
if (Status == STATUS_INFO_LENGTH_MISMATCH)//如果 buffer 长度不满足条件，则返回 STATUS_INFO_LENGTH_MISMATCH 状态
{
ExFreePool(pBuffer);//‎ExFreePool‎‎例程取消分配池内存块
cbuffer *= 2;//内存乘以2
}
else if (!NT_SUCCESS(Status))
{
ExFreePool(pBuffer);//四方内存
return 1;
}

} while (Status == STATUS_INFO_LENGTH_MISMATCH);
pInfo = (PSYSTEM_PROCESS_INFORMATION)pBuffer;//将查询后的值转为pInfo = (PSYSTEM_PROCESS_INFORMATION)pBuffer;
for (;;)//循环
{
LPWSTR pszProcessName = pInfo->ProcessName.Buffer;//获取进程名字
if (pszProcessName == NULL)
{
pszProcessName = L"null";

}//打印信息
DbgPrint("ProcessID%d 进程名：：%S  父进程ID%d", pInfo->ProcessId, pInfo->ProcessName.Buffer, pInfo->InheritedFromProcessId);
KdPrint(("HandleCount=%d", pInfo->HandleCount));
if (pInfo->NextEntryDelta == 0)//判断下一个的偏移量是否为空，为空表示最后一个进程信息
{
break;//跳出循环
}
pInfo = (PSYSTEM_PROCESS_INFORMATION)(((PUCHAR)pInfo) + pInfo->NextEntryDelta);//将指向下一个的信息结构  赋给当前的结构成员

}
ExFreePool(pBuffer);//释放内存
return 0;

}

VOID Unload(IN PDRIVER_OBJECT DriverObject)
{
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
DriverObject->DriverUnload = Unload;//卸载例程

Ring0EnumProcess();//调用我们自定义的枚举函数
return STATUS_SUCCESS;
}

今日一天！驱动下的进程枚举