Hook SSDT

Tommy Liang — Sat, 21 Mar 2009 08:19:00 GMT

摘要: 看了《Rootkit》和《黑客防线2009》的文章，代码写了一下，有些体会：驱动程序代码： #include "ntddk.h"#define NT_DEVICE_NAME L"\\Device\\ProtectProcess"#define DOS_DEVICE_NAME L"\\DosDevices\\ProtectProcess"#de... 阅读全文

Tommy Liang 2009-03-21 16:19 发表评论

根据进程标识符显示其相关信息

Tommy Liang — Sat, 22 Oct 2005 03:01:00 GMT

如下：

// ProcessHelper.h: interface for the ProcessHelper class.
//
//////////////////////////////////////////////////////////////////////

#if !defined(AFX_PROCESSHELPER_H__EA2A87A6_5E54_4610_8EDD_C5F8119D2976__INCLUDED_)
#define AFX_PROCESSHELPER_H__EA2A87A6_5E54_4610_8EDD_C5F8119D2976__INCLUDED_

#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000

#include <Tlhelp32.h>
#include <Psapi.h>

#define ProcessBasicInformation 0

typedef struct
{
    DWORD ExitStatus;
    DWORD PebBaseAddress;
    DWORD AffinityMask;
    DWORD BasePriority;
    ULONG UniqueProcessId;
    ULONG InheritedFromUniqueProcessId;
}   PROCESS_BASIC_INFORMATION;

// ntdll!NtQueryInformationProcess (NT specific!)
//
// The function copies the process information of the
// specified type into a buffer
//
// NTSYSAPI
// NTSTATUS
// NTAPI
// NtQueryInformationProcess(
//    IN HANDLE ProcessHandle,              // handle to process
//    IN PROCESSINFOCLASS InformationClass, // information type
//    OUT PVOID ProcessInformation,         // pointer to buffer
//    IN ULONG ProcessInformationLength,    // buffer size in bytes
//    OUT PULONG ReturnLength OPTIONAL      // pointer to a 32-bit
//                                          // variable that receives
//                                          // the number of bytes
//                                          // written to the buffer
// );
typedef LONG (WINAPI *PROCNTQSIP)(HANDLE,UINT,PVOID,ULONG,PULONG);

class ProcessHelper
{
public:
    ProcessHelper();
    virtual ~ProcessHelper();

    DWORD GetParentProcessID(DWORD dwId);

    DWORD GetProcessFileName( DWORD dwId,LPTSTR lpImageFileName);

private:
    PROCNTQSIP NtQueryInformationProcess;

};

ProcessHelper::ProcessHelper()
{
    NtQueryInformationProcess = (PROCNTQSIP)GetProcAddress(
        GetModuleHandle("ntdll"),
        "NtQueryInformationProcess"
        );
}

ProcessHelper::~ProcessHelper()
{

}

DWORD ProcessHelper::GetProcessFileName( DWORD dwId,LPTSTR lpImageFileName)
{
    HANDLE hSnapshot = ::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,dwId);
    if (hSnapshot == INVALID_HANDLE_VALUE)
        return (FALSE);

    MODULEENTRY32 me32        = {0};
    me32.dwSize = sizeof(MODULEENTRY32);

    if(! Module32First(hSnapshot,&me32))
    {
        CloseHandle(hSnapshot);
        return (DWORD) -1;
    }

    strcpy(lpImageFileName,me32.szModule);

    CloseHandle(hSnapshot);
    return (DWORD)0;
}

DWORD ProcessHelper::GetParentProcessID(DWORD dwId)
{
    if (!NtQueryInformationProcess)  return -1;

    LONG                      status;
    DWORD                     dwParentPID = (DWORD)-1;
    HANDLE                    hProcess;
    PROCESS_BASIC_INFORMATION pbi;

    // Get process handle
    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,dwId);
    if (!hProcess)
        return (DWORD)-1;

    // Retrieve information
    status = NtQueryInformationProcess( hProcess,
        ProcessBasicInformation,
        (PVOID)&pbi,
        sizeof(PROCESS_BASIC_INFORMATION),
        NULL
        );

    // Copy parent Id on success
    if  (!status)
        dwParentPID = pbi.InheritedFromUniqueProcessId;

    CloseHandle (hProcess);

    return dwParentPID;
}

#endif

Tommy Liang 2005-10-22 11:01 发表评论

取得内存中的实例数

Tommy Liang — Sat, 22 Oct 2005 02:47:00 GMT

this is the content:

#include <Tlhelp32.h>

//取得内存中的实例数
int GetMemoryProcessCount(LPCSTR peFileName)
{
    int result = 0;

    HANDLE hSnapshot;
    PROCESSENTRY32 pe;
    pe.dwSize=sizeof(pe);
    BOOL blExist=FALSE;
    char sPath[MAX_PATH] = "";
    strcpy(sPath,peFileName);

    size_t len = strlen(sPath);
    hSnapshot=::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
    if(hSnapshot<0) goto L1;

    if(::Process32First(hSnapshot,&pe)==FALSE)
    {
        ::CloseHandle(hSnapshot); goto L1;
    }
    if(_strnicmp(sPath,pe.szExeFile,len)==0)
    {
        ++ result;
    }

    while(::Process32Next(hSnapshot,&pe))
    {
        if(_strnicmp(sPath,pe.szExeFile,len)==0)
        {
            ++ result;
        }
    }

L1:
    ::CloseHandle(hSnapshot);
    return result;
}

Tommy Liang 2005-10-22 10:47 发表评论

C++博客-tommy-随笔分类-进程与线程

Hook SSDT

根据进程标识符显示其相关信息

取得内存中的实例数