Ring3枚举进程
在Ring3枚举进程通常有一下几种方法：
- ToolHelper32
- Psapi
- ZwQuerySystemInformation
- WTSEnumerateProcesses
一、ToolHelper32
头文件：TlHelp32.h
关键函数：CreateToolhelp32Snapshot，Process32Next
BOOL EnumProcessesByToolHelper32()
{
PROCESSENTRY32 ProcessEntry32 = { 0 };
HANDLE hSnapshot = INVALID_HANDLE_VALUE;
BOOL IsOk = FALSE;
hSnapshot = CreateToolhelp32Snapshot(2, 0);
if (INVALID_HANDLE_VALUE == hSnapshot)
{
return FALSE;
}
//不添加这句会出现 0x0018 错误
ProcessEntry32.dwSize = sizeof(ProcessEntry32);
//遍历名字查找
_tprintf(TEXT("ProcessID\tProcessImageName\r\n"));
if (Process32First(hSnapshot, &ProcessEntry32))
{
do
{
_tprintf(TEXT("%d\t%s\r\n"), ProcessEntry32.th32ProcessID, ProcessEntry32.szExeFile);
} while (Process32Next(hSnapshot, &ProcessEntry32));
}
CloseHandle(hSnapshot);
getchar();
}
二、Psapi
头文件：Psapi.h
关键函数：EnumProcesses，OpenProcess，EnumProcessModules，GetProcessImageFileName，GetModuleBaseName
总结：由于该方法需要进程句柄，如果得不到进程句柄，什么信息都得不到，不建议使用。
// 注意：32位程序只能枚举32位程序，枚举不出64位程序
BOOL EnumProcessByPsapi()
{
TCHAR ProcessDosPath[0x200] = {};
TCHAR ProcessNtPath[MAX_PATH];
TCHAR ProcessName[MAX_PATH];
DWORD ProcessID[1024];
DWORD ProcessesCount;
DWORD CbNeeded;
HANDLE ProcessHandle = NULL;
HMODULE hMod = NULL;
if (!EnumProcesses(ProcessID, sizeof(ProcessID), &CbNeeded))
{
return FALSE;
}
ProcessesCount = CbNeeded / sizeof(DWORD);
_tprintf(TEXT("ProcessID\t ProcessImageName\t ProcessImageFullPath\r\n"));
for (size_t i = 0; i < CbNeeded; i++)
{
if (0 != ProcessID[i])
{
// 没有PROCESS_VM_READ 权限是枚举不出来的
ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
FALSE, ProcessID[i]);
if (ProcessHandle != NULL)
{
// 完整路径
if (GetProcessImageFileName(ProcessHandle, ProcessDosPath, _countof(ProcessDosPath)) > NULL)
{
// The GetProcessImageFileName function returns the path in device form, rather than drive letters.
// For example, the file name C:\Windows\System32\Ctype.nls would look as follows in
// device form :\Device\Harddisk0\Partition1\Windows\System32\Ctype.nls
DosPathToNtPath(ProcessDosPath, ProcessNtPath, MAX_PATH);
}
//进程名称()
if (EnumProcessModules(ProcessHandle, &hMod, sizeof(hMod), &CbNeeded))
{
GetModuleBaseName(ProcessHandle, hMod, ProcessName, sizeof(ProcessName) / sizeof(TCHAR));
}
else
{
_stprintf_s(ProcessName, TEXT("%s"), TEXT("" ));
}
_tprintf(TEXT("%d\t%s\t%s\r\n"), ProcessID[i], ProcessName, ProcessNtPath);
CloseHandle(ProcessHandle);
}
}
}
return TRUE;
}
BOOL DosPathToNtPath(IN LPTSTR DosPath, OUT LPTSTR NtPath,IN ULONG CchNtPath)
{
// DosPath: \Device\HarddiskVolume2\Windows\System32\sihost.exe
TCHAR DosPathOfVolume[0x200];
TCHAR DeviceName[3] = TEXT("A:");
TCHAR COMDeviceName[5] = TEXT("COM0");
ULONG StringLength = 0;
while (DeviceName[0] <= 'Z') //Z
{
// 如果指定DeviceName为NULL，那么该函数将输出所有存在的 MS-DOS device names
if (QueryDosDevice(DeviceName, DosPathOfVolume, 0x100 /sizeof(TCHAR)))
{
// C: 对应的DosPath是 \Device\HarddiskVolume2
StringLength = lstrlen(DosPathOfVolume);
// \Device\HarddiskVolume2 --> \Device\HarddiskVolume2\Windows\System32\sihost.exe
lstrcat(DosPathOfVolume, DosPath + StringLength);
// 判断是否是待转换的路径
if (lstrcmpi(DosPathOfVolume, DosPath) == NULL)
{
lstrcpy(NtPath, DeviceName); // D:
lstrcat(NtPath, DosPath + StringLength); // D:\Windows\system32
return TRUE;
}
}
DeviceName[0]++;
}
while (COMDeviceName[3] <= '9') //9
{
if (QueryDosDevice(COMDeviceName, DosPathOfVolume, MAX_PATH * 2) > NULL)
{
StringLength = lstrlen(DosPathOfVolume);
lstrcat(DosPathOfVolume, (DosPath + StringLength));
if (lstrcmpi(DosPathOfVolume, DosPath) == NULL)
{
lstrcpy(NtPath, COMDeviceName);
lstrcat(NtPath, (DosPath + StringLength));
return TRUE;
}
}
COMDeviceName[3]++;
}
return FALSE;
}
三、NtQuerySystemInformation
头文件：Winternl.h（头文件中的结构体都是不全的，需要自己定义，通常都是从ntdll.dll 中 Get 到函数地址）
关键函数：NtQuerySystemInformation
关键宏：SystemProcessInformation
关键结构：SYSTEM_PROCESS_INFORMATION
BOOL EnumProcessByZwQuerySystemInformation()
{
LPFN_NtQuerySystemInformation __NtQuerySystemInformation;
HMODULE hNtdll = LoadLibraryW(L"ntdll.dll");
if (!hNtdll)
{
return FALSE;
}
__NtQuerySystemInformation = (LPFN_NtQuerySystemInformation)GetProcAddress(hNtdll, "NtQuerySystemInformation");
if (!__NtQuerySystemInformation)
{
return FALSE;
}
PSYSTEM_PROCESS_INFORMATION SystemProcessInfo = NULL;
DWORD ReturnLength = 0;
DWORD BufferLength = 1;
// 将BufferLength置位1，查询需要的缓冲区大小
if (STATUS_INFO_LENGTH_MISMATCH == __NtQuerySystemInformation(SystemProcessInformation, &SystemProcessInfo, BufferLength, &ReturnLength))
{
BufferLength = ReturnLength;
SystemProcessInfo = (PSYSTEM_PROCESS_INFORMATION)malloc(BufferLength);
if (!SystemProcessInfo)
{
return FALSE;
}
if (__NtQuerySystemInformation(SystemProcessInformation, SystemProcessInfo, BufferLength, &ReturnLength) != STATUS_SUCCESS)
{
GetLastError();
return FALSE;
}
while (SystemProcessInfo->NextEntryOffset != 0)
{
wprintf(L"%d\t%s\r\n", SystemProcessInfo->UniqueProcessId, SystemProcessInfo->ImageName.Buffer);
SystemProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((PUINT8)SystemProcessInfo + SystemProcessInfo->NextEntryOffset);
}
}
}
四、WTSEnumerateProcesses
头文件：Wtsapi32.h（该方法需要获得计算机名，局域网内的其它计算机应该也能枚举）
关键函数：GetComputerName，WTSOpenServer，WTSEnumerateProcesses
关键结构：PWTS_PROCESS_INFO
int EnumProcessByWTSEnumerateProcesses()
{
TCHAR ComputerName[MAX_COMPUTERNAME_LENGTH + 2];
DWORD BufferSize;
BufferSize = sizeof ComputerName - 1;
GetComputerName(ComputerName, &BufferSize);
PWTS_PROCESS_INFO wts;
DWORD dwCount;
HANDLE hWtsServer = WTSOpenServer(ComputerName);
if (!WTSEnumerateProcesses(hWtsServer, 0, 1, &wts, &dwCount))
return 0;
for (DWORD i = 0; i < dwCount; i++)
{
printf("%d\t%s\n", wts[i].ProcessId, wts[i].pProcessName);
}
getchar();
return 0;
}