驱动层得到进程的完整路径

　　　在得到进程EProcess之后，对于进程完整路径的获得一般有两种方法，一种是访问的进程的PEB结构，在PEB结构中保存有进程的完整路径，另一种方法就是采用访问_FILE_OBJECT的方法。

　　访问PEB的方法便存在线程靠挂的问题，因为运行于Ring0层的线程是无法去访问用户地址空间的，需要将线程暂时靠挂到目标呢进程，进而去访问进程的PEB结构。我一般都采用的访问_FILE_OBJECT的方法，避免了线程的靠挂问题，而且访问peb的方法会存在一个问题:如果想要进行进程拦截，在进程未启动之前就阻止进程的启动，此时进程空间还未开辟，peb结构都不存在，只能去访问exe文件在ring0层的文件对象，通过文件对象来获得进程的完整路径。

　　进程靠挂函数原型

1 VOID KeStackAttachProcess (

2     PKPROCESS  Process,

3     PRKAPC_STATE  ApcState

4     );

访问目标进程的用户地址空间之后返回ring0运行调用函数

VOID KeUnstackDetachProcess(

   PRKAPC_STATE  ApcState

    );

kd> dt _eprocess

+0x1b0 Peb              : Ptr32 _PEB    //X86 Peb在EProcess中的偏移量

kd> dt _peb

+0x00c Ldr              : Ptr32 _PEB_LDR_DATA        ;进程加载的模块链表

关于进程加载模块链表是有三条链表

InLoadOrderModuleList    //模块的加载顺序

InMemoryOrderModuleList   // 模块在内存中的顺序

InInitializationOrderModuleList   // 模块的初始化顺序

进程的第一模块就是exe文件，对于exe的路径就是取InLoadOrderModuleList 中的第一模块的FullDllName。

 

第二种方法，用_FILE_OBJECT 的方法

以下为Windbg的调试过程，在虚拟机中打开calc.exe然后获得calc.exe的完整路径

Win7 X64

1 kd> !process 0 0

2 

3 PROCESS fffffa801a619b30

4     SessionId: 1  Cid: 0b10    Peb: 7fffffd6000  ParentCid: 05fc

5     DirBase: 5f017000  ObjectTable: fffff8a00296ac00  HandleCount:  79.

6     Image: calc.exe

kd> dt _eprocess fffffa801a619b30

+0x268 SectionObject    : 0xfffff8a0`01ba1f30 Void

kd> dt _section_object 0xfffff8a0`01ba1f30
nt!_SECTION_OBJECT
+0x000 StartingVa : (null)
+0x008 EndingVa : 0xfffff880`03bd4ba8 Void
+0x010 Parent : 0xfffff880`03bd4b90 Void
+0x018 LeftChild : (null)
+0x020 RightChild : 0xfffffa80`19e84300 Void
+0x028 Segment : 0xfffff8a0`01b19850 _SEGMENT_OBJECT

　　

kd> dt _segment 0xfffff8a0`01b19850
nt!_SEGMENT
+0x000 ControlArea : 0xfffffa80`1a687d30 _CONTROL_AREA
+0x008 TotalNumberOfPtes : 0xe3
+0x00c SegmentFlags : _SEGMENT_FLAGS
+0x010 NumberOfCommittedPages : 0
+0x018 SizeOfSegment : 0xe3000
+0x020 ExtendInfo : 0x00000000`ffbf0000 _MMEXTEND_INFO
+0x020 BasedAddress : 0x00000000`ffbf0000 Void
+0x028 SegmentLock : _EX_PUSH_LOCK
+0x030 u1 : <unnamed-tag>
+0x038 u2 : <unnamed-tag>
+0x040 PrototypePte : 0xfffff8a0`01b19898 _MMPTE
+0x048 ThePtes : [1] _MMPTE

 

kd> dt _CONTROL_AREA 0xfffffa80`1a687d30
nt!_CONTROL_AREA
+0x000 Segment : 0xfffff8a0`01b19850 _SEGMENT
+0x008 DereferenceList : _LIST_ENTRY [ 0x00000000`00000000 - 0xfffffa80`1a8a1018 ]
+0x018 NumberOfSectionReferences : 1
+0x020 NumberOfPfnReferences : 0x97
+0x028 NumberOfMappedViews : 1
+0x030 NumberOfUserReferences : 2
+0x038 u : <unnamed-tag>
+0x03c FlushInProgressCount : 0
+0x040 FilePointer : _EX_FAST_REF       //与X86的不同，X86下FilePointer的类型为_FILE_OBJECT，X64加了一层封装

 

kd> dt _EX_FAST_REF 0xfffffa80`1a687d30+0x040
nt!_EX_FAST_REF
+0x000 Object : 0xfffffa80`1a685073 Void         //真正的_FILE_OBJECT 最后一位要进行清0操作，  文件对象的最后一位必然为0
+0x000 RefCnt : 0y0011
+0x000 Value : 0xfffffa80`1a685073

 

 

kd> dt _File_object 0xfffffa80`1a685070 //_File_Object 最后一位清0
nt!_FILE_OBJECT
+0x000 Type : 0n5
+0x002 Size : 0n216
+0x008 DeviceObject : 0xfffffa80`19376530 _DEVICE_OBJECT
+0x010 Vpb : 0xfffffa80`19376470 _VPB
+0x018 FsContext : 0xfffff8a0`000f5140 Void
+0x020 FsContext2 : 0xfffff8a0`019715d0 Void
+0x028 SectionObjectPointer : 0xfffffa80`19e5ec88 _SECTION_OBJECT_POINTERS
+0x030 PrivateCacheMap : (null)
+0x038 FinalStatus : 0n0
+0x040 RelatedFileObject : (null)
+0x048 LockOperation : 0 ''
+0x049 DeletePending : 0 ''
+0x04a ReadAccess : 0x1 ''
+0x04b WriteAccess : 0 ''
+0x04c DeleteAccess : 0 ''
+0x04d SharedRead : 0x1 ''
+0x04e SharedWrite : 0 ''
+0x04f SharedDelete : 0x1 ''
+0x050 Flags : 0x44042
+0x058 FileName : _UNICODE_STRING "\Windows\System32\calc.exe"                                    //完整路径
+0x068 CurrentByteOffset : _LARGE_INTEGER 0x0
+0x070 Waiters : 0
+0x074 Busy : 0
+0x078 LastLock : (null)
+0x080 Lock : _KEVENT
+0x098 Event : _KEVENT
+0x0b0 CompletionContext : (null)
+0x0b8 IrpListLock : 0
+0x0c0 IrpList : _LIST_ENTRY [ 0xfffffa80`1a685130 - 0xfffffa80`1a685130 ]
+0x0d0 FileObjectExtension : (null)

 

 

 

 

 

 

WinXP X86

kd> !process 0 0

PROCESS 8971d6f8 SessionId: 0 Cid: 0378 Peb: 7ffdc000 ParentCid: 0664
DirBase: 0f8c02a0 ObjectTable: e23027a8 HandleCount: 44.
Image: calc.exe

kd> dt _eprocess 8971d6f8

+0x138 SectionObject : 0xe22963d0 Void

kd> dt _section_object 0xe22963d0
nt!_SECTION_OBJECT
+0x000 StartingVa : (null)
+0x004 EndingVa : (null)
+0x008 Parent : (null)
+0x00c LeftChild : (null)
+0x010 RightChild : (null)
+0x014 Segment : 0xe18e4820 _SEGMENT_OBJECT

kd> dt _segment 0xe18e4820
nt!_SEGMENT
+0x000 ControlArea : 0x89769478 _CONTROL_AREA
+0x004 TotalNumberOfPtes : 0x1f
+0x008 NonExtendedPtes : 0x1f
+0x00c WritableUserReferences : 0
+0x010 SizeOfSegment : 0x1f000
+0x018 SegmentPteTemplate : _MMPTE
+0x020 NumberOfCommittedPages : 0
+0x024 ExtendInfo : (null)
+0x028 SystemImageBase : (null)
+0x02c BasedAddress : 0x01000000 Void
+0x030 u1 : __unnamed
+0x034 u2 : __unnamed
+0x038 PrototypePte : 0xe18e4860 _MMPTE
+0x040 ThePtes : [1] _MMPTE

kd> dt _CONTROL_AREA 0x89769478
nt!_CONTROL_AREA
+0x000 Segment : 0xe18e4820 _SEGMENT
+0x004 DereferenceList : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x00c NumberOfSectionReferences : 1
+0x010 NumberOfPfnReferences : 0x1d
+0x014 NumberOfMappedViews : 1
+0x018 NumberOfSubsections : 4
+0x01a FlushInProgressCount : 0
+0x01c NumberOfUserReferences : 2
+0x020 u : __unnamed
+0x024 FilePointer : 0x8958a9b0 _FILE_OBJECT
+0x028 WaitingForDeletion : (null)
+0x02c ModifiedWriteCount : 0
+0x02e NumberOfSystemCacheViews : 0

kd> dt _FILE_OBJECT 0x8958a9b0
nt!_FILE_OBJECT
+0x000 Type : 0n5
+0x002 Size : 0n112
+0x004 DeviceObject : 0x899ab900 _DEVICE_OBJECT
+0x008 Vpb : 0x8994c1d8 _VPB                               //卷参数块，由此得到所属卷设备，即盘符
+0x00c FsContext : 0xe228f710 Void
+0x010 FsContext2 : 0xe1f5ea90 Void
+0x014 SectionObjectPointer : 0x894bbbe4 _SECTION_OBJECT_POINTERS
+0x018 PrivateCacheMap : (null)
+0x01c FinalStatus : 0n0
+0x020 RelatedFileObject : (null)
+0x024 LockOperation : 0 ''
+0x025 DeletePending : 0 ''
+0x026 ReadAccess : 0x1 ''
+0x027 WriteAccess : 0 ''
+0x028 DeleteAccess : 0 ''
+0x029 SharedRead : 0x1 ''
+0x02a SharedWrite : 0 ''
+0x02b SharedDelete : 0x1 ''
+0x02c Flags : 0x44042
+0x030 FileName : _UNICODE_STRING "\WINDOWS\system32\calc.exe"                            //完整路径
+0x038 CurrentByteOffset : _LARGE_INTEGER 0x0
+0x040 Waiters : 0
+0x044 Busy : 0
+0x048 LastLock : (null)
+0x04c Lock : _KEVENT
+0x05c Event : _KEVENT
+0x06c CompletionContext : (null)

 结构体的定义

ypedef struct _CONTROL_AREA64

{

    PVOID64 Segment;

    PVOID64 p1;

    PVOID64 p2;

    ULONG64 NumberOfSectionReferences;

    ULONG64 NumberOfPfnReferences;

    ULONG64 NumberOfMappedViews;

    ULONG64 NumberOfUserReferences;

    union

    {

        ULONG LongFlags;

        ULONG Flags;

    } u;

    PVOID64 FilePointer;

} CONTROL_AREA64, *PCONTROL_AREA64;



typedef struct _CONTROL_AREA

{

    PVOID Segment;

    LIST_ENTRY DereferenceList;

    ULONG NumberOfSectionReferences;

    ULONG NumberOfPfnReferences;

    ULONG NumberOfMappedViews;

    ULONG NumberOfSystemCacheViews;

    ULONG NumberOfUserReferences;

    union

    {

        ULONG LongFlags;

        ULONG Flags;

    } u;

    PFILE_OBJECT FilePointer;

} CONTROL_AREA, *PCONTROL_AREA;





typedef struct _SEGMENT64

{

    PVOID64 ControlArea;

    ULONG TotalNumberOfPtes;

    ULONG NonExtendedPtes;

    ULONG Spare0;

}SEGMENT64,*PSEGMENT64;



typedef struct _SEGMENT

{

    struct _CONTROL_AREA *ControlArea;

    ULONG TotalNumberOfPtes;

    ULONG NonExtendedPtes;

    ULONG Spare0;

} SEGMENT, *PSEGMENT;





typedef struct _SECTION_OBJECT

{

    PVOID StartingVa;

    PVOID EndingVa;

    PVOID Parent;

    PVOID LeftChild;

    PVOID RightChild;

    PSEGMENT Segment;

} SECTION_OBJECT, *PSECTION_OBJECT;





typedef struct _SECTION_OBJECT64

{

    PVOID64 StartingVa;

    PVOID64 EndingVa;

    PVOID64 Parent;

    PVOID64 LeftChild;

    PVOID64 RightChild;

    PVOID64 Segment;

} SECTION_OBJECT64, *PSECTION_OBJECT64;

 

 

BOOLEAN

GetProcessPathBySectionObject(ULONG_PTR ulProcessID,WCHAR* wzProcessPath)

{

    PEPROCESS         EProcess = NULL;

    PSECTION_OBJECT   SectionObject   = NULL;

    PSECTION_OBJECT64 SectionObject64 = NULL;

    PSEGMENT        Segment   = NULL;

    PSEGMENT64      Segment64 = NULL;

    PCONTROL_AREA   ControlArea = NULL;

    PCONTROL_AREA64 ControlArea64 = NULL;

    PFILE_OBJECT    FileObject  = NULL;

    BOOLEAN         bGetPath = FALSE;



    if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)ulProcessID, &EProcess)))

    {



        switch(WinVersion)

        {

        case WINDOWS_XP:   //x86 XP sp3

            {

                SectionObjectOfEProcess  = 0x138;

                if (SectionObjectOfEProcess!=0&&MmIsAddressValid((PVOID)((ULONG_PTR)EProcess + SectionObjectOfEProcess)))

                {

                    SectionObject = *(PSECTION_OBJECT*)((ULONG_PTR)EProcess + SectionObjectOfEProcess);

                    if (SectionObject && MmIsAddressValid(SectionObject))

                    {

                        Segment = (PSEGMENT)SectionObject->Segment;

                        if (Segment && MmIsAddressValid(Segment))

                        {

                            ControlArea = Segment->ControlArea;

                            if (ControlArea && MmIsAddressValid(ControlArea))

                            {

                                FileObject = ControlArea->FilePointer;

                                if (FileObject&&MmIsAddressValid(FileObject))

                                {

                                    bGetPath = GetPathByFileObject(FileObject, wzProcessPath);

                                    if (!bGetPath)

                                    {

                                        DbgPrint("SectionObject: 0x%08X, FileObject: 0x%08X\n", SectionObject, FileObject);

                                    }

                                }

                            }

                        }

                    }

                }

                break;

            }



        case WINDOWS_7:  //Win 7 x64 sp1

            {    

                SectionObjectOfEProcess = 0x268;           

                if (SectionObjectOfEProcess!=0&&MmIsAddressValid((PVOID)((ULONG_PTR)EProcess + SectionObjectOfEProcess)))

                {

                    SectionObject64 = *(PSECTION_OBJECT64*)((ULONG_PTR)EProcess + SectionObjectOfEProcess);

                    if (SectionObject64 && MmIsAddressValid(SectionObject64))

                    {



                        Segment64 = (PSEGMENT64)(SectionObject64->Segment);

                        if (Segment64 && MmIsAddressValid(Segment64))

                        {

                            ControlArea64 = (PCONTROL_AREA64)Segment64->ControlArea;

                            if (ControlArea64 && MmIsAddressValid(ControlArea64))

                            {

                                FileObject = (PFILE_OBJECT)ControlArea64->FilePointer;

                                if (FileObject&&MmIsAddressValid(FileObject))

                                {

                                    FileObject = (PFILE_OBJECT)((ULONG_PTR)FileObject & 0xFFFFFFFFFFFFFFF0);

                                    bGetPath = GetPathByFileObject(FileObject, wzProcessPath);

                                    if (!bGetPath)

                                    {

                                        DbgPrint("SectionObject: 0x%08X, FileObject: 0x%08X\n", SectionObject, FileObject);

                                    }

                                }

                            }

                        }

                    }

                }

                break;

            }

        }        

    }

    if (bGetPath==FALSE)

    {

        wcscpy(wzProcessPath,L"Unknow");

    }



    return bGetPath;    



}

 

获得文件对象以后，获得完整的路径

//传入文件对象，返回完整路径

  1 BOOLEAN GetPathByFileObject(PFILE_OBJECT FileObject, WCHAR* wzPath)

  2 {

  3     BOOLEAN bGetPath = FALSE;

  4     CHAR szIoQueryFileDosDeviceName[] = "IoQueryFileDosDeviceName";

  5     CHAR szIoVolumeDeviceToDosName[] = "IoVolumeDeviceToDosName";

  6     CHAR szRtlVolumeDeviceToDosName[] = "RtlVolumeDeviceToDosName";

  7 

  8     POBJECT_NAME_INFORMATION ObjectNameInformation = NULL;

  9     __try

 10     {

 11         if (FileObject && MmIsAddressValid(FileObject) && wzPath)

 12         {

 13         

 14             if (NT_SUCCESS(IoQueryFileDosDeviceName(FileObject,&ObjectNameInformation)))   //注意该函数调用后要释放内存

 15             {

 16                 wcsncpy(wzPath,ObjectNameInformation->Name.Buffer,ObjectNameInformation->Name.Length);

 17 

 18                 bGetPath = TRUE;

 19 

 20                 ExFreePool(ObjectNameInformation);

 21             }

 22             

 23             

 24             if (!bGetPath)

 25             {

 26             

 27                 if (IoVolumeDeviceToDosName||RtlVolumeDeviceToDosName)

 28                 {

 29                     NTSTATUS  Status = STATUS_UNSUCCESSFUL;

 30                     ULONG_PTR ulRet= 0;

 31                     PVOID     Buffer = ExAllocatePool(PagedPool,0x1000);

 32 

 33                     if (Buffer)

 34                     {

 35                         // ObQueryNameString : \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareTray.exe

 36                         memset(Buffer, 0, 0x1000);

 37                         Status = ObQueryNameString(FileObject, (POBJECT_NAME_INFORMATION)Buffer, 0x1000, &ulRet);

 38                         if (NT_SUCCESS(Status))

 39                         {

 40                             POBJECT_NAME_INFORMATION Temp = (POBJECT_NAME_INFORMATION)Buffer;

 41                         

 42                             WCHAR szHarddiskVolume[100] = L"\\Device\\HarddiskVolume";

 43 

 44                             if (Temp->Name.Buffer!=NULL)

 45                             {

 46                                 if (Temp->Name.Length / sizeof(WCHAR) > wcslen(szHarddiskVolume) &&

 47                                     !_wcsnicmp(Temp->Name.Buffer, szHarddiskVolume, wcslen(szHarddiskVolume)))

 48                                 {

 49                                     // 如果是以 "\\Device\\HarddiskVolume" 这样的形式存在的，那么再查询其卷名。

 50                                     UNICODE_STRING uniDosName;

 51 

 52                                     if (NT_SUCCESS(IoVolumeDeviceToDosName(FileObject->DeviceObject, &uniDosName)))

 53                                     {

 54                                         if (uniDosName.Buffer!=NULL)

 55                                         {

 56                                         

 57                                             wcsncpy(wzPath, uniDosName.Buffer, uniDosName.Length);

 58                                             wcsncat(wzPath, Temp->Name.Buffer + wcslen(szHarddiskVolume) + 1, Temp->Name.Length - (wcslen(szHarddiskVolume) + 1));

 59                                             bGetPath = TRUE;

 60                                         }    

 61 

 62                                         ExFreePool(uniDosName.Buffer);

 63                                     }

 64 

 65                                     else if (NT_SUCCESS(RtlVolumeDeviceToDosName(FileObject->DeviceObject, &uniDosName)))

 66                                     {

 67                                         if (uniDosName.Buffer!=NULL)

 68                                         {

 69 

 70                                             wcsncpy(wzPath, uniDosName.Buffer, uniDosName.Length);

 71                                             wcsncat(wzPath, Temp->Name.Buffer + wcslen(szHarddiskVolume) + 1, Temp->Name.Length - (wcslen(szHarddiskVolume) + 1));

 72                                             bGetPath = TRUE;

 73                                         }    

 74 

 75                                         ExFreePool(uniDosName.Buffer);

 76                                     }

 77                                     

 78                                 }

 79                                 else

 80                                 {

 81                                     // 如果不是以 "\\Device\\HarddiskVolume" 这样的形式开头的，那么直接复制名称。

 82                                     

 83                                     wcsncpy(wzPath, Temp->Name.Buffer, Temp->Name.Length);

 84                                     bGetPath = TRUE;

 85                                 }

 86                             }

 87                         }

 88 

 89                         ExFreePool(Buffer);

 90                     }

 91                 }

 92             }

 93         }

 94     }

 95     __except(1)

 96     {

 97         DbgPrint("GetPathByFileObject Catch __Except\r\n");

 98         bGetPath = FALSE;

 99     }

100 

101     return bGetPath;

102 }