Native API -- ScOpenProcess

        好久没写日志了，实在是没有时间啊！写日志也成了浪费时间，无奈啊！

        最近研究了下如何用 Native API 打开指定进程，从而实现根据 PID 来返回进程句柄，从而达到内存填 0 来查杀进程的目的！下面贴出来代码，当然参考了很多大牛的代码：

HANDLE __stdcall ScOpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId)

{  

    NTSTATUS    status;

    BOOLEAN     wasEnabled;

    char        *pBuf = NULL;

    DWORD       buflen = 0x10000, needlen = 0;

    DWORD       HandleCnt = 0;

    HANDLE      hRetProcess;



    PSYSTEM_HANDLE_INFORMATION  pSysHandleInfo = NULL;

    OBJECT_ATTRIBUTES           objatr = {sizeof(OBJECT_ATTRIBUTES), 0, NULL, NULL};

    CLIENT_ID                   cid;



    if ( bInheritHandle )

        objatr.Attributes |= OBJ_INHERIT;



    // 提权

    RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE, &wasEnabled);



    // 尝试正常方式打开

    cid.UniqueProcess = (HANDLE)dwProcessId;

    cid.UniqueThread  = 0;

    status = ZwOpenProcess(&hRetProcess, dwDesiredAccess, &objatr, &cid);

    if (NT_SUCCESS(status) )

        return hRetProcess;



    // 查询句柄信息

    do 

    {

        // 申请查询句柄信息所需要的内存

        ZwAllocateVirtualMemory(

            NtCurrentProcess(), 

            (PVOID *)&pBuf,

            0,

            &buflen,

            MEM_COMMIT,

            PAGE_READWRITE);

        // 查询系统句柄信息

        status = ZwQuerySystemInformation(

            SystemHandleInformation,

            (PVOID)pBuf,

            buflen,

            &needlen);

        if (status == STATUS_SUCCESS)

            break;



        // 若不成功则释放内存

        ZwFreeVirtualMemory(

            NtCurrentProcess(),

            (PVOID *)&pBuf,

            &buflen,

            MEM_RELEASE);



        // 加大申请的内存块, 一直到成功为止

        buflen *= 2;

        pBuf = NULL;

    } while ( TRUE );



    // 返回的缓冲区内容第一个 DWORD 是句柄的个数

    HandleCnt = *(DWORD *)pBuf;



    pSysHandleInfo = (PSYSTEM_HANDLE_INFORMATION)( (char *)pBuf + sizeof(DWORD) );

    for (DWORD i = 0; i < HandleCnt; i ++)

    {

        // 只验证类型为 PROCESS 的

        if ( pSysHandleInfo->ObjectTypeNumber == OB_TYPE_PROCESS)

        {

            HANDLE      hOwnerProc;

            HANDLE      hTmpProc;



            cid.UniqueProcess = (HANDLE)pSysHandleInfo->ProcessId;

            cid.UniqueThread  = 0;

            status = ZwOpenProcess(

                &hOwnerProc,

                PROCESS_DUP_HANDLE,

                &objatr,

                &cid);

            if ( NT_SUCCESS(status) )

            {

                // 打开成功，则把句柄复制过来

                status = ZwDuplicateObject(

                    hOwnerProc,

                    (HANDLE)pSysHandleInfo->Handle,

                    NtCurrentProcess(),

                    &hTmpProc,

                    PROCESS_ALL_ACCESS,

                    FALSE,

                    0);

                if ( NT_SUCCESS(status) )

                {

                    PROCESS_BASIC_INFORMATION BasicInfo = {0};



                    status = ZwQueryInformationProcess(

                        hTmpProc,

                        ProcessBasicInformation,

                        &BasicInfo,

                        sizeof(BasicInfo),

                        NULL);

                    if ( NT_SUCCESS(status) )

                    {

                        if (BasicInfo.UniqueProcessId == dwProcessId)

                        {

                            // 按需要的权限把句柄复制过来

                            ZwDuplicateObject(

                                hOwnerProc,

                                (HANDLE)pSysHandleInfo->Handle,

                                NtCurrentProcess(),

                                &hRetProcess,

                                dwDesiredAccess,

                                FALSE,

                                0);

                            ZwClose(hOwnerProc);

                            ZwClose(hTmpProc);

                            break;

                        }

                    }

                    ZwClose(hTmpProc);

                }

                ZwClose(hOwnerProc);

            }

        }

        pSysHandleInfo ++;

    }

    // 释放内存

    if (pBuf)

        ZwFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&pBuf, &buflen, MEM_RELEASE);



    return hRetProcess;

}

 

由此可以内存暴力枚举进程的雏形，关键是ZwQueryInformationProcess啊！通过抹掉自己进程在csrss里的句柄可以逃过这种方法。如今R3下的方法已经变得科普了，真正的技术还是在R0啊！打好基础，努力向R0迈进吧！