在驱动中获取进程全路径
本文转自 http://xiabl.blog.ccidnet.com/blog.php?do=showone&itemid=129339&typ=blog
仅作收藏
在驱动中获取进程全路径
系统具备:
WinDbg,
Windows Symbol Packages
(http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx下载)
取得EPROCESS(PsGetCurrentProcess();)
通过偏移量取得PEB, (Address + BASE_PROCESS_PEB_OFFSET )
通过PEB指针的偏移量取得RTL_USER_PROCESS_PARAMETER( Address + BASE_PEB_PROCESS_PARAMETER_OFFSET)
最后是取得其ImagePathName, 得到是UNICODE_STRING结构.
#define BASE_PROCESS_PEB_OFFSET 0x01B0
#define BASE_PEB_PROCESS_PARAMETER_OFFSET 0x0010
#define BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME 0x003C
#define W2003_BASE_PROCESS_PEB_OFFSET 0x0190
#define W2003_BASE_PROCESS_PEB_OFFSET_SP1 0x01A0
#define VISTA_BASE_PROCESS_PEB_OFFSET 0x0188
PCWSTR GetProcessFullName()
{
ULONG OsMajorVersion;
ULONG OsMinorVersion ;
DWORD dwAddress;
PCWSTR Temp=NULL;
if(KeGetCurrentIrql() != PASSIVE_LEVEL)
{
return NULL;
}
try
{
dwAddress = (DWORD)PsGetCurrentProcess();
if(dwAddress == 0 || dwAddress == 0xFFFFFFFF)
{
return NULL;
}
PsGetVersion(&OsMajorVersion,
&OsMinorVersion,
NULL,
NULL
);
//目前只支持Win 2000/xp/2003/VISTA
if( OsMajorVersion < 5 ||
OsMinorVersion > 2 )
{
return NULL;
}
//取得PEB，不同平台的位置是不同的。
//
//2000 0X0500 XP 0X0501
//
if( OsMajorVersion == 5 && OsMinorVersion < 2)
{
dwAddress += BASE_PROCESS_PEB_OFFSET;
}
//
//2003 0X0502
//
if(OsMajorVersion == 5 && OsMinorVersion ==2)
{
dwAddress += W2003_BASE_PROCESS_PEB_OFFSET;
}
//
//VISTA 0X0600
//
if(OsMajorVersion == 6 && OsMinorVersion ==0)
{
dwAddress += VISTA_BASE_PROCESS_PEB_OFFSET;
}
if((dwAddress = *(DWORD*)dwAddress) == 0)
{
return NULL;
}
//
// 通过peb取得RTL_USER_PROCESS_PARAMETERS
//
dwAddress += BASE_PEB_PROCESS_PARAMETER_OFFSET;
if((dwAddress = *(DWORD*)dwAddress) == 0)
{
return NULL;
}
//
// 在RTL_USER_PROCESS_PARAMETERS->ImagePathName保存了路径，偏移为38,
//
dwAddress += BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME;
if((dwAddress = *(DWORD*)dwAddress) == 0)
{
return NULL;
}
// [10/14/2006]
Temp=(PCWSTR)dwAddress;
if (wcslen(Temp)>4)
{
if (Temp[0]==L'//'&&
Temp[1]==L'?'&&
Temp[2]==L'?'&&
Temp[3]==L'//')
{
dwAddress+=8;
}
if (Temp[0]==L'//'&&
Temp[1]==L'//'&&
Temp[2]==L'?'&&
Temp[3]==L'//')
{
dwAddress+=8;
}
}
}
except (EXCEPTION_EXECUTE_HANDLER)
{
try
{
if(OsMajorVersion == 5 && OsMinorVersion ==2)
{dwAddress = (DWORD)PsGetCurrentProcess();
dwAddress += W2003_BASE_PROCESS_PEB_OFFSET_SP1;
if((dwAddress = *(DWORD*)dwAddress) == 0)
{
return NULL;
}
//
// 通过peb取得RTL_USER_PROCESS_PARAMETERS
//
dwAddress += BASE_PEB_PROCESS_PARAMETER_OFFSET;
if((dwAddress = *(DWORD*)dwAddress) == 0)
{
return NULL;
}
//
// 在RTL_USER_PROCESS_PARAMETERS->ImagePathName保存了路径，偏移为38,
//
dwAddress += BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME;
if((dwAddress = *(DWORD*)dwAddress) == 0)
{
return NULL;
}
// [10/14/2006]
Temp=(PCWSTR)dwAddress;
if (wcslen(Temp)>4)
{
if (Temp[0]==L'//'&&
Temp[1]==L'?'&&
Temp[2]==L'?'&&
Temp[3]==L'//')
{
dwAddress+=8;
}
if (Temp[0]==L'//'&&
Temp[1]==L'//'&&
Temp[2]==L'?'&&
Temp[3]==L'//')
{
dwAddress+=8;
}
}
return (PCWSTR)dwAddress;
}
}
except (EXCEPTION_EXECUTE_HANDLER)
{
}
return 0;
}
return (PCWSTR)dwAddress;
}
PEB的偏移量可以通过Windbg查找
kd> dt nt!_EPROCESS
Here is an example of !processfields from a Windows 2000 system:
kd> !processfields
EPROCESS structure offsets:
Pcb: 0x0
ExitStatus: 0x6c
LockEvent: 0x70
LockCount: 0x80
CreateTime: 0x88
ExitTime: 0x90
LockOwner: 0x98
UniqueProcessId: 0x9c
ActiveProcessLinks: 0xa0
QuotaPeakPoolUsage[0]: 0xa8
QuotaPoolUsage[0]: 0xb0
PagefileUsage: 0xb8
CommitCharge: 0xbc
PeakPagefileUsage: 0xc0
PeakVirtualSize: 0xc4
VirtualSize: 0xc8
Vm: 0xd0
DebugPort: 0x120
ExceptionPort: 0x124
ObjectTable: 0x128
Token: 0x12c
WorkingSetLock: 0x130
WorkingSetPage: 0x150
ProcessOutswapEnabled: 0x154
ProcessOutswapped: 0x155
AddressSpaceInitialized: 0x156
AddressSpaceDeleted: 0x157
AddressCreationLock: 0x158
ForkInProgress: 0x17c
VmOperation: 0x180
VmOperationEvent: 0x184
PageDirectoryPte: 0x1f0
LastFaultCount: 0x18c
VadRoot: 0x194
VadHint: 0x198
CloneRoot: 0x19c
NumberOfPrivatePages: 0x1a0
NumberOfLockedPages: 0x1a4
ForkWasSuccessful: 0x182
ExitProcessCalled: 0x1aa
CreateProcessReported: 0x1ab
SectionHandle: 0x1ac
Peb: 0x1b0
SectionBaseAddress: 0x1b4
QuotaBlock: 0x1b8
LastThreadExitStatus: 0x1bc
WorkingSetWatch: 0x1c0
InheritedFromUniqueProcessId: 0x1c8
GrantedAccess: 0x1cc
DefaultHardErrorProcessing 0x1d0
LdtInformation: 0x1d4
VadFreeHint: 0x1d8
VdmObjects: 0x1dc
DeviceMap: 0x1e0
ImageFileName[0]: 0x1fc
VmTrimFaultValue: 0x20c
Win32Process: 0x214
Win32WindowStation: 0x1c4
注意要在windgb加载相应的Symbol