驱动枚举进程

最新推荐文章于 2022-10-22 09:51:42 发布

instruder

最新推荐文章于 2022-10-22 09:51:42 发布

阅读量1.9k

点赞数

分类专栏：驱动/内核/HOOK/ROOKIT 文章标签： extension integer system object string thread

本文链接：https://blog.csdn.net/instruder/article/details/5378696

版权

驱动/内核/HOOK/ROOKIT 专栏收录该内容

26 篇文章 2 订阅

订阅专栏

Driver.cpp

// DriEnumProcess.cpp : Defines the entry point for the console application.
//

#include "Driver.h"
#include "ntddk.h"
#include <ntddkbd.h>
#include "stdarg.h"
#include "stdio.h"
#include "ntddkbd.h"

typedef enum _SYSTEM_INFORMATION_CLASS {
SystemBasicInformation,
SystemProcessorInformation,
SystemPerformanceInformation,
SystemTimeOfDayInformation,
SystemNotImplemented1,
SystemProcessesAndThreadsInformation,
SystemCallCounts,
SystemConfigurationInformation,
SystemProcessorTimes,
SystemGlobalFlag,
SystemNotImplemented2,
SystemModuleInformation,
SystemLockInformation,
SystemNotImplemented3,
SystemNotImplemented4,
SystemNotImplemented5,
SystemHandleInformation,
SystemObjectInformation,
SystemPagefileInformation,
SystemInstructionEmulationCounts,
SystemInvalidInfoClass1,
SystemCacheInformation,
SystemPoolTagInformation,
SystemProcessorStatistics,
SystemDpcInformation,
SystemNotImplemented6,
SystemLoadImage,
SystemUnloadImage,
SystemTimeAdjustment,
SystemNotImplemented7,
SystemNotImplemented8,
SystemNotImplemented9,
SystemCrashDumpInformation,
SystemExceptionInformation,
SystemCrashDumpStateInformation,
SystemKernelDebuggerInformation,
SystemContextSwitchInformation,
SystemRegistryQuotaInformation,
SystemLoadAndCallImage,
SystemPrioritySeparation,
SystemNotImplemented10,
SystemNotImplemented11,
SystemInvalidInfoClass2,
SystemInvalidInfoClass3,
SystemTimeZoneInformation,
SystemLookasideInformation,
SystemSetTimeSlipEvent,
SystemCreateSession,
SystemDeleteSession,
SystemInvalidInfoClass4,
SystemRangeStartInformation,
SystemVerifierInformation,
SystemAddVerifier,
    SystemSessionProcessesInformation
} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
//------------------------------

//---------线程信息结构---------
typedef struct _SYSTEM_THREAD {
LARGE_INTEGER           KernelTime;
LARGE_INTEGER           UserTime;
LARGE_INTEGER           CreateTime;
ULONG                   WaitTime;
PVOID                   StartAddress;
CLIENT_ID               ClientId;
KPRIORITY               Priority;
LONG                    BasePriority;
ULONG                   ContextSwitchCount;
ULONG                   State;
KWAIT_REASON            WaitReason;
} SYSTEM_THREAD, *PSYSTEM_THREAD;
//------------------------------

//---------进程信息结构---------
typedef struct _SYSTEM_PROCESS_INFORMATION {
ULONG                   NextEntryOffset; //NextEntryDelta 构成结构序列的偏移量
ULONG                   NumberOfThreads; //线程数目
LARGE_INTEGER           Reserved[3];
LARGE_INTEGER           CreateTime;   //创建时间
LARGE_INTEGER           UserTime;     //用户模式(Ring 3)的CPU时间
LARGE_INTEGER           KernelTime;   //内核模式(Ring 0)的CPU时间
UNICODE_STRING          ImageName;    //进程名称
KPRIORITY               BasePriority; //进程优先权
HANDLE                  ProcessId;    //ULONG UniqueProcessId 进程标识符
HANDLE                  InheritedFromProcessId; //父进程的标识符
ULONG                   HandleCount; //句柄数目
ULONG                   Reserved2[2];
ULONG                   PrivatePageCount;
VM_COUNTERS             VirtualMemoryCounters; //虚拟存储器的结构
IO_COUNTERS             IoCounters; //IO计数结构
SYSTEM_THREAD           Threads[0]; //进程相关线程的结构数组
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

NTSYSAPI
extern "C"
NTSTATUS
NTAPI
NtQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
             OUT PVOID SystemInformation,
             IN ULONG SystemInformationLength,
             OUT PULONG ReturnLength OPTIONAL);

EnumProcess()
{
ULONG pNeededSize=0;
int iCount = 1;
int bOver=0;
NTSTATUS status;
ULONG uSize;
PVOID pSi=NULL;
PSYSTEM_PROCESS_INFORMATION pSpiNext = NULL;
uSize=0x8000;
pSi=ExAllocatePoolWithTag(NonPagedPool,uSize,'tag1');
if (pSi!=NULL)
{
  status=NtQuerySystemInformation(SystemProcessesAndThreadsInformation,pSi,uSize,&pNeededSize);
  DbgPrint("[Aliwy] SUCCESS uSize = %.8X, pNeededSize = %.8X, status = %.8X/n", uSize, pNeededSize, status);
  uSize=pNeededSize;
  status=NtQuerySystemInformation(SystemProcessesAndThreadsInformation,pSi,uSize,&pNeededSize);
  if (STATUS_SUCCESS==status)
  {
   pSpiNext=(PSYSTEM_PROCESS_INFORMATION) pSi;
   while (TRUE)
   {
    if (pSpiNext->ProcessId==0)
    {
     KdPrint(("[Aliwy] %d - System Idle Process/n",pSpiNext->ProcessId));
    }
    else
    {
     KdPrint(("[Aliwy] %d - %wZ/n",pSpiNext->ProcessId,&pSpiNext->ImageName));
    }
    if (pSpiNext->NextEntryOffset==0)
    {
     KdPrint(("[Aliwy] EnumProcess Over, Count is: %d/n"),iCount);
     bOver=1;
     break;
    }
    pSpiNext = (PSYSTEM_PROCESS_INFORMATION)((ULONG)pSpiNext + pSpiNext->NextEntryOffset);
          iCount++;
   }
   ExFreePool(pSi);

  }
  else
  {
   DbgPrint("[Aliwy] SUCCESS uSize = %.8X, pNeededSize = %.8X, status = %.8X/n", uSize, pNeededSize, status);

  }

}

return STATUS_SUCCESS;

}
#pragma INITCODE
extern "C" NTSTATUS DriverEntry (
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath )
{
NTSTATUS status;
KdPrint(("Enter DriverEntry/n"));

//注册其他驱动调用函数入口
pDriverObject->DriverUnload = HelloDDKUnload;
pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKDispatchRoutine;

//创建驱动设备对象
status = CreateDevice(pDriverObject);

EnumProcess();
KdPrint(("DriverEntry end/n"));
return status;
}

/************************************************************************
* 函数名称:CreateDevice
* 功能描述:初始化设备对象
* 参数列表:
      pDriverObject:从I/O管理器中传进来的驱动对象
* 返回值:返回初始化状态
*************************************************************************/
#pragma INITCODE
NTSTATUS CreateDevice (
  IN PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt;

//创建设备名称
UNICODE_STRING devName;
RtlInitUnicodeString(&devName,L"//Device//MyDDKDevice");

//创建设备
status = IoCreateDevice( pDriverObject,
      sizeof(DEVICE_EXTENSION),
      &(UNICODE_STRING)devName,
      FILE_DEVICE_UNKNOWN,
      0, TRUE,
      &pDevObj );
if (!NT_SUCCESS(status))
  return status;

pDevObj->Flags |= DO_BUFFERED_IO;
pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice = pDevObj;
pDevExt->ustrDeviceName = devName;
//创建符号链接
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName,L"//??//HelloDDK");
pDevExt->ustrSymLinkName = symLinkName;
status = IoCreateSymbolicLink( &symLinkName,&devName );
if (!NT_SUCCESS(status))
{
IoDeleteDevice( pDevObj );
return status;
}
return STATUS_SUCCESS;
}

/************************************************************************
* 函数名称:HelloDDKUnload
* 功能描述:负责驱动程序的卸载操作
* 参数列表:
      pDriverObject:驱动对象
* 返回值:返回状态
*************************************************************************/
#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
KdPrint(("Enter DriverUnload/n"));
pNextObj = pDriverObject->DeviceObject;
while (pNextObj != NULL)
{
  PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
   pNextObj->DeviceExtension;

  //删除符号链接
  UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
  IoDeleteSymbolicLink(&pLinkName);
  pNextObj = pNextObj->NextDevice;
  IoDeleteDevice( pDevExt->pDevice );
}
}

/************************************************************************
* 函数名称:HelloDDKDispatchRoutine
* 功能描述:对读IRP进行处理
* 参数列表:
      pDevObj:功能设备对象
      pIrp:从IO请求包
* 返回值:返回状态
*************************************************************************/
#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
         IN PIRP pIrp)
{
KdPrint(("Enter HelloDDKDispatchRoutine/n"));
NTSTATUS status = STATUS_SUCCESS;
// 完成IRP
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = 0; // bytes xfered
IoCompleteRequest( pIrp, IO_NO_INCREMENT );
KdPrint(("Leave HelloDDKDispatchRoutine/n"));
return status;
}

//Driver.h

#pragma once

#ifdef __cplusplus
extern "C"
{
#endif
#include <NTDDK.h>
#ifdef __cplusplus
}
#endif

#define PAGEDCODE code_seg("PAGE")
#define LOCKEDCODE code_seg()
#define INITCODE code_seg("INIT")

#define PAGEDDATA data_seg("PAGE")
#define LOCKEDDATA data_seg()
#define INITDATA data_seg("INIT")

#define arraysize(p) (sizeof(p)/sizeof((p)[0]))

typedef struct _DEVICE_EXTENSION {
PDEVICE_OBJECT pDevice;
UNICODE_STRING ustrDeviceName; //设备名称
UNICODE_STRING ustrSymLinkName; //符号链接名
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;

// 函数声明

NTSTATUS CreateDevice (IN PDRIVER_OBJECT pDriverObject);
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject);
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp);

下一个写一下查杀指定的进程，今天到此为止