枚举进程句柄File,Section,Mutant,Timer关闭Mutex句柄实现游戏多开

枚举进程句柄File,Section,Mutant,Timer关闭Mutex句柄实现游戏多开

2013-09-03 01:41  472人阅读  评论(0)  收藏  举报

 

标 题: 枚举进程句柄File,Section,Mutant,Timer关闭Mutex句柄实现游戏多开
作 者: Y4ng
时 间: 2012-09-06 19:50:32 星期四
链 接: http://www.cnblogs.com/Y4ng/archive/2012/09/06/EnumProcessHandle_EnumMutex.html

 

   相信做过游戏多开的朋友就会发现，很多游戏普遍使用互斥mutex来防止程序多开，说实话这种方式已经非常OUT了。但是由于时间和技术的沉淀关系，留下来的游戏依然会存在这种方式。 最近接触到一款游戏是N前非常火热的对战游戏，可以称为经典之作；它就是用的Mutant来实现游戏防止多开的，一般咱们测试的时候都是用Xuetr来关闭游戏，但是要作为成品发布不可能要求客户拿Xuetr来列进程对象句柄，关句柄吧~

   网上搜索了半天都没有找到枚举进程句柄的例子，经过群里的大牛提点指到 ZwQuerySystemInformation SystemHandleInformation 可以实现句柄枚举功能；经过一番搜索编码测试 于是有了本文代码；

 

 

[cpp]  view plain  copy

1. /*头文件声明*/  
2. typedef LONG NTSTATUS;  
3. #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)  
4. #define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)  
5.   
6. typedef enum _SYSTEM_INFORMATION_CLASS {  
7.     SystemBasicInformation,              // 0        Y        N  
8.     SystemProcessorInformation,          // 1        Y        N  
9.     SystemPerformanceInformation,        // 2        Y        N  
10.     SystemTimeOfDayInformation,          // 3        Y        N  
11.     SystemNotImplemented1,               // 4        Y        N  
12.     SystemProcessesAndThreadsInformation, // 5       Y        N  
13.     SystemCallCounts,                    // 6        Y        N  
14.     SystemConfigurationInformation,      // 7        Y        N  
15.     SystemProcessorTimes,                // 8        Y        N  
16.     SystemGlobalFlag,                    // 9        Y        Y  
17.     SystemNotImplemented2,               // 10       Y        N  
18.     SystemModuleInformation,             // 11       Y        N  
19.     SystemLockInformation,               // 12       Y        N  
20.     SystemNotImplemented3,               // 13       Y        N  
21.     SystemNotImplemented4,               // 14       Y        N  
22.     SystemNotImplemented5,               // 15       Y        N  
23.     SystemHandleInformation,             // 16       Y        N  
24.     SystemObjectInformation,             // 17       Y        N  
25.     SystemPagefileInformation,           // 18       Y        N  
26.     SystemInstructionEmulationCounts,    // 19       Y        N  
27.     SystemInvalidInfoClass1,             // 20  
28.     SystemCacheInformation,              // 21       Y        Y  
29.     SystemPoolTagInformation,            // 22       Y        N  
30.     SystemProcessorStatistics,           // 23       Y        N  
31.     SystemDpcInformation,                // 24       Y        Y  
32.     SystemNotImplemented6,               // 25       Y        N  
33.     SystemLoadImage,                     // 26       N        Y  
34.     SystemUnloadImage,                   // 27       N        Y  
35.     SystemTimeAdjustment,                // 28       Y        Y  
36.     SystemNotImplemented7,               // 29       Y        N  
37.     SystemNotImplemented8,               // 30       Y        N  
38.     SystemNotImplemented9,               // 31       Y        N  
39.     SystemCrashDumpInformation,          // 32       Y        N  
40.     SystemExceptionInformation,          // 33       Y        N  
41.     SystemCrashDumpStateInformation,     // 34       Y        Y/N  
42.     SystemKernelDebuggerInformation,     // 35       Y        N  
43.     SystemContextSwitchInformation,      // 36       Y        N  
44.     SystemRegistryQuotaInformation,      // 37       Y        Y  
45.     SystemLoadAndCallImage,              // 38       N        Y  
46.     SystemPrioritySeparation,            // 39       N        Y  
47.     SystemNotImplemented10,              // 40       Y        N  
48.     SystemNotImplemented11,              // 41       Y        N  
49.     SystemInvalidInfoClass2,             // 42  
50.     SystemInvalidInfoClass3,             // 43  
51.     SystemTimeZoneInformation,           // 44       Y        N  
52.     SystemLookasideInformation,          // 45       Y        N  
53.     SystemSetTimeSlipEvent,              // 46       N        Y  
54.     SystemCreateSession,                 // 47       N        Y  
55.     SystemDeleteSession,                 // 48       N        Y  
56.     SystemInvalidInfoClass4,             // 49  
57.     SystemRangeStartInformation,         // 50       Y        N  
58.     SystemVerifierInformation,           // 51       Y        Y  
59.     SystemAddVerifier,                   // 52       N        Y  
60.     SystemSessionProcessesInformation    // 53       Y        N  
61. } SYSTEM_INFORMATION_CLASS;  
62.   
63. typedef struct _CLIENT_ID  
64. {  
65.     HANDLE UniqueProcess;  
66.     HANDLE UniqueThread;  
67. }CLIENT_ID,*PCLIENT_ID;  
68.   
69. typedef struct  
70. {  
71.     USHORT Length;  
72.     USHORT MaxLen;  
73.     USHORT *Buffer;  
74. }UNICODE_STRING, *PUNICODE_STRING;  
75.   
76. typedef struct _OBJECT_ATTRIBUTES   
77. {  
78.     ULONG Length;  
79.     HANDLE RootDirectory;  
80.     PUNICODE_STRING ObjectName;  
81.     ULONG Attributes;  
82.     PVOID SecurityDescriptor;  
83.     PVOID SecurityQualityOfService;  
84. } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;   
85.   
86. typedef struct _IO_COUNTERSEX {  
87.     LARGE_INTEGER ReadOperationCount;  
88.     LARGE_INTEGER WriteOperationCount;  
89.     LARGE_INTEGER OtherOperationCount;  
90.     LARGE_INTEGER ReadTransferCount;  
91.     LARGE_INTEGER WriteTransferCount;  
92.     LARGE_INTEGER OtherTransferCount;  
93. } IO_COUNTERSEX, *PIO_COUNTERSEX;  
94.   
95. typedef enum {  
96.     StateInitialized,  
97.     StateReady,  
98.     StateRunning,  
99.     StateStandby,  
100.     StateTerminated,  
101.     StateWait,  
102.     StateTransition,  
103.     StateUnknown  
104. } THREAD_STATE;  
105.   
106. typedef struct _VM_COUNTERS {  
107.     SIZE_T PeakVirtualSize;  
108.     SIZE_T VirtualSize;  
109.     ULONG PageFaultCount;  
110.     SIZE_T PeakWorkingSetSize;  
111.     SIZE_T WorkingSetSize;  
112.     SIZE_T QuotaPeakPagedPoolUsage;  
113.     SIZE_T QuotaPagedPoolUsage;  
114.     SIZE_T QuotaPeakNonPagedPoolUsage;  
115.     SIZE_T QuotaNonPagedPoolUsage;  
116.     SIZE_T PagefileUsage;  
117.     SIZE_T PeakPagefileUsage;  
118. } VM_COUNTERS;  
119. typedef VM_COUNTERS *PVM_COUNTERS;  
120.   
121. typedef struct _SYSTEM_THREADS {  
122.     LARGE_INTEGER KernelTime;  
123.     LARGE_INTEGER UserTime;  
124.     LARGE_INTEGER CreateTime;  
125.     ULONG WaitTime;  
126.     PVOID StartAddress;  
127.     CLIENT_ID ClientId;  
128.     ULONG Priority;  
129.     ULONG BasePriority;  
130.     ULONG ContextSwitchCount;  
131.     THREAD_STATE State;  
132.     ULONG WaitReason;  
133. } SYSTEM_THREADS, *PSYSTEM_THREADS;  
134.   
135. typedef struct _SYSTEM_PROCESSES { // Information Class 5  
136.     ULONG NextEntryDelta;  
137.     ULONG ThreadCount;  
138.     ULONG Reserved1[6];  
139.     LARGE_INTEGER CreateTime;  
140.     LARGE_INTEGER UserTime;  
141.     LARGE_INTEGER KernelTime;  
142.     UNICODE_STRING ProcessName;  
143.     ULONG BasePriority;  
144.     ULONG ProcessId;  
145.     ULONG InheritedFromProcessId;  
146.     ULONG HandleCount;  
147.     ULONG Reserved2[2];  
148.     VM_COUNTERS VmCounters;  
149.     IO_COUNTERSEX IoCounters;  // Windows 2000 only  
150.     SYSTEM_THREADS Threads[1];  
151. } SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;  
152.   
153. typedef struct _SYSTEM_HANDLE_INFORMATION  
154. {  
155.     ULONG            ProcessId;  
156.     UCHAR            ObjectTypeNumber;  
157.     UCHAR            Flags;  
158.     USHORT            Handle;  
159.     PVOID            Object;  
160.     ACCESS_MASK        GrantedAccess;  
161. } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;  
162.   
163. typedef enum _OBJECT_INFORMATION_CLASS {  
164.     ObjectBasicInformation,  
165.     ObjectNameInformation,  
166.     ObjectTypeInformation,  
167.     ObjectAllInformation,  
168.     ObjectDataInformation  
169. } OBJECT_INFORMATION_CLASS;  
170.   
171. typedef struct _OBJECT_NAME_INFORMATION {  
172.     UNICODE_STRING Name;  
173. } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;  
174.   
175. typedef NTSTATUS (NTAPI *NTQUERYOBJECT)(  
176.                        _In_opt_   HANDLE Handle,  
177.                        _In_       OBJECT_INFORMATION_CLASS ObjectInformationClass,  
178.                        _Out_opt_  PVOID ObjectInformation,  
179.                        _In_       ULONG ObjectInformationLength,  
180.                        _Out_opt_  PULONG ReturnLength  
181.                        );  
182.   
183.   
184. typedef NTSTATUS  
185. (NTAPI *ZWQUERYSYSTEMINFORMATION)(  
186.                                   IN SYSTEM_INFORMATION_CLASS SystemInformationClass,  
187.                                   OUT PVOID SystemInformation,  
188.                                   IN ULONG SystemInformationLength,  
189.                                   OUT PULONG ReturnLength OPTIONAL  
190.                                   );  
191. ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(GetModuleHandle("ntdll.dll"),"ZwQuerySystemInformation");  
192. NTQUERYOBJECT    NtQueryObject = (NTQUERYOBJECT)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtQueryObject");  

 

 

[cpp]  view plain  copy

1. /*功能函数体*/  
2. int _tmain(int argc, _TCHAR* argv[])  
3. {  
4.     DWORD dwSize = 0;  
5.     PSYSTEM_HANDLE_INFORMATION pmodule = NULL;  
6.     POBJECT_NAME_INFORMATION pNameInfo;  
7.     POBJECT_NAME_INFORMATION pNameType;  
8.     PVOID pbuffer = NULL;  
9.     NTSTATUS Status;  
10.     int nIndex = 0;  
11.     DWORD dwFlags = 0;  
12.     char szType[128] = {0};  
13.     char szName[512] = {0};  
14.   
15.     if(!ZwQuerySystemInformation)  
16.     {  
17.         goto Exit0;  
18.     }  
19.   
20.     pbuffer = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);  
21.   
22.     if(!pbuffer)  
23.     {  
24.         goto Exit0;  
25.     }  
26.   
27.     Status = ZwQuerySystemInformation(SystemHandleInformation, pbuffer, 0x1000, &dwSize);  
28.   
29.     if(!NT_SUCCESS(Status))  
30.     {  
31.         if (STATUS_INFO_LENGTH_MISMATCH != Status)  
32.         {  
33.             goto Exit0;  
34.         }  
35.         else  
36.         {  
37.             // 这里大家可以保证程序的正确性使用循环分配稍好  
38.             if (NULL != pbuffer)  
39.             {  
40.                 VirtualFree(pbuffer, 0, MEM_RELEASE);  
41.             }  
42.   
43.             if (dwSize*2 > 0x4000000)  // MAXSIZE  
44.             {  
45.                 goto Exit0;  
46.             }  
47.   
48.             pbuffer = VirtualAlloc(NULL, dwSize*2, MEM_COMMIT, PAGE_READWRITE);  
49.   
50.             if(!pbuffer)  
51.             {  
52.                 goto Exit0;  
53.             }  
54.   
55.             Status = ZwQuerySystemInformation(SystemHandleInformation, pbuffer, dwSize*2, NULL);  
56.   
57.             if(!NT_SUCCESS(Status))  
58.             {  
59.                 goto Exit0;      
60.             }  
61.         }  
62.     }  
63.   
64.     pmodule = (PSYSTEM_HANDLE_INFORMATION)((PULONG)pbuffer+1);  
65.     dwSize = *((PULONG)pbuffer);  
66.   
67.     for(nIndex = 0; nIndex < dwSize; nIndex++)  
68.     {  
69.           
70.         Status = NtQueryObject((HANDLE)pmodule[nIndex].Handle, ObjectNameInformation, szName, 512, &dwFlags);  
71.   
72.         if (!NT_SUCCESS(Status))  
73.         {  
74.             goto Exit0;  
75.         }  
76.   
77.         Status = NtQueryObject((HANDLE)pmodule[nIndex].Handle, ObjectTypeInformation, szType, 128, &dwFlags);  
78.   
79.         if (!NT_SUCCESS(Status))  
80.         {  
81.             goto Exit0;  
82.         }  
83.   
84.         pNameInfo = (POBJECT_NAME_INFORMATION)szName;  
85.         pNameType = (POBJECT_NAME_INFORMATION)szType;  
86.   
87.         printf("%wZ   %wZ\n", pNameType, pNameInfo);  
88.   
89.         // 匹配是否为需要关闭的句柄名称  
90.         if (0 == wcscmp((wchar_t *)pNameType->Name.Buffer, L"Mutant"))  
91.         {  
92.             if (wcsstr((wchar_t *)pNameInfo->Name.Buffer, CLOSEMUTEXNAME))  
93.             {  
94.                 CloseHandle((HANDLE)pmodule[nIndex].Handle);  
95.                 goto Exit0;  
96.             }  
97.         }  
98.     }  
99.   
100. Exit0:  
101.     if (NULL != pbuffer)  
102.     {  
103.         VirtualFree(pbuffer, 0, MEM_RELEASE);  
104.     }  
105.   
106.     return 0;  
107. }