一些零碎的记忆

G_P_U

已于 2023-12-21 00:35:41 修改

阅读量362

点赞数 6

文章标签： c++

于 2023-12-07 15:08:16 首次发布

本文链接：https://blog.csdn.net/luduxin001/article/details/134856050

版权

1)
<R3层的gs 为TEB    +30h/+60h  为PEB   R0层gs 为kpcr>    
#include <intrin.h>
包含有：__readgsqword(0x60)  __readfsdword(0x30)  这二个命令
2)
符号                                 格式说明符                                        类型
%c, %lc                           ANSI字符                                            char
%C, %wc                         宽字符                                                 wchar_t
%d, %i                            十进制有符号整数                                 int
%D                                  十进制_int64                                     _int64
%L                                  十六进制的LARGE_INTEGER            LARGE_INTEGER
%s, %ls                           NULL终止的ANSI字符串                      char*
%S, %ws                        NULL终止的宽字符串                          wchar_t*
%Z                                 ANSI_STRING字符串
%wZ                              UNICODE_STRING字符串
%u                                 十进制的ULONG                                   ULONG
%x                                小写字符十六进制的ULONG                   ULONG
%X                                大写字符十六进制的ULONG                   ULONG
%p                                指针Pointer 32/64位

【NtQuerySystemInformation】  SystemProcessInformation类取进程线程结构体逆向NtQuerySystemInformation(SystemProcessInformation, pInfo, dwSize, &dwSize);



typedef struct _mSYSTEM_THREAD_INFORMATION {
	LARGE_INTEGER Reserved1[3];    
	ULONG Reserved2;				//+0x18
	PVOID StartAddress;				//+0x20
	CLIENT_ID ClientId;				//+0x28
	KPRIORITY Priority;				//+0x38
	LONG BasePriority;				//+0x3C
	ULONG Reserved3;
	ULONG ThreadState;				//+0x44
	ULONG WaitReason;				//+0x48
} mSYSTEM_THREAD_INFORMATION, * PmSYSTEM_THREAD_INFORMATION;
typedef struct _SYSTEM_PROCESS_INFORMATION {
	ULONG NextEntryOffset;		//结构长度 +0
	ULONG NumberOfThreads;		//线程数量	+4
	BYTE Reserved1[48];			//+8
	UNICODE_STRING ImageName;	//+38 中间空4个字节 到名字缓存区 +40
	KPRIORITY BasePriority;		//+48  空4字节
	HANDLE UniqueProcessId;		//+50	
	PVOID Reserved2;			//+58
	ULONG HandleCount;			//+60
	ULONG SessionId;			//+64	
	PVOID Reserved3;			//+68   //未初始化
	SIZE_T PeakVirtualSize;		//+70
	SIZE_T VirtualSize;			//应该为Dword +78  后空4字节
	ULONG Reserved4;			//+80
	SIZE_T PeakWorkingSetSize;	//+88
	SIZE_T WorkingSetSize;		//+90
	PVOID Reserved5;			//+98
	SIZE_T QuotaPagedPoolUsage;	//+A0  
	PVOID Reserved6;			//+A8
	SIZE_T QuotaNonPagedPoolUsage;	//+B0
	SIZE_T PagefileUsage;		//+B8    
	SIZE_T PeakPagefileUsage;	//+C0
	SIZE_T PrivatePageCount;	//+C8
	LARGE_INTEGER Reserved7[6];	//+D0  长度为0x38
	//后面紧接SYSTEM_THREAD_INFORMATION <线程结构>  注：但winternl.h  里未接  但事实取回来的数据里是接  逆向系统为win10 18363
} SYSTEM_PROCESS_INFORMATION;