通过ntdll.dll提供的API函数实现当前进程的枚举

最新推荐文章于 2021-04-26 19:19:57 发布

JeaminThk

最新推荐文章于 2021-04-26 19:19:57 发布

阅读量1.5k

点赞数 1

本文链接：https://blog.csdn.net/zhiyuan_x/article/details/17113539

版权

这种枚举的方法是通过ntdll.dll提供的API函数ZwQuery？SystemInformation（）来实现，此方法比前面所提供的方法复杂一些，

下面提供实际的代码如下：

#include <windows.h>
#include <ntsecapi.h>
#include <stdio.h>
typedef DWORD (WINAPI *ZWQUERYSYSTEMINFORMATION) (DWORD,PVOID,DWORD,PDWORD);
typedef struct _SYSTEM_PROCESS_INFORMATION{
	DWORD NextEntryDelta;
	DWORD ThreadCount;
	DWORD Reserved[6];
	FILETIME ftCreateTime;
	FILETIME ftUserTime;
	UNICODE_STRING ProcessName;
	DWORD BasePriority;
	DWORD ProcessID;
	DWORD InheritedFromProcessID;
	DWORD HandleCount;
	DWORD Reserved2[2];
	DWORD VmCounters;
	DWORD dCommitCharge;
	PVOID ThreadInfos[1];
}SYSTEM_PROCESS_INFORMATION,* PSYSTEM_PROCESS_INFORMATION;
#define SystemProcessesAndThreadsInformation 5
void main()
{
	HMODULE hNtDLL=GetModuleHandle("ntdll.dll");
	if(!hNtDLL)
		return;
	ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation=(ZWQUERYSYSTEMINFORMATION)GetProcAddress(
																			hNtDLL,"ZwQuerySystemInformation");
	ULONG cbBuffer=0x10000; // 设置缓冲区的大小，与系统有关
	LPVOID pBuffer=NULL;
	pBuffer=malloc(cbBuffer);
	if(pBuffer==NULL)
		return;
	ZwQuerySystemInformation(SystemProcessesAndThreadsInformation,pBuffer,cbBuffer,NULL);
	PSYSTEM_PROCESS_INFORMATION  pInfo=(PSYSTEM_PROCESS_INFORMATION)pBuffer;
	for(;;)
	{
		printf("ProcessID: %d (%ls) \n",pInfo->ProcessID,pInfo->ProcessName.Buffer);
		if(pInfo->NextEntryDelta ==0)
			break;
		// 查找下一个进程结构地址
		pInfo=(PSYSTEM_PROCESS_INFORMATION)(((PUCHAR)pInfo)+pInfo->NextEntryDelta);
	}
	free(pBuffer);
}

但是运行的时候程序根本就起不来