Native API -- ScOpenProcess

        好久没写日志了，实在是没有时间啊！写日志也成了浪费时间，无奈啊！

        最近研究了下如何用 Native API 打开指定进程，从而实现根据 PID 来返回进程句柄，从而达到内存填 0 来查杀进程的目的！下面贴出来代码，当然参考了很多大牛的代码：

HANDLE __stdcall ScOpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId) { NTSTATUS status; BOOLEAN wasEnabled; char *pBuf = NULL; DWORD buflen = 0x10000, needlen = 0; DWORD HandleCnt = 0; HANDLE hRetProcess; PSYSTEM_HANDLE_INFORMATION pSysHandleInfo = NULL; OBJECT_ATTRIBUTES objatr = {sizeof(OBJECT_ATTRIBUTES), 0, NULL, NULL}; CLIENT_ID cid; if ( bInheritHandle ) objatr.Attributes |= OBJ_INHERIT; // 提权 RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE, &wasEnabled); // 尝试正常方式打开 cid.UniqueProcess = (HANDLE)dwProcessId; cid.UniqueThread = 0; status = ZwOpenProcess(&hRetProcess, dwDesiredAccess, &objatr, &cid); if (NT_SUCCESS(status) ) return hRetProcess; // 查询句柄信息 do { // 申请查询句柄信息所需要的内存 ZwAllocateVirtualMemory( NtCurrentProcess(), (PVOID *)&pBuf, 0, &buflen, MEM_COMMIT, PAGE_READWRITE); // 查询系统句柄信息 status = ZwQuerySystemInformation( SystemHandleInformation, (PVOID)pBuf, buflen, &needlen); if (status == STATUS_SUCCESS) break; // 若不成功则释放内存 ZwFreeVirtualMemory( NtCurrentProcess(), (PVOID *)&pBuf, &buflen, MEM_RELEASE); // 加大申请的内存块, 一直到成功为止 buflen *= 2; pBuf = NULL; } while ( TRUE ); // 返回的缓冲区内容第一个 DWORD 是句柄的个数 HandleCnt = *(DWORD *)pBuf; pSysHandleInfo = (PSYSTEM_HANDLE_INFORMATION)( (char *)pBuf + sizeof(DWORD) ); for (DWORD i = 0; i < HandleCnt; i ++) { // 只验证类型为 PROCESS 的 if ( pSysHandleInfo->ObjectTypeNumber == OB_TYPE_PROCESS) { HANDLE hOwnerProc; HANDLE hTmpProc; cid.UniqueProcess = (HANDLE)pSysHandleInfo->ProcessId; cid.UniqueThread = 0; status = ZwOpenProcess( &hOwnerProc, PROCESS_DUP_HANDLE, &objatr, &cid); if ( NT_SUCCESS(status) ) { // 打开成功，则把句柄复制过来 status = ZwDuplicateObject( hOwnerProc, (HANDLE)pSysHandleInfo->Handle, NtCurrentProcess(), &hTmpProc, PROCESS_ALL_ACCESS, FALSE, 0); if ( NT_SUCCESS(status) ) { PROCESS_BASIC_INFORMATION BasicInfo = {0}; status = ZwQueryInformationProcess( hTmpProc, ProcessBasicInformation, &BasicInfo, sizeof(BasicInfo), NULL); if ( NT_SUCCESS(status) ) { if (BasicInfo.UniqueProcessId == dwProcessId) { // 按需要的权限把句柄复制过来 ZwDuplicateObject( hOwnerProc, (HANDLE)pSysHandleInfo->Handle, NtCurrentProcess(), &hRetProcess, dwDesiredAccess, FALSE, 0); ZwClose(hOwnerProc); ZwClose(hTmpProc); break; } } ZwClose(hTmpProc); } ZwClose(hOwnerProc); } } pSysHandleInfo ++; } // 释放内存 if (pBuf) ZwFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&pBuf, &buflen, MEM_RELEASE); return hRetProcess; }

由此可以内存暴力枚举进程的雏形，关键是ZwQueryInformationProcess啊！通过抹掉自己进程在csrss里的句柄可以逃过这种方法。如今R3下的方法已经变得科普了，真正的技术还是在R0啊！打好基础，努力向R0迈进吧！