枚举进程,线程,进程模块

头文件包含及结构体声明:

#include<ntifs.h>
#include<ntdef.h>
#pragma warning(disable:4201)

#define PROCESS_ACTIVE_PROCESS_LINKS_OFFSET 0x2e8
#define THREAD_LIST_ENTRY_OFFSET 0x6a8
#define THREAD_LIST_HEAD_OFFSET 0x488
#define PROCESS_PEB_OFFSET 0x3f8
#define PEB_LDR_DATA_OFFSET 0x18
#define LDR_IN_MEMORY_ORDER_MODULE_LIST_OFFSET 0x20

PPEB PsGetProcessPeb(PEPROCESS Process);
PPEB PsGetProcessWow64Process(PEPROCESS Process);
PCHAR PsGetProcessImageFileName(IN PEPROCESS Process);

typedef VOID(*EnumThreadCallBack)(PETHREAD thread);

typedef struct _LDR_DATA_TABLE_ENTRY {
	LIST_ENTRY InLoadOrderLinks;
	LIST_ENTRY InMemoryOrderLinks;
	LIST_ENTRY InInitializationOrderLinks;
	PVOID DllBase;
	PVOID EntryPoint;//模块的进入点 DriverEntry
	ULONG SizeOfImage;
	UNICODE_STRING FullDllName;//模块的满路径
	UNICODE_STRING BaseDllName;//不带路径的模块名字
	ULONG Flags;
	USHORT LoadCount;
	USHORT TlsIndex;
	union {
		LIST_ENTRY HashLinks;
		struct {
			PVOID SectionPointer;
			ULONG CheckSum;
		};
	};
	union {
		struct {
			ULONG TimeDateStamp;
		};
		struct {
			PVOID LoadedImports;
		};
	};
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;


typedef struct _LDR_DATA_TABLE_ENTRY32 {
	LIST_ENTRY32 InLoadOrderLinks;
	LIST_ENTRY32 InMemoryOrderLinks;
	LIST_ENTRY32 InInitializationOrderLinks;
	ULONG DllBase;
	ULONG EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STRING32 FullDllName;
	UNICODE_STRING32 BaseDllName;
	ULONG Flags;
	USHORT LoadCount;
	USHORT TlsIndex;
	union {
		LIST_ENTRY32 HashLinks;
		struct {
			ULONG SectionPointer;
			ULONG  CheckSum;
		};
	};
	union {
		struct {
			ULONG  TimeDateStamp;
		};
		struct {
			ULONG LoadedImports;
		};
	};

	//
	// NOTE : Do not grow this structure at the dump files used a packed
	// array of these structures.
	//

} LDR_DATA_TABLE_ENTRY32, * PLDR_DATA_TABLE_ENTRY32;


typedef struct _PEB_LDR_DATA {
	PCHAR Reserved1[8];
	PVOID Reserved2[3];
	LIST_ENTRY InMemoryOrderModuleList;
} PEB_LDR_DATA, * PPEB_LDR_DATA;

函数实现:

PEPROCESS GetProcessByActiveLink(const char* name)
{
	PEPROCESS process = 0;
	PsLookupProcessByProcessId((HANDLE)4, &process);

	if (!process || !name) return 0;

	PLIST_ENTRY ListEntry = (PLIST_ENTRY)((ULONG64)process + PROCESS_ACTIVE_PROCESS_LINKS_OFFSET);

	for (PLIST_ENTRY pListEntry = ListEntry->Flink; pListEntry != ListEntry; pListEntry = pListEntry->Flink)
	{
		PEPROCESS pro = (PEPROCESS)((PCHAR)pListEntry - PROCESS_ACTIVE_PROCESS_LINKS_OFFSET);
		if (!strcmp(name, PsGetProcessImageFileName(pro)))
			return pro;
	}
	return 0;
}


VOID EnumThreadByLink(PEPROCESS process, EnumThreadCallBack callBack)
{
	if (!process || !callBack) return;

	PLIST_ENTRY ListEntry = (PLIST_ENTRY)((ULONG64)process + THREAD_LIST_HEAD_OFFSET);

	for (PLIST_ENTRY pListEntry = ListEntry->Flink; pListEntry != ListEntry; pListEntry = pListEntry->Flink)
	{
		PETHREAD thread = (PETHREAD)((PCHAR)pListEntry - THREAD_LIST_ENTRY_OFFSET);
		callBack(thread);
	}
}


PVOID GetProcessModuleByName(PEPROCESS process,wchar_t* name)
{
	KAPC_STATE ApcState;
	PVOID reAddr = 0;
	PPEB peb = 0;

	if (!process || !name) return 0;

	BOOLEAN IsWow64 = (PsGetProcessWow64Process(process) != NULL) ? TRUE : FALSE;

	if (IsWow64)
		peb = PsGetProcessWow64Process(process);
	else
		peb = PsGetProcessPeb(process);

	if (peb == NULL) return 0;

	KeStackAttachProcess(process, &ApcState);

	if (IsWow64)
	{
		PLIST_ENTRY32 ListHeader;
		PLIST_ENTRY32 CurrentListEntry;
		PLDR_DATA_TABLE_ENTRY32 LdrDataTable;

		ULONG ldr = *(ULONG*)((PCHAR)peb + PEB32_LDR_DATA_OFFSET);
		ListHeader = (PLIST_ENTRY32)((PCHAR)ldr + LDR32_IN_MEMORY_ORDER_MODULE_LIST_OFFSET);

		CurrentListEntry = (PLIST_ENTRY32)ListHeader->Flink;
		while (CurrentListEntry != ListHeader)
		{
			LdrDataTable = CONTAINING_RECORD(CurrentListEntry, LDR_DATA_TABLE_ENTRY32, InMemoryOrderLinks);

			//KdPrint(("Base:%p \t %ws\n", LdrDataTable->DllBase, LdrDataTable->BaseDllName.Buffer));

			if (!_wcsicmp(name, (const wchar_t*)LdrDataTable->BaseDllName.Buffer))
			{
				KdPrint(("Base:%p \t %ws\n", LdrDataTable->DllBase, LdrDataTable->BaseDllName.Buffer));
				reAddr = (PVOID)LdrDataTable->DllBase;
				break;
			}
			CurrentListEntry = (PLIST_ENTRY32)CurrentListEntry->Flink;
		}
	}
	else
	{
		PLIST_ENTRY ListHeader;
		PLIST_ENTRY CurrentListEntry;
		PLDR_DATA_TABLE_ENTRY LdrDataTable;
		UNICODE_STRING UnicodeName = { 0 };

		RtlInitUnicodeString(&UnicodeName, name);
		PPEB_LDR_DATA ldr = *(PPEB_LDR_DATA*)((PCHAR)peb + PEB64_LDR_DATA_OFFSET);
		ListHeader = (PLIST_ENTRY)((PCHAR)ldr + LDR_IN_MEMORY_ORDER_MODULE_LIST_OFFSET);

		CurrentListEntry = ListHeader->Flink;
		while (CurrentListEntry != ListHeader)
		{
			LdrDataTable = CONTAINING_RECORD(CurrentListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);

			if (RtlEqualUnicodeString(&UnicodeName, &LdrDataTable->BaseDllName, TRUE))
			{
				KdPrint(("Base:%p \t %wZ\n", LdrDataTable->DllBase, &LdrDataTable->BaseDllName));
				reAddr = LdrDataTable->DllBase;
				break;
			}
			CurrentListEntry = CurrentListEntry->Flink;
		}
	}

	KeUnstackDetachProcess(&ApcState);

	return reAddr;
}