sys port and process

#include "ntddk.h"
#include "string.h"

#define SystemHandleInformation  16
#define TCPUDP_FLAG   100
#define WIN2K_SOCKET_FLAG  0x1a //2k
#define WINXP_SOCKET_FLAG  0x1c //xp
#define WIN2K3_SOCKET_FLAG  0x1a //2k3

#define WIN2K_EPROCESS_NAMEOFFSET    0x1fc //2k
#define WINXP_EPROCESS_NAMEOFFSET    0x174 //xp
#define WIN2K3_EPROCESS_NAMEOFFSET   0x1fc //2k3
#define  WIN7_EPPROCESS_NAMEOFFSET   0x16c

#define ObjectNameInformation  1
#define ObjectAllTypesInformation 3

#define  IOCTL_TCP_QUERY_INFORMATION_EX  0x120003
/*
typedef struct _OBJECT_NAME_INFORMATION {
UNICODE_STRING Name;
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;

typedef struct _OBJECT_TYPE_INFORMATION {
UNICODE_STRING Name;
ULONG ObjectCount;
ULONG HandleCount;
ULONG Reserved1[4];
ULONG PeakObjectCount;
ULONG PeakHandleCount;
ULONG Reserved2[4];
ULONG InvalidAttributes;
GENERIC_MAPPING GenericMapping;
ULONG ValidAccess;
UCHAR Unknown;
BOOLEAN MaintainHandleDatabase;
POOL_TYPE PoolType;
ULONG PagedPoolUsage;
ULONG NonPagedPoolUsage;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

typedef struct _OBJECT_ALL_TYPES_INFORMATION {
ULONG NumberOfTypes;
OBJECT_TYPE_INFORMATION TypeInformation;
} OBJECT_ALL_TYPES_INFORMATION, *POBJECT_ALL_TYPES_INFORMATION;
*/

#define ntohs(s) /
 ( ( ((s) >> 8) & 0x00FF ) | /
 ( ((s) << 8) & 0xFF00 ) )

typedef struct _TDI_CONNECTION_INFO {
 ULONG          State;
 ULONG          Event;
 ULONG          TransmittedTsdus;
 ULONG          ReceivedTsdus;
 ULONG          TransmissionErrors;
 ULONG          ReceiveErrors;
 LARGE_INTEGER  Throughput;
 LARGE_INTEGER  Delay;
 ULONG          SendBufferSize;
 ULONG          ReceiveBufferSize;
 BOOLEAN        Unreliable;
} TDI_CONNECTION_INFO, *PTDI_CONNECTION_INFO;

typedef struct _TDI_CONNECTION_INFORMATION {
 LONG   UserDataLength;
 PVOID  UserData;
 LONG   OptionsLength;
 PVOID  Options;
 LONG   RemoteAddressLength;
 PVOID  RemoteAddress;
} TDI_CONNECTION_INFORMATION, *PTDI_CONNECTION_INFORMATION;

typedef struct _SYSTEM_HANDLE_INFORMATION
{
 ULONG ProcessID;        //进程的标识ID
 UCHAR ObjectTypeNumber;        //对象类型
 UCHAR Flags;             //0x01 = PROTECT_FROM_CLOSE,0x02 = INHERIT
 USHORT Handle;             //对象句柄的数值
 PVOID  Object;            //对象句柄所指的内核对象地址 WinNT4/Windows2000是0x1A xp中是0x1c 2003中是
 ACCESS_MASK GrantedAccess;      //创建句柄时所准许的对象的访问权
}SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;

/*
http://forum.sysinternals.com/topic19403&OB=DESC.html

#define SystemExtendedHandleInformation 64

typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
{
PVOID Object;
HANDLE UniqueProcessId;
HANDLE HandleValue;
ACCESS_MASK GrantedAccess;
USHORT CreatorBackTraceIndex;
USHORT ObjectTypeIndex;
ULONG HandleAttributes;
PVOID Reserved;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;

typedef struct _SYSTEM_EXTENDED_HANDLE_INFORMATION
{
ULONG NumberOfHandles;
SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
} SYSTEM_EXTENDED_HANDLE_INFORMATION, *PSYSTEM_EXTENDED_HANDLE_INFORMATION;

 

Summoned NtQuerySystemInformation with parameter SystemHandleInformation for systems where SystemVersion.dwMajorVersion = 5
and SystemVersion.dwMajorVersion = 6 with parameter SystemExtendedHandleInformation.

 

*/

NTSYSAPI
 NTSTATUS
 NTAPI
 ZwQuerySystemInformation(
 IN ULONG SystemInformationClass,
 IN OUT PVOID SystemInformation,
 IN ULONG SystemInformationLength,
 OUT PULONG ReturnLength);

NTSYSAPI
 NTSTATUS
 NTAPI
 NtDeviceIoControlFile(
 IN HANDLE FileHandle,
 IN HANDLE Event OPTIONAL,
 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
 IN PVOID ApcContext OPTIONAL,
 OUT PIO_STATUS_BLOCK IoStatusBlock,
 IN ULONG IoControlCode,
 IN PVOID InputBuffer OPTIONAL,
 IN ULONG InputBufferLength,
 OUT PVOID OutputBuffer OPTIONAL,
 IN ULONG OutputBufferLength
 );

NTSYSAPI
 NTSTATUS
 NTAPI
 ZwQueryObject(
 IN HANDLE ObjectHandle,
 IN ULONG ObjectInformationClass,
 OUT PVOID ObjectInformation,
 IN ULONG ObjectInformationLength,
 OUT PULONG ReturnLength OPTIONAL
 );

NTSYSAPI
 BOOLEAN
 NTAPI
 NtDuplicateObject(
 IN HANDLE hSourceProcessHandle,
 IN HANDLE hSourceHandle,
 IN HANDLE hTargetProcessHandle,
 OUT HANDLE * lpTargetHandle,
 IN ULONG dwDesiredAccess,
 IN BOOLEAN bInheritHandle,
 IN ULONG dwOptions
 );

NTSYSAPI
 NTSTATUS
 NTAPI
 PsLookupProcessByProcessId(
 IN ULONG ulProcId,
 OUT PEPROCESS * pEProcess
 );

NTSTATUS
 DriverEntry(IN PDRIVER_OBJECT DriverObject,
 IN PUNICODE_STRING RegistryPath);

void DriverUnload(IN PDRIVER_OBJECT DriverObject);

 

 

//几个全局变量，记录端口相关信息，最后列印出来
ULONG g_pid[1000];
ULONG g_port[1000];
ULONG g_handle[1000];
ULONG g_tcpudp[1000];
ULONG g_num =0 ;
ULONG g_tu[1000]; //g_tu=0 tcp, g_tu=1 udp

//获得所有句柄
ULONG GetHandleList()
{
 ULONG n;
 ULONG pBuffer;
 NTSTATUS status;
 DbgPrint("GetHandleList/n");

 pBuffer =(ULONG)ExAllocatePool(PagedPool,0x1000);
 status = ZwQuerySystemInformation(SystemHandleInformation,(PVOID)pBuffer,0x1000,&n);
 ExFreePool((PVOID)pBuffer);
 if(STATUS_INFO_LENGTH_MISMATCH == status)
 {
  pBuffer =(ULONG)ExAllocatePool(NonPagedPool,n);
  ZwQuerySystemInformation(SystemHandleInformation,(PVOID)pBuffer,n,NULL);
  return pBuffer;
 }
 else
  return 0;
}

//根据句柄得到端口信息
void GetOpenPort(ULONG dwProcessesID,ULONG Handle,int NoCache,ULONG tcpudp)
{
 HANDLE hProc,DupHandle=NULL;
 USHORT openport;
 ULONG i=0;
 NTSTATUS status;
 TDI_CONNECTION_INFO    TdiConnInfo={0};
 TDI_CONNECTION_INFORMATION TdiConnInformation={0};
 ULONG dwRetu=0;   
 IO_STATUS_BLOCK    IoStatusBlock={0};
 CLIENT_ID id;
 OBJECT_ATTRIBUTES objatt = {0};
 POBJECT_NAME_INFORMATION ObjectName;
 char ObjectNameBuf[512];
 // char ObjectNameMBS[261];
 ULONG ReturnLen;
 ObjectName = (POBJECT_NAME_INFORMATION)ObjectNameBuf;
 ObjectName->Name.MaximumLength = 500;

 //DbgPrint("GetOpenPort/n");

 id.UniqueProcess = (HANDLE)dwProcessesID;
 id.UniqueThread = 0;
 //打开对方进程
 NtOpenProcess(&hProc,PROCESS_DUP_HANDLE,&objatt,&id);
 //复制句柄
 NtDuplicateObject(hProc,
  (HANDLE)Handle,
  (HANDLE)0xffffffff,
  &DupHandle,
  0,
  FALSE,
  2);
 //根据object的数据得到端口信息
 if(NoCache==0x2)
 {
  //取得句柄关联的对象的信息
  ZwQueryObject(DupHandle, ObjectNameInformation, ObjectName, sizeof(ObjectNameBuf), &ReturnLen);

  TdiConnInformation.RemoteAddressLength= 4;
  
  status = NtDeviceIoControlFile((HANDLE)DupHandle,  
   NULL,
   NULL,
   NULL,
   &IoStatusBlock,
   0x210012,  // Command code   0x120003
   &TdiConnInformation,
   sizeof(TdiConnInformation),
   &TdiConnInfo,
   sizeof(TdiConnInfo));

  //进行TDI查询,得到连接的相关信息
  if(status == 0)

  { 
   //端口值
   openport = ntohs((USHORT)TdiConnInfo.ReceivedTsdus);

   if(openport == 0)
    return;

   //先检测是不是已经记录了
   for(i=0;i<g_num;i++)
   {
    if(g_pid[i] == dwProcessesID && g_port[i] == openport)
     if(tcpudp >= TCPUDP_FLAG && g_tcpudp[i] >= TCPUDP_FLAG || tcpudp < TCPUDP_FLAG && g_tcpudp[i] < TCPUDP_FLAG)
      return;
   }
   //开始记录
   g_pid[i] = dwProcessesID;
   g_port[i] = openport;
   g_handle[i] = Handle;
   g_tcpudp[i] = tcpudp;
   g_num++;
   if (wcscmp(ObjectName->Name.Buffer, L"file://Device//Tcp") == 0||wcscmp(ObjectName->Name.Buffer, L"//Device//Tcp") == 0)
   { 
    //TCP
    g_tu[i] = 0;
   }
   if (wcscmp(ObjectName->Name.Buffer, L"file://Device//Udp") == 0||wcscmp(ObjectName->Name.Buffer, L"//Device//Udp") == 0)
   {
    //UDP
    g_tu[i] = 1;
   }
  }
 }
 if(NoCache==0x1)
 {
  ZwQueryObject(DupHandle, ObjectNameInformation, ObjectName, sizeof(ObjectNameBuf), &ReturnLen);

  //远程地址是3个字节数？？？？
  TdiConnInformation.RemoteAddressLength= 3;
  
  status = NtDeviceIoControlFile((HANDLE)DupHandle,       
   NULL,
   NULL,
   NULL,
   &IoStatusBlock,
   0x210012,  // Command code
   &TdiConnInformation,
   sizeof(TdiConnInformation),
   &TdiConnInfo,
   sizeof(TdiConnInfo));                    
  //进行TDI查询,得到连接的相关信息
  if(status == 0)

  {
   openport = ntohs((USHORT)TdiConnInfo.ReceivedTsdus);

   if(openport == 0)
    return;

   for(i=0;i<g_num;i++)  
   {
    if(g_pid[i] == dwProcessesID && g_port[i] == openport)
     if(tcpudp >= TCPUDP_FLAG && g_tcpudp[i] >= TCPUDP_FLAG || tcpudp < TCPUDP_FLAG && g_tcpudp[i] < TCPUDP_FLAG)
      return;
   }

   g_pid[i] = dwProcessesID;
   g_port[i] = openport;
   g_handle[i] = Handle;
   g_tcpudp[i] = tcpudp;
   g_num++;
   if (wcscmp(ObjectName->Name.Buffer, L"file://Device//Tcp") == 0||wcscmp(ObjectName->Name.Buffer, L"//Device//Tcp") == 0)
   {
    g_tu[i] = 0;
   }
   if (wcscmp(ObjectName->Name.Buffer, L"file://Device//Udp") == 0||wcscmp(ObjectName->Name.Buffer, L"//Device//Udp") == 0)
   {
    g_tu[i] = 1;
   }
  }
 }
}

void Start(ULONG pBuffer)
{
 ULONG i;
 //头4个字节是所有的句柄的数目UNONG 32位
 //从第5个字节开始就是结构体了
 PSYSTEM_HANDLE_INFORMATION pProcesses = (PSYSTEM_HANDLE_INFORMATION)(pBuffer+4);
 ULONG nocache;
 ULONG tcpudp;
 PEPROCESS epro;
 char *p;
 ULONG uMajorVersion;
 ULONG uMinorVersion;
 ULONG uBuildNumber;
 ULONG uOsVer;

 DbgPrint("Start11/n");

 PsGetVersion(&uMajorVersion, &uMinorVersion, &uBuildNumber, NULL);
 if(uMajorVersion == 5)
 {
  if(uMinorVersion == 0)
  {
   DbgPrint("2k/n");
   uOsVer = 0;//2k
  }
  else if(uMinorVersion == 1)
  {
   uOsVer = 1;//xp
   DbgPrint("xp/n");
  }
  else if(uMinorVersion == 2)
  {
   uOsVer = 2;//2k3
   DbgPrint("2k3/n");
  }
  else
  {
   uOsVer = 3;//nt
   DbgPrint("NT/n");
  }
 }else if(uMajorVersion == 6)
 {
  uOsVer = 4;//WIN7
 }  else
 {
  uOsVer = 99;
  DbgPrint("Unknow OS/n");
 }

 for (i=0;i<((ULONG)(*(ULONG*)pBuffer));i++)
 {
  //2000 xp 2003 三种操作系统
  if(pProcesses[i].ObjectTypeNumber == WIN2K_SOCKET_FLAG
   || pProcesses[i].ObjectTypeNumber == WINXP_SOCKET_FLAG
   || pProcesses[i].ObjectTypeNumber == WIN2K3_SOCKET_FLAG)
  {           
   //得到SYSTEM_HANDLE_INFORMATION.object的相关数据
   //这里要密切注意内存情况，一不小心就蓝屏。因为句柄经常变化，有些可能已经被销毁了
   nocache = (ULONG)pProcesses[i].Object;
   if(!MmIsAddressValid((VOID*)nocache))
    continue;
   nocache = (ULONG)(*((ULONG*)(nocache)+4));

   tcpudp = (ULONG)(*((ULONG*)(pProcesses[i].Object)+1));
   if(!MmIsAddressValid((VOID*)tcpudp))
    continue;
   tcpudp = (ULONG)(*((ULONG*)(tcpudp)+1));

   if(nocache == 2 || nocache == 1)
   {
    //当noncache和tcpudp有效时候我们便开始解析
    //nocache是PTE里面的结构
    GetOpenPort(pProcesses[i].ProcessID,pProcesses[i].Handle,nocache,tcpudp);
   }
  }
 }

 for(i=0;i<g_num;i++)   {
  //根据PID得到进程名
  PsLookupProcessByProcessId(g_pid[i],&epro);

  if(uOsVer == 0)
  { //2k中进程名在EPROCESS结构中的位置
   p = (char*)epro + WIN2K_EPROCESS_NAMEOFFSET;
   //DbgPrint("2k/n");
  }
  if(uOsVer == 1)
  { //xp中进程名在EPROCESS结构中的位置
   p = (char*)epro + WINXP_EPROCESS_NAMEOFFSET;
   //DbgPrint("xp/n");
  }
  if(uOsVer == 2)
  { //2k3中进程名在EPROCESS结构中的位置
   p = (char*)epro + WIN2K3_EPROCESS_NAMEOFFSET;
   //DbgPrint("2k3/n");
  }
  if(uOsVer == 3)
  {
   p = (char*)epro + WIN2K_EPROCESS_NAMEOFFSET; //NT
   //DbgPrint("nt/n");
  }

  if(uOsVer == 4)
  {
   p = (char*)epro + WIN7_EPPROCESS_NAMEOFFSET; //NT
   //DbgPrint("nt/n");
  }

  if(uOsVer == 99)
  {
   //DbgPrint("Unknow OS/n");
   break;
  }

  if(g_tu[i] == 0)
   DbgPrint("TCP:/tProcName=%s/tPID=%d/tport=%d/t%d/n",p,g_pid[i],g_port[i],g_tcpudp[i]);
  if(g_tu[i] == 1)
   DbgPrint("UDP:/tProcName=%s/tPID=%d/tport=%d/t%d/n",p,g_pid[i],g_port[i],g_tcpudp[i]);

 }

 return;
}
//

NTSTATUS
 DriverEntry(IN PDRIVER_OBJECT DriverObject,
 IN PUNICODE_STRING RegistryPath)
{
 ULONG pbuf;

 DbgPrint("DriverEntry/n");

 DriverObject->DriverUnload = DriverUnload;

 pbuf = GetHandleList();
 Start(pbuf);

 return STATUS_SUCCESS;
}

void DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
 NTSTATUS            status;
 //ResumeDestFunction();
 if(pDriverObject->DeviceObject != NULL)
 {
  IoDeleteDevice( pDriverObject->DeviceObject );
 }

 DbgPrint("DriverUnload/n");
}