句柄表和pspcidtable

最新推荐文章于 2024-01-30 15:30:48 发布

yaneng

最新推荐文章于 2024-01-30 15:30:48 发布

阅读量840

点赞数

文章标签： table struct object blog list api

首先要先BS一下自己.一直以为进程的句柄表和PspCidTable是一样的.结果因为概念上的理解错误导致偶浪费了不少时间.多亏好心的FC的耐心指导算是明白一些.
总结一下FC教偶的: PspCidTable与进程句柄表没有直接关系.它只是借用了句柄表的结构.它里面存的内容是 eprocess 或者 ethread 的地址.

提供一些参考资源:
http://hi.baidu.com/gz1x/blog/item/d99aeefa4d1c92ddb48f31b9.html
http://www.rootkit.com/vault/petersilberman/FUTo_enhanced.zip

另外教主大虾在blog上说了下一篇他就会讲PspCidTable 大家记得去看哦.
偶对了提供几个结构声明和定义希望能给将要学习句柄表的童鞋带来帮助

#define WORD USHORT
typedef struct _EX_PUSH_LOCK
{
     union
     {
          ULONG Locked: 1;
          ULONG Waiting: 1;
          ULONG Waking: 1;
          ULONG MultipleShared: 1;
          ULONG Shared: 28;
          ULONG Value;
          PVOID Ptr;
     };
} EX_PUSH_LOCK, *PEX_PUSH_LOCK;

typedef struct _HANDLE_TRACE_DB_ENTRY
{
     CLIENT_ID ClientId;
     PVOID Handle;
     ULONG Type;
     VOID * StackTrace[16];
} HANDLE_TRACE_DB_ENTRY, *PHANDLE_TRACE_DB_ENTRY;

typedef struct _HANDLE_TABLE_ENTRY_INFO
{
ULONG AuditMask;
} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;

typedef struct _HANDLE_TABLE_ENTRY
{
     union
     {
          PVOID Object;
          ULONG ObAttributes;
          PHANDLE_TABLE_ENTRY_INFO InfoTable;
          ULONG Value;
     };
     union
     {
          ULONG GrantedAccess;
          struct
          {
               WORD GrantedAccessIndex;
               WORD CreatorBackTraceIndex;
          };
          LONG NextFreeTableEntry;
     };
} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;

typedef struct _HANDLE_TRACE_DEBUG_INFO
{
     LONG RefCount;
     ULONG TableSize;
     ULONG BitMaskFlags;
     FAST_MUTEX CloseCompactionLock;
     ULONG CurrentStackIndex;
     HANDLE_TRACE_DB_ENTRY TraceDb[1];
} HANDLE_TRACE_DEBUG_INFO, *PHANDLE_TRACE_DEBUG_INFO;

typedef struct _HANDLE_TABLE
{
     ULONG   TableCode;
     PEPROCESS QuotaProcess;
     PVOID UniqueProcessId;
     EX_PUSH_LOCK HandleLock;
     LIST_ENTRY HandleTableList;
     EX_PUSH_LOCK HandleContentionEvent;
     PHANDLE_TRACE_DEBUG_INFO DebugInfo;
     LONG ExtraInfoPages;
     ULONG Flags;
     ULONG StrictFIFO: 1;
     LONG FirstFreeHandle;
     PHANDLE_TABLE_ENTRY LastFreeHandleEntry;
     LONG HandleCount;
     ULONG NextHandleNeedingPool;
} HANDLE_TABLE, *PHANDLE_TABLE;

有个枚举句柄表的API:
extern
NTKERNELAPI
BOOLEAN

ExEnumHandleTable (
    __in PHANDLE_TABLE                      HandleTable,
    __in EX_ENUMERATE_HANDLE_ROUTINE     EnumHandleProcedure,//回调函数返回FALSE表示继续枚举
    __in PVOID     EnumParameter,
    __out_opt PHANDLE Handle
     );

回调函数的原形:
typedef BOOLEAN (__stdcall*EX_ENUMERATE_HANDLE_ROUTINE)(PHANDLE_TABLE_ENTRY arg1,ULONG arg2,PVOID arg3 );