结构如下: typedef struct _HANDLE_TABLE { ULONG Flags; LONG HandleCount; PHANDLE_TABLE_ENTRY **Table; PEPROCESS QuotaProcess; HANDLE UniqueProcessId; LONG FirstFreeTableEntry; LONG NextIndexNeedingPool; ERESOURCE HandleTableLock; LIST_ENTRY HandleTableList; KEVENT HandleContentionEvent; } HANDLE_TABLE , *PHANDLE_TABLE ;
我们利用调试器先从内核里找到这张表:
kd> version Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible Built by: 2600.xpsp_sp2_rtm.040803-2158 Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20 //... dbgeng: image 6.7.0005.1, built Wed Jun 20 11:50:35 2007 //...
typedef struct ServiceDescriptorEntry { unsigned int *ServiceTableBase; unsigned int *ServiceCounterTableBase; //Used only in checked build unsigned int NumberOfServices; unsigned char *ParamTableBase; } ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
if(EnumParameter== HandleTableEntry) { return TRUE; } else { // we ignore the in handle param,use i,j to walk the list for(uWalkTableCount=0;uWalkTableCount<0x100;uWalkTableCount++) { if(HandleTableEntry->Object) { Cid=(HANDLE)((1024*uWalkTablePage)+(uWalkTableCount<<2)); //you can take Handle,too;
if (Cid> (PVOID)4) {//you can walk the list yourself completely...I'm slothful :-) ntStatus = PsLookupProcessByProcessId( Cid, &Process ); if(NT_SUCCESS(ntStatus)) { DbgPrint("PID:%4d/tNAME:/t%-16s/n", Cid, ((PUCHAR)Process+EPROC_NAME_OFFSET) ); ObDereferenceObject( Process ); } } else { if (Cid== 0) { DbgPrint("PID:%4d/tNAME:/tIdle/n",0); //简化 } else { DbgPrint("PID:%4d/tNAME:/tSystem/n",4); //简化,自己EPROCESS吧 } } } } uWalkTablePage++;
return FALSE; } }
NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath ) { HANDLE h;