windows 显示进程地址空间
windows 显示进程地址空间
显示进程地址空间
/*
3-ProcessInfo.cpp
显示进程地址空间
*/
#include "..\\CommonFiles\\CmnHdr.h"
#include "..\\CommonFiles\\Toolhelp.h"
#include "resource.h"
#include <windowsx.h>
#include <stdarg.h>
#include <stdio.h>
#include <winternl.h> //用于windows内部声明
#include <AclAPI.h> //用于ACL（访问控制器列表）管理
#include <Shlwapi.h> //用于windows shell strFormatKBSize.
#include <ShlObj.h> //为IsUserAnAdmin测试当前用户是否是管理员组的成员。
#include <AclAPI.h> //用于ACL/ACE函数
#include <tchar.h>
#include <strsafe.h>
#pragma comment (lib,"shlwapi.lib")//shell 轻型使用工具函数库
#pragma comment (lib,"shell32.lib")
//
//NTQueryInformationProcess在winternl.h中定义
typedef NTSTATUS(CALLBACK* PFN_NTQUERYINFORMATIONPROCESS)(
HANDLE ProcessHandle,
PROCESSINFOCLASS ProcessInformationClass,
PVOID ProcessInformation,
ULONG ProcessInformationLength,
PULONG ReturnLength OPTIONAL
);
typedef struct
{
DWORD Filler[4];
DWORD InfoBlockAddress;
}__PEB;
typedef struct
{
DWORD Filler[17];
DWORD wszCmdLineAddress;
}__INFOBLOCK;
//
/*
PEB(process Environment Block)是一个未公开的结构体
typedef struct _PEB{
BYTE Reserved1[2];//2字节
BYTE BeingDegged; //1
BYTE Reserved2[1];//1
PVOID Reserved3[2]//2*4=8
PPED_LDR_DATA Ldr; //4
PRTL_USER_PROCESS_PARAMETERS ProcessParamters;
BYTE Reserved4[104];
PVOID Reserved5[52];
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
BYTE Reserved6[128];
PVOID Reserved7[1];
ULONG SessionId;
}PEB,*PPEB;
typedef struct _RTL_USER_PROCESS_PARAMETERS{
BYTE Reserved1[16];16字节
PVOID Reserved2[10];
UNICODE_STRING ImagePathName;
UNICODE_STRING CommandLine;
}RTL_USER_PROCESS_PARAMETERS,*PRTL_USER_PROCESS_PARAMETERS
}
*/
//全局变量
//指示由GetTokenInformation函数查询的令牌的提升类型
TOKEN_ELEVATION_TYPE s_elevationType = TokenElevationTypeDefault;
BOOL s_bIsAdmin = FALSE;//是否未管理员
const int s_cchAddress = sizeof(PVOID) * 2;
//函数原型
INT_PTR WINAPI Dlg_Proc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam);
BOOL Dlg_OnInitDialog(HWND hwnd, HWND hwndFocus, LPARAM lParam);
BOOL Dlg_OnSize(HWND hwnd, UINT state, int cx, int cy);
void Dlg_OnCommand(HWND hwnd, int id, HWND hwndCtrl, UINT codeNotify);
DWORD StartElevatedProcess(LPCTSTR szExecutable, LPCTSTR szCmdLine);
BOOL GetProcessElevation(TOKEN_ELEVATION_TYPE* pElevationType, BOOL* pIsAdmin);
VOID ShowModeleInfo(HWND hwnd, PCTSTR pszModulePath);
VOID ShowProcessInfo(HWND hwnd, DWORD dwProcessID);
VOID FormatSizeInKB(DWORD dwSize, DWORD nCharacters,LPTSTR szSize,size_t cchSize);
BOOL GetProcessOwner(DWORD PID, LPTSTR szOwner, DWORD cchSize);
BOOL GetProcessOwner(HANDLE hProcess, LPTSTR szOwner, size_t cchSize);
BOOL GetProcessCmdLine(DWORD PID, LPTSTR szCmdLine, DWORD Size);
BOOL GetProcessCmdLine(HANDLE hProcess, LPTSTR szCmdLine, DWORD Size);
NTSTATUS _NtQueryInformationProcess(HANDLE hProcess, PROCESSINFOCLASS pic,
PVOID pPI, ULONG cbSize, PULONG pLength);
VOID Dlg_PopulateModuleList(HWND hwnd);
VOID Dlg_PopulateProcessList(HWND hwnd);
BOOL GetProcessIntegrityLevel(DWORD PID, PDWORD pIntegrityLevel,
PDWORD pPolicy, PDWORD pResourceIntegrityLevel, PDWORD pResourcePolicy);
BOOL GetProcessIntegrityLevel(HANDLE hProcess, PDWORD pIntegrityLevel,
PDWORD pPolicy, PDWORD pResourceIntegrityLevel, PDWORD pResourcePolicy);
void AddText(HWND hwnd, PCTSTR pszFormat, ...);
PVOID GetModulePreferredBaseAddr(DWORD dwProcessId, PVOID pvModuleRemote);
BOOL GetProcessOwner(HANDLE hProcess, LPTSTR szOwner, size_t cchSize) {
// Sanity checks
if ((szOwner == NULL) || (cchSize == 0))
return(FALSE);
// Default value
szOwner[0] = TEXT('\0');
// Gget process token
HANDLE hToken = NULL;
CToolhelp::EnablePrivilege(SE_TCB_NAME, TRUE);
if (!OpenProcessToken(hProcess, TOKEN_QUERY, &hToken)) {
CToolhelp::EnablePrivilege(SE_TCB_NAME, FALSE);
return(FALSE);
}
// Obtain the size of the user information in the token.
DWORD cbti = 0;
GetTokenInformation(hToken, TokenUser, NULL, 0, &cbti);
// Call should have failed due to zero-length buffer.
if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
// Allocate buffer for user information in the token.
PTOKEN_USER ptiUser =
(PTOKEN_USER)HeapAlloc(GetProcessHeap(), 0, cbti);
if (ptiUser != NULL) {
// Retrieve the user information from the token.
if (GetTokenInformation(hToken, TokenUser, ptiUser, cbti, &cbti)) {
SID_NAME_USE snu;
TCHAR szUser[MAX_PATH];
DWORD chUser = MAX_PATH;
PDWORD pcchUser = &chUser;
TCHAR szDomain[MAX_PATH];
DWORD chDomain = MAX_PATH;
PDWORD pcchDomain = &chDomain;
// Retrieve user name and domain name based on user's SID.
if (
LookupAccountSid(
NULL,
ptiUser->User.Sid,
szUser,
pcchUser,
szDomain,
pcchDomain,
&snu
)
) {
// build the owner string as \\DomainName\UserName
_tcscpy_s(szOwner, cchSize, TEXT("\\\\"));
_tcscat_s(szOwner, cchSize, szDomain);
_tcscat_s(szOwner, cchSize, TEXT("\\"));
_tcscat_s(szOwner, cchSize, szUser);
}
}
// Don't forget to free memory buffer
HeapFree(GetProcessHeap(), 0, ptiUser);
}
}
// Don't forget to free process token
CloseHandle(hToken);
// Restore privileges
CToolhelp::EnablePrivilege(SE_TCB_NAME, TRUE);
return(TRUE);
}
BOOL GetProcessOwner(DWORD PID, LPTSTR szOwner, DWORD cchSize) {
// Sanity checks
if ((PID <= 0) || (szOwner == NULL))
return(FALSE);
// Check if we can get information for this process
HANDLE hProcess =
OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, PID);
if (hProcess == NULL)
return(FALSE);
BOOL bReturn = GetProcessOwner(hProcess, szOwner, cchSize);
// Don't forget to release the process handle
CloseHandle(hProcess);
return(bReturn);
}
NTSTATUS _NtQueryInformationProcess(
HANDLE hProcess,
PROCESSINFOCLASS pic,
PVOID pPI,
ULONG cbSize,
PULONG pLength
) {
HMODULE hNtDll = LoadLibrary(TEXT("ntdll.dll"));
if (hNtDll == NULL) {
return(-1);
}
NTSTATUS lStatus = -1; // error by default.
// Note that function name is not UNICODE
PFN_NTQUERYINFORMATIONPROCESS pfnNtQIP =
(PFN_NTQUERYINFORMATIONPROCESS)GetProcAddress(
hNtDll, "NtQueryInformationProcess");
if (pfnNtQIP != NULL) {
lStatus = pfnNtQIP(hProcess, pic, pPI, cbSize, pLength);
}
FreeLibrary(hNtDll);
return(lStatus);
}
///
int WINAPI _tWinMain(HINSTANCE hInstanceExe, HINSTANCE, PTSTR pszCmdLine, int)
{
//打开调试权限以运行应用程序查看服务应用
CToolhelp::EnablePrivilege(SE_DEBUG_NAME, TRUE);
//打开访问SACL权限--访问控制权限
CToolhelp::EnablePrivilege(SE_SECURITY_NAME, TRUE);
//显示主窗口
DialogBox(hInstanceExe, MAKEINTRESOURCE(IDD_PROCESSINFO), NULL, Dlg_Proc);
CToolhelp::EnablePrivilege(SE_SECURITY_NAME, FALSE);
CToolhelp::EnablePrivilege(SE_DEBUG_NAME, FALSE);
return (0);
}
INT_PTR WINAPI Dlg_Proc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
switch (uMsg)
{
chHANDLE_DLGMSG(hwnd, WM_INITDIALOG, Dlg_OnInitDialog);
chHANDLE_DLGMSG(hwnd, WM_SIZE, Dlg_OnSize);
chHANDLE_DLGMSG(hwnd, WM_COMMAND, Dlg_OnCommand);
}
return(FALSE);
}
BOOL Dlg_OnInitDialog(HWND hwnd, HWND hwndFocus, LPARAM lParam)
{
chSETDLGICONS(hwnd, IDI_PROCESSINFO);
//当提升权限或者禁用UAC时吗，管理员特权被设置为TRUE
BOOL bCanReadSystemProcesses = FALSE;
//显示是否正在运行“Filter Token”
if (GetProcessElevation(&s_elevationType,&s_bIsAdmin))
{
//提升标题的前缀
TCHAR szTitle[64];
switch (s_elevationType)
{
//默认用户活禁用UAC
case TokenElevationTypeDefault:
if (IsUserAnAdmin())
{
_tcscpy_s(szTitle, _countof(szTitle), TEXT("Default Administrator"));
bCanReadSystemProcesses = TRUE;
}
else
{
_tcscpy_s(szTitle, _countof(szTitle), TEXT("Default: "));
}
break;
//进程权限被提升成功
case TokenElevationTypeFull:
if (IsUserAnAdmin())
{
_tcscpy_s(szTitle, _countof(szTitle), TEXT("Elevated Administorator"));
bCanReadSystemProcesses = TRUE;
}
else
{
_tcscpy_s(szTitle, _countof(szTitle), TEXT("Elevated: "));
}
break;
//进程运行与受限（筛选令牌）下
case TokenElevationTypeLimited:
if (s_bIsAdmin)
{
_tcscpy_s(szTitle, _countof(szTitle), TEXT("Filtered Administrator"));
}
else
{
_tcscpy_s(szTitle, _countof(szTitle), TEXT("Filtered: "));
}
break;
}
//根据提示类型更新对话框标题
GetWindowText(hwnd, _tcschr(szTitle, TEXT('\0')),
_countof(szTitle) - _tcslen(szTitle));
SetWindowText(hwnd, szTitle);
//增加“循牌”图标，以运行用户以提升的权限来运行程序
if (!bCanReadSystemProcesses)
{
Button_SetElevationRequiredState(
GetDlgItem(hwnd, IDC_BTN_SYSTEM_PROCESSES),
!bCanReadSystemProcesses);
}
else
{
//已经提升权限则不不需要显示按钮
ShowWindow(GetDlgItem(hwnd, IDC_BTN_SYSTEM_PROCESSES), SW_HIDE);
//将组合列表框扩展到整个对话框的宽度
MoveWindow(GetDlgItem(hwnd, IDC_BTN_SYSTEM_PROCESSES),
0,0,0,0,FALSE);
}
}
//隐藏“模块帮助”列表框
ShowWindow(GetDlgItem(hwnd, IDC_MODULEHELP), SW_HIDE);
//使输出窗口使用等宽字体
SetWindowFont(GetDlgItem(hwnd, IDC_RESULTS),
GetStockFont(ANSI_FIXED_FONT), FALSE);
//默认下，显示运行中的进程
Dlg_PopulateProcessList(hwnd);
return (TRUE);
}
//
BOOL Dlg_OnSize(HWND hwnd, UINT state, int cx, int cy)
{
RECT btnRect;
HWND hwndCtrl = GetDlgItem(hwnd, IDC_BTN_SYSTEM_PROCESSES);
GetClientRect(hwndCtrl, &btnRect);
RECT rc;
int n = LOWORD(GetDialogBaseUnits());//字体的宽度
hwndCtrl = GetDlgItem(hwnd, IDC_PROCESSMODULELIST);
GetClientRect(hwndCtrl, &rc);
SetWindowPos(hwndCtrl, NULL,
n + n + btnRect.right,//按钮宽度+一个字符宽度
n,//y=一个字符的高度
cx - n - n - n - btnRect.right,//Combox宽度，右边距留一字符宽度
rc.bottom,
SWP_NOZORDER);
hwndCtrl = GetDlgItem(hwnd, IDC_RESULTS);
SetWindowPos(hwndCtrl, NULL,
n,
n + rc.bottom + n,
cx - n - n,
cy - (n + rc.bottom + n) - n,
SWP_NOZORDER);
return 0;
}
//
void Dlg_OnCommand(HWND hwnd, int id, HWND hwndCtrl, UINT codeNotify)
{
static BOOL s_fProcesses = TRUE;
switch (id)
{
case IDCANCEL:
EndDialog(hwnd, id);
break;
//以管理员身份重启应用程序
case IDC_BTN_SYSTEM_PROCESSES:
{
//case分支里面定义变量，要加大括号
ShowWindow(hwnd, SW_HIDE);
TCHAR szApplication[MAX_PATH];
DWORD cchLength = _countof(szApplication);
//获取进程的完整银蛇名称
//第二个参为0表示使用win32路径格式，PROCESS_NAME_NATIVE,表示使用本地系统路径格式
//第四个参数：返回字符串中字符的个数（不含\0)
QueryFullProcessImageName(
GetCurrentProcess(), 0, szApplication, &cchLength);
DWORD dwStatus = StartElevatedProcess(szApplication, NULL);//手动提升权限
if (dwStatus == S_OK)
{
//不需要极限在低特权下工作，退出本进程
ExitProcess(0);
}
//否则，新进程如果启动失败，重新显示本进程的主窗口
ShowWindow(hwnd, SW_SHOWNORMAL);
}
break;
//Processes菜单
case ID_PROCESSES:
s_fProcesses = TRUE;
//MF_BYCOMMAND:通过ID定位
EnableMenuItem(GetMenu(hwnd), ID_VMMAP, MF_BYCOMMAND | MF_ENABLED);
DrawMenuBar(hwnd);
Dlg_PopulateProcessList(hwnd);
break;
//modules菜单项
case ID_MODULES:
EnableMenuItem(GetMenu(hwnd), ID_VMMAP,MF_BYCOMMAND|MF_GRAYED);
DrawMenuBar(hwnd);
s_fProcesses = FALSE;
Dlg_PopulateModuleList(hwnd);
break;
case IDC_PROCESSMODULELIST:
if (codeNotify == CBN_SELCHANGE)
{
DWORD dw = ComboBox_GetCurSel(hwndCtrl);
if (s_fProcesses)
{
dw = (DWORD)ComboBox_GetItemData(hwndCtrl, dw);//process id
ShowProcessInfo(GetDlgItem(hwnd, IDC_RESULTS), dw);
}
else
{
//完整路径的索引在helper listbox中
dw = (DWORD)ComboBox_GetItemData(hwndCtrl, dw);
TCHAR szModulePath[1024];
ListBox_GetText(GetDlgItem(hwnd, IDC_MODULEHELP),
dw, szModulePath);
ShowModeleInfo(GetDlgItem(hwnd, IDC_RESULTS), szModulePath);
}
}
break;
//VMAP菜单0
case ID_VMMAP:{
TCHAR szCmdLine[32];
//下拉列表框
HWND hwndCB = GetDlgItem(hwnd, IDC_PROCESSMODULELIST);
DWORD dwProcessId = (DWORD)
ComboBox_GetItemData(hwndCB, ComboBox_GetCurSel(hwndCB));
StringCchPrintf(szCmdLine, _countof(szCmdLine), TEXT("%d"),
dwProcessId);
DWORD dwStatus =
StartElevatedProcess(TEXT("\"14-VMMap.exe\""), szCmdLine);
//以管理员身份运行14-VMMap.exe程序时，会进行提升权限的询问，如果时用户拒绝
//则显示下列消息框
if (dwStatus == ERROR_CANCELLED)
{
chMB("Failed to run 14-VMMap.exe:you refused access.");
}
}
break;
}
}
//手动提升权限
DWORD StartElevatedProcess(LPCTSTR szExecutable, LPCTSTR szCmdLine)
{
//初始化结构体
SHELLEXECUTEINFO sei = { sizeof(SHELLEXECUTEINFO) };
//请求管理员身份
sei.lpVerb = TEXT("runas");//run administrator?
//传入要提高权限的应用城项名
sei.lpFile = szExecutable;
//传入命令行参数
sei.lpParameters = szCmdLine;
//窗口正常显示，否则新启动的进程，七窗口将被隐藏
sei.nShow = SW_SHOWNORMAL;
ShellExecuteEx(&sei);
return (GetLastError());
}
//获取令牌提升的类型机判断当前进程是否以管理员身份运行
BOOL GetProcessElevation(TOKEN_ELEVATION_TYPE* pElevationType, BOOL* pIsAdmin)
{
HANDLE hToken = NULL;
DWORD dwSize;
//获取当前进程的Token
if (!OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY,&hToken))
{
return (FALSE);
}
BOOL bResult = FALSE;
//获取提升类型
if (GetTokenInformation(hToken,TokenElevationType,
pElevationType,sizeof(TOKEN_ELEVATION_TYPE),&dwSize))
{
//创建管理员组的SID
byte adminSID[SECURITY_MAX_SID_SIZE];
dwSize = sizeof(adminSID);
CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, &adminSID,
&dwSize);
//筛选令牌
if (*pElevationType == TokenElevationTypeLimited)
{
//取地与筛选令牌关联的未筛选令牌
HANDLE hUnfilTeredToken = NULL;
GetTokenInformation(hToken, TokenLinkedToken, (void*)
&hUnfilTeredToken, sizeof(HANDLE), &dwSize);
//通过初始未被筛选的令牌判断是否包含管理员SID
if (CheckTokenMembership(hUnfilTeredToken,&adminSID,pIsAdmin))
{
bResult = TRUE;
}
//关闭未筛选的令牌
CloseHandle(hUnfilTeredToken);
}
else
{
//未筛选令牌
*pIsAdmin = IsUserAnAdmin();
bResult = TRUE;
}
}
//关闭当前进程的令牌
CloseHandle(hToken);
return (bResult);
}
VOID ShowModeleInfo(HWND hwnd, PCTSTR pszModulePath)
{
SetWindowText(hwnd, TEXT(" "));//Clear the output box
CToolhelp thProcesses(TH32CS_SNAPPROCESS);
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL fOk = thProcesses.ProcessFirst(&pe);
AddText(hwnd, TEXT("Pathname:%s\r\n\r\n"), pszModulePath);
AddText(hwnd, TEXT("Process Informaton:\r\n"));
AddText(hwnd, TEXT(" PID %-*s Process\r\n"),
s_cchAddress, TEXT("BaseAddr"));
for (; fOk; fOk = thProcesses.ProcessNext(&pe))
{
CToolhelp thModules(TH32CS_SNAPMODULE, pe.th32ProcessID);
MODULEENTRY32 me = { sizeof(me) };
BOOL fOk = thModules.ModuleFirst(&me);
for (;fOk;fOk = thModules.ModuleNext(&me))
{
if (_tcscmp(me.szExePath, pszModulePath) == 0)
{
AddText(hwnd, TEXT(" %08X %p %s\r\n"),
pe.th32ProcessID, me.modBaseAddr, pe.szExeFile);
}
}
}
}
void AddText(HWND hwnd, PCTSTR pszFormat, ...)
{
va_list argList;
va_start(argList, pszFormat);
TCHAR sz[20 * 1024];
Edit_GetText(hwnd, sz, _countof(sz));
_vstprintf_s(_tcschr(sz, TEXT('\0')), _countof(sz) - _tcslen(sz),
pszFormat, argList);
Edit_SetText(hwnd, sz);
va_end(argList);
}
VOID ShowProcessInfo(HWND hwnd, DWORD dwProcessID) {
SetWindowText(hwnd, TEXT("")); // Clear the output box
CToolhelp th(TH32CS_SNAPALL, dwProcessID);
// Show Process details
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL fOk = th.ProcessFirst(&pe);
for (; fOk; fOk = th.ProcessNext(&pe)) {
if (pe.th32ProcessID == dwProcessID) {
TCHAR szCmdLine[1024];
if (GetProcessCmdLine(dwProcessID, szCmdLine, _countof(szCmdLine))) {
AddText(hwnd,
TEXT("Command line: %s %s\r\n"), pe.szExeFile, szCmdLine);
}
else {
AddText(hwnd, TEXT("Filename: %s\r\n"), pe.szExeFile);
}
AddText(hwnd, TEXT(" PID=%08X, ParentPID=%08X, ")
TEXT("PriorityClass=%d, Threads=%d, Heaps=%d\r\n"),
pe.th32ProcessID, pe.th32ParentProcessID,
pe.pcPriClassBase, pe.cntThreads,
th.HowManyHeaps());
TCHAR szOwner[MAX_PATH + 1];
if (GetProcessOwner(dwProcessID, szOwner, MAX_PATH)) {
AddText(hwnd, TEXT("Owner: %s\r\n"), szOwner);
}
break; // No need to continue looping
}
}
// Show Modules in the Process
// Number of characters to display an address
AddText(hwnd, TEXT("\r\nModules Information:\r\n")
TEXT(" Usage %-*s(%-*s) %10s Module\r\n"),
s_cchAddress, TEXT("BaseAddr"),
s_cchAddress, TEXT("ImagAddr"), TEXT("Size"));
MODULEENTRY32 me = { sizeof(me) };
fOk = th.ModuleFirst(&me);
for (; fOk; fOk = th.ModuleNext(&me)) {
if (me.ProccntUsage == 65535) {
// Module was implicitly loaded and cannot be unloaded
AddText(hwnd, TEXT(" Fixed"));
}
else {
AddText(hwnd, TEXT(" %5d"), me.ProccntUsage);
}
// Try to format the size in kb.
TCHAR szFormattedSize[64];
if (StrFormatKBSize(me.modBaseSize, szFormattedSize,
_countof(szFormattedSize)) == NULL)
{
StringCchPrintf(szFormattedSize, _countof(szFormattedSize),
TEXT("%10u"), me.modBaseSize);
}
PVOID pvPreferredBaseAddr =
GetModulePreferredBaseAddr(pe.th32ProcessID, me.modBaseAddr);
if (me.modBaseAddr == pvPreferredBaseAddr) {
AddText(hwnd, TEXT(" %p %*s %10s %s\r\n"),
me.modBaseAddr, s_cchAddress, TEXT(""),
szFormattedSize, me.szExePath);
}
else {
AddText(hwnd, TEXT(" %p(%p) %10s %s\r\n"),
me.modBaseAddr, pvPreferredBaseAddr,
szFormattedSize, me.szExePath);
}
}
// Show threads in the process
AddText(hwnd, TEXT("\r\nThread Information:\r\n")
TEXT(" TID Priority\r\n"));
THREADENTRY32 te = { sizeof(te) };
fOk = th.ThreadFirst(&te);
for (; fOk; fOk = th.ThreadNext(&te)) {
if (te.th32OwnerProcessID == dwProcessID) {
int nPriority = te.tpBasePri + te.tpDeltaPri;
if ((te.tpBasePri < 16) && (nPriority > 15)) nPriority = 15;
if ((te.tpBasePri > 15) && (nPriority > 31)) nPriority = 31;
if ((te.tpBasePri < 16) && (nPriority < 1)) nPriority = 1;
if ((te.tpBasePri > 15) && (nPriority < 16)) nPriority = 16;
AddText(hwnd, TEXT(" %08X %2d\r\n"),
te.th32ThreadID, nPriority);
}
}
}
BOOL GetProcessCmdLine(HANDLE hProcess, LPTSTR szCmdLine, DWORD Size) {
// Sanity checks
if ((hProcess == NULL) || (szCmdLine == NULL) || (Size == 0))
return(FALSE);
// 0. Get the Process Environment Block address
int iReturn = 1;
DWORD dwSize;
SIZE_T size;
PROCESS_BASIC_INFORMATION pbi;
// The PEB was supposed to always be at address 0x7ffdf000 in XP...
// ... but, here is the "right" way to get it now in Vista.
iReturn =
_NtQueryInformationProcess(
hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), &dwSize);
// NtQueryInformationProcess returns a negative value if it fails
if (iReturn >= 0) {
// 1. Find the Process Environment Block
__PEB PEB;
size = dwSize;
if (!ReadProcessMemory(hProcess, pbi.PebBaseAddress, &PEB,
sizeof(PEB), &size)) {
// Call GetLastError() if you need to know why
return(FALSE);
}
// 2. From this PEB, get the address of the block containing
// a pointer to the CmdLine
__INFOBLOCK Block;
if (!ReadProcessMemory(hProcess, (LPVOID)PEB.InfoBlockAddress,
&Block, sizeof(Block), &size)) {
// Call GetLastError() if you need to know why
return(FALSE);
}
// 3. Get the CmdLine
wchar_t wszCmdLine[MAX_PATH + 1];
if (!ReadProcessMemory(hProcess, (LPVOID)Block.wszCmdLineAddress,
wszCmdLine, MAX_PATH * sizeof(wchar_t), &size)) {
// Call GetLastError() if you need to know why
return(FALSE);
}
// 4. Skip the application pathname
// it can be empty, "c:\...\app.exe" or c:\...\app.exe
wchar_t* pPos = wszCmdLine;
if (*pPos != L'\0') {
if (*pPos == L'"') {
// Find the next " character
pPos = wcschr(&pPos[1], L'"');
}
else {
// Find the next SPACE character
pPos = wcschr(&pPos[1], L' ');
}
// Skip it
if (pPos != NULL)
pPos++;
}
// Copy it back
if (pPos != NULL) {
if (*pPos != L'\0') {
#ifdef UNICODE
// Both strings are in UNICODE.
_tcscpy_s(szCmdLine, Size, pPos);
#else
// from UNICODE to ANSI
MultiByteToWideChar(CP_ACP, 0, szCmdLine, Size,
pPos, wcslen(pPos));
#endif
}
else
szCmdLine[0] = TEXT('\0');
}
else
szCmdLine[0] = TEXT('\0');
}
else {
return(FALSE);
}
return(TRUE);
}
BOOL GetProcessCmdLine(DWORD PID, LPTSTR szCmdLine, DWORD Size) {
// Sanity checks
if ((PID <= 0) || (szCmdLine == NULL))
return(FALSE);
// Check if we can get information for this process
HANDLE hProcess =
OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, PID);
if (hProcess == NULL)
return(FALSE);
BOOL bReturn = GetProcessCmdLine(hProcess, szCmdLine, Size);
// Don't forget to release the process handle
CloseHandle(hProcess);
return(bReturn);
}
VOID FormatSizeInKB(DWORD dwSize, DWORD nCharacters,
LPTSTR szSize, size_t cchSize) {
TCHAR szFormattedSize[64];
if (StrFormatKBSize(dwSize, szFormattedSize,
_countof(szFormattedSize)) == NULL) {
StringCchPrintf(szFormattedSize, _countof(szFormattedSize), TEXT("%8u"), dwSize);
}
// Format to the right nCharacter width if needed.
if (_tcslen(szFormattedSize) < nCharacters) {
DWORD current = 0;
for (current = 0;
current < (nCharacters - _tcslen(szFormattedSize));
current++) {
szSize[current] = TEXT(' ');
}
szSize[current] = TEXT('\0');
_tcscat_s(szSize, cchSize - current, szFormattedSize);
}
}
VOID Dlg_PopulateProcessList(HWND hwnd) {
HWND hwndList = GetDlgItem(hwnd, IDC_PROCESSMODULELIST);
SetWindowRedraw(hwndList, FALSE);
ComboBox_ResetContent(hwndList);
CToolhelp thProcesses(TH32CS_SNAPPROCESS);
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL fOk = thProcesses.ProcessFirst(&pe);
for (; fOk; fOk = thProcesses.ProcessNext(&pe)) {
TCHAR sz[1024];
// Place the process name (without its path) & ID in the list
PCTSTR pszExeFile = _tcsrchr(pe.szExeFile, TEXT('\\'));
if (pszExeFile == NULL) {
pszExeFile = pe.szExeFile;
}
else {
pszExeFile++; // Skip over the slash
}
// Append the code/resource integrity level and policy
DWORD dwCodeIntegrityLevel = 0;
DWORD dwCodePolicy = TOKEN_MANDATORY_POLICY_OFF;
DWORD dwResourcePolicy = 0;
DWORD dwResourceIntegrityLevel = 0;
TCHAR szCodeDetails[256];
szCodeDetails[0] = TEXT('\0');
TCHAR szResourceDetails[256];
szResourceDetails[0] = TEXT('\0');
if (GetProcessIntegrityLevel(pe.th32ProcessID, &dwCodeIntegrityLevel,
&dwCodePolicy, &dwResourceIntegrityLevel, &dwResourcePolicy)) {
switch (dwCodeIntegrityLevel) {
case SECURITY_MANDATORY_LOW_RID:
_tcscpy_s(szCodeDetails, _countof(szCodeDetails),
TEXT("- Low "));
break;
case SECURITY_MANDATORY_MEDIUM_RID:
_tcscpy_s(szCodeDetails, _countof(szCodeDetails),
TEXT("- Medium "));
break;
case SECURITY_MANDATORY_HIGH_RID:
_tcscpy_s(szCodeDetails, _countof(szCodeDetails),
TEXT("- High "));
break;
case SECURITY_MANDATORY_SYSTEM_RID:
_tcscpy_s(szCodeDetails, _countof(szCodeDetails),
TEXT("- System "));
break;
default:
_tcscpy_s(szCodeDetails, _countof(szCodeDetails),
TEXT("- ??? "));
}
if (dwCodePolicy == TOKEN_MANDATORY_POLICY_OFF) { // = 0
_tcscat_s(szCodeDetails,
_countof(szCodeDetails), TEXT(" + no policy"));
}
else {
if ((dwCodePolicy & TOKEN_MANDATORY_POLICY_VALID_MASK) == 0) {
_tcscat_s(szCodeDetails, _countof(szCodeDetails),
TEXT(" + ???"));
}
else {
if ((dwCodePolicy & TOKEN_MANDATORY_POLICY_NO_WRITE_UP)
== TOKEN_MANDATORY_POLICY_NO_WRITE_UP) {
_tcscat_s(szCodeDetails, _countof(szCodeDetails),
TEXT(" + no write-up"));
}
if ((dwCodePolicy & TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN)
== TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN) {
_tcscat_s(szCodeDetails, _countof(szCodeDetails),
TEXT(" + new process min"));
}
}
}
switch (dwResourceIntegrityLevel) {
case SECURITY_MANDATORY_LOW_RID:
_tcscpy_s(szResourceDetails,
_countof(szResourceDetails), TEXT("Low"));
break;
case SECURITY_MANDATORY_MEDIUM_RID:
_tcscpy_s(szResourceDetails,
_countof(szResourceDetails), TEXT("Medium"));
break;
case SECURITY_MANDATORY_HIGH_RID:
_tcscpy_s(szResourceDetails,
_countof(szResourceDetails), TEXT("High"));
break;
case SECURITY_MANDATORY_SYSTEM_RID:
_tcscpy_s(szResourceDetails,
_countof(szResourceDetails), TEXT("System"));
break;
case 0:
_tcscpy_s(szResourceDetails,
_countof(szResourceDetails), TEXT("Not set"));
break;
default:
_tcscpy_s(szResourceDetails,
_countof(szResourceDetails), TEXT("???"));
}
if (dwResourcePolicy == 0) { // = 0
_tcscat_s(szResourceDetails,
_countof(szResourceDetails), TEXT(" + 0 policy"));
}
else {
if ((dwResourcePolicy & TOKEN_MANDATORY_POLICY_VALID_MASK) == 0) {
_tcscat_s(szResourceDetails,
_countof(szResourceDetails), TEXT(" + ???"));
}
else {
if ((dwResourcePolicy & SYSTEM_MANDATORY_LABEL_NO_WRITE_UP)
== SYSTEM_MANDATORY_LABEL_NO_WRITE_UP) {
_tcscat_s(szResourceDetails,
_countof(szResourceDetails),
TEXT(" + no write-up"));
}
if ((dwResourcePolicy & SYSTEM_MANDATORY_LABEL_NO_READ_UP)
== SYSTEM_MANDATORY_LABEL_NO_READ_UP) {
_tcscat_s(szResourceDetails,
_countof(szResourceDetails),
TEXT(" + no read-up"));
}
if ((dwResourcePolicy & SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP)
== SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP) {
_tcscat_s(szResourceDetails,
_countof(szResourceDetails),
TEXT(" + no execute-up"));
}
}
}
}
StringCchPrintf(sz, _countof(sz), TEXT("%s (0x%08X) %s [%s]"),
pszExeFile, pe.th32ProcessID, szCodeDetails, szResourceDetails);
int n = ComboBox_AddString(hwndList, sz);
// Associate the process ID with the added item
ComboBox_SetItemData(hwndList, n, pe.th32ProcessID);
}
ComboBox_SetCurSel(hwndList, 0); // Select the first entry
// Simulate the user selecting this first item so that the
// results pane shows something interesting
FORWARD_WM_COMMAND(hwnd, IDC_PROCESSMODULELIST,
hwndList, CBN_SELCHANGE, SendMessage);
SetWindowRedraw(hwndList, TRUE);
InvalidateRect(hwndList, NULL, FALSE);
}
///
VOID Dlg_PopulateModuleList(HWND hwnd) {
HWND hwndModuleHelp = GetDlgItem(hwnd, IDC_MODULEHELP);
ListBox_ResetContent(hwndModuleHelp);
CToolhelp thProcesses(TH32CS_SNAPPROCESS);
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL fOk = thProcesses.ProcessFirst(&pe);
for (; fOk; fOk = thProcesses.ProcessNext(&pe)) {
CToolhelp thModules(TH32CS_SNAPMODULE, pe.th32ProcessID);
MODULEENTRY32 me = { sizeof(me) };
BOOL fOk = thModules.ModuleFirst(&me);
for (; fOk; fOk = thModules.ModuleNext(&me)) {
int n = ListBox_FindStringExact(hwndModuleHelp, -1, me.szExePath);
if (n == LB_ERR) {
// This module hasn't been added before
ListBox_AddString(hwndModuleHelp, me.szExePath);
}
}
}
HWND hwndList = GetDlgItem(hwnd, IDC_PROCESSMODULELIST);
SetWindowRedraw(hwndList, FALSE);
ComboBox_ResetContent(hwndList);
int nNumModules = ListBox_GetCount(hwndModuleHelp);
for (int i = 0; i < nNumModules; i++) {
TCHAR sz[1024];
ListBox_GetText(hwndModuleHelp, i, sz);
// Place module name (without its path) in the list
int nIndex = ComboBox_AddString(hwndList, _tcsrchr(sz, TEXT('\\')) + 1);
// Associate the index of the full path with the added item
ComboBox_SetItemData(hwndList, nIndex, i);
}
ComboBox_SetCurSel(hwndList, 0); // Select the first entry
// Simulate the user selecting this first item so that the
// results pane shows something interesting
FORWARD_WM_COMMAND(hwnd, IDC_PROCESSMODULELIST,
hwndList, CBN_SELCHANGE, SendMessage);
SetWindowRedraw(hwndList, TRUE);
InvalidateRect(hwndList, NULL, FALSE);
}
BOOL GetProcessIntegrityLevel(HANDLE hProcess, PDWORD pIntegrityLevel,
PDWORD pPolicy, PDWORD pResourceIntegrityLevel, PDWORD pResourcePolicy) {
HANDLE hToken = NULL;
if (!OpenProcessToken(hProcess, TOKEN_READ, &hToken)) {
return(FALSE);
}
BOOL bReturn = FALSE;
// First, compute the size of the buffer to get the Integrity level
DWORD dwNeededSize = 0;
if (!GetTokenInformation(
hToken, TokenIntegrityLevel, NULL, 0, &dwNeededSize)) {
PTOKEN_MANDATORY_LABEL pTokenInfo = NULL;
if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
// Second, allocate a memory block with the the required size
pTokenInfo = (PTOKEN_MANDATORY_LABEL)LocalAlloc(0, dwNeededSize);
if (pTokenInfo != NULL) {
// And finally, ask for the integrity level
if (GetTokenInformation(hToken, TokenIntegrityLevel, pTokenInfo,
dwNeededSize, &dwNeededSize)) {
*pIntegrityLevel =
*GetSidSubAuthority(
pTokenInfo->Label.Sid,
(*GetSidSubAuthorityCount(pTokenInfo->Label.Sid) - 1)
);
bReturn = TRUE;
}
// Don't forget to free the memory
LocalFree(pTokenInfo);
}
}
}
// Try to get the policy if the integrity level was available
if (bReturn) {
*pPolicy = TOKEN_MANDATORY_POLICY_OFF;
dwNeededSize = sizeof(DWORD);
GetTokenInformation(hToken, TokenMandatoryPolicy, pPolicy,
dwNeededSize, &dwNeededSize);
}
// Look for the resource policy
*pResourceIntegrityLevel = 0; // 0 means none explicitely set
*pResourcePolicy = 0;
PACL pSACL = NULL;
PSECURITY_DESCRIPTOR pSD = NULL;
DWORD dwResult = ERROR_SUCCESS;
// Look for the no-read-up/no-write-up policy in the SACL
if (hToken != NULL) {
dwResult =
GetSecurityInfo(
hProcess, SE_KERNEL_OBJECT,
LABEL_SECURITY_INFORMATION,
NULL, NULL, NULL,
&pSACL, &pSD
);
if (dwResult == ERROR_SUCCESS) {
if (pSACL != NULL) {
SYSTEM_MANDATORY_LABEL_ACE* pACE = NULL;
if ((pSACL->AceCount > 0) && (GetAce(pSACL, 0, (PVOID*)&pACE))) {
if (pACE != NULL) {
SID* pSID = (SID*)(&pACE->SidStart);
*pResourceIntegrityLevel = pSID->SubAuthority[0];
*pResourcePolicy = pACE->Mask;
}
}
}
}
// Cleanup memory allocated on our behalf
if (pSD != NULL) LocalFree(pSD);
}
// Don't forget to close the token handle.
CloseHandle(hToken);
return(bReturn);
}
BOOL GetProcessIntegrityLevel(DWORD PID, PDWORD pIntegrityLevel,
PDWORD pPolicy, PDWORD pResourceIntegrityLevel, PDWORD pResourcePolicy) {
// Sanity checks
if ((PID <= 0) || (pIntegrityLevel == NULL))
return(FALSE);
// Check if we can get information for this process
HANDLE hProcess = OpenProcess(
READ_CONTROL | PROCESS_QUERY_INFORMATION,
FALSE, PID);
if (hProcess == NULL)
return(FALSE);
BOOL bReturn = GetProcessIntegrityLevel(hProcess, pIntegrityLevel,
pPolicy, pResourceIntegrityLevel, pResourcePolicy);
// Don't forget to release the process handle
CloseHandle(hProcess);
return(bReturn);
}
PVOID GetModulePreferredBaseAddr(DWORD dwProcessId, PVOID pvModuleRemote) {
PVOID pvModulePreferredBaseAddr = NULL;
IMAGE_DOS_HEADER idh;
IMAGE_NT_HEADERS inth;
// Read the remote module's DOS header
Toolhelp32ReadProcessMemory(dwProcessId,
pvModuleRemote, &idh, sizeof(idh), NULL);
// Verify the DOS image header
if (idh.e_magic == IMAGE_DOS_SIGNATURE) {
// Read the remote module's NT header
Toolhelp32ReadProcessMemory(dwProcessId,
(PBYTE)pvModuleRemote + idh.e_lfanew, &inth, sizeof(inth), NULL);
// Verify the NT image header
if (inth.Signature == IMAGE_NT_SIGNATURE) {
// This is valid NT header, get the image's preferred base address
pvModulePreferredBaseAddr = (PVOID)inth.OptionalHeader.ImageBase;
}
}
return(pvModulePreferredBaseAddr);
}
2701
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
