枚举PEB获取进程模块列表

枚举进程模块的方法有很多种，常见的有枚举PEB和内存搜索法，今天，先来看看实现起来最简单的枚举PEB实现获取进程模块列表。

首先，惯例是各种繁琐的结构体定义。需要包含 ntifs.h 和 WinDef.h, 此处不再列出，各位看官根据情况自行添加。

[cpp] view plain copy

print?

1. typedef PPEB (__stdcall *PFNPsGetProcessPeb)(PEPROCESS pEProcess);
2. typedef ULONG   PPS_POST_PROCESS_INIT_ROUTINE;
3. typedef struct _PEB_LDR_DATA {
4. BYTE       Reserved1[8];
5. PVOID      Reserved2[3];
6. LIST_ENTRY InMemoryOrderModuleList;
7. } PEB_LDR_DATA, *PPEB_LDR_DATA;
8. typedef struct _RTL_USER_PROCESS_PARAMETERS {
9. BYTE           Reserved1[16];
10. PVOID          Reserved2[10];
11. UNICODE_STRING ImagePathName;
12. UNICODE_STRING CommandLine;
13. } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
14. typedef struct _PEB {
15. BYTE                          Reserved1[2];
16. BYTE                          BeingDebugged;
17. BYTE                          Reserved2[1];
18. PVOID                         Reserved3[2];
19. PPEB_LDR_DATA                 Ldr;
20. PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
21. BYTE                          Reserved4[104];
22. PVOID                         Reserved5[52];
23. PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
24. BYTE                          Reserved6[128];
25. PVOID                         Reserved7[1];
26. ULONG                         SessionId;
27. } PEB, *PPEB;
28. typedef struct _LDR_DATA_TABLE_ENTRY
29. {
30. LIST_ENTRY InLoadOrderLinks;
31. LIST_ENTRY InMemoryOrderLinks;
32. LIST_ENTRY InInitializationOrderLinks;
33. PVOID DllBase;
34. PVOID EntryPoint;
35. DWORD SizeOfImage;
36. UNICODE_STRING FullDllName;
37. UNICODE_STRING BaseDllName;
38. DWORD Flags;
39. WORD LoadCount;
40. WORD TlsIndex;
41. LIST_ENTRY HashLinks;
42. PVOID SectionPointer;
43. DWORD CheckSum;
44. DWORD TimeDateStamp;
45. PVOID LoadedImports;
46. PVOID EntryPointActivationContext;
47. PVOID PatchInformation;
48. }LDR_DATA_TABLE_ENTRY,*PLDR_DATA_TABLE_ENTRY;

typedef PPEB (__stdcall *PFNPsGetProcessPeb)(PEPROCESS pEProcess);

typedef ULONG   PPS_POST_PROCESS_INIT_ROUTINE;  

typedef struct _PEB_LDR_DATA {
    BYTE       Reserved1[8];
    PVOID      Reserved2[3];
    LIST_ENTRY InMemoryOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

typedef struct _RTL_USER_PROCESS_PARAMETERS {
    BYTE           Reserved1[16];
    PVOID          Reserved2[10];
    UNICODE_STRING ImagePathName;
    UNICODE_STRING CommandLine;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

typedef struct _PEB {
    BYTE                          Reserved1[2];
    BYTE                          BeingDebugged;
    BYTE                          Reserved2[1];
    PVOID                         Reserved3[2];
    PPEB_LDR_DATA                 Ldr;
    PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
    BYTE                          Reserved4[104];
    PVOID                         Reserved5[52];
    PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
    BYTE                          Reserved6[128];
    PVOID                         Reserved7[1];
    ULONG                         SessionId;
} PEB, *PPEB;

typedef struct _LDR_DATA_TABLE_ENTRY
{
    LIST_ENTRY InLoadOrderLinks;
    LIST_ENTRY InMemoryOrderLinks;
    LIST_ENTRY InInitializationOrderLinks;
    PVOID DllBase;
    PVOID EntryPoint;
    DWORD SizeOfImage;
    UNICODE_STRING FullDllName;
    UNICODE_STRING BaseDllName;
    DWORD Flags;
    WORD LoadCount;
    WORD TlsIndex;
    LIST_ENTRY HashLinks;
    PVOID SectionPointer;
    DWORD CheckSum;
    DWORD TimeDateStamp;
    PVOID LoadedImports;
    PVOID EntryPointActivationContext;
    PVOID PatchInformation;
}LDR_DATA_TABLE_ENTRY,*PLDR_DATA_TABLE_ENTRY;  

下面进入真正的实现代码：

[cpp] view plain copy

print?

1. NTSTATUS GetProcessModules(ULONG ulProcessId)
2. {
3. NTSTATUS nStatus;
4. //PEB结构指针
5. PPEB pPEB = NULL;
6. //EPROCESS结构指针
7. PEPROCESS  pEProcess = NULL;
8. //查找的函数名称
9. UNICODE_STRING uniFunctionName;
10. //进程参数信息
11. PRTL_USER_PROCESS_PARAMETERS pParam  = NULL;
12. //LDR数据结构
13. PPEB_LDR_DATA pPebLdrData = NULL;
14. //LDR链表入口
15. PLDR_DATA_TABLE_ENTRY pLdrDataEntry = NULL;
16. //链表头节点、尾节点
17. PLIST_ENTRY pListEntryStart = NULL;
18. PLIST_ENTRY pListEntryEnd = NULL;
19. //函数指针
20. PFNPsGetProcessPeb  PsGetProcessPeb = NULL;
21. //保存APC状态
22. KAPC_STATE KAPC ={0};
23. //是否已经附加到进程
24. BOOLEAN bIsAttached = FALSE;
25. //获取进程的EPROCESS结构指针
26. nStatus = PsLookupProcessByProcessId((HANDLE)ulProcessId, &pEProcess);
27. if (!NT_SUCCESS(nStatus))
28. {
29. return STATUS_UNSUCCESSFUL;
30. }
31. //查找函数地址
32. RtlInitUnicodeString(&uniFunctionName, L"PsGetProcessPeb");
33. PsGetProcessPeb = (PFNPsGetProcessPeb)MmGetSystemRoutineAddress(&uniFunctionName);
34. if (PsGetProcessPeb == NULL)
35. {
36. KdPrint(("Get PsGetProcessPeb Failed~!\n"));
37. return STATUS_UNSUCCESSFUL;
38. }
39. //获取PEB指针
40. pPEB = PsGetProcessPeb(pEProcess);
41. if (pPEB == NULL)
42. {
43. KdPrint(("Get pPEB Failed~!\n"));
44. return STATUS_UNSUCCESSFUL;
45. }
46. //附加到进程
47. KeStackAttachProcess(pEProcess, &KAPC);
48. bIsAttached = TRUE;
49. //指向LDR
50. pPebLdrData = pPEB->Ldr;
51. //头节点、尾节点
52. pListEntryStart = pListEntryEnd = pPebLdrData->InMemoryOrderModuleList.Flink;
53. //开始遍历_LDR_DATA_TABLE_ENTRY
54. do
55. {
56. //通过_LIST_ENTRY的Flink成员获取_LDR_DATA_TABLE_ENTRY结构
57. pLdrDataEntry = (PLDR_DATA_TABLE_ENTRY)CONTAINING_RECORD(pListEntryStart,LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
58. //输出DLL全路径
59. KdPrint(("%wZ \n", &pLdrDataEntry->FullDllName));
60. pListEntryStart = pListEntryStart->Flink;
61. }while(pListEntryStart != pListEntryEnd);
62. //Detach进程
63. if (bIsAttached != FALSE)
64. {
65. KeUnstackDetachProcess(&KAPC);
66. }
67. //减少引用计数
68. if (pEProcess != NULL)
69. {
70. ObDereferenceObject(pEProcess);
71. pEProcess = NULL;
72. }
73. return STATUS_SUCCESS;
74. }

NTSTATUS GetProcessModules(ULONG ulProcessId)
{
    NTSTATUS nStatus;
    //PEB结构指针
    PPEB pPEB = NULL;

    //EPROCESS结构指针
    PEPROCESS  pEProcess = NULL;

    //查找的函数名称
    UNICODE_STRING uniFunctionName;

    //进程参数信息
    PRTL_USER_PROCESS_PARAMETERS pParam  = NULL;

    //LDR数据结构
    PPEB_LDR_DATA pPebLdrData = NULL;  

    //LDR链表入口
    PLDR_DATA_TABLE_ENTRY pLdrDataEntry = NULL;  

    //链表头节点、尾节点
    PLIST_ENTRY pListEntryStart = NULL;
    PLIST_ENTRY pListEntryEnd = NULL; 

    //函数指针
    PFNPsGetProcessPeb  PsGetProcessPeb = NULL;

    //保存APC状态
    KAPC_STATE KAPC ={0};

    //是否已经附加到进程
    BOOLEAN bIsAttached = FALSE;

    //获取进程的EPROCESS结构指针
    nStatus = PsLookupProcessByProcessId((HANDLE)ulProcessId, &pEProcess);
    if (!NT_SUCCESS(nStatus))
    {
        return STATUS_UNSUCCESSFUL;
    }

    //查找函数地址
    RtlInitUnicodeString(&uniFunctionName, L"PsGetProcessPeb");
    PsGetProcessPeb = (PFNPsGetProcessPeb)MmGetSystemRoutineAddress(&uniFunctionName);
    if (PsGetProcessPeb == NULL)
    {
        KdPrint(("Get PsGetProcessPeb Failed~!\n"));
        return STATUS_UNSUCCESSFUL;
    }

    //获取PEB指针
    pPEB = PsGetProcessPeb(pEProcess);
    if (pPEB == NULL)
    {
        KdPrint(("Get pPEB Failed~!\n"));
        return STATUS_UNSUCCESSFUL;
    }

    //附加到进程
    KeStackAttachProcess(pEProcess, &KAPC);

    bIsAttached = TRUE;

    //指向LDR
    pPebLdrData = pPEB->Ldr;

    //头节点、尾节点
    pListEntryStart = pListEntryEnd = pPebLdrData->InMemoryOrderModuleList.Flink;

    //开始遍历_LDR_DATA_TABLE_ENTRY
    do
    {
        //通过_LIST_ENTRY的Flink成员获取_LDR_DATA_TABLE_ENTRY结构
        pLdrDataEntry = (PLDR_DATA_TABLE_ENTRY)CONTAINING_RECORD(pListEntryStart,LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);  

        //输出DLL全路径
        KdPrint(("%wZ \n", &pLdrDataEntry->FullDllName));

        pListEntryStart = pListEntryStart->Flink;  

    }while(pListEntryStart != pListEntryEnd);  

    //Detach进程
    if (bIsAttached != FALSE)
    {
        KeUnstackDetachProcess(&KAPC);
    }

    //减少引用计数
    if (pEProcess != NULL)
    {
        ObDereferenceObject(pEProcess);
        pEProcess = NULL;
    }

    return STATUS_SUCCESS;
}

下面是运行截图：

本帖为原创，转帖请说明出处，谢谢合作。

本帖地址：http://blog.csdn.net/sonsie007/article/details/22622177