通过ZwQuerySystemInformation获取EPROCESS

google一下,发现很多都是直接通过ZwQuerySystemInformation通过11号获取进程结构SYSTEM_PROCESS_INFORMATION,对于详细的进程信息表达不够。所以想要通过这个来查看详细的 EPROCESS 结构。方法可以通过 PsLookupProcessByProcessId 这个函数来获取。函数原型在下面给出。

typedef struct _SYSTEM_PROCESS_INFORMATION {

  ULONG                   NextEntryOffset;
ULONG NumberOfThreads;
LARGE_INTEGER Reserved[];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE ProcessId;
HANDLE InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[];
ULONG PrivatePageCount;
VM_COUNTERS VirtualMemoryCounters;
IO_COUNTERS IoCounters;
SYSTEM_THREAD Threads[]; } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

而_SYSTEM_PROCESS_INFORMATION结构在WRK下面的结构明显比上面的多。看来微软的动作还挺大的。

typedef struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
LARGE_INTEGER SpareLi1;
LARGE_INTEGER SpareLi2;
LARGE_INTEGER SpareLi3;
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
ULONG HandleCount;
ULONG SessionId;
ULONG_PTR PageDirectoryBase;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG PageFaultCount;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
SIZE_T QuotaPeakPagedPoolUsage;
SIZE_T QuotaPagedPoolUsage;
SIZE_T QuotaPeakNonPagedPoolUsage;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

ReactOS下的PsLookupProcessByProcessId:

NTSTATUS
NTAPI
PsLookupProcessByProcessId(IN HANDLE ProcessId,
OUT PEPROCESS *Process)
{
PHANDLE_TABLE_ENTRY CidEntry;
PEPROCESS FoundProcess;
NTSTATUS Status = STATUS_INVALID_PARAMETER;
PAGED_CODE();
PSTRACE(PS_PROCESS_DEBUG, "ProcessId: %p\n", ProcessId);
KeEnterCriticalRegion(); /* Get the CID Handle Entry */
CidEntry = ExMapHandleToPointer(PspCidTable, ProcessId);
if (CidEntry)
{
/* Get the Process */
FoundProcess = CidEntry->Object; /* Make sure it's really a process */
if (FoundProcess->Pcb.Header.Type == ProcessObject)
{
/* Safe Reference and return it */
if (ObReferenceObjectSafe(FoundProcess))
{
*Process = FoundProcess;
Status = STATUS_SUCCESS;
}
} /* Unlock the Entry */
ExUnlockHandleTableEntry(PspCidTable, CidEntry);
} /* Return to caller */
KeLeaveCriticalRegion();
return Status;
}

WRK下的PsLookupProcessByProcessId:

NTSTATUS
PsLookupProcessByProcessId(
__in HANDLE ProcessId,
__deref_out PEPROCESS *Process
) /*++ Routine Description: This function accepts the process id of a process and returns a
referenced pointer to the process. Arguments: ProcessId - Specifies the Process ID of the process. Process - Returns a referenced pointer to the process specified by the
process id. Return Value: STATUS_SUCCESS - A process was located based on the contents of
the process id. STATUS_INVALID_PARAMETER - The process was not found. --*/ { PHANDLE_TABLE_ENTRY CidEntry;
PEPROCESS lProcess;
PETHREAD CurrentThread;
NTSTATUS Status; PAGED_CODE(); Status = STATUS_INVALID_PARAMETER; CurrentThread = PsGetCurrentThread ();
KeEnterCriticalRegionThread (&CurrentThread->Tcb); CidEntry = ExMapHandleToPointer(PspCidTable, ProcessId);
if (CidEntry != NULL) {
lProcess = (PEPROCESS)CidEntry->Object;
if (lProcess->Pcb.Header.Type == ProcessObject &&
lProcess->GrantedAccess != ) {
if (ObReferenceObjectSafe(lProcess)) {
*Process = lProcess;
Status = STATUS_SUCCESS;
}
} ExUnlockHandleTableEntry(PspCidTable, CidEntry);
} KeLeaveCriticalRegionThread (&CurrentThread->Tcb);
return Status;
}

通过ZwQuerySystemInformation获取EPROCESS的代码块:

        status = ZwQuerySystemInformation(SystemProcessesAndThreadsInformation,NULL,,&BufferSize);
if (!BufferSize)
{
KdPrint(("ZwQuerySystemInformation error!\n"));
return status;
}
Buffer = ExAllocatePoolWithTag(NonPagedPool,BufferSize,'myta');
if (!Buffer)
{
KdPrint(("ExAllocatePoolWithTag error!\n"));
return STATUS_UNSUCCESSFUL;
}
status = ZwQuerySystemInformation(SystemProcessesAndThreadsInformation,Buffer,BufferSize,);
if (!NT_SUCCESS(status))
{
KdPrint(("ZwQuerySystemInformation error!\n"));
ExFreePool(Buffer);
return status;
} pProcessInfo = (PSYSTEM_PROCESS_INFORMATION)Buffer; status = PsLookupProcessByProcessId(pProcessInfo->ProcessId,&eProcess);
if (!NT_SUCCESS(status))
{
KdPrint(("PsLookupProcessByProcessId error! %x\n",status));
ExFreePool(Buffer);
return status;
}

上述代码不出意外的话能够得到EPROCESS结构。

上一篇:洛谷P2762 太空飞行计划问题(最大权闭合图)


下一篇:洛谷P2762 太空飞行计划问题(最小割)