Board logo

标题: 查找加载某个windows标准动态库的进程 [打印本页]
作者: x86    时间: 2006-3-21 01:14     标题: 查找加载某个windows标准动态库的进程

[这个贴子最后由x86在 2006/03/22 00:26am 第 4 次编辑] 一段查找加载某个windows标准动态库的进程id的代码,没有显示进程名字,只有id winxp+vc6.0编译通过 以后还会增加一些功能..
  1. &#35;include <stdio.h>
  2. &#35;include <windows.h>
  3. &#35;include <Psapi.h>
  5. &#35;pragma comment(lib, "psapi.lib")
  6. &#35;pragma comment(lib, "ws2_32.lib")
  9. &#35;define PROCESSNUM 128
  11. //////////////////////////////////////////////////////////////////
  12. //进程权限提升函数
  13. //////////////////////////////////////////////////////////////////
  14. BOOL AdjustProcessPrivileges ( LPCSTR szPrivilegesName)
  15. {
  16. HANDLE hToken;
  17. TOKEN_PRIVILEGES tkp;
  19. if(!OpenProcessToken(GetCurrentProcess(),
  20. TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))
  21. {
  22. return FALSE;
  23. }
  25. if(!LookupPrivilegeV&#97;lue(NULL,szPrivilegesName,
  26. &tkp.Privileges[0].Luid))
  27. {
  28. CloseHandle(hToken);
  29. return FALSE;
  30. }
  31. tkp.PrivilegeCount = 1;
  32. tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
  34. if(!AdjustTokenPrivileges(hToken,FALSE,&tkp,sizeof(tkp),NULL,NULL))
  35. {
  36. CloseHandle(hToken);
  37. return 0;
  38. }
  40. CloseHandle(hToken);
  41. return TRUE;
  42. }
  44. //////////////////////////////////////////////////////////////////
  45. //查找系统中加载某一特定模块的进程，并返回其进程id到一数组
  46. //////////////////////////////////////////////////////////////////
  47. BOOL FindProcessByModuleName(DWORD * lpidProcesses,DWORD numOfProcess,LPCSTR FindModuleName,
  48. DWORD * lpoutProcessBuffer, DWORD cb, DWORD * dwNeed)
  49. {
  50. *dwNeed = 0;
  51. CHAR MapFileName[MAX_PATH] = "unknown";
  52. CHAR ModuleName[MAX_PATH];
  53. memset(ModuleName, 0, sizeof(ModuleName));
  54. DWORD FileNameLength = 0;
  55. DWORD ModuleNameLength = 0;
  57. DWORD ModuleAddr = (DWORD)LoadLibrary(FindModuleName);
  59. if((HMODULE)ModuleName == NULL)
  60. {
  61. return FALSE;
  62. }
  63. HANDLE pHd;
  64. DWORD ProcessBufferId = 0;
  66. for (DWORD i = 1; i < numOfProcess; i++)
  67. {
  68. pHd = OpenProcess( PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
  69. FALSE, lpidProcesses[i] );
  70. if (pHd == NULL)
  71. {
  72. continue;
  73. }
  75. FileNameLength = GetMappedFileName( pHd, (LPVOID)ModuleAddr,MapFileName, sizeof(MapFileName) );
  77. if(FileNameLength == 0)
  78. {
  79. CloseHandle(pHd);
  80. continue;
  81. }
  82. for(DWORD j = (FileNameLength - 1); MapFileName[j] != ';\\';; j--)
  83. {
  84. ModuleName[FileNameLength - j - 1] = MapFileName[j];
  85. }
  86. char temp;
  87. DWORD Starti = 0;
  88. DWORD Endi = strlen(ModuleName) - 1;
  90. while( Starti != Endi && Starti < Endi )
  91. {
  92. temp = ModuleName[Starti];
  93. ModuleName[Starti] = ModuleName[Endi];
  94. ModuleName[Endi] = temp;
  95. Starti++;
  96. Endi--;
  97. }
  98. if(0 != strcmp(ModuleName,FindModuleName))
  99. {
  100. CloseHandle(pHd);
  101. continue;
  102. }
  103. CloseHandle(pHd);
  104. if(*dwNeed >= (cb / sizeof(DWORD)))
  105. return FALSE;
  106. lpoutProcessBuffer[ProcessBufferId] = lpidProcesses[i];
  107. printf("Find %d:%s\n", lpoutProcessBuffer[ProcessBufferId], ModuleName);
  108. ProcessBufferId++;
  109. (*dwNeed)++;
  110. }
  111. return TRUE;
  112. }
  114. //////////////////////////////////////////////////////////////////
  115. //在一组进程空间中保留和提交一段指定大小和保护属性的内存空间
  116. //////////////////////////////////////////////////////////////////
  117. BOOL ReserveAndCommitForProcesses(DWORD * lpidProcesses, DWORD numOfProcess, DWORD dwThreadSize,
  118. DWORD * lpCommitAddrs, DWORD cb, DWORD * dwNeeded,
  119. DWORD * lpCresPondPids,DWORD cbOfCres)
  120. {
  121. (*dwNeeded) = 0;
  122. HANDLE hTargetProcess;
  123. DWORD dwTargetAddr = 0;
  124. for (DWORD i = 0; i < numOfProcess; i++)
  125. {
  126. hTargetProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, lpidProcesses[i] );
  127. if (hTargetProcess == NULL)
  128. {
  129. continue;
  130. }
  131. if(*dwNeeded >= (cb/sizeof(DWORD)) || *dwNeeded >= (cbOfCres/sizeof(DWORD)))
  132. {
  133. CloseHandle(hTargetProcess);
  134. return FALSE;
  135. }
  136. dwTargetAddr = (DWORD)VirtualAllocEx(hTargetProcess, NULL, dwThreadSize,
  137. MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  138. if((LPVOID)dwTargetAddr == NULL)
  139. {
  140. CloseHandle(hTargetProcess);
  141. continue;
  142. }
  143. CloseHandle(hTargetProcess);
  144. lpCommitAddrs[*dwNeeded] = dwTargetAddr;
  145. lpCresPondPids[*dwNeeded] = lpidProcesses[i];
  146. (*dwNeeded)++;
  147. }
  148. return TRUE;
  149. }
  151. int main(int argc, char *argv[])
  152. {
  153. DWORD ProcessIds[PROCESSNUM];
  154. DWORD AccordProcessIds[PROCESSNUM];
  155. DWORD CommitAddres[PROCESSNUM];
  156. DWORD MatchAddrPids[PROCESSNUM];
  157. DWORD cPids = 0;
  158. DWORD cAccordPids = 0;
  159. DWORD cCommitAddr = 0;
  161. if(!AdjustProcessPrivileges(SE_DEBUG_NAME))
  162. {
  163. printf("AdjustProcessPrivileges Error!\n");
  164. return 1;
  165. }
  167. if (!EnumProcesses( ProcessIds, sizeof(ProcessIds), &cPids))
  168. {
  169. printf("EnumProcess Error!\n");
  170. return 1;
  171. }
  174. if(!FindProcessByModuleName(ProcessIds, cPids/sizeof(DWORD), "ws2_32.dll", AccordProcessIds, sizeof(AccordProcessIds), &cAccordPids))
  175. {
  176. printf("FindProcessByModuleName Error!\n");
  177. return 1;
  178. }
  180. printf("%d Processes Load The ws2_32.dll\n",cAccordPids);
  182. if(!ReserveAndCommitForProcesses(AccordProcessIds, cAccordPids, 4096,
  183. CommitAddres, sizeof(CommitAddres), &cCommitAddr,
  184. MatchAddrPids, sizeof(MatchAddrPids)))
  185. {
  186. printf("ReserveAndCommitForProcesses Error!\n");
  187. return 1;
  188. }
  190. for (DWORD i = 0; i < cCommitAddr; i++)
  191. {
  192. printf("PID:%d,Commit Addr:0x%x\n", MatchAddrPids[i], CommitAddres[i]);
  193. }
  194. printf("Commit %d addresses!\n", cCommitAddr);
  195. return 0;
  196. }
复制代码
作者: x86    时间: 2006-3-22 23:15     标题: 查找加载某个windows标准动态库的进程

  1. &#35;include <stdio.h>
  2. &#35;include <windows.h>
  3. &#35;include <Psapi.h>
  5. &#35;pragma comment(lib, "psapi.lib")
  6. &#35;pragma comment(lib, "ws2_32.lib")
  9. &#35;define PROCESSNUM 128
  11. //线程参数结构体定义
  12. typedef struct _RemoteParam {
  13. char szMsg[12]; //MessageBox函数中显示的字符提示
  14. DWORD dwMessageBox;//MessageBox函数的入口地址
  15. char szModulename[12]; //加载的动态库名
  16. DWORD dwLoadLibrary;
  17. HMODULE ModuleAddr;
  18. DWORD dwFreeLibrary;
  19. } RemoteParam, * PRemoteParam;
  20. //定义MessageBox类型的函数指针
  21. typedef int (__stdcall * PFN_MESSAGEBOX)(HWND, LPCTSTR, LPCTSTR, DWORD);
  22. typedef int (__stdcall * PFN_LOADLIBRARY)(LPCTSTR);
  23. typedef int (__stdcall * PFN_FREELIBRARY)(HMODULE);
  24. //线程函数定义
  25. DWORD __stdcall threadProc(LPVOID lParam)
  26. {
  27. RemoteParam* pRP = (RemoteParam*)lParam;
  28. PFN_MESSAGEBOX pfnMessageBox;
  29. PFN_LOADLIBRARY pfnLoadLibrary;
  30. PFN_FREELIBRARY pfnFreeLibrary;
  31. pfnMessageBox = (PFN_MESSAGEBOX)pRP->dwMessageBox;
  32. pfnLoadLibrary = (PFN_LOADLIBRARY)pRP->dwLoadLibrary;
  33. pfnFreeLibrary = (PFN_FREELIBRARY)pRP->dwFreeLibrary;
  34. pfnLoadLibrary(pRP->szModulename);
  35. pfnMessageBox(NULL, pRP->szMsg, pRP->szMsg, 0);
  36. pfnFreeLibrary(pRP->ModuleAddr);
  37. return 0;
  38. }
  40. //////////////////////////////////////////////////////////////////
  41. //进程权限提升函数
  42. //////////////////////////////////////////////////////////////////
  43. BOOL AdjustProcessPrivileges ( LPCSTR szPrivilegesName)
  44. {
  45. HANDLE hToken;
  46. TOKEN_PRIVILEGES tkp;
  48. if(!OpenProcessToken(GetCurrentProcess(),
  49. TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))
  50. {
  51. return FALSE;
  52. }
  54. if(!LookupPrivilegeValue(NULL,szPrivilegesName,
  55. &tkp.Privileges[0].Luid))
  56. {
  57. CloseHandle(hToken);
  58. return FALSE;
  59. }
  60. tkp.PrivilegeCount = 1;
  61. tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
  63. if(!AdjustTokenPrivileges(hToken,FALSE,&tkp,sizeof(tkp),NULL,NULL))
  64. {
  65. CloseHandle(hToken);
  66. return 0;
  67. }
  69. CloseHandle(hToken);
  70. return TRUE;
  71. }
  73. //////////////////////////////////////////////////////////////////
  74. //查找系统中加载某一特定模块的进程，并返回其进程id到一数组
  75. //////////////////////////////////////////////////////////////////
  76. BOOL FindProcessByModuleName(DWORD * lpidProcesses,DWORD numOfProcess,LPCSTR FindModuleName,
  77. DWORD * lpoutProcessBuffer, DWORD cb, DWORD * dwNeed)
  78. {
  79. *dwNeed = 0;
  80. CHAR MapFileName[MAX_PATH] = "unknown";
  81. CHAR ModuleName[MAX_PATH];
  82. memset(ModuleName, 0, sizeof(ModuleName));
  83. DWORD FileNameLength = 0;
  84. DWORD ModuleNameLength = 0;
  86. DWORD ModuleAddr = (DWORD)LoadLibrary(FindModuleName);
  88. if((HMODULE)ModuleName == NULL)
  89. {
  90. return FALSE;
  91. }
  92. HANDLE pHd;
  93. DWORD ProcessBufferId = 0;
  95. for (DWORD i = 1; i < numOfProcess; i++)
  96. {
  97. pHd = OpenProcess( PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
  98. FALSE, lpidProcesses[i] );
  99. if (pHd == NULL)
  100. {
  101. continue;
  102. }
  104. FileNameLength = GetMappedFileName( pHd, (LPVOID)ModuleAddr,MapFileName, sizeof(MapFileName) );
  106. if(FileNameLength == 0)
  107. {
  108. CloseHandle(pHd);
  109. continue;
  110. }
  111. for(DWORD j = (FileNameLength - 1); MapFileName[j] != ';\\';; j--)
  112. {
  113. ModuleName[FileNameLength - j - 1] = MapFileName[j];
  114. }
  115. char temp;
  116. DWORD Starti = 0;
  117. DWORD Endi = strlen(ModuleName) - 1;
  119. while( Starti != Endi && Starti < Endi )
  120. {
  121. temp = ModuleName[Starti];
  122. ModuleName[Starti] = ModuleName[Endi];
  123. ModuleName[Endi] = temp;
  124. Starti++;
  125. Endi--;
  126. }
  127. if(0 != strcmp(ModuleName,FindModuleName))
  128. {
  129. CloseHandle(pHd);
  130. continue;
  131. }
  132. CloseHandle(pHd);
  133. if(*dwNeed >= (cb / sizeof(DWORD)))
  134. return FALSE;
  135. lpoutProcessBuffer[ProcessBufferId] = lpidProcesses[i];
  136. ProcessBufferId++;
  137. (*dwNeed)++;
  138. }
  139. return TRUE;
  140. }
  142. //////////////////////////////////////////////////////////////////
  143. //在一组进程空间中保留和提交一段指定大小和保护属性的内存空间
  144. //////////////////////////////////////////////////////////////////
  145. BOOL ReserveAndCommitForProcesses(DWORD * lpidProcesses, DWORD numOfProcess, DWORD dwThreadSize,
  146. DWORD * lpCommitAddrs, DWORD cb, DWORD * dwNeeded,
  147. DWORD * lpCresPondPids,DWORD cbOfCres)
  148. {
  149. (*dwNeeded) = 0;
  150. HANDLE hTargetProcess;
  151. DWORD dwTargetAddr = 0;
  152. for (DWORD i = 0; i < numOfProcess; i++)
  153. {
  154. hTargetProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, lpidProcesses[i] );
  155. if (hTargetProcess == NULL)
  156. {
  157. continue;
  158. }
  159. if(*dwNeeded >= (cb/sizeof(DWORD)) || *dwNeeded >= (cbOfCres/sizeof(DWORD)))
  160. {
  161. CloseHandle(hTargetProcess);
  162. return FALSE;
  163. }
  164. dwTargetAddr = (DWORD)VirtualAllocEx(hTargetProcess, NULL, dwThreadSize,
  165. MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  166. if((LPVOID)dwTargetAddr == NULL)
  167. {
  168. CloseHandle(hTargetProcess);
  169. continue;
  170. }
  171. CloseHandle(hTargetProcess);
  172. lpCommitAddrs[*dwNeeded] = dwTargetAddr;
  173. lpCresPondPids[*dwNeeded] = lpidProcesses[i];
  174. (*dwNeeded)++;
  175. }
  176. return TRUE;
  177. }
  179. //////////////////////////////////////////////////////////////////////////
  180. //在一组进程空间中已经申请的内存地址上写入本程序空间中指定地址和大小的数据
  181. //////////////////////////////////////////////////////////////////////////
  182. BOOL WriteRemoteProcessesMemory(DWORD * lpidProcesses, DWORD * lpRemoteAddresses,DWORD numOfProcess,
  183. DWORD LocalBuffer, DWORD cb, DWORD * cWrittenProcesses)
  184. {
  185. HANDLE hTargetProcess;
  186. *cWrittenProcesses = 0;
  187. for (DWORD i = 0; i < numOfProcess; i++)
  188. {
  189. hTargetProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, lpidProcesses[i] );
  190. if (hTargetProcess == NULL)
  191. {
  192. continue;
  193. }
  194. if (!WriteProcessMemory(hTargetProcess , (LPVOID)lpRemoteAddresses[i], (LPVOID)LocalBuffer, cb, NULL))
  195. {
  196. CloseHandle(hTargetProcess);
  197. continue;
  198. }
  199. (*cWrittenProcesses)++;
  200. CloseHandle(hTargetProcess);
  201. }
  202. return TRUE;
  203. }
  205. int main(int argc, char *argv[])
  206. {
  207. DWORD ProcessIds[PROCESSNUM];
  208. DWORD AccordProcessIds[PROCESSNUM];
  209. DWORD CommitThreadAddres[PROCESSNUM];
  210. DWORD CommitPramaAddres[PROCESSNUM];
  211. DWORD MatchAddrPids[PROCESSNUM];
  212. DWORD cPids = 0;
  213. DWORD cAccordPids = 0;
  214. DWORD cCommitAddr = 0;
  215. DWORD cWrittenProcesses = 0;
  216. DWORD RemoteThreadId = 0;
  217. if(!AdjustProcessPrivileges(SE_DEBUG_NAME))
  218. {
  219. printf("AdjustProcessPrivileges Error!\n");
  220. return 1;
  221. }
  223. if (!EnumProcesses( ProcessIds, sizeof(ProcessIds), &cPids))
  224. {
  225. printf("EnumProcess Error!\n");
  226. return 1;
  227. }
  230. if(!FindProcessByModuleName(ProcessIds, cPids/sizeof(DWORD), "ws2_32.dll", AccordProcessIds, sizeof(AccordProcessIds), &cAccordPids))
  231. {
  232. printf("FindProcessByModuleName Error!\n");
  233. return 1;
  234. }
  236. printf("%d Processes Load The ws2_32.dll\n\n",cAccordPids);
  238. if(!ReserveAndCommitForProcesses(AccordProcessIds, cAccordPids, 4096,
  239. CommitThreadAddres, sizeof(CommitThreadAddres), &cCommitAddr,
  240. MatchAddrPids, sizeof(MatchAddrPids)))
  241. {
  242. printf("ReserveAndCommitForProcesses Error!\n");
  243. return 1;
  244. }
  246. for (DWORD i = 0; i < cCommitAddr; i++)
  247. {
  248. printf("PID:%.4d,Commit Addr:0x%.8x\n", MatchAddrPids[i], CommitThreadAddres[i]);
  249. }
  251. printf("Commit %d addresses for thread!\n\n", cCommitAddr);
  252. if(!WriteRemoteProcessesMemory(MatchAddrPids, CommitThreadAddres, cCommitAddr,
  253. (DWORD)&threadProc, 4096, &cWrittenProcesses))
  254. {
  255. printf("WriteRemoteProcessesMemory Error!\n");
  256. return 1;
  257. }
  258. printf("Written %d Processess for thread!\n\n", cWrittenProcesses);
  259. //定义线程参数结构体变量
  260. RemoteParam remoteData;
  261. ZeroMemory(&remoteData, sizeof(RemoteParam));
  263. //填充结构体变量中的成员
  264. HINSTANCE hUser32 = LoadLibrary("User32.dll");
  265. remoteData.dwMessageBox = (DWORD)GetProcAddress(hUser32, "MessageBoxA");
  266. strcat(remoteData.szMsg, "Hello\0");
  268. HINSTANCE hKernel32 = LoadLibrary("Kernel32.dll");
  269. remoteData.dwLoadLibrary = (DWORD)GetProcAddress(hKernel32, "LoadLibraryA");
  270. strcat(remoteData.szModulename, "User32.dll\0");
  271. remoteData.dwFreeLibrary = (DWORD)GetProcAddress(hKernel32, "FreeLibrary");
  272. remoteData.ModuleAddr = hUser32;
  275. if(!ReserveAndCommitForProcesses(AccordProcessIds, cAccordPids, sizeof(RemoteParam),
  276. CommitPramaAddres, sizeof(CommitPramaAddres), &cCommitAddr,
  277. MatchAddrPids, sizeof(MatchAddrPids)))
  278. {
  279. printf("ReserveAndCommitForProcesses Error!\n");
  280. return 1;
  281. }
  283. for (DWORD j = 0; j < cCommitAddr; j++)
  284. {
  285. printf("PID:%.4d,Commit Addr:0x%.8x\n", MatchAddrPids[j], CommitPramaAddres[j]);
  286. }
  288. printf("Commit %d addresses for param!\n\n", cCommitAddr);
  289. if(!WriteRemoteProcessesMemory(MatchAddrPids, CommitPramaAddres, cCommitAddr,
  290. (DWORD)&remoteData, sizeof(remoteData), &cWrittenProcesses))
  291. {
  292. printf("WriteRemoteProcessesMemory Error!\n");
  293. return 1;
  294. }
  295. printf("Written %d Processess for prama!\n\n", cWrittenProcesses);
  296. HANDLE hRemoteThread;
  297. HANDLE hTargetProcess;
  298. DWORD cRunThreadInProcess = 0;
  299. for (DWORD numOfRemoteThread = 0; numOfRemoteThread < cWrittenProcesses; numOfRemoteThread++)
  300. {
  301. hTargetProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, MatchAddrPids[numOfRemoteThread] );
  302. if (hTargetProcess == NULL)
  303. {
  304. continue;
  305. }
  307. hRemoteThread = CreateRemoteThread(hTargetProcess, NULL, 0, (DWORD (__stdcall *)(void *))CommitThreadAddres[numOfRemoteThread],
  308. (LPVOID)CommitPramaAddres[numOfRemoteThread], 0, &RemoteThreadId);
  309. if(hRemoteThread == NULL)
  310. {
  311. CloseHandle(hTargetProcess);
  312. continue;
  313. }
  314. printf("PID: %.4d. TID:%.8d\n", MatchAddrPids[numOfRemoteThread], RemoteThreadId);
  315. CloseHandle(hTargetProcess);
  316. CloseHandle(hRemoteThread);
  317. cRunThreadInProcess++;
  318. }
  319. printf("Run %d Threads in Target Processes\n\n", cRunThreadInProcess);
  321. FreeLibrary(hUser32);
  322. FreeLibrary(hKernel32);
  323. return 0;
  324. }
复制代码
作者: x86    时间: 2006-3-24 01:57     标题: 查找加载某个windows标准动态库的进程

[这个贴子最后由x86在 2006/03/24 01:59pm 第 1 次编辑] 请看最新的,插入到所有加载谋个动态库的进程,并弹出对话框表明进程运行路径和名称,代码如下: 例子是插入到所有加载了ws2_32,dll的进程,也就是所有的要进行网络数据传递的进程. 提供一个可执行文件,大家可以试着使用一下 , 0, &RemoteThreadId); if(hRemoteThread == NULL) { printf("创建远程线程失败!"); CloseHandle(hTargetProcess); return 0; } CloseHandle(hTargetProcess); CloseHandle(hRemoteThread); //;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; */ FreeLibrary(hUser32); FreeLibrary(hKernel32); return 0; }
作者: yhf3201    时间: 2006-4-6 14:58     标题: 查找加载某个windows标准动态库的进程

我是菜鸟
看不懂
还是要谢谢



欢迎光临 黑色海岸线论坛 (http://bbs.thysea.com/) Powered by Discuz! 7.2