-
-
[旧帖]
[原创]发一个超精简版枚举进程代码。
0.00雪花
-
2012-5-28 13:52
2197
-
[旧帖] [原创]发一个超精简版枚举进程代码。
0.00雪花
通过进程句柄表枚举进程。WinXP SP3测试通过。
#define HANDLE_TBL_OFF 0x0C4
#define IMAGE_NAME_OFF 0x174
#define HTBL_FLINK_OFF 0x01C
#define PID_OFF 0x084
#define HTBL_EPROC_OFF 0x004
VOID ListProcess()
{
ULONG currEPROC;
ULONG currHandleTbl;
currEPROC = (ULONG)PsGetCurrentProcess();
currHandleTbl = *(PULONG)(currEPROC + HANDLE_TBL_OFF);
while ( TRUE ){
//打印进程
DbgPrint( "PID:%4d ImageName:%s\r\n", *(PULONG)(currEPROC+PID_OFF), (PVOID)(currEPROC+IMAGE_NAME_OFF) );
//下一个进程
currHandleTbl = *(PULONG)(currHandleTbl + HTBL_FLINK_OFF) - HTBL_FLINK_OFF;
currEPROC = *(PULONG)(currHandleTbl + HTBL_EPROC_OFF);
//回到起始处则结束
if ( !currEPROC )
break;
}
}
[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法