能力值:
( LV2,RANK:10 )
2 楼
挂上wingdb看看哪出错了
能力值:
( LV2,RANK:10 )
3 楼
1. Windows 不同版本的 EPROCESS 中的 ActiveProcessList 的偏移不一样。具体自己用 Windbg
dt nt!_EPROCESS
2. 调试程序都不会、错误代码都不会定位....。
能力值:
( LV9,RANK:380 )
4 楼
NTSTATUS LookupProcessByName(
IN PCHAR pcProcessName,
OUT PEPROCESS *pEprocess
)
{
NTSTATUS status;
ULONG uCount = 0;
ULONG uLength = 0;
PLIST_ENTRY pListActiveProcess;
PEPROCESS pCurrentEprocess = NULL;
ULONG ulNextProcess = 0;
ULONG g_Offset_Eprocess_Flink;
WIN_VER_DETAIL WinVer;
char lpszProName[100];
char *lpszAttackProName = NULL; if (!ARGUMENT_PRESENT(pcProcessName) || !ARGUMENT_PRESENT(pEprocess))
{
return STATUS_INVALID_PARAMETER;
}
if (KeGetCurrentIrql() > PASSIVE_LEVEL)
{
return STATUS_UNSUCCESSFUL;
}
uLength = strlen(pcProcessName);
WinVer = GetWindowsVersion();
switch(WinVer)
{
case WINDOWS_VERSION_XP:
g_Offset_Eprocess_Flink = 0x88;
break;
case WINDOWS_VERSION_7_7600_UP:
case WINDOWS_VERSION_7_7000:
g_Offset_Eprocess_Flink = 0xb8;
break;
case WINDOWS_VERSION_VISTA_2008:
g_Offset_Eprocess_Flink = 0x0a0;
break;
case WINDOWS_VERSION_2K3_SP1_SP2:
g_Offset_Eprocess_Flink = 0x98;
break;
case WINDOWS_VERSION_2K3:
g_Offset_Eprocess_Flink = 0x088;
break;
}
if (!g_Offset_Eprocess_Flink){
return STATUS_UNSUCCESSFUL;
}
pCurrentEprocess = PsGetCurrentProcess();
ulNextProcess =(ULONG) pCurrentEprocess; __try
{
memset(lpszProName,0,sizeof(lpszProName));
if (uLength > 15)
{
strncat(lpszProName,pcProcessName,15);
}
while(1)
{
lpszAttackProName = NULL;
lpszAttackProName = (char *)PsGetProcessImageFileName(pCurrentEprocess);
if (uLength > 15)
{
if (lpszAttackProName &&
strlen(lpszAttackProName) == uLength)
{
if(_strnicmp(lpszProName,lpszAttackProName, uLength) == 0)
{
*pEprocess = pCurrentEprocess;
status = STATUS_SUCCESS;
break;
}
}
}
else
{
if (lpszAttackProName &&
strlen(lpszAttackProName) == uLength)
{
if(_strnicmp(pcProcessName,lpszAttackProName, uLength) == 0)
{
*pEprocess = pCurrentEprocess;
status = STATUS_SUCCESS;
break;
}
}
}
if ((uCount >= 1) && (ulNextProcess ==(ULONG) pCurrentEprocess))
{
*pEprocess = 0x00000000;
status = STATUS_NOT_FOUND;
break;
}
pListActiveProcess = (LIST_ENTRY *)((ULONG)pCurrentEprocess + g_Offset_Eprocess_Flink);
(ULONG)pCurrentEprocess = (ULONG)pListActiveProcess->Flink;
(ULONG)pCurrentEprocess = (ULONG)pCurrentEprocess - g_Offset_Eprocess_Flink;
uCount++;
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
KdPrint(("LookupProcessByName:%08x\r\n",GetExceptionCode()));
status = STATUS_NOT_FOUND;
}
return status;
} 自己提取。。。
能力值:
( LV2,RANK:10 )
5 楼
感谢回复,我刚学所以不会调试。。。 我是在host win8下直接用VS2012+虚拟机win8调试的,但是调试会报一个"Driver Testing - An error occured deploying the driver(s) in the solution. The system cannot find the file specified ".的错误。
能力值:
( LV2,RANK:10 )
6 楼
OK,我试试
能力值:
( LV2,RANK:10 )
7 楼
VS能调内核驱动?看来我out了
能力值:
( LV2,RANK:10 )
8 楼
你好,请问怎么获得以下偏移值的方法呢?讲解的详细点哈!
这些是XP SP3的,我想获得2003的偏移,怎么弄呢?
#define EPROCESS_SIZE 0x260
#define PEB_OFFSET 0x1B0
#define FILE_NAME_OFFSET 0x174
#define PROCESS_LINK_OFFSET 0x088
#define PROCESS_ID_OFFSET 0x084
#define EXIT_TIME_OFFSET 0x078
#define OBJECT_HEADER_SIZE 0x018
#define OBJECT_TYPE_OFFSET 0x008