// Peb
//
typedef struct _CURDIR
{
UNICODE_STRING DosPath;
HANDLE Handle;
} CURDIR, *PCURDIR;
typedef struct _RTL_USER_PROCESS_PARAMETERS {
UINT32 MaximumLength;
UINT32 Length;
UINT32 Flags;
UINT32 DebugFlags;
HANDLE ConsoleHandle;
UINT32 ConsoleFlags;
HANDLE StandardInput;
HANDLE StandardOutput;
HANDLE StandardError;
CURDIR CurrentDirectory; // ProcessParameters
UNICODE_STRING DllPath; // ProcessParameters
UNICODE_STRING ImagePathName; // ProcessParameters
UNICODE_STRING CommandLine; // ProcessParameters
PVOID Environment;
UINT32 StartingX;
UINT32 StartingY;
UINT32 CountX;
UINT32 CountY;
UINT32 CountCharsX;
UINT32 CountCharsY;
UINT32 FillAttribute;
UINT32 WindowFlags;
UINT32 ShowWindowFlags;
UNICODE_STRING WindowTitle;
UNICODE_STRING DesktopInfo;
UNICODE_STRING ShellInfo;
UNICODE_STRING RuntimeData;
UINT32 CurrentDirectores[8];
#ifdef _WIN64
UINT64 EnvironmentSize;
UINT64 EnvironmentVersion;
#endif // _WIN64
}RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
typedef struct _PEB_LDR_DATA32
{
UINT32 Length;
UINT8 Initialized;
UINT32 SsHandle;
LIST_ENTRY32 InLoadOrderModuleList;
LIST_ENTRY32 InMemoryOrderModuleList;
LIST_ENTRY32 InInitializationOrderModuleList;
} PEB_LDR_DATA32, *PPEB_LDR_DATA32;
typedef struct _LDR_DATA_TABLE_ENTRY32
{
LIST_ENTRY32 InLoadOrderLinks;
LIST_ENTRY32 InMemoryOrderLinks;
LIST_ENTRY32 InInitializationOrderLinks;
UINT32 DllBase;
UINT32 EntryPoint;
UINT32 SizeOfImage;
UNICODE_STRING32 FullDllName;
UNICODE_STRING32 BaseDllName;
UINT32 Flags;
UINT16 LoadCount;
UINT16 TlsIndex;
LIST_ENTRY32 HashLinks;
UINT32 TimeDateStamp;
} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32;
typedef struct _PEB32
{
UINT8 InheritedAddressSpace;
UINT8 ReadImageFileExecOptions;
UINT8 BeingDebugged;
UINT8 BitField;
UINT32 Mutant;
UINT32 ImageBaseAddress;
UINT32 Ldr;
UINT32 ProcessParameters;
UINT32 SubSystemData;
UINT32 ProcessHeap;
UINT32 FastPebLock;
UINT32 AtlThunkSListPtr;
UINT32 IFEOKey;
UINT32 CrossProcessFlags;
UINT32 UserSharedInfoPtr;
UINT32 SystemReserved;
UINT32 AtlThunkSListPtr32;
UINT32 ApiSetMap;
} PEB32, *PPEB32;
typedef struct _WOW64_PROCESS {
PVOID Wow64;
} WOW64_PROCESS, *PWOW64_PROCESS;
PWOW64_PROCESS Wow64Process = NULL;
PPEB32 Peb = NULL;
PRTL_USER_PROCESS_PARAMETERS ProcessParam = NULL;
// PPEB_LDR_DATA32 Ldr = NULL;
//PLDR_DATA_TABLE_ENTRY32 LdrDataTableEntry = NULL;
// PLDR_DATA_TABLE_ENTRY32 FoundDataTableEntry = NULL;
Wow64Process = PsGetCurrentProcessWow64Process();
if (NULL != Wow64Process)
{
DbgPrint("it is 32bit\n");
Peb = (PPEB32)&Wow64Process->Wow64;
if (NULL != Peb)
{
DbgPrint("Peb is not NULL\n");
ProcessParam = ULongToPtr(Peb->ProcessParameters);
if (NULL != ProcessParam)
{
DbgPrint("ProcessParam is not NULL\n");
DbgPrint("command:%ws\n", ProcessParam->CommandLine.Buffer);
}
// PUNICODE_STRING commandline = (PUNICODE_STRING)((UINT32)param+40);
// DbgPrint("command:%ws\n", commandline->Buffer);
}
这是我的代码，我是通过回调的方式，检测32进程启动，然后抓获进程，但是打印时从未显示正确过，跪求大神指点！
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
hzqst
