//枚举进程DLL获得加载地址
void GetProcessModule(HANDLE hProcessID, unsigned short* uni_ModuleName, void* Buffer)
{
UNICODE_STRING uniModuleName = { NULL };
RtlInitUnicodeString(&uniModuleName, uni_ModuleName);
PUNICODE_STRING uni_alloc = ExAllocatePoolWithTag(PagedPool, uniModuleName.Length, 'pinu');
*uni_alloc = uniModuleName;
NTSTATUS nStatus;
//PEB结构指针
PPEB pPEB = NULL;
//EPROCESS结构指针
PEPROCESS pEProcess = NULL;
//查找的函数名称
UNICODE_STRING uniFunctionName;
//进程参数信息
PRTL_USER_PROCESS_PARAMETERS pParam = NULL;
//LDR数据结构
PPEB_LDR_DATA pPebLdrData = NULL;
//LDR链表入口
PLDR_DATA_TABLE_ENTRY pLdrDataEntry = NULL;
//链表头节点、尾节点
PLIST_ENTRY pListEntryStart = NULL;
PLIST_ENTRY pListEntryEnd = NULL;
//函数指针
PFNPsGetProcessPeb PsGetProcessPeb = NULL;
//保存APC状态
KAPC_STATE KAPC = { 0 };
//是否已经附加到进程
BOOLEAN bIsAttached = FALSE;
//获取进程的EPROCESS结构指针
nStatus = PsLookupProcessByProcessId((HANDLE)hProcessID, &pEProcess);
if (!NT_SUCCESS(nStatus))
{
return;
}
//查找函数地址
RtlInitUnicodeString(&uniFunctionName, L"PsGetProcessPeb");
PsGetProcessPeb = (PFNPsGetProcessPeb)MmGetSystemRoutineAddress(&uniFunctionName);
if (PsGetProcessPeb == NULL)
{
KdPrint(("Get PsGetProcessPeb Failed~!\n"));
return;
}
//获取PEB指针
pPEB = PsGetProcessPeb(pEProcess);
if (pPEB == NULL)
{
KdPrint(("Get pPEB Failed~!\n"));
return;
}
//附加到进程
KeStackAttachProcess(pEProcess, &KAPC);
bIsAttached = TRUE;
//指向LDR
pPebLdrData = pPEB->Ldr;
//头节点、尾节点
pListEntryStart = pListEntryEnd = pPebLdrData->InMemoryOrderModuleList.Flink;
//开始遍历_LDR_DATA_TABLE_ENTRY
do
{
//通过_LIST_ENTRY的Flink成员获取_LDR_DATA_TABLE_ENTRY结构
pLdrDataEntry = (PLDR_DATA_TABLE_ENTRY)CONTAINING_RECORD(pListEntryStart, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
pListEntryStart = pListEntryStart->Flink;
} while (!RtlEqualUnicodeString(uni_alloc, &pLdrDataEntry->BaseDllName, TRUE));
//数据传递
memcpy(Buffer, &pLdrDataEntry->DllBase, sizeof(pLdrDataEntry->DllBase));
//Detach进程
if (bIsAttached != FALSE)
{
KeUnstackDetachProcess(&KAPC);
}
//减少引用计数
if (pEProcess != NULL)
{
ObDereferenceObject(pEProcess);
pEProcess = NULL;
}
return;
}
问题就出在KeStackAttackProcess之前uni_alloc是正常的传进来的DLL名，在Attach之后，就会变动，应该是指针访问的问题,不知道怎么解决，望大佬解决
