我想学别人做一个查看其他进程打开了那些文件handle的软件,好用来查看流氓软件....
我上传附件里面就是一个这样的软件(无毒,大家放心下载).
我的代码如下,可以得到所有进程的所有句柄,但是就是用GetFileSize就是得不到文件的Size....
都不知道为什么.......
有人可以指点一下我么?
代码如下:
#include <iostream>
#include <windows.h>
#include <AccCtrl.h>
#include <AclAPI.h>
#pragma comment(lib,"ntdll")
#define MAX_HANDLE_LIST_BUF 0x200000
#define OBJ_FILE 0x1c//猜测是这个..
#define OBJ_SOCKET 0x1a//据说这个时socket,但是又好像不是..
typedef long NTSTATUS;
extern "C" __declspec(dllimport) NTSTATUS __stdcall
NtQuerySystemInformation(IN DWORD SystemInformationClass, OUT PVOID SystemInformation,\
IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL );
typedef struct _HandleInfo
{
USHORT dwPid;
USHORT CreatorBackTraceIndex;
BYTE ObjectType;
BYTE HandleAttributes;
USHORT HndlOffset;
DWORD dwKeObject;
ULONG GrantedAccess;
}HANDLEINFO, *PHANDLEINFO;
void AdjustDacl( HANDLE hProcess )
{
SID world = { SID_REVISION, 1, SECURITY_WORLD_SID_AUTHORITY, 0 };
LPTSTR ptstrName = (LPTSTR)&world;
EXPLICIT_ACCESS ea =
{
STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL,
SET_ACCESS,
NO_INHERITANCE,
{
0, NO_MULTIPLE_TRUSTEE,
TRUSTEE_IS_SID,
TRUSTEE_IS_USER,ptstrName
}
};
ACL * pdacl = 0;
if ( SetEntriesInAcl(1, &ea, 0, &pdacl) != ERROR_SUCCESS )
printf( "SetEntriesInAcl Error:%d", GetLastError() );
if ( SetSecurityInfo(hProcess, SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,0 , 0, pdacl, 0 ) != ERROR_SUCCESS )
printf( "SetSecurityInfo Error:%d", GetLastError() );
LocalFree(pdacl);
}//end of AdjustDacl
void main()
{
using namespace std;
HANDLE hNew,hOld=GetCurrentProcess();
OpenProcessToken(hOld,TOKEN_QUERY|TOKEN_ADJUST_PRIVILEGES,&hNew);
TOKEN_PRIVILEGES tkp;//指派特权.
LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid);
tkp.PrivilegeCount=1;
tkp.Privileges[0].Attributes|=SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hNew,FALSE,&tkp,0,0,0);
CloseHandle(hNew);
PDWORD pdwHandleList = (PDWORD)malloc( MAX_HANDLE_LIST_BUF );
DWORD dwNumBytesRet = 0;
NtQuerySystemInformation(16,pdwHandleList,MAX_HANDLE_LIST_BUF,&dwNumBytesRet);//查询
DWORD dwNumEntries=*pdwHandleList;//总共的句柄个数.
cout<<"整个系统拥有的句柄个数:"<<dwNumEntries<<endl;
PHANDLEINFO pHandleInfo;
pHandleInfo=(PHANDLEINFO)(pdwHandleList+1);
//int Count=0;
DWORD Size=0;
for (DWORD j=0;j!=dwNumEntries;++j)
{
//if (pHandleInfo->ObjectType==0x03)
//{
HANDLE hProc=OpenProcess(WRITE_DAC,true,/*pHandleInfo->dwPid*/GetCurrentProcessId());
AdjustDacl(hProc);
CloseHandle(hProc);
hProc=OpenProcess(WRITE_DAC,true,pHandleInfo->dwPid);
AdjustDacl(hProc);
CloseHandle(hProc);
hProc=OpenProcess(PROCESS_DUP_HANDLE,true,pHandleInfo->dwPid);
HANDLE hClone=NULL;
DuplicateHandle(hProc,(HANDLE)pHandleInfo->HndlOffset,GetCurrentProcess(),&hClone,/*STANDARD_RIGHTS_ALL*/0,FALSE,0);
CloseHandle(hProc);
GetFileSize(hClone,&Size);
//getlasterr 老是6(句柄错误)或者1(函数错误)...要怎么做才对?
if (GetLastError()==0)
{
++Size;
}
CloseHandle(hClone);
//}
++pHandleInfo;
//++Size;
}
free(pdwHandleList);
//ZwUnloadDriver(0);
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工
作，每周日13:00-18:00直播授课
