-
-
[求助]为何用NtQueryInformationProcess得不到其他进程的信息
-
发表于: 2008-10-13 10:13
-
首先我提升了权限:
HANDLE hToken;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken);
LookupPrivilegeValue( NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid );
tkp.PrivilegeCount=1;
tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
BOOL bRet=AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof tkp,NULL,NULL );
然后在已知Pid的情况下打开进程句柄:
hProcess=OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,
FALSE,
dwProcessId);
最后调用 status=NtQueryInformationProcess(hProcess,
ProcessBasicInformation,
(PVOID)&pbi,
sizeof(PROCESS_BASIC_INFORMATION),
NULL
);
结果pbi里面的PEB显式不正确,pbi其他成员均正确 !!
然而当我把hProcess改为GerCurrentProcess()的时候,能正确获取本进程的pbi和PEB.
请高手指教,谢谢!
HANDLE hToken;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken);
LookupPrivilegeValue( NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid );
tkp.PrivilegeCount=1;
tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
BOOL bRet=AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof tkp,NULL,NULL );
然后在已知Pid的情况下打开进程句柄:
hProcess=OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,
FALSE,
dwProcessId);
最后调用 status=NtQueryInformationProcess(hProcess,
ProcessBasicInformation,
(PVOID)&pbi,
sizeof(PROCESS_BASIC_INFORMATION),
NULL
);
结果pbi里面的PEB显式不正确,pbi其他成员均正确 !!
然而当我把hProcess改为GerCurrentProcess()的时候,能正确获取本进程的pbi和PEB.
请高手指教,谢谢!
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
