//当我们用远程线程注入DLL到另一个进程空间中时，我们就会经常用到OpenProcess（）函数。现在假设我们的进程调用OpenProcess（）根据要打开的另一个进程Id号，它是怎么得到那一个进程句柄的。然后根据 这个句柄操作那个进程的。OpenProcess里面会调用 NtOpenProcess()系统调用,其它的很多细节没有分析，我只分析了如何得到句柄。看代码如下（都是操作系统的代码，我只是分析一下，因为技术有限）
NTSTATUS
NtOpenProcess (
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId OPTIONAL
)
{ HANDLE Handle;
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status;
PEPROCESS Process;
PETHREAD Thread;
CLIENT_ID CapturedCid;
BOOLEAN ObjectNamePresent;
BOOLEAN ClientIdPresent;
ACCESS_STATE AccessState;
AUX_ACCESS_DATA AuxData;
BOOLEAN DebugPrivilege;
PAGED_CODE();
//
// Make sure that only one of either ClientId or ObjectName is
// present.
//
PreviousMode = KeGetPreviousMode();
if (PreviousMode != KernelMode) {//如果这个调用是从OpenProcess引起的就进来，就要检查看内核函数看能不能访问用户空间的地址
//
// Since we need to look at the ObjectName field, probe
// ObjectAttributes and capture object name present indicator.
//
try {
ProbeForWriteHandle(ProcessHandle);
ProbeForRead(ObjectAttributes,
sizeof(OBJECT_ATTRIBUTES),
sizeof(ULONG));
ObjectNamePresent = (BOOLEAN)ARGUMENT_PRESENT(ObjectAttributes->ObjectName);
if (ARGUMENT_PRESENT(ClientId)) {
ProbeForRead(ClientId, sizeof(CLIENT_ID), sizeof(ULONG));
CapturedCid = *ClientId;
ClientIdPresent = TRUE;
}
else {
ClientIdPresent = FALSE;
}
}
except(EXCEPTION_EXECUTE_HANDLER) {
return GetExceptionCode();
}
}
else {
//如果直接从内核下调用的，直接访问就是了
ObjectNamePresent = (BOOLEAN)ARGUMENT_PRESENT(ObjectAttributes->ObjectName);
if (ARGUMENT_PRESENT(ClientId)) {
CapturedCid = *ClientId;
ClientIdPresent = TRUE;
}
else {
ClientIdPresent = FALSE;
}
}
if ( ObjectNamePresent && ClientIdPresent ) {
return STATUS_INVALID_PARAMETER_MIX;//如果进程对象名和进程ID号都存在的话，返回参数错误
}
//
// Create an AccessState here, because the caller may have
// DebugPrivilege, which requires us to make special adjustments
// to his desired access mask. We do this by modifying the
// internal fields in the AccessState to achieve the effect
// we desire.
//
Status = SeCreateAccessState(
&AccessState,
&AuxData,
DesiredAccess,
&PsProcessType->TypeInfo.GenericMapping
);
if ( !NT_SUCCESS(Status) ) {
return Status;
}
//
// Check here to see if the caller has SeDebugPrivilege. If
// he does, we will allow him any access he wants to the process.
// We do this by clearing the DesiredAccess in the AccessState
// and recording what we want him to have in the PreviouslyGrantedAccess
// field.
//
// Note that this routine performs auditing as appropriate.
//
if (NtGlobalFlag & ***_IGNORE_DEBUG_PRIV) {
DebugPrivilege = TRUE;
} else
DebugPrivilege = SeSinglePrivilegeCheck(
SeDebugPrivilege,
PreviousMode
);
if (DebugPrivilege) {
//如果这个进程有SeDebugPrivilege权限就会进入这里进一步设置
if ( AccessState.RemainingDesiredAccess & MAXIMUM_ALLOWED ) {
AccessState.PreviouslyGrantedAccess |= PROCESS_ALL_ACCESS;
} else {
AccessState.PreviouslyGrantedAccess |= ( AccessState.RemainingDesiredAccess );
}
AccessState.RemainingDesiredAccess = 0;//清除这个权限，意味着给了这个进程对要操作的进程对象的所有权限
}
if ( ObjectNamePresent ) {
//
// Open handle to the process object with the specified desired access,
// set process handle value, and return service completion status.
//
Status = ObOpenObjectByName(
ObjectAttributes,
PsProcessType,
PreviousMode,
&AccessState,
0,
NULL,
&Handle
); 这里应该也会在本进程的句柄表中加入一项，并返回这个HANDLE_TABLE_ENTRY数组的下标(进程句柄),这个HANDLE_TABLE_ENTRY结构里的object指向被打开的那个进程对象头的地址 SeDeleteAccessState( &AccessState );
if ( NT_SUCCESS(Status) ) {
try {
*ProcessHandle = Handle;
}
except(EXCEPTION_EXECUTE_HANDLER) {
return Status;
}
}
return Status;
}
if ( ClientIdPresent ) {
Thread = NULL;
if (CapturedCid.UniqueThread) {
Status = PsLookupProcessThreadByCid(
&CapturedCid,
&Process,
&Thread
);
if ( !NT_SUCCESS(Status) ) {
SeDeleteAccessState( &AccessState );
return Status;
}
}
else {
//注意这里的进程ID其实是PspCidTable句柄表中数组的下标（它是全局的，整个系统才一个这样的表）线程ID也是一样的
Status = PsLookupProcessByProcessId(
CapturedCid.UniqueProcess,
&Process
);//根据进程ID从PspCidTable表中得到进程对象（注意这里是对象体不是对象头）的地址
if ( !NT_SUCCESS(Status) ) {
SeDeleteAccessState( &AccessState );
return Status;
}
}
//
// OpenObjectByAddress
//
Status = ObOpenObjectByPointer(
Process,
ObjectAttributes->Attributes,
&AccessState,
0,
PsProcessType,
PreviousMode,
&Handle
);//这里应该也会在本进程的句柄表中加入一项，并返回这个HANDLE_TABLE_ENTRY数组的下标(进程句柄),这个HANDLE_TABLE_ENTRY结构里的object指向被打开的那个进程对象头的地址。 SeDeleteAccessState( &AccessState );
if ( Thread ) {
ObDereferenceObject(Thread);
}
ObDereferenceObject(Process);
if ( NT_SUCCESS(Status) ) {
try {
*ProcessHandle = Handle;
}
except(EXCEPTION_EXECUTE_HANDLER) {
return Status;
}
}
return Status;
}
return STATUS_INVALID_PARAMETER_MIX;
}
NTSTATUS
ObOpenObjectByPointer(
IN PVOID Object,
IN ULONG HandleAttributes,
IN PACCESS_STATE PassedAccessState OPTIONAL,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_TYPE ObjectType OPTIONAL,
IN KPROCESSOR_MODE AccessMode,
OUT PHANDLE Handle
)
{
NTSTATUS Status;
HANDLE NewHandle;
POBJECT_HEADER ObjectHeader;
ACCESS_STATE LocalAccessState;
PACCESS_STATE AccessState = NULL;
AUX_ACCESS_DATA AuxData;
PAGED_CODE();
ObpValidateIrql( "ObOpenObjectByPointer" );
Status = ObReferenceObjectByPointer( Object,
0,
ObjectType,
AccessMode
);//这个函数会增加这个对象的引用计数，防止对象管理器删除这个对象，如下ObjectHeader->PointerCount += 1;
if (NT_SUCCESS( Status )) {
ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
if (!ARGUMENT_PRESENT( PassedAccessState )) {
Status = SeCreateAccessState( &LocalAccessState,
&AuxData,
DesiredAccess,
&ObjectHeader->Type->TypeInfo.GenericMapping
);
if (!NT_SUCCESS( Status )) {
ObDereferenceObject( Object );
return(Status);
}
AccessState = &LocalAccessState;
} else {
AccessState = PassedAccessState;
}
if (ObjectHeader->Type->TypeInfo.InvalidAttributes & HandleAttributes) {
if (AccessState == &LocalAccessState) {
SeDeleteAccessState( AccessState );
}
ObDereferenceObject( Object );
return( STATUS_INVALID_PARAMETER );
}
Status = ObpCreateHandle( ObOpenHandle,
Object,
ObjectType,
AccessState,
0,
HandleAttributes,
FALSE,
AccessMode,
(PVOID *)NULL,
&NewHandle
);
if (!NT_SUCCESS( Status )) {
ObDereferenceObject( Object );
}
}
if (NT_SUCCESS( Status )) {
*Handle = NewHandle;
}
else {
*Handle = NULL;
}
if (AccessState == &LocalAccessState) {
SeDeleteAccessState( AccessState );
}
return( Status );
}
NTSTATUS
ObpCreateHandle(
IN OB_OPEN_REASON OpenReason,
IN PVOID Object,
IN POBJECT_TYPE ExpectedObjectType OPTIONAL,
IN PACCESS_STATE AccessState,
IN ULONG ObjectPointerBias OPTIONAL,
IN ULONG Attributes,
IN BOOLEAN DirectoryLocked,
IN KPROCESSOR_MODE AccessMode,
OUT PVOID *ReferencedNewObject OPTIONAL,
OUT PHANDLE Handle
)
{
NTSTATUS Status;
POBJECT_HEADER ObjectHeader;
POBJECT_TYPE ObjectType;
PVOID ObjectTable;
OBJECT_TABLE_ENTRY ObjectTableEntry;
HANDLE NewHandle;
ACCESS_MASK DesiredAccess;
ACCESS_MASK GrantedAccess;
ULONG BiasCount;
PAGED_CODE();
ObpValidateIrql( "ObpCreateHandle" );
DesiredAccess = AccessState->RemainingDesiredAccess |
AccessState->PreviouslyGrantedAccess;
ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
ObjectType = ObjectHeader->Type;
if (ARGUMENT_PRESENT( ExpectedObjectType ) &&
ObjectType != ExpectedObjectType
) {
if (DirectoryLocked) {
ObpLeaveRootDirectoryMutex();
}
return( STATUS_OBJECT_TYPE_MISMATCH );
}
ObjectTableEntry.ObjectHeader = ObjectHeader;//初始化handle_table_entry结构，它用来插入到句柄表中的一项
//#define ObpGetObjectTable() (PsGetCurrentProcess()->ObjectTable)
ObjectTable = ObpGetObjectTable();//得到当前进程的句柄表（也就是调用OpenProcess的进程）
//
// ObpIncrementHandleCount will perform access checking on the
// object being opened as appropriate.
//
Status = ObpIncrementHandleCount( OpenReason,
PsGetCurrentProcess(),
Object,
ObjectType,
AccessState,
AccessMode,
Attributes
);
if (AccessState->GenerateOnClose) {
Attributes |= OBJ_AUDIT_OBJECT_CLOSE;
}
ObjectTableEntry.Attributes |= (Attributes & OBJ_HANDLE_ATTRIBUTES);
DesiredAccess = AccessState->RemainingDesiredAccess |
AccessState->PreviouslyGrantedAccess;
GrantedAccess = DesiredAccess &
(ObjectType->TypeInfo.ValidAccessMask |
ACCESS_SYSTEM_SECURITY );
if (DirectoryLocked) {
ObpLeaveRootDirectoryMutex();
}
if (!NT_SUCCESS( Status )) {
return( Status );
}
if (ARGUMENT_PRESENT( ObjectPointerBias )) {
BiasCount = ObjectPointerBias;
while (BiasCount--) {
ObpIncrPointerCount( ObjectHeader );
}
}
#if i386 && !FPO
if (NtGlobalFlag & ***_KERNEL_STACK_TRACE_DB) {
ObjectTableEntry.GrantedAccessIndex = ObpComputeGrantedAccessIndex( GrantedAccess );
ObjectTableEntry.CreatorBackTraceIndex = RtlLogStackBackTrace();
}
else
#endif // i386 && !FPO
ObjectTableEntry.GrantedAccess = GrantedAccess;//初始化这个句柄的权限
NewHandle = ExCreateHandle( ObjectTable, (PHANDLE_ENTRY)&ObjectTableEntry );//它会在本进程的句柄表中加入一项ObjectTableEntry，然后返回这个新的句柄（HANDLE_TABLE_ENTRY数组的下标）这里就是在调用OpenProcess()的进程的句柄表中加入了一项得到了句柄。以后根据这个句柄就能调用很多函数了，比如WriteProcessMemory（）需要以进程句柄作为参数的函数。
if (NewHandle == NULL) {
if (ARGUMENT_PRESENT( ObjectPointerBias )) {
BiasCount = ObjectPointerBias;
while (BiasCount--) {
ObpDecrPointerCount( ObjectHeader );
}
}
ObpDecrementHandleCount( PsGetCurrentProcess(),
ObjectHeader,
ObjectType,
GrantedAccess
);
return( STATUS_INSUFFICIENT_RESOURCES );
}
*Handle = MAKE_OBJECT_HANDLE( NewHandle );
//
// If requested, generate audit messages to indicate that a new handle
// has been allocated.
//
// This is the final security operation in the creation/opening of the
// object.
//
if ( AccessState->GenerateAudit ) {
SeAuditHandleCreation(
AccessState,
*Handle
);
}
if (OpenReason == ObCreateHandle) {
PAUX_ACCESS_DATA AuxData = AccessState->AuxData;
if ( ( AuxData->PrivilegesUsed != NULL) && (AuxData->PrivilegesUsed->PrivilegeCount > 0) ) {
SePrivilegeObjectAuditAlarm(
*Handle,
&AccessState->SubjectSecurityContext,
GrantedAccess,
AuxData->PrivilegesUsed,
TRUE,
KeGetPreviousMode()
);
}
}
if (ARGUMENT_PRESENT( ObjectPointerBias ) &&
ARGUMENT_PRESENT( ReferencedNewObject )
) {
*ReferencedNewObject = Object;
}
return( STATUS_SUCCESS );
}
