Posted on 2009-10-28 14:49
S.l.e!ep.￠% 閱讀(300)
評論(0) 編輯 收藏 引用 所屬分類:
RootKit
應用層的代碼，與之前的代碼不同之前，并沒有直接使用 ZwQuerySystemInformation() 而是公開的API EnumProcess
#include?
<
windows.h
>
#include?
<
stdio.h
>
#include?
"
psapi.h
"
#pragma?comment(lib,?
"
psapi.lib
"
)
void
?PrintModules(?DWORD?processID?)
{
????HMODULE?hMods[
1024
];
????HANDLE?hProcess;
????DWORD?cbNeeded;
????unsigned?
int
?i;
????
//
?Print?the?process?identifier.
????printf(?
"
Process?ID:?%u\n
"
,?processID?);
????
//
?Get?a?list?of?all?the?modules?in?this?process.
????
????hProcess?
=
?OpenProcess(?PROCESS_QUERY_INFORMATION?
|
????????PROCESS_VM_READ,
????????FALSE,?processID?);
????
if
?(NULL?
==
?hProcess)
????????
return
;
????
if
(?EnumProcessModules(hProcess,?hMods,?
sizeof
(hMods),?
&
cbNeeded))
????{
????????
for
?(?i?
=
?
0
;?i?
<
?(cbNeeded?
/
?
sizeof
(HMODULE));?i
++
?)
????????{
????????????
char
?szModName[MAX_PATH];
????????????
//
?Get?the?full?path?to?the?module's?file.
????????????
if
?(?GetModuleFileNameEx(?hProcess,?hMods[i],?szModName,?
sizeof
(szModName)))
????????????{
????????????????
//
?Print?the?module?name?and?handle?value.
????????????????printf(
"
\t%s?(0x%08X)\n
"
,?szModName,?hMods?);
????????????}
????????}
????????????????}
????CloseHandle(?hProcess?);
}
void
?main(?)
{
????
//
?Get?the?list?of?process?identifiers.
????DWORD?aProcesses[
1024
],?cbNeeded,?cProcesses;
????unsigned?
int
?i;
????
if
?(?
!
EnumProcesses(?aProcesses,?
sizeof
(aProcesses),?
&
cbNeeded?)?)
????????
return
;
????
//
?Calculate?how?many?process?identifiers?were?returned.
????cProcesses?
=
?cbNeeded?
/
?
sizeof
(DWORD);
????
//
?Print?the?name?of?the?modules?for?each?process.
????
for
?(?i?
=
?
0
;?i?
<
?cProcesses;?i
++
?)
????????PrintModules(?aProcesses[i]?);
}