利用ZwQuerySystemInformation和paspi枚举进程

最新推荐文章于 2025-05-14 16:34:35 发布

挂在树上的鳄鱼

最新推荐文章于 2025-05-14 16:34:35 发布

阅读量1.1k

点赞数

CC 4.0 BY-SA版权

分类专栏： windows

本文链接：https://blog.youkuaiyun.com/pickupyourrevolution/article/details/17510907

windows 专栏收录该内容

6 篇文章

订阅专栏

本文介绍了如何利用ntdll中的ZwQuerySystemInformation函数进行进程枚举，此方法常见于内核态操作。同时提到了在Windows 7系统下，部分psapi函数如EnumProcesses的变化，它们的功能转移到了kernel32.dll，并以K32EnumProcesses形式存在。此外，还提及批处理文件可以实现进程的自删除功能。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

#include<windows.h>
#include<stdio.h>
#include<ntsecapi.h>
typedef DWORD (WINAPI *ZWQUERYSYSTEMINFORMATION)(DWORD,PVOID,DWORD,PDWORD);
typedef struct _SYSTEM_PROCESS_INFORMATION{
    DWORD NextEntryDelta;
    DWORD ThreadCount;
    DWORD Reserved1[6];
    FILETIME ftCreateTime;
    FILETIME ftUserTime;
    FILETIME ftKernelTime;
    UNICODE_STRING ProcessName;
    DWORD BasePriority;
    DWORD ProcessId;
    DWORD InheritedFromProcessId;
    DWORD HandleCount;
    DWORD Reserved2[2];
    DWORD VmCounters;
    DWORD dCommitCharge;
    PVOID ThreadInfos[1];
}SYSTEM_PROCEESS_INFORMATION,*PSYSTEM_PROCEESS_INFORMATION;
#define SystemProcessesAndThreadsInformation 5
int main(){
    HMODULE hNtDll=GetModuleHandle("ntdll.dll");
    if(hNtDll==NULL)
        return -1;
    ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation=
    (ZWQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"ZwQuerySystemInformation");
    if(ZwQuerySystemInformation==NULL)
        return -1;
    DWORD cbBuffer=0x10000;
    LPVOID pBuffer=NULL;
    if((pBuffer=malloc(cbBuffer))==NULL)
        return -1;
    ZwQuerySystemInformation(SystemProcessesAndThreadsInformation,pBuffer,cbBuffer,NULL);
    PSYSTEM_PROCEESS_INFORMATION pInfo=(PSYSTEM_PROCEESS_INFORMATION)pBuffer;
    char buffer[100];
    if(fp==NULL)
        return -1;
    for(;;){
        wcstombs(buffer,pInfo->ProcessName.Buffer,100);//wchar_t转char
        if(strcmp(buffer,"1.exe")==0){//发现程序是1.exe就杀死该进程
            HANDLE hProcess=OpenProcess(PROCESS_TERMINATE,FALSE,pInfo->ProcessId);
            TerminateProcess(hProcess,0);
        }
        printf("PID:%d \t%ls\n",pInfo->ProcessId,pInfo->ProcessName.Buffer);
        if(pInfo->NextEntryDelta==0){
            break;
        }pInfo=(PSYSTEM_PROCEESS_INFORMATION)(((PUCHAR)pInfo)+pInfo->NextEntryDelta);
    }
    free(pBuffer);
    return 0;
}

以上是利用ntdll中的ZwQuerySystemInformation来实现进程枚举，这个函数也经常在内核态中使用

下面是利用psapi 参考见

http://msdn.microsoft.com/en-us/library/windows/desktop/ms682629(v=vs.85).aspx

http://msdn.microsoft.com/en-us/library/windows/desktop/ms684894(v=vs.85).aspx

操作系统win7，一些psapi的函数在win7下换了个样子，如EnumProcesses变成了K32EnumProcesses

连实现也从psapi.dll转移到kernel.dll了

#include<stdio.h>
#include<windows.h>
#include<psapi.h>
typedef BOOL (WINAPI*K32EnumProcesses1)(DWORD*,DWORD,LPDWORD);
typedef BOOL (WINAPI*K32EnumProcessModules1)(HANDLE,HMODULE *,DWORD,LPDWORD);
typedef DWORD (WINAPI*K32GetModuleBaseName1)(HANDLE,HMODULE ,LPTSTR,DWORD);
int main(){
	HMODULE k32=GetModuleHandle(TEXT("kernel32.dll"));
	K32EnumProcesses1 MyK32EnumProcesses=(K32EnumProcesses1)GetProcAddress(k32,"K32EnumProcesses");
	K32EnumProcessModules1 MyK32EnumProcessModules=(K32EnumProcessModules1)GetProcAddress(k32,"K32EnumProcessModules");
	K32GetModuleBaseName1 MyK32GetModuleBaseName=(K32GetModuleBaseName1)GetProcAddress(k32,"K32GetModuleBaseNameA");
	//	NewUninstallHook pUninstallHook=(NewUninstallHook)GetProcAddress(dllTest,"UninstallHook");
	DWORD ProcessCount;
	DWORD cbNeeded;
	DWORD ProcessId[1024];
	HMODULE hModule;
	char szPath[MAX_PATH];
	unsigned int i;
	MyK32EnumProcesses(ProcessId,sizeof(ProcessId),&cbNeeded);
	ProcessCount=cbNeeded/sizeof(DWORD);
	for(i=0;i<ProcessCount;i++){
		HANDLE hProcess=OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,FALSE,ProcessId[i]);
		if(hProcess){
			MyK32EnumProcessModules(hProcess,&hModule,sizeof(hModule),&cbNeeded);
			MyK32GetModuleBaseName(hProcess,hModule,szPath,sizeof(szPath));
			printf("PID:%4d  %s\n",ProcessId[i],szPath);
			if(strcmp(szPath,"1.exe")==0){
				FILE *fp=fopen("kill.bat","w");
				fprintf(fp,"taskkill /im ");
				fprintf(fp,szPath);
				fprintf(fp," /f /t\n");
				fclose(fp);
				ShellExecute(NULL,"open","kill.bat",NULL,NULL,SW_HIDE);
			}
		}else {
			continue;
		}
	}
	return 0;
}

这又是一种杀死进程的方式，是利用批处理文件，批处理也能实现自删除，因为批处理能删除自身

参考资料：WINDOWS黑客技术揭秘与攻防 1 C语言篇

-------------------------http://blog.youkuaiyun.com/pickupyourrevolution