//findprocess.c
// by uty@uaty
//
#include <ntddk.h>
#define PDE_INVALID 2
#define PTE_INVALID 1
#define VALID 0
#define PEB_OFFSET 0x1b0
#define OBJECT_HEADER_SIZE 0x18
#define OBJECT_TYPE_OFFSET 0x8
#define EPROCESS_NAME_OFFSET 0x174
VOID WorkThread(IN PVOID pContext);
VOID DriverUnload(IN PDRIVER_OBJECT Driver_object);
VOID searchprocess(VOID);
VOID getname(ULONG Addr);
ULONG validpage(ULONG Addr);
BOOLEAN IsARealProcess(ULONG i);
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)
{
NTSTATUS dwStatus;
HANDLE hThread;
DbgPrint("i'm coming :>/n");
DriverObject->DriverUnload = DriverUnload;
dwStAtus = PsCreateSystemThread(&hThread,
(ACCESS_MASK)0,
NULL,
(HANDLE)0,
NULL,
WorkThread,
NULL
);
return STATUS_SUCCESS;
}
//--------------------------------------------------------------------
VOID DriverUnload(IN PDRIVER_OBJECT Driver_object)
{
}
//--------------------------------------------------------------------
VOID WorkThread(IN PVOID pContext)
{
searchprocess();
PsTerminateSystemThread(STATUS_SUCCESS);
DbgPrint("Never be here ?/n");
}
//--------------------------------------------------------------------
VOID searchprocess(void)
{
ULONG i;
ULONG result;
for (i = 0x80000000 ;i<0x90000000;i+=4){
result = validpage(i);
if (result == VALID){
if (*(PULONG)i == 0x7ffdf000){
if(IsARealProcess(i)){
DbgPrint("EPROCESS: 0x%x ",i-PEB_OFFSET);
getname(i);
}
}
}
else if(result == PTE_INVALID){
i -=4;
i += 0x1000;//4k
}
else{
i-=4;
i+= 0x400000;//4mb
}
}
for (i = 0xf0000000 ;i<0xffbe0000;i+=4){
result = validpage(i);
if (result == VALID){
if (*(PULONG)i == 0x7ffdf000){
if(IsARealProcess(i)){
DbgPrint("EPROCESS: 0x%x ",i-PEB_OFFSET);
getname(i);
}
}
}
else if(result == PTE_INVALID){
i -=4;
i += 0x1000;//4k
}
else{
i-=4;
i+= 0x400000;//4mb
}
}
DbgPrint("searching finish /n");
}
//--------------------------------------------------------------------
VOID getname(ULONG Addr)
{
DbgPrint("process name: %s/n",(PCHAR)(Addr-PEB_OFFSET+EPROCESS_NAME_OFFSET));
}
//--------------------------------------------------------------------
ULONG validpage(ULONG Addr)
{
ULONG pte;
ULONG pde;
pde = 0xc0300000 + (Addr>>22)*4;
if((*(PULONG)pde & 0x1) != 0){
//lArge pAge
if((*(PULONG)pde & 0x80) != 0){
return VALID;
}
pte = 0xc0000000 + (Addr>>12)*4;
if((*(PULONG)pte & 0x1) != 0){
return VALID;
}
else{
return PTE_INVALID;
}
}
return PDE_INVALID;
}
//--------------------------------------------------------------------
BOOLEAN IsARealProcess(ULONG i)
{
NTSTATUS status;
PUNICODE_STRING pUnicode;
UNICODE_STRING Process;
ULONG pObjectType;
ULONG pObjectTypeProcess;
pObjectTypeProcess = *(PULONG)((ULONG)PsGetCurrentProcess() -OBJECT_HEADER_SIZE +OBJECT_TYPE_OFFSET);
if (validpage(i-PEB_OFFSET) != VALID){
return FALSE;
}
if (validpage(i-PEB_OFFSET - OBJECT_HEADER_SIZE + OBJECT_TYPE_OFFSET) == VALID){
pObjectType = *(PULONG)(i-PEB_OFFSET - OBJECT_HEADER_SIZE + OBJECT_TYPE_OFFSET);
}
else{
return FALSE;
}
if(pObjectTypeProcess == pObjectType){
return TRUE;
}
return FALSE;
}
//--------------------------------------------------------------------
相关推荐
Windows内核驱动逆向分析实战:从混淆壳到功能解构
在软件安全与系统底层开发领域,理解程序如何与操作系统内核交互是核心课题。内核模式驱动程序作为连接用户态应用与硬件资源的桥梁,其工作原理涉及内存管理、进程调度和系统服务调用等基础概念。通过逆向工程分析驱动,不仅能深入理解Windows内核机制,还能有效提升对抗恶意代码、构建安全防护体系的技术能力。本次分析聚焦于一个经过高强度混淆和反调试保护的游戏外挂驱动,运用IDA Pro、WinDbg等工具链,系统性地拆解了其从动态解密、反调试对抗到内存隐藏、内核回调注册的全过程。文章详细阐述了如何搭建安全的虚拟化分析环境
通过暴力搜索PID遍历进程并获取进程信息
背景 通常我们在内核中使用 ZwQuerySystemInformation 函数来遍历进程模块并获取进程信息,这种是通过正常的进程遍历方式,所以,有很多 Rootkit 程序会 HOOK 这个 ZwQuerySystemInformation 函数,过滤指定进程,从而实现进程的隐藏。 本文实现的进程遍历和获取进程信息并不打算使用 ZwQuerySystemInformation 这种方式,而是直接暴力搜索进程的 PID,根据有效的 PID 获取相应进程的信息,从而实现进程的遍历。现在,我就来讲解具体的实现
内存取证与恶意代码分析实战:从Volatility到逆向工程
内存取证是网络安全领域的关键技术,它专注于分析易失性内存中的数据,以发现传统文件扫描难以检测的威胁。其核心原理在于操作系统运行时,进程、网络连接、加密密钥等关键证据仅存于内存中,通过提取和解析内存镜像,可以还原攻击链。这项技术的价值在于应对无文件攻击、高级持续性威胁等复杂场景,是事件响应和威胁狩猎的核心能力。在实际应用中,结合Volatility框架进行内存结构解析、进程与网络关联分析,并利用Ghidra等工具对提取的恶意代码进行逆向工程,能够有效定位诸如代码注入、隐蔽C2通信等恶意行为。本文通过实战演练,
EPROCESS遍历进程
Windows为每一个进程都安排了一个EPROCESS的结构用于维护每一个进程,当然EPROCESS是属于内核管理的,所以只有ring0层的程序才可以访问这个结构,下面我们来看一下EPROCESS的结构是怎样的。 kd> dt _eprocess ntdll!_EPROCESS +0x000 Pcb : _KPROCESS +0x06c ProcessL...
Windows内核驱动EPROCESS遍历进程模块
windows驱动 遍历进程模块
告别交越失真:手把手教你设计高性能互补输出级电路(LTspice实测)
本文深入剖析音频放大器中常见的交越失真问题,并提供基于LTspice仿真的实战解决方案。通过对比二极管偏置、Vbe倍增器和集成运放驱动三种经典方案,手把手指导设计高性能互补输出级电路,涵盖原理分析、仿真验证及实物调试要点,助力消除音频失真,提升音质。
内核PspCidTable句柄表遍历获取隐藏进程
先从WinDBG中来看下PspCidTable. lkd> dd pspcidtable 84196eb4 8ae011c8 00000000 80000018 00000101 84196ec4 800005e0 80000020 00000000 00000000 84196ed4 00000000 00000000 00000000 00000113 84196ee4 0000
【Windows】 解决联想为主的所有自带摄像头(integrate camera)打不开的毛病(特别点名小新、thinkbook、thinkpad、y7000...)
解决联想系列电脑打不开自带摄像头的问题
通过EPROCESS枚举进程
http://bbs.pediy.com/showthread.php?p=583402 网上的一段代码 通过内存搜索EPROCESS来枚举进程在我的xp sp2系统上测试 只能枚举出三个进程 这是为什么?关键代码如下:代码:VOID searchprocess(void){ ULONG i; ULONG res
Material Studio 2024安装避坑指南:从证书配置到权限设置的完整解决方案
本文详细解析了Material Studio 2024的安装流程,从环境准备到权限优化的完整解决方案。针对证书配置、系统权限和计算服务等常见问题,提供了12个关键风险点的避坑指南,帮助科研工作者高效完成安装,提升材料模拟工作的效率。
多仓智能订单路由与动态优化方案设计
现在有很多商家会有多个仓库,并分布在不同的城市中,当用户下单后会根据商品库存及订单信息将订单分配到对应的仓库进行发货,如就近原则,本期基于多仓库设计一套订单路由方案,包含核心逻辑、规则优先级和实施方案,适用于多仓协同的订单自动分配场景
一段比较有用的代码,顺手还原了一下
今天在看一驱动的时候发现了一段比较有用的代码,主要功能就是用来确定ImageFileName成员在EPROCESS结构中的偏移的,如下 : FindNameOffset proc near ; CODE XREF: sub_10966+1Dp.text:000107F0 push ebx.text:000107F1
纯方位观测下的三维定位,IV-PLKF(Inverse Velocity-Weighted Pseudo-Linear Kalman Filter)
在现代定位系统中,纯方位观测因其无需测距设备的优势,在无线通信、无人机导航和室内定位等领域备受关注。本文深入探讨基于算法的三维定位方法,并提供完整的MATLAB仿真例程。
ring0级暴力搜索内存检测系统隐藏进程(或Rootkit)
#include //EPROCESS结构大小,我的系统是XP SP3,所以0x260,不过经过测试,这里设置成比实际EPROCESS小也是没问题的 #define EPROCESS_SIZE 0x260 #define PEB_OFFSET 0x1B0 //PEB偏移,下面就不注释了 #define FILE_NAME_OFFS
Exploring Automated Distractor Generation for Math Multiple-choice Questions via Large Language Mode
多项选择题(MCQ)在几乎所有级别的教育中都无处不在,因为它们易于管理、评分,并且是评估和实践中可靠的格式。MCQ最重要的方面之一是干扰因素,即旨在针对真实学生常见错误或误解的不正确选项。迄今为止,对于教师和学习内容设计师来说,制作高质量的干扰物的任务在很大程度上仍然是一个劳动和时间密集型的过程,其可扩展性有限。在这项工作中,我们研究了数学MCQ领域的自动干扰物生成任务,并探索了从上下文学习到微调的各种基于大型语言模型(LLM)的方法。
delphi 调用deepseek r1 api 并流式返回结果
摘要:本文展示了一个使用Delphi调用DeepSeek API的代码示例,包含两种调用方式:一次性获取结果和流式返回结果。代码实现了完整的API请求处理,包括HTTP客户端设置、JSON数据处理和UI界面交互。其中流式调用通过TStreamReader处理服务器发送事件(SSE),实时更新到TRichEdit控件并保持滚动条位置。文章还提到界面美化优化,为Delphi开发者提供了调用AI服务的实用参考方案。(150字)
在EPROCESS中搜索ProcessName的偏移
ULONG gProcessNameOffset; void GetProcessNameOffset() { PEPROCESS curproc; int i; curproc = PsGetCurrentProcess(); for( i = 0; i < 3*PAGE_SIZE; i++ ) { if( !strncmp( "System", (PCHAR) curproc
基于simulink的多能源系统协同控制的复杂场景实例:氢燃料电池+锂电池混合动力电动汽车能量管理仿真
本文介绍了基于Simulink的氢燃料电池与锂电池混合动力电动汽车能量管理系统的建模与仿真方法。系统包含驾驶循环输入、氢燃料电池、锂电池、能量管理和电机驱动等模块,通过Simulink实现各模块的协同控制。文章详细说明了从模型创建到性能评估的完整流程,包括驾驶循环输入设置、燃料电池和锂电池子系统建模、能量管理策略设计等关键步骤。该仿真模型可验证不同工况下的系统响应和能量利用效率,为优化混合动力汽车的能量管理策略提供有效工具。通过引入更复杂的物理细节和环境因素,可进一步提升模型的实用性和准确性。
内核态下基于动态感染技术的应用程序执行保护(五 动态感染)
源代码:http://download.youkuaiyun.com/detail/hitetoshi/3633188 绝影做尘,铁甲四方逐鹿而争。风起云涌,八面九锡更兼策马奔。南面独傲,铜雀二乔,欲休却报诏到。假节钺,赞拜不名,剑履入殿谁能?青梅煮酒,本初不数,惊起雷霆咋休。玺绶之册,即阼亦重,却累身三秋。观之沧海,星汉一粟,不道身成五彩。隔江叹:景升之子,豚犬之流。 扯远了,赶紧返回。今天这章...
精雕软件(JDpaint) 5.5 绿色版
精雕软件(JDpaint) 5.5 绿色版精雕软件(JDpaint) 5.5 绿色版精雕软件(JDpaint) 5.5 绿色版
efm32 入门.pdf
本PDF共计22页,介绍的是操作驱动API,下载与否自己斟酌。
内核态下基于动态感染技术的应用程序执行保护
绝影做尘,铁甲四方逐鹿而争。风起云涌,八面九锡更兼策马奔。南面独傲,铜雀二乔,欲休却报诏到。假节钺,赞拜不名,剑履入殿谁能?青梅煮酒,本初不数,惊起雷霆咋休。玺绶之册,即阼亦重,却累身三秋。观之沧海,星汉一粟,不道身成五彩。隔江叹:景升之子,豚犬之流。 扯远了,赶紧返回。今天这章是这篇系列文章的最后一章。 前面我们的驱动程序已经可以监视进程的创
visio安装包
Microsoft Office Visio 是一款专业的制图软件。利用经过更新的形状、协作工具和数据链接图表,创建专业级图表以简化复杂的信息。
内存管理(3)用户空间内存管理&内存区对象
进程内存管理 MmCreateProcessAddressSpace 初始化进程的系统空间部分 1.先做一些检查,检查系统是否有足够的页面 2.申请四个物理页面分别用于:页目录,超空间页表,VAD位图,工作集链表 3.初始化EPROCESS中的一些结构_MMSUPPORT Vm.MinimumWorkingSetSize; DirectoryTableBase WorkingSet
深度学习工具包 DeepLearningToolbox
深度学习工具包Deprecation notice.-----This toolbox is outdated and no longer maintained.There are much better tools available for deep learning than this toolbox, e.g. [Theano](http://deeplearning.net/software/theano/), [torch](http://torch.ch/) or [tensorflow](http://www.tensorflow.org/)I would suggest you use one of the tools mentioned above rather than use this toolbox.Best, Rasmus.DeepLearnToolbox================A Matlab toolbox for Deep Learning.Deep Learning is a new subfield of machine learning that focuses on learning deep hierarchical models of data.It is inspired by the human brain's apparent deep (layered, hierarchical) architecture.A good overview of the theory of Deep Learning theory is[Learning Deep Architectures for AI](http://www.iro.umontreal.ca/~bengioy/papers/ftml_book.pdf)For a more informal introduction, see the following videos by Geoffrey Hinton and Andrew Ng.* [The Next Generation of Neural Networks](http://www.youtube.com/watch?v=AyzOUbkUf3M) (Hinton, 2007)* [Recent Developments in Deep Learning](http://www.youtube.com/watch?v=VdIURAu1-aU) (Hinton, 2010)* [Unsupervised Feature Learning and Deep Learning](http://www.youtube.com/watch?v=ZmNOAtZIgIk) (Ng, 2011)If you use this toolbox in your research please cite [Prediction as a candidate for learning deep hierarchical models of data](http://www2.imm.dtu.dk/pubdb/views/publication_details.php?id=6284)```@MASTERSTHESIS\{IMM2012-06284, author = "R. B. Palm", title = "Prediction as a candidate for learning deep hierarchical models of data", year = "2012",}```Contact: rasmusbergpalm at gmail dot comDirectories included in the toolbox-----------------------------------`NN/` - A library for Feedforward Backpropagation Neural Networks`CNN/` - A library for Convolutional Neural Networks`DBN/` - A library for Deep Belief Networks`SAE/` - A library for Stacked Auto-Encoders`CAE/` - A library for Convolutional Auto-Encoders`util/` - Utility functions used by the libraries`data/` - Data used by the examples`tests/` - unit tests to verify toolbox is workingFor references on each library check REFS.mdSetup-----1. Download.2. addpath(genpath('DeepLearnToolbox'));Example: Deep Belief Network---------------------```matlabfunction test_example_DBNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit RBM and visualize its weightsrand('state',0)dbn.sizes = [100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);figure; visualize(dbn.rbm{1}.W'); % Visualize the RBM weights%% ex2 train a 100-100 hidden unit DBN and use its weights to initialize a NNrand('state',0)%train dbndbn.sizes = [100 100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);%unfold dbn to nnnn = dbnunfoldtonn(dbn, 10);nn.activation_function = 'sigm';%train nnopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.10, 'Too big error');```Example: Stacked Auto-Encoders---------------------```matlabfunction test_example_SAEload mnist_uint8;train_x = double(train_x)/255;test_x = double(test_x)/255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit SDAE and use it to initialize a FFNN% Setup and train a stacked denoising autoencoder (SDAE)rand('state',0)sae = saesetup([784 100]);sae.ae{1}.activation_function = 'sigm';sae.ae{1}.learningRate = 1;sae.ae{1}.inputZeroMaskedFraction = 0.5;opts.numepochs = 1;opts.batchsize = 100;sae = saetrain(sae, train_x, opts);visualize(sae.ae{1}.W{1}(:,2:end)')% Use the SDAE to initialize a FFNNnn = nnsetup([784 100 10]);nn.activation_function = 'sigm';nn.learningRate = 1;nn.W{1} = sae.ae{1}.W{1};% Train the FFNNopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.16, 'Too big error');```Example: Convolutional Neural Nets---------------------```matlabfunction test_example_CNNload mnist_uint8;train_x = double(reshape(train_x',28,28,60000))/255;test_x = double(reshape(test_x',28,28,10000))/255;train_y = double(train_y');test_y = double(test_y');%% ex1 Train a 6c-2s-12c-2s Convolutional neural network %will run 1 epoch in about 200 second and get around 11% error. %With 100 epochs you'll get around 1.2% errorrand('state',0)cnn.layers = { struct('type', 'i') %input layer struct('type', 'c', 'outputmaps', 6, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %sub sampling layer struct('type', 'c', 'outputmaps', 12, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %subsampling layer};cnn = cnnsetup(cnn, train_x, train_y);opts.alpha = 1;opts.batchsize = 50;opts.numepochs = 1;cnn = cnntrain(cnn, train_x, train_y, opts);[er, bad] = cnntest(cnn, test_x, test_y);%plot mean squared errorfigure; plot(cnn.rL);assert(er<0.12, 'Too big error');```Example: Neural Networks---------------------```matlabfunction test_example_NNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);% normalize[train_x, mu, sigma] = zscore(train_x);test_x = normalize(test_x, mu, sigma);%% ex1 vanilla neural netrand('state',0)nn = nnsetup([784 100 10]);opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samples[nn, L] = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.08, 'Too big error');%% ex2 neural net with L2 weight decayrand('state',0)nn = nnsetup([784 100 10]);nn.weightPenaltyL2 = 1e-4; % L2 weight decayopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex3 neural net with dropoutrand('state',0)nn = nnsetup([784 100 10]);nn.dropoutFraction = 0.5; % Dropout fraction opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex4 neural net with sigmoid activation functionrand('state',0)nn = nnsetup([784 100 10]);nn.activation_function = 'sigm'; % Sigmoid activation functionnn.learningRate = 1; % Sigm require a lower learning rateopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex5 plotting functionalityrand('state',0)nn = nnsetup([784 20 10]);opts.numepochs = 5; % Number of full sweeps through datann.output = 'softmax'; % use softmax outputopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex6 neural net with sigmoid activation and plotting of validation and training error% split training data into training and validation datavx = train_x(1:10000,:);tx = train_x(10001:end,:);vy = train_y(1:10000,:);ty = train_y(10001:end,:);rand('state',0)nn = nnsetup([784 20 10]); nn.output = 'softmax'; % use softmax outputopts.numepochs = 5; % Number of full sweeps through dataopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, tx, ty, opts, vx, vy); % nntrain takes validation set as last two arguments (optionally)[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');```[](https://bitdeli.com/free "Bitdeli Badge")
从x86进程与执行环境深度解析“拒绝访问”错误及系统编程原理
进程是操作系统进行资源分配和调度的基本单位,它代表了一个正在执行的程序实例。在x86架构下,进程的创建与管理依赖于硬件提供的特权级、内存管理单元(MMU)和中断机制等核心支持。理解进程的本质及其执行环境,对于开发高性能、高稳定性的软件至关重要,尤其是在处理并发、资源隔离和系统调用时。本文通过一个常见的“拒绝访问”错误案例,深入探讨了进程如何持有文件句柄、操作系统如何通过进程控制块(PCB)管理资源,以及从编译链接到加载执行的全过程。掌握这些原理,不仅能帮助开发者解决文件无法删除、端口占用等实际问题,更是深入
驱动插ring3线程执行代码
近日有在写一个小东西 需要在内核态中运行一个WIN32程序 之前提到的插入APC可以满足部分要求 但是一到WIN7 x86平台下就崩溃了WIN7下只能插入第三方的进程 一插入系统进程就崩溃,但是这样满足不了我们猥琐的想法- - 后来找到了一段代码 是注入RING3线程的 基本流程就是查找系统中某个进程 比如explorer.exe然后遍历线程链表,判断线程是否是RING3的线程...
439



被折叠的 条评论
为什么被折叠?



