а теперь - в том коде есть несколько (много) багов
вот (вроде) правильный (+ добавил получение SeDebugPrivilege):
#define MPID 0xFFFF+1
#define SHOW_ALL
#define SEDEBUG
#if defined(WIN32) && !defined(_WIN32)
#define _WIN32
#endif
#define _WIN32_WINNT 0x0500
#include <stdio.h>
#include <tchar.h>
#include <windows.h>
#include <winbase.h>
#include <psapi.h>
#pragma comment(lib,"Psapi.lib")
#ifndef STATUS_INFO_LENGTH_MISMATCH
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
#endif
#define NtQuerySystemInformation _NtQuerySystemInformation
#include <winternl.h>
#undef NtQuerySystemInformation
#define SystemHandleInformation 16
typedef LONG KPRIORITY;
typedef struct {
int index;
bool hidden;
HANDLE handle;
TCHAR Name[MAX_PATH];
} Process;
Process List[MPID];
SYSTEM_PROCESS_INFORMATION SystemPrInfo[MPID];
typedef struct {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
LARGE_INTEGER SpareLi1;
LARGE_INTEGER SpareLi2;
LARGE_INTEGER SpareLi3;
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
ULONG HandleCount;
ULONG SessionId;
ULONG SpareUl3;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG PageFaultCount;
ULONG PeakWorkingSetSize;
ULONG WorkingSetSize;
SIZE_T QuotaPeakPagedPoolUsage;
SIZE_T QuotaPagedPoolUsage;
SIZE_T QuotaPeakNonPagedPoolUsage;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
} MORE_SYSTEM_PROCESS_INFORMATION;
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {
USHORT UniqueProcessId;
USHORT CreatorBackTraceIndex;
UCHAR ObjectTypeIndex;
UCHAR HandleAttributes;
USHORT HandleValue;
PVOID Object;
ULONG GrantedAccess;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
typedef struct _SYSTEM_HANDLE_INFORMATION {
ULONG NumberOfHandles;
SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[ 1 ];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
typedef NTSTATUS (WINAPI* NTQUERYSYSTEMINFORMATION)(DWORD, PVOID, DWORD, DWORD*);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
static DWORD find(int* xt)
{ int k = 0;
SIZE_T RequiredLength;
NTSTATUS s;
MORE_SYSTEM_PROCESS_INFORMATION *ProcTable,*Proc;
RequiredLength=64*1024;
ProcTable = (MORE_SYSTEM_PROCESS_INFORMATION *)VirtualAlloc(NULL,RequiredLength,MEM_COMMIT,PAGE _READWRITE);
if (ProcTable == NULL) return -1;
while ((s=NtQuerySystemInformation(SystemProcessInformat ion,
ProcTable,
(ULONG)RequiredLength,NULL))
== STATUS_INFO_LENGTH_MISMATCH)
{
RequiredLength += 16*1024;
VirtualFree(ProcTable,0,MEM_RELEASE);
ProcTable = (MORE_SYSTEM_PROCESS_INFORMATION *)VirtualAlloc (NULL,RequiredLength,
MEM_COMMIT,PAGE_READWRITE);
if (ProcTable == NULL) return -1;
}
Proc=ProcTable;
do {
k++;
RtlCopyMemory(List[(DWORD)Proc->UniqueProcessId].Name,Proc->ImageName.Buffer,Proc->ImageName.MaximumLength);
if(!List[(DWORD)Proc->UniqueProcessId].hidden){
(*xt)++;
printf("strange one: %.4X ", (DWORD)Proc->UniqueProcessId);
_putts(List[(DWORD)Proc->UniqueProcessId].Name);
}
List[(DWORD)Proc->UniqueProcessId].hidden = false ;
Proc=(MORE_SYSTEM_PROCESS_INFORMATION *)((char *)Proc+Proc->NextEntryOffset);
} while (Proc->NextEntryOffset);
VirtualFree (ProcTable,0,MEM_RELEASE);
return k;
}
void Enum2(){
int f1 = 0, f2 = 0, xt = 0, z = 0;
HMODULE hNtDll = LoadLibrary(TEXT("ntdll.dll"));
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(
hNtDll, "NtQuerySystemInformation");
for(int i = 0; i < MPID; i+=4){
HANDLE p = OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_R EAD, false, i);
HMODULE a; DWORD b=0;
if (p&&(EnumProcessModules(p,&a,0,&b)||(b>0))||i==4){
List[i].handle = p;
GetModuleFileNameExW(p, 0, List[i].Name, MAX_PATH);
CloseHandle(p);
List[i].hidden = true;
f1++;
}else{
if(p){
List[i].handle = (HANDLE)-1;
List[i].hidden = true;
z++;
}
}
}
f2 = find(&xt);
/**/
int cpid = GetCurrentProcessId();
//f1 -- : current
f1--;
f2--;
/**/
#ifdef SHOW_ALL
for (int i = 0; i<MPID; i+=4)
if(List[i].handle && List[i].handle!=(HANDLE)-1 && i != cpid){
printf("%.4X - ",i);
if (List[i].hidden)
printf("(warning! hidden one!) ");
_putts(List[i].Name);
}
printf("Zombies:\n");
int k = 0;
for (int i = 0; i<MPID; i+=4)
if(List[i].handle==(HANDLE)-1){
printf("%X",i);
if (++k!=z) printf(", ");
}
printf("\n\n------------\n");
printf("all: %d + %d\nvisible: %d\nzombies: %d\n",f1, xt, f2, z);
#endif
int i;
scanf("%c", &i);
}
bool SetDebugPrivileges() {
LUID Luid;
TOKEN_PRIVILEGES tpToken;
HANDLE hToken;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) {
return false;
}
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &Luid)) {
CloseHandle (hToken);
return false;
}
tpToken.PrivilegeCount = 1;
tpToken.Privileges[0].Luid = Luid;
tpToken.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, false, &tpToken, NULL, NULL, NULL)) {
CloseHandle(hToken);
return false;
}
CloseHandle(hToken);
return true;
}
int main(){
#ifdef SEDEBUG
SetDebugPrivileges();
#endif
Enum2();
return 0;
}
thx 2 slesh
>>у рема в phunter всё это было реализовано
Да тут нетрудно реализутся-то ) другое дело, что во время кодинга можно какие-то забавные вещи узнать.. вот например, оказалось, что во время загрузки программы (то есть при исследуемый pid = CurrentPid), в имени модуля лежит не имя экзешника, а полный путь..