Pspcidtable遍历进程

来源：互联网发布：if you音译歌词知乎编辑：程序博客网时间：2024/06/04 18:37

PspCidTable句柄表

PspCidTable也是一个句柄表，但是这个句柄表不是私有句柄表，它里面存放的是系统中所有的进程和线程对象,其索引也就是进程ID(PID)或线程ID(TID).

看到我们的表

kd> dd Pspcidtable
8055b260 e1001798 00000002 00000000 00000000
8055b270 00000000 00000000 00000000 00000000
8055b280 00000000 00000000 00000000 00000000
8055b290 00000000 00000000 00000000 00000000
8055b2a0 00000000 00000000 00000000 00000000
8055b2b0 00000000 00000000 00000000 00000000
8055b2c0 00000000 00000000 00000000 00000000
8055b2d0 00000000 00000000 00000000 00000000

查看数据内容

kd> dt _HANDLE_TABLE e1001798
nt!_HANDLE_TABLE
+0x000 TableCode : 0xe1086001
+0x004 QuotaProcess : (null)
+0x008 UniqueProcessId : (null)
+0x00c HandleTableLock : [4] _EX_PUSH_LOCK
+0x01c HandleTableList : _LIST_ENTRY [ 0xe10017b4 - 0xe10017b4 ]
+0x024 HandleContentionEvent : _EX_PUSH_LOCK
+0x028 DebugInfo : (null)
+0x02c ExtraInfoPages : 0n0
+0x030 FirstFree : 0x828
+0x034 LastFree : 0x36c
+0x038 NextHandleNeedingPool : 0x1000
+0x03c HandleCount : 0n374
+0x040 Flags : 1
+0x040 StrictFIFO : 0y1

这个表的意思就是如果你是三层表结构你就需要依靠tablecode就寻找第二层表结构，再去寻找第一层表结构。

kd> dd 0xe1086000
e1086000 e1003000 e108b000 00000000 00000000
e1086010 00000000 00000000 00000000 00000000
e1086020 00000000 00000000 00000000 00000000
e1086030 00000000 00000000 00000000 00000000
e1086040 00000000 00000000 00000000 00000000
e1086050 00000000 00000000 00000000 00000000
e1086060 00000000 00000000 00000000 00000000
e1086070 00000000 00000000 00000000 00000000

这两个二级表对应着一级表的地址，通过这两个地址找到一级表中对应的数据

kd> dd e1003000
e1003000 00000000 fffffffe 865b7661 00000000
e1003010 865b73e9 00000000 865b6021 00000000
e1003020 865b6d21 00000000 865b6aa9 00000000
e1003030 865b6831 00000000 865b65b9 00000000
e1003040 865b6341 00000000 865b5021 00000000
e1003050 865b5da9 00000000 865b5b31 00000000
e1003060 865b58b9 00000000 865b5641 00000000
e1003070 865b53c9 00000000 865b4021 00000000

kd> dd e108b000
e108b000 00000000 fffffffe 00000000 00000324
e108b010 00000000 00000804 00000000 00000808
e108b020 00000000 0000080c 00000000 00000810
e108b030 00000000 00000814 00000000 00000818
e108b040 85ffe4f1 00000000 8633eda9 00000000
e108b050 00000000 00000844 00000000 0000043c
e108b060 861c95f1 00000000 85fc0869 00000000
e108b070 8647e021 00000000 861c9da9 00000000

这个时候通过这两个就可以找到进程了

以这个865b7661为例子

前4Byte是一个Object对象,Object指针的低3Bit 有另外意义的:
①第0位OBJ_PROTECT_CLOSE，表示调用者是否允许关闭该句柄;
②第1位OBJ_ INHERIT，指示该进程所创建的子进程是否可以继承该句柄，即是否将该句柄项拷贝到子进程的句柄表中;
③第2位OBJ_ AUDIT_OBJECT_ CLOSE。指示关闭该对象时是否产生一个审计事件。
所以在使用该指针的时候要掩掉低3Bit

kd> !object 865b7660
Object: 865b7660 Type: (865b7ca0) Process
ObjectHeader: 865b7648 (old version)
HandleCount: 2 PointerCount: 67

kd> dt _EPROCESS 865b7660
nt!_EPROCESS
+0x000 Pcb : _KPROCESS
+0x06c ProcessLock : _EX_PUSH_LOCK
+0x070 CreateTime : _LARGE_INTEGER 0x0
+0x078 ExitTime : _LARGE_INTEGER 0x0
+0x080 RundownProtect : _EX_RUNDOWN_REF
+0x084 UniqueProcessId : 0x00000004 Void
+0x088 ActiveProcessLinks : _LIST_ENTRY [ 0x86483310 - 0x8055b158 ]
+0x090 QuotaUsage : [3] 0
+0x09c QuotaPeak : [3] 0
+0x0a8 CommitCharge : 7
+0x0ac PeakVirtualSize : 0x289000
+0x0b0 VirtualSize : 0x1c7000
+0x0b4 SessionProcessLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x0bc DebugPort : (null)
+0x0c0 ExceptionPort : (null)
+0x0c4 ObjectTable : 0xe1001bf8 _HANDLE_TABLE
+0x0c8 Token : _EX_FAST_REF
+0x0cc WorkingSetLock : _FAST_MUTEX
+0x0ec WorkingSetPage : 0
+0x0f0 AddressCreationLock : _FAST_MUTEX
+0x110 HyperSpaceLock : 0
+0x114 ForkInProgress : (null)
+0x118 HardwareTrigger : 0
+0x11c VadRoot : 0x865b3220 Void
+0x120 VadHint : 0x865b3220 Void
+0x124 CloneRoot : (null)
+0x128 NumberOfPrivatePages : 3
+0x12c NumberOfLockedPages : 0
+0x130 Win32Process : (null)
+0x134 Job : (null)
+0x138 SectionObject : (null)
+0x13c SectionBaseAddress : (null)
+0x140 QuotaBlock : 0x8055b200 _EPROCESS_QUOTA_BLOCK
+0x144 WorkingSetWatch : (null)
+0x148 Win32WindowStation : (null)
+0x14c InheritedFromUniqueProcessId : (null)
+0x150 LdtInformation : (null)
+0x154 VadFreeHint : (null)
+0x158 VdmObjects : (null)
+0x15c DeviceMap : 0xe1005450 Void
+0x160 PhysicalVadList : _LIST_ENTRY [ 0x865b77c0 - 0x865b77c0 ]
+0x168 PageDirectoryPte : _HARDWARE_PTE
+0x168 Filler : 0
+0x170 Session : (null)
+0x174 ImageFileName : [16] "System"
+0x184 JobLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x18c LockedPagesList : (null)
+0x190 ThreadListHead : _LIST_ENTRY [ 0x865b7614 - 0x864cac8c ]
+0x198 SecurityPort : 0xe1a5c3e8 Void
+0x19c PaeTop : (null)
+0x1a0 ActiveThreads : 0x3b
+0x1a4 GrantedAccess : 0x1f0fff
+0x1a8 DefaultHardErrorProcessing : 1
+0x1ac LastThreadExitStatus : 0n0
+0x1b0 Peb : (null)
+0x1b4 PrefetchTrace : _EX_FAST_REF
+0x1b8 ReadOperationCount : _LARGE_INTEGER 0xa6
+0x1c0 WriteOperationCount : _LARGE_INTEGER 0x17c
+0x1c8 OtherOperationCount : _LARGE_INTEGER 0x14b5
+0x1d0 ReadTransferCount : _LARGE_INTEGER 0x1a1bb0
+0x1d8 WriteTransferCount : _LARGE_INTEGER 0x2246a8
+0x1e0 OtherTransferCount : _LARGE_INTEGER 0xa6ea8
+0x1e8 CommitChargeLimit : 0
+0x1ec CommitChargePeak : 0x1cb
+0x1f0 AweInfo : (null)
+0x1f4 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
+0x1f8 Vm : _MMSUPPORT
+0x238 LastFaultCount : 0
+0x23c ModifiedPageCount : 0x10ec
+0x240 NumberOfVads : 4
+0x244 JobStatus : 0
+0x248 Flags : 0x40000
+0x248 CreateReported : 0y0
+0x248 NoDebugInherit : 0y0
+0x248 ProcessExiting : 0y0
+0x248 ProcessDelete : 0y0
+0x248 Wow64SplitPages : 0y0
+0x248 VmDeleted : 0y0
+0x248 OutswapEnabled : 0y0
+0x248 Outswapped : 0y0
+0x248 ForkFailed : 0y0
+0x248 HasPhysicalVad : 0y0
+0x248 AddressSpaceInitialized : 0y00
+0x248 SetTimerResolution : 0y0
+0x248 BreakOnTermination : 0y0
+0x248 SessionCreationUnderway : 0y0
+0x248 WriteWatch : 0y0
+0x248 ProcessInSession : 0y0
+0x248 OverrideAddressSpace : 0y0
+0x248 HasAddressSpace : 0y1
+0x248 LaunchPrefetched : 0y0
+0x248 InjectInpageErrors : 0y0
+0x248 VmTopDown : 0y0
+0x248 Unused3 : 0y0
+0x248 Unused4 : 0y0
+0x248 VdmAllowed : 0y0
+0x248 Unused : 0y00000 (0)
+0x248 Unused1 : 0y0
+0x248 Unused2 : 0y0
+0x24c ExitStatus : 0n259
+0x250 NextPageColor : 0x8c82
+0x252 SubSystemMinorVersion : 0 ''
+0x253 SubSystemMajorVersion : 0 ''
+0x252 SubSystemVersion : 0
+0x254 PriorityClass : 0x2 ''
+0x255 WorkingSetAcquiredUnsafe : 0 ''
+0x258 Cookie : 0

可以看到这是一个system进程

遍历其他进程同理

有疑问欢迎留言

0 0