-
-
[求助] 提两个有关进程枚举与隐藏的问题?
-
发表于: 2008-6-4 07:46
-
最近在学习Windows进程枚举与隐藏，编写过程中有出现一些小问题，还望各位高手赐教！
问题一: 使用EPROCESS中ActiveProcessLinks枚举进程时,在最末处的PID值为何如此大? kd> ImageFileNameOffset = 00000174 SN PID EPROCESS ImageFileName 00 00000004 80EEA030 System 01 0000017C 80D81950 SMSS.EXE 02 00000264 80DC28E0 csrss.exe 03 0000027C 80DDE2C8 winlogon.exe 04 000002AC 80DE4980 services.exe 05 000002B8 80DDBA78 lsass.exe 06 00000368 80E55DA0 svchost.exe 07 000003BC 80D80478 svchost.exe 08 0000042C 80D81DA0 svchost.exe 09 00000460 80DBD420 svchost.exe 10 000004F8 80D973A8 svchost.exe 11 0000060C 80E6B700 spoolsv.exe 12 00000614 80DA8980 Explorer.EXE 13 000007C8 FFB388A8 VMwareUser.exe 14 000007EC FFB33150 ctfmon.exe 15 00000198 80E976C0 VMwareService.e 16 00000774 FFAD5DA0 alg.exe 17 000002F4 FFADBBB8 conime.exe 18 00000678 FFAC2738 SnipeSword.exe 19 00000754 80DC8C10 q}.exe 20 8055AC20 805622D0 ─┬── └──────────────→PID值如此大??? kd> da 80EEA030+ 174 80eea1a4 "System" kd> da 80DC8C10+ 174 80dc8d84 "q..}.exe" kd> da 805622D0+ 174 80562444 "...." kd> dt _EPROCESS 80EEA030 nt!_EPROCESS +0x084 UniqueProcessId : 0x00000004 +0x088 ActiveProcessLinks : _LIST_ENTRY [ 0x80d819d8 - 0x80562358 ] +0x174 ImageFileName : [16] "System" kd> dt _EPROCESS 805622D0 nt!_EPROCESS +0x084 UniqueProcessId : 0x8055ac20 <== 为何这个PID值如此大??? +0x088 ActiveProcessLinks : _LIST_ENTRY [ 0x80eea0b8 - 0x80dc8c98 ] +0x174 ImageFileName : [16] "???" <== 未知名称??? ; 以下是通过检测ActiveProcessLinks内的值,用来验证上面地址的合法性 kd> dt _EPROCESS 0x80eea0b8-0x088 nt!_EPROCESS +0x084 UniqueProcessId : 0x00000004 +0x088 ActiveProcessLinks : _LIST_ENTRY [ 0x80d819d8 - 0x80562358 ] +0x174 ImageFileName : [16] "System" kd> dt _EPROCESS 0x80dc8c98-0x088 nt!_EPROCESS +0x084 UniqueProcessId : 0x00000754 +0x088 ActiveProcessLinks : _LIST_ENTRY [ 0x80562358 - 0xffac27c0 ] +0x174 ImageFileName : [16] "q???" 问题二: 对于采用修改EPROCESS中活动进程链表来隐藏进程的进程,通过恢复进程链表来显示其进程, 当其正常退出后, 若再次通过进程链表来枚举进程,该EPROCESS仍然存在.为何系统没有将该进程相关 数据从内存中删除(尤其是他还在活动进程链表,居然不会引起错误)??? [B][COLOR="Blue"]红色特殊标记的为已经退出的进程,居然还可以对其进行枚举，隐藏和恢复隐藏操作，不会引发BSOD[/COLOR][/B]00000000 0.00000000 ImageFileNameOffset = 00000174 00000001 0.00008688 (1)正常情況枚举所有进程(测试开始) 00000002 0.00016483 SN PID EPROCESS ImageFileName 00000003 0.00021036 00 0004 82FBB9C8 System [COLOR="Red"][B]00000004 0.00025646 01 3592 828F1690 HSQCMD.exe[/B][/COLOR] 00000005 0.00030171 02 3480 827D2758 HSQCMD.exe 00000006 0.00034697 03 0576 82D85020 smss.exe 00000007 0.00039195 04 0632 82AAC790 csrss.exe 00000008 0.00043721 05 0656 82A75DA0 winlogon.exe 00000009 0.00048218 06 0700 82A3C9B0 services.exe 00000010 0.00052744 07 0712 82A549B8 lsass.exe 00000011 0.00057298 08 0868 82A19920 svchost.exe 00000012 0.00061823 09 0944 829E6370 svchost.exe 00000013 0.00066377 10 1292 829D0020 svchost.exe 00000014 0.00070903 11 1460 829A1638 svchost.exe 00000015 0.00075429 12 1564 82A00118 svchost.exe 00000016 0.00079982 13 1636 829F1020 spoolsv.exe 00000017 0.00084508 14 0528 829AD2B0 explorer.exe 00000018 0.00089034 15 1044 82931450 stormliv.exe 00000019 0.00093559 16 1136 8293C6A8 wdfmgr.exe 00000020 0.00098113 17 1192 8290F5A8 vmount2.exe 00000021 0.00102695 18 1400 82914020 vmware-tray.exe 00000022 0.00107220 19 1436 829DE020 hqtray.exe 00000023 0.00111746 20 1448 82943BB0 ctfmon.exe 00000024 0.00116272 21 1208 829608F0 vmnat.exe 00000025 0.00120825 22 1372 829697A8 vmnetdhcp.exe 00000026 0.00125351 23 0972 8296BAF0 vmware-authd.ex 00000027 0.00129877 24 0512 8287A6F8 vmware.exe 00000028 0.00134430 25 1840 82874598 svchost.exe 00000029 0.00138984 26 2364 827A44E8 editplus.exe 00000030 0.00143510 27 3560 8295D3C0 conime.exe 00000031 0.00148036 28 2412 8289A020 Dbgview.exe 00000032 0.00152561 29 2628 829B4B58 q}.exe 00000033 0.00157199 30 -2138559456 8088A2D0 00000034 0.00161445 隐藏指定进程成功 00000035 0.00165747 (2)正常情況枚举所有进程(测试中...) 00000036 0.00173514 SN PID EPROCESS ImageFileName 00000037 0.00178011 00 0004 82FBB9C8 System 00000038 0.00182537 01 3480 827D2758 HSQCMD.exe 00000039 0.00187035 02 0576 82D85020 smss.exe 00000040 0.00191505 03 0632 82AAC790 csrss.exe 00000041 0.00196031 04 0656 82A75DA0 winlogon.exe 00000042 0.00200528 05 0700 82A3C9B0 services.exe 00000043 0.00205026 06 0712 82A549B8 lsass.exe 00000044 0.00209524 07 0868 82A19920 svchost.exe 00000045 0.00214022 08 0944 829E6370 svchost.exe 00000046 0.00218547 09 1292 829D0020 svchost.exe 00000047 0.00223045 10 1460 829A1638 svchost.exe 00000048 0.00227571 11 1564 82A00118 svchost.exe 00000049 0.00232097 12 1636 829F1020 spoolsv.exe 00000050 0.00236594 13 0528 829AD2B0 explorer.exe 00000051 0.00241120 14 1044 82931450 stormliv.exe 00000052 0.00245618 15 1136 8293C6A8 wdfmgr.exe 00000053 0.00250144 16 1192 8290F5A8 vmount2.exe 00000054 0.00254669 17 1400 82914020 vmware-tray.exe 00000055 0.00259195 18 1436 829DE020 hqtray.exe 00000056 0.00263721 19 1448 82943BB0 ctfmon.exe 00000057 0.00268218 20 1208 829608F0 vmnat.exe 00000058 0.00272744 21 1372 829697A8 vmnetdhcp.exe 00000059 0.00277270 22 0972 8296BAF0 vmware-authd.ex 00000060 0.00281768 23 0512 8287A6F8 vmware.exe 00000061 0.00286293 24 1840 82874598 svchost.exe 00000062 0.00290791 25 2364 827A44E8 editplus.exe 00000063 0.00295317 26 3560 8295D3C0 conime.exe 00000064 0.00299815 27 2412 8289A020 Dbgview.exe 00000065 0.00304340 28 2628 829B4B58 q}.exe 00000066 0.00308922 29 -2138559456 8088A2D0 00000067 0.00313420 恢复指定进程成功 00000068 0.00317750 (3)正常情況枚举所有进程(测试中...) 00000069 0.00325488 SN PID EPROCESS ImageFileName 00000070 0.00329986 00 0004 82FBB9C8 System [COLOR="red"][B]00000071 0.00334484 01 3592 828F1690 HSQCMD.exe[/B][/COLOR] 00000072 0.00339010 02 3480 827D2758 HSQCMD.exe 00000073 0.00343507 03 0576 82D85020 smss.exe 00000074 0.00348005 04 0632 82AAC790 csrss.exe 00000075 0.00352503 05 0656 82A75DA0 winlogon.exe 00000076 0.00357001 06 0700 82A3C9B0 services.exe 00000077 0.00361498 07 0712 82A549B8 lsass.exe 00000078 0.00365996 08 0868 82A19920 svchost.exe 00000079 0.00370494 09 0944 829E6370 svchost.exe 00000080 0.00375048 10 1292 829D0020 svchost.exe 00000081 0.00379573 11 1460 829A1638 svchost.exe 00000082 0.00384099 12 1564 82A00118 svchost.exe 00000083 0.00388625 13 1636 829F1020 spoolsv.exe 00000084 0.00393151 14 0528 829AD2B0 explorer.exe 00000085 0.00397648 15 1044 82931450 stormliv.exe 00000086 0.00402174 16 1136 8293C6A8 wdfmgr.exe 00000087 0.00406700 17 1192 8290F5A8 vmount2.exe 00000088 0.00411225 18 1400 82914020 vmware-tray.exe 00000089 0.00415751 19 1436 829DE020 hqtray.exe 00000090 0.00420277 20 1448 82943BB0 ctfmon.exe 00000091 0.00424803 21 1208 829608F0 vmnat.exe 00000092 0.00429328 22 1372 829697A8 vmnetdhcp.exe 00000093 0.00433854 23 0972 8296BAF0 vmware-authd.ex 00000094 0.00438352 24 0512 8287A6F8 vmware.exe 00000095 0.00442878 25 1840 82874598 svchost.exe 00000096 0.00447403 26 2364 827A44E8 editplus.exe 00000097 0.00451929 27 3560 8295D3C0 conime.exe 00000098 0.00456427 28 2412 8289A020 Dbgview.exe 00000099 0.00460952 29 2628 829B4B58 q}.exe 00000100 0.00465534 30 -2138559456 8088A2D0 00000101 0.00469808 再次隐藏指定进程成功 00000102 0.00474111 (4)正常情況枚举所有进程(测试中...) 00000103 0.00481877 SN PID EPROCESS ImageFileName 00000104 0.00486375 00 0004 82FBB9C8 System 00000105 0.00490900 01 3480 827D2758 HSQCMD.exe 00000106 0.00495398 02 0576 82D85020 smss.exe 00000107 0.00501125 03 0632 82AAC790 csrss.exe 00000108 0.00505651 04 0656 82A75DA0 winlogon.exe 00000109 0.00510149 05 0700 82A3C9B0 services.exe 00000110 0.00514646 06 0712 82A549B8 lsass.exe 00000111 0.00527106 07 0868 82A19920 svchost.exe 00000112 0.00531744 08 0944 829E6370 svchost.exe 00000113 0.00536269 09 1292 829D0020 svchost.exe 00000114 0.00540795 10 1460 829A1638 svchost.exe 00000115 0.00545321 11 1564 82A00118 svchost.exe 00000116 0.00549846 12 1636 829F1020 spoolsv.exe 00000117 0.00554372 13 0528 829AD2B0 explorer.exe 00000118 0.00558898 14 1044 82931450 stormliv.exe 00000119 0.00563396 15 1136 8293C6A8 wdfmgr.exe 00000120 0.00567921 16 1192 8290F5A8 vmount2.exe 00000121 0.00572447 17 1400 82914020 vmware-tray.exe 00000122 0.00576945 18 1436 829DE020 hqtray.exe 00000123 0.00581471 19 1448 82943BB0 ctfmon.exe 00000124 0.00585968 20 1208 829608F0 vmnat.exe 00000125 0.00590494 21 1372 829697A8 vmnetdhcp.exe 00000126 0.00595020 22 0972 8296BAF0 vmware-authd.ex 00000127 0.00599518 23 0512 8287A6F8 vmware.exe 00000128 0.00604015 24 1840 82874598 svchost.exe 00000129 0.00608541 25 2364 827A44E8 editplus.exe 00000130 0.00613067 26 3560 8295D3C0 conime.exe 00000131 0.00617565 27 2412 8289A020 Dbgview.exe 00000132 0.00622090 28 2628 829B4B58 q}.exe 00000133 0.00626672 29 -2138559456 8088A2D0 00000134 0.00630974 再次恢复指定进程成功 00000135 0.00635276 (5)正常情況枚举所有进程(测试结束) 00000136 0.00643043 SN PID EPROCESS ImageFileName 00000137 0.00647540 00 0004 82FBB9C8 System [COLOR="red"][B]00000138 0.00652066 01 3592 828F1690 HSQCMD.exe[/B][/COLOR] 00000139 0.00656592 02 3480 827D2758 HSQCMD.exe 00000140 0.00661062 03 0576 82D85020 smss.exe 00000141 0.00665587 04 0632 82AAC790 csrss.exe 00000142 0.00670085 05 0656 82A75DA0 winlogon.exe 00000143 0.00674611 06 0700 82A3C9B0 services.exe 00000144 0.00679081 07 0712 82A549B8 lsass.exe 00000145 0.00683578 08 0868 82A19920 svchost.exe 00000146 0.00688076 09 0944 829E6370 svchost.exe 00000147 0.00692602 10 1292 829D0020 svchost.exe 00000148 0.00697128 11 1460 829A1638 svchost.exe 00000149 0.00701653 12 1564 82A00118 svchost.exe 00000150 0.00706179 13 1636 829F1020 spoolsv.exe 00000151 0.00710705 14 0528 829AD2B0 explorer.exe 00000152 0.00715231 15 1044 82931450 stormliv.exe 00000153 0.00719756 16 1136 8293C6A8 wdfmgr.exe 00000154 0.00724254 17 1192 8290F5A8 vmount2.exe 00000155 0.00728780 18 1400 82914020 vmware-tray.exe 00000156 0.00733305 19 1436 829DE020 hqtray.exe 00000157 0.00737803 20 1448 82943BB0 ctfmon.exe 00000158 0.00742329 21 1208 829608F0 vmnat.exe 00000159 0.00746855 22 1372 829697A8 vmnetdhcp.exe 00000160 0.00751408 23 0972 8296BAF0 vmware-authd.ex 00000161 0.00755906 24 0512 8287A6F8 vmware.exe 00000162 0.00760432 25 1840 82874598 svchost.exe 00000163 0.00764958 26 2364 827A44E8 editplus.exe 00000164 0.00769483 27 3560 8295D3C0 conime.exe 00000165 0.00773981 28 2412 8289A020 Dbgview.exe 00000166 0.00778507 29 2628 829B4B58 q}.exe 00000167 0.00783088 30 -2138559456 8088A2D0 00000168 1.13630307 DriverUnload
|
|
|---|---|
|
|
|
|
|
|
|
|
已经基本解决
|
|
|
|
