用ZwQueryVirtualMemory枚举进程模块

痛定思痛。 2021-12-22 07:17 392阅读 0赞

枚举进程模块通常可以使用诸如:CreateToolhelp32Snapshot,Module32First,Module32Next 等"Tool Help Functions"接口来实现, 并且这也是最通用的方法(从Win95就开始支持了), 但是今天我们要介绍的是ntdll.dll导出的未文档化接口ZwQueryVirtualMemory,。相比前面所介绍的方法，该方法可以检测出隐藏的模块（类似IceSword）。

我们先来看下这个接口的原型:

//-------------------------------------------------------------------------------------------------

NTSTATUS  
NTAPI  
ZwQueryVirtualMemory(  
IN HANDLE ProcessHandle,  
IN PVOID BaseAddress,  
IN MEMORY\_INFORMATION\_CLASS MemoryInformationClass,  
OUT PVOID MemoryInformation,  
IN ULONG MemoryInformationLength,  
OUT PULONG ReturnLength OPTIONAL );

typedef enum \_MEMORY\_INFORMATION\_CLASS \{  
MemoryBasicInformation,  
MemoryWorkingSetList,  
MemorySectionName,  
MemoryBasicVlmInformation  
\} MEMORY\_INFORMATION\_CLASS;

参数说明:  
ProcessHandle - 目标进程句柄  
BaseAddress - 要查询的虚拟内存基址  
MemoryInformationClass - 要查询的内存信息类  
MemoryInformation - 用户提供的缓冲区,返回内存相关信息  
MemoryInformationLength - 缓冲区长度(字节为单位)  
ReturnLength - 实际返回的内存信息长度(字节为单位)  
返回值:  
NTSTATUS - 返回STATUS\_SUCCESS或一个错误状态码

//-------------------------------------------------------------------------------------------------

我们要枚举进程模块信息, 需要用到两类内存信息MemoryBasicInformation和MemorySectionName,  
前者返回内存的基本信息, 比如: 内存区的基址,大小以及页面的各种属性等等, 而后者则返回内存段的名字,  
也就是我们所要找的模块名. 利用前者我们可以过滤出类型为MEM\_IMAGE的内存段并得到内存段的基址和属性, 利用后者我们可以得到模块名.

另外，需要注意的是该方法找出来的设备名是诸如\\Device\\HarddiskVolume1之类的名称，所以我们需要把它转换为我们习惯的DOS设备名，如C:\\，D:\\等。不能自以为是的认为\\Device\\HarddiskVolume1对应C盘\\Device\\HarddiskVolume2对应D盘。该转换是通过调用QueryDosDevice来实现的。

具体看代码：

// CheckDll.cpp : 定义控制台应用程序的入口点。

\#include "stdafx.h"  
\#include <windows.h>  
\#include <winternl.h>  
\#include <string>  
\#include <map>  
using namespace std;  
  
\#pragma warning(disable:4312)

typedef enum \_MEMORY\_INFORMATION\_CLASS  
\{  
MemoryBasicInformation,  
MemoryWorkingSetList,  
MemorySectionName  
\}MEMORY\_INFORMATION\_CLASS;

typedef  
NTSTATUS  
(WINAPI \*ZWQUERYVIRTUALMEMORY) (  
IN HANDLE ProcessHandle,  
IN PVOID BaseAddress,  
IN MEMORY\_INFORMATION\_CLASS MemoryInformationClass,  
OUT PVOID MemoryInformation,  
IN ULONG MemoryInformationLength,  
OUT PULONG ReturnLength OPTIONAL  
);

map<wstring, wstring> g\_mapDevice2Path;

void ConvertVolumePaths(  
IN PWCHAR DeviceName,  
IN PWCHAR VolumeName  
)

\{  
DWORD CharCount = MAX\_PATH + 1;  
PWCHAR Names = NULL;  
PWCHAR NameIdx = NULL;  
BOOL Success = FALSE;

for (;;)  
\{  
//  
// Allocate a buffer to hold the paths.  
Names = (PWCHAR) new BYTE \[CharCount \* sizeof(WCHAR)\];  
  
if ( !Names )  
\{  
//  
// If memory can't be allocated, return.  
return;  
\}

//  
// Obtain all of the paths  
// for this volume.  
Success = GetVolumePathNamesForVolumeNameW(  
VolumeName, Names, CharCount, &CharCount  
);

if ( Success )  
\{  
break;  
\}

if ( GetLastError() != ERROR\_MORE\_DATA )  
\{  
break;  
\}

//  
// Try again with the  
// new suggested size.  
delete \[\] Names;  
Names = NULL;  
\}

if ( Success )  
\{  
//  
// Display the various paths.  
for ( NameIdx = Names;  
NameIdx\[0\] != L'\\0';  
NameIdx += wcslen(NameIdx) + 1 )  
\{  
g\_mapDevice2Path\[DeviceName\] = NameIdx;  
\}  
\}

if ( Names != NULL )  
\{  
delete \[\] Names;  
Names = NULL;  
\}  
return;  
\}

BOOL InitDevice2Path()  
\{  
BOOL bRet = FALSE;  
DWORD CharCount = 0;  
WCHAR DeviceName\[MAX\_PATH\] = L"";  
DWORD Error = ERROR\_SUCCESS;  
HANDLE FindHandle = INVALID\_HANDLE\_VALUE;  
BOOL Found = FALSE;  
size\_t Index = 0;  
BOOL Success = FALSE;  
WCHAR VolumeName\[MAX\_PATH\] = L"";

//  
// Enumerate all volumes in the system.  
FindHandle = FindFirstVolumeW(VolumeName, ARRAYSIZE(VolumeName));

if (FindHandle == INVALID\_HANDLE\_VALUE)  
\{  
Error = GetLastError();  
wprintf(L"FindFirstVolumeW failed with error code %d\\n", Error);  
return bRet;  
\}

for (;;)  
\{  
//  
// Skip the [\\\\?\\][Link 1] prefix and remove the trailing backslash.  
Index = wcslen(VolumeName) - 1;

if (VolumeName\[0\] != L'\\\\' ||  
VolumeName\[1\] != L'\\\\' ||  
VolumeName\[2\] != L'?' ||  
VolumeName\[3\] != L'\\\\' ||  
VolumeName\[Index\] != L'\\\\')  
\{  
Error = ERROR\_BAD\_PATHNAME;  
wprintf(L"FindFirstVolumeW/FindNextVolumeW returned a bad path: %s\\n", VolumeName);  
break;  
\}

//  
// QueryDosDeviceW doesn't allow a trailing backslash,  
// so temporarily remove it.  
VolumeName\[Index\] = L'\\0';  
CharCount = QueryDosDeviceW(&VolumeName\[4\], DeviceName, ARRAYSIZE(DeviceName));  
VolumeName\[Index\] = L'\\\\';  
if ( CharCount == 0 )  
\{  
Error = GetLastError();  
wprintf(L"QueryDosDeviceW failed with error code %d\\n", Error);  
break;  
\}  
ConvertVolumePaths(DeviceName, VolumeName);  
//  
// Move on to the next volume.  
Success = FindNextVolumeW(FindHandle, VolumeName, ARRAYSIZE(VolumeName));

if ( !Success )  
\{  
Error = GetLastError();  
if (Error != ERROR\_NO\_MORE\_FILES)  
\{  
wprintf(L"FindNextVolumeW failed with error code %d\\n", Error);  
break;  
\}

//  
// Finished iterating  
// through all the volumes.  
Error = ERROR\_SUCCESS;  
break;  
\}  
\}  
FindVolumeClose(FindHandle);  
FindHandle = INVALID\_HANDLE\_VALUE;  
return bRet;  
\}

void DeviceName2PathName(OUT WCHAR\* szPathName, IN const WCHAR\* szDeviceName)  
\{

memset(szPathName, 0, MAX\_PATH \* 2);  
wstring strDeviceName = szDeviceName;  
size\_t pos = strDeviceName.find(L'\\\\', 9);  
wstring strTemp1 = strDeviceName.substr(0, pos);  
wstring strTemp2 = strDeviceName.substr(pos + 1);  
wstring strDriverLetter = g\_mapDevice2Path\[strTemp1\];  
wstring strPathName = strDriverLetter + strTemp2;  
wcscpy\_s(szPathName, MAX\_PATH, strPathName.c\_str());  
\}

/\*\*  
\* 枚举指定进程加载的模块  
\* @param dwProcessId 进程Id  
\* @return void  
\*/

void EnumProcessModules(IN DWORD dwProcessId)  
\{  
DWORD dwStartAddr = 0x00000000;  
BYTE szBuffer\[MAX\_PATH \* 2 + 4\] = \{0\};  
WCHAR szModuleName\[MAX\_PATH\] = \{0\};  
WCHAR szPathName\[MAX\_PATH\] = \{0\};  
MEMORY\_BASIC\_INFORMATION mbi;  
PUNICODE\_STRING usSectionName;  
ZWQUERYVIRTUALMEMORY fnZwQueryVirtualMemory;  
HANDLE hProcess =NULL;

hProcess = OpenProcess(PROCESS\_ALL\_ACCESS, TRUE, dwProcessId);  
if (hProcess == NULL)  
\{  
wprintf(L"Open Process %d Error\\n", dwProcessId);  
return;  
\}

dwStartAddr = 0x00000000;

fnZwQueryVirtualMemory = (ZWQUERYVIRTUALMEMORY)  
::GetProcAddress(GetModuleHandleA("ntdll.dll"),  
"ZwQueryVirtualMemory" );  
if(fnZwQueryVirtualMemory)  
\{  
do  
\{  
if (fnZwQueryVirtualMemory(  
hProcess,  
(PVOID)dwStartAddr,  
MemoryBasicInformation,  
&mbi,  
sizeof(mbi),  
0) >= 0 )  
\{  
if(mbi.Type == MEM\_IMAGE)  
\{  
if (fnZwQueryVirtualMemory(  
hProcess,  
(PVOID)dwStartAddr,  
MemorySectionName,  
szBuffer,  
sizeof(szBuffer),  
0) >= 0 )  
\{  
usSectionName = (PUNICODE\_STRING)szBuffer;  
if( \_wcsnicmp(szModuleName, usSectionName->Buffer, usSectionName->Length / sizeof(WCHAR)) )  
\{  
wcsncpy\_s(szModuleName, usSectionName->Buffer, usSectionName->Length / sizeof(WCHAR) );  
szModuleName\[usSectionName->Length / sizeof(WCHAR)\] = UNICODE\_NULL;  
DeviceName2PathName(szPathName, szModuleName);  
wprintf(L"\[0x%.8x\]\\t%s\\n", dwStartAddr, szPathName);  
\}  
\}  
\}  
\}  
// 递增基址,开始下一轮查询!  
dwStartAddr += 0x1000;  
\}while( dwStartAddr < 0x80000000 );  
\}  
CloseHandle(hProcess);  
\}

/\*\*  
\* 提升当前进程权限函数("SeDebugPrivilege"读、写控制权限)  
\* @param void  
\* @return TRUE-成功；FALSE-失败  
\*/

BOOL EnableDebugPriv()  
\{  
HANDLE hToken;  
TOKEN\_PRIVILEGES tkp;  
LUID Luid;

if (!OpenProcessToken(GetCurrentProcess(),  
TOKEN\_ADJUST\_PRIVILEGES | TOKEN\_QUERY, &hToken))  
\{  
return FALSE;  
\}

if (!LookupPrivilegeValue(NULL, SE\_DEBUG\_NAME, &Luid ))  
\{  
CloseHandle(hToken);  
return FALSE;  
\}

tkp.PrivilegeCount = 1;  
tkp.Privileges\[0\].Luid = Luid;  
tkp.Privileges\[0\].Attributes = SE\_PRIVILEGE\_ENABLED;

if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))  
\{  
CloseHandle(hToken);  
return FALSE;  
\}  
return TRUE;  
\}

int \_tmain(int argc, \_TCHAR\* argv\[\])  
\{  
DWORD dwProcessId = 4;  
if (argc != 2)  
\{  
wprintf(L"usage:CheckDll ProcessId");  
return 1;  
\}  
dwProcessId = \_ttoi(argv\[1\]);  
InitDevice2Path();  
// 首先提示权限  
if (EnableDebugPriv())  
\{  
EnumProcessModules(dwProcessId);  
\}  
g\_mapDevice2Path.clear();  
return 0;

[Link 1]: http://file//%3F/