EPROCESS
在内核中 进程是靠EPROCESS来识别的 dt _EPROCESS fffffa801aaecb30 nt!_EPROCESS +0x000 Pcb : _KPROCESS +0x160 ProcessLock : _EX_PUSH_LOCK +0x168 CreateTime : _LARGE_INTEGER 0x1d298d0`61177c21 +0x170 ExitTime : _LARGE_INTEGER 0x0 +0x178 RundownProtect : _EX_RUNDOWN_REF +0x180 UniqueProcessId : 0x00000000`00000b8c Void +0x188 ActiveProcessLinks : _LIST_ENTRY [ 0xfffff800`0402bb90 - 0xfffffa80`1912fcb8 ] +0x198 ProcessQuotaUsage : [2] 0x2908 +0x1a8 ProcessQuotaPeak : [2] 0x2a38 +0x1b8 CommitCharge : 0x1c5 +0x1c0 QuotaBlock : 0xfffff800`04009c00 _EPROCESS_QUOTA_BLOCK +0x1c8 CpuQuotaBlock : (null) +0x1d0 PeakVirtualSize : 0x2b8f000 +0x1d8 VirtualSize : 0x2b0f000 +0x1e0 SessionProcessLinks : _LIST_ENTRY [ 0xfffff880`04469010 - 0xfffffa80`1912fd10 ] +0x1f0 DebugPort : (null) +0x1f8 ExceptionPortData : 0xfffffa80`19937e60 Void +0x1f8 ExceptionPortValue : 0xfffffa80`19937e60 +0x1f8 ExceptionPortState : 0y000 +0x200 ObjectTable : 0xfffff8a0`032d50e0 _HANDLE_TABLE +0x208 Token : _EX_FAST_REF +0x210 WorkingSetPage : 0x67712 +0x218 AddressCreationLock : _EX_PUSH_LOCK +0x220 RotateInProgress : (null) +0x228 ForkInProgress : (null) +0x230 HardwareTrigger : 0 +0x238 PhysicalVadRoot : (null) +0x240 CloneRoot : (null) +0x248 NumberOfPrivatePages : 0x182 +0x250 NumberOfLockedPages : 0 +0x258 Win32Process : 0xfffff900`c07e2010 Void +0x260 Job : (null) +0x268 SectionObject : 0xfffff8a0`032f1ea0 Void +0x270 SectionBaseAddress : 0x00000000`ff490000 Void +0x278 Cookie : 0x92aa5a69 +0x27c UmsScheduledThreads : 0 +0x280 WorkingSetWatch : (null) +0x288 Win32WindowStation : 0x00000000`00000038 Void +0x290 InheritedFromUniqueProcessId : 0x00000000`000001fc Void +0x298 LdtInformation : (null) +0x2a0 Spare : (null) +0x2a8 ConsoleHostProcess : 0 +0x2b0 DeviceMap : 0xfffff8a0`00008aa0 Void +0x2b8 EtwDataSource : (null) +0x2c0 FreeTebHint : 0x000007ff`fff9e000 Void +0x2c8 FreeUmsTebHint : 0x00000001`00000000 Void +0x2d0 PageDirectoryPte : _HARDWARE_PTE +0x2d0 Filler : 0 +0x2d8 Session : 0xfffff880`04469000 Void +0x2e0 ImageFileName : [15] "VSSVC.exe" +0x2ef PriorityClass : 0x2 '' +0x2f0 JobLinks : _LIST_ENTRY [ 0x00000000`00000000 - 0x0 ] +0x300 LockedPagesList : (null) +0x308 ThreadListHead : _LIST_ENTRY [ 0xfffffa80`1aaea480 - 0xfffffa80`1aaf47f0 ] +0x318 SecurityPort : (null) +0x320 Wow64Process : (null) +0x328 ActiveThreads : 6 +0x32c ImagePathHash : 0x4d079cc +0x330 DefaultHardErrorProcessing : 0 +0x334 LastThreadExitStatus : 0n0 +0x338 Peb : 0x000007ff`fffd4000 _PEB +0x340 PrefetchTrace : _EX_FAST_REF +0x348 ReadOperationCount : _LARGE_INTEGER 0x1 +0x350 WriteOperationCount : _LARGE_INTEGER 0x1 +0x358 OtherOperationCount : _LARGE_INTEGER 0x33 +0x360 ReadTransferCount : _LARGE_INTEGER 0x74 +0x368 WriteTransferCount : _LARGE_INTEGER 0xa0 +0x370 OtherTransferCount : _LARGE_INTEGER 0x818 +0x378 CommitChargeLimit : 0 +0x380 CommitChargePeak : 0x20a +0x388 AweInfo : (null) +0x390 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO +0x398 Vm : _MMSUPPORT +0x420 MmProcessLinks : _LIST_ENTRY [ 0xfffff800`040324c0 - 0xfffffa80`1912ff50 ] +0x430 HighestUserAddress : 0x000007ff`ffff0000 Void +0x438 ModifiedPageCount : 0 +0x43c Flags2 : 0xd000 +0x43c JobNotReallyActive : 0y0 +0x43c AccountingFolded : 0y0 +0x43c NewProcessReported : 0y0 +0x43c ExitProcessReported : 0y0 +0x43c ReportCommitChanges : 0y0 +0x43c LastReportMemory : 0y0 +0x43c ReportPhysicalPageChanges : 0y0 +0x43c HandleTableRundown : 0y0 +0x43c NeedsHandleRundown : 0y0 +0x43c RefTraceEnabled : 0y0 +0x43c NumaAware : 0y0 +0x43c ProtectedProcess : 0y0 +0x43c DefaultPagePriority : 0y101 +0x43c PrimaryTokenFrozen : 0y1 +0x43c ProcessVerifierTarget : 0y0 +0x43c StackRandomizationDisabled : 0y0 +0x43c AffinityPermanent : 0y0 +0x43c AffinityUpdateEnable : 0y0 +0x43c PropagateNode : 0y0 +0x43c ExplicitAffinity : 0y0 +0x440 Flags : 0x144d0801 +0x440 CreateReported : 0y1 +0x440 NoDebugInherit : 0y0 +0x440 ProcessExiting : 0y0 +0x440 ProcessDelete : 0y0 +0x440 Wow64SplitPages : 0y0 +0x440 VmDeleted : 0y0 +0x440 OutswapEnabled : 0y0 +0x440 Outswapped : 0y0 +0x440 ForkFailed : 0y0 +0x440 Wow64VaSpace4Gb : 0y0 +0x440 AddressSpaceInitialized : 0y10 +0x440 SetTimerResolution : 0y0 +0x440 BreakOnTermination : 0y0 +0x440 DeprioritizeViews : 0y0 +0x440 WriteWatch : 0y0 +0x440 ProcessInSession : 0y1 +0x440 OverrideAddressSpace : 0y0 +0x440 HasAddressSpace : 0y1 +0x440 LaunchPrefetched : 0y1 +0x440 InjectInpageErrors : 0y0 +0x440 VmTopDown : 0y0 +0x440 ImageNotifyDone : 0y1 +0x440 PdeUpdateNeeded : 0y0 +0x440 VdmAllowed : 0y0 +0x440 CrossSessionCreate : 0y0 +0x440 ProcessInserted : 0y1 +0x440 DefaultIoPriority : 0y010 +0x440 ProcessSelfDelete : 0y0 +0x440 SetTimerResolutionLink : 0y0 +0x444 ExitStatus : 0n259 +0x448 VadRoot : _MM_AVL_TABLE +0x488 AlpcContext : _ALPC_PROCESS_CONTEXT +0x4a8 TimerResolutionLink : _LIST_ENTRY [ 0x00000000`00000000 - 0x0 ] +0x4b8 RequestedTimerResolution : 0 +0x4bc ActiveThreadsHighWatermark : 7 +0x4c0 SmallestTimerResolution : 0 +0x4c8 TimerResolutionStackRecord : (null) 判断代码是否运行在某个进程的上下文中 VOID DisplayItsProcessName() { PEPROCESS pEProcess = PsGetCurrentProcess(); PTSTR ProcessName = (PTSTR)((ULONG)pEProcess + 0x174); //X64位下应该+0x2e0 KdPrint(("%s\n",ProcessName)); } 断链隐藏进程 利用 ActiveProcessLinks 双向链表断链
枚举进程模块
VadRoot 利用的是红黑树实现内存模块管理
爱程序 不爱bug
爱生活 不爱黑眼圈
我和你们一样 我和你们不一样
我不是凡客 我要做geek