内核态实现进程和端口关联

//////////////////////////////////////////////////////////////////////////////////////////
//  作者 beiyu http://beiyu.bokee.com/
//  内核态实现进程和端口关联，在WINDOWS2000.xp,2003下可以用。
//  感谢Leven公布了他的代码，增加了区分tcp，udp，增加了操作系统的兼容性
//  可以在Windows 2000, xp, 2003下面正常使用,编译环境Win2000DDK
//  使用妳的sys loader加载，使用Dbgview查看
//  如果你有什么改进，请email我: beiyuly@gmail.com 
//
//////////////////////////////////////////////////////////////////////////////////////////

#include "ntddk.h"
#include "string.h"

#define SystemHandleInformation  16
#define TCPUDP_FLAG   100
#define WIN2K_SOCKET_FLAG  0x1a //2k
#define WINXP_SOCKET_FLAG  0x1c //xp
#define WIN2K3_SOCKET_FLAG  0x1a //2k3
#define WIN2K_EPROCESS_NAMEOFFSET    0x1fc //2k
#define WINXP_EPROCESS_NAMEOFFSET    0x174 //xp
#define WIN2K3_EPROCESS_NAMEOFFSET   0x1fc //2k3

#define ObjectNameInformation  1
#define ObjectAllTypesInformation 3

/*
typedef struct _OBJECT_NAME_INFORMATION {
 UNICODE_STRING Name;
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;

typedef struct _OBJECT_TYPE_INFORMATION {
 UNICODE_STRING Name;
 ULONG ObjectCount;
 ULONG HandleCount;
 ULONG Reserved1[4];
 ULONG PeakObjectCount;
 ULONG PeakHandleCount;
 ULONG Reserved2[4];
 ULONG InvalidAttributes;
 GENERIC_MAPPING GenericMapping;
 ULONG ValidAccess;
 UCHAR Unknown;
 BOOLEAN MaintainHandleDatabase;
 POOL_TYPE PoolType;
 ULONG PagedPoolUsage;
 ULONG NonPagedPoolUsage;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

typedef struct _OBJECT_ALL_TYPES_INFORMATION {
 ULONG NumberOfTypes;
 OBJECT_TYPE_INFORMATION TypeInformation;
} OBJECT_ALL_TYPES_INFORMATION, *POBJECT_ALL_TYPES_INFORMATION;
*/

#define ntohs(s) \
    ( ( ((s) >> 8) & 0x00FF ) | \
( ((s) << 8) & 0xFF00 ) )

typedef struct _TDI_CONNECTION_INFO {
    ULONG          State;
    ULONG          Event;
    ULONG          TransmittedTsdus;
    ULONG          ReceivedTsdus;
    ULONG          TransmissionErrors;
    ULONG          ReceiveErrors;
    LARGE_INTEGER  Throughput;
    LARGE_INTEGER  Delay;
    ULONG          SendBufferSize;
    ULONG          ReceiveBufferSize;
    BOOLEAN        Unreliable;
} TDI_CONNECTION_INFO, *PTDI_CONNECTION_INFO;

typedef struct _TDI_CONNECTION_INFORMATION {
    LONG   UserDataLength;
    PVOID  UserData;
    LONG   OptionsLength;
    PVOID  Options;
    LONG   RemoteAddressLength;
    PVOID  RemoteAddress;
} TDI_CONNECTION_INFORMATION, *PTDI_CONNECTION_INFORMATION;

typedef struct _SYSTEM_HANDLE_INFORMATION
{
        ULONG ProcessID;        //进程的标识ID
        UCHAR ObjectTypeNumber;        //对象类型
        UCHAR Flags;             //0x01 = PROTECT_FROM_CLOSE,0x02 = INHERIT
        USHORT Handle;             //对象句柄的数值
        PVOID  Object;            //对象句柄所指的内核对象地址 WinNT4/Windows2000是0x1A xp中是0x1c 2003中是
        ACCESS_MASK GrantedAccess;      //创建句柄时所准许的对象的访问权
}SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;

NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
    IN ULONG SystemInformationClass,
    IN OUT PVOID SystemInformation,
    IN ULONG SystemInformationLength,
    OUT PULONG ReturnLength);

NTSYSAPI
NTSTATUS
NTAPI
NtDeviceIoControlFile(
                      IN HANDLE FileHandle,
                      IN HANDLE Event OPTIONAL,
                      IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
                      IN PVOID ApcContext OPTIONAL,
                      OUT PIO_STATUS_BLOCK IoStatusBlock,
                      IN ULONG IoControlCode,
                      IN PVOID InputBuffer OPTIONAL,
                      IN ULONG InputBufferLength,
                      OUT PVOID OutputBuffer OPTIONAL,
                      IN ULONG OutputBufferLength
                      );

NTSYSAPI
NTSTATUS
NTAPI
ZwQueryObject(
     IN HANDLE ObjectHandle,
     IN ULONG ObjectInformationClass,
     OUT PVOID ObjectInformation,
     IN ULONG ObjectInformationLength,
     OUT PULONG ReturnLength OPTIONAL
     );

NTSYSAPI
BOOLEAN
NTAPI
NtDuplicateObject(
  IN HANDLE hSourceProcessHandle,
  IN HANDLE hSourceHandle,
  IN HANDLE hTargetProcessHandle,
  OUT HANDLE * lpTargetHandle,
  IN ULONG dwDesiredAccess,
  IN BOOLEAN bInheritHandle,
  IN ULONG dwOptions
);

NTSYSAPI
NTSTATUS
NTAPI
PsLookupProcessByProcessId(
     IN ULONG ulProcId,
     OUT PEPROCESS * pEProcess
     );

NTSTATUS
DriverEntry(IN PDRIVER_OBJECT DriverObject,
            IN PUNICODE_STRING RegistryPath);

void DriverUnload(IN PDRIVER_OBJECT DriverObject);

//几个全局变量，记录端口相关信息，最后列印出来
ULONG g_pid[1000];
ULONG g_port[1000];
ULONG g_handle[1000];
ULONG g_tcpudp[1000];
ULONG g_num =0 ;
ULONG g_tu[1000]; //g_tu=0 tcp, g_tu=1 udp

//获得所有句柄
ULONG GetHandleList()
{
    ULONG n;
    ULONG pBuffer;
    NTSTATUS status;
 DbgPrint("GetHandleList\n");

    pBuffer =(ULONG)ExAllocatePool(PagedPool,0x1000);
    status = ZwQuerySystemInformation(SystemHandleInformation,(PVOID)pBuffer,0x1000,&n);
    ExFreePool((PVOID)pBuffer);
    if(STATUS_INFO_LENGTH_MISMATCH == status)
    {
        pBuffer =(ULONG)ExAllocatePool(NonPagedPool,n);
        ZwQuerySystemInformation(SystemHandleInformation,(PVOID)pBuffer,n,NULL);
        return pBuffer;
    }
    else
        return 0;
}

//根据句柄得到端口信息
void GetOpenPort(ULONG dwProcessesID,ULONG Handle,int NoCache,ULONG tcpudp)
{
    HANDLE hProc,DupHandle=NULL;
    USHORT openport;
    ULONG i=0;
    NTSTATUS status;
    TDI_CONNECTION_INFO    TdiConnInfo={0};
    TDI_CONNECTION_INFORMATION TdiConnInformation={0};
    ULONG dwRetu=0;   
    IO_STATUS_BLOCK    IoStatusBlock={0};
    CLIENT_ID id;
    OBJECT_ATTRIBUTES objatt = {0};
 POBJECT_NAME_INFORMATION ObjectName;
 char ObjectNameBuf[512];
// char ObjectNameMBS[261];
 ULONG ReturnLen;
 ObjectName = (POBJECT_NAME_INFORMATION)ObjectNameBuf;
 ObjectName->Name.MaximumLength = 500;

    //DbgPrint("GetOpenPort\n");

    id.UniqueProcess = (HANDLE)dwProcessesID;
    id.UniqueThread = 0;
//打开对方进程
    NtOpenProcess(&hProc,PROCESS_DUP_HANDLE,&objatt,&id);
//复制句柄
    NtDuplicateObject(hProc,
        (HANDLE)Handle,
        (HANDLE)0xffffffff,
        &DupHandle,
        0,
        FALSE,
        2);
//根据object的数据得到端口信息
    if(NoCache==0x2)
    {
  //取得句柄关联的对象的信息
  ZwQueryObject(DupHandle, ObjectNameInformation, ObjectName, sizeof(ObjectNameBuf), &ReturnLen);

        TdiConnInformation.RemoteAddressLength= 4;
        status = NtDeviceIoControlFile((HANDLE)DupHandle,  
              NULL,
        NULL,
        NULL,
        &IoStatusBlock,
        0x210012,  // Command code
        &TdiConnInformation,
        sizeof(TdiConnInformation),
        &TdiConnInfo,
        sizeof(TdiConnInfo));

        //进行TDI查询,得到连接的相关信息
        if(status == 0)
        {
            openport = ntohs((USHORT)TdiConnInfo.ReceivedTsdus);

            if(openport == 0)
                return;

            for(i=0;i<g_num;i++)
            {
                if(g_pid[i] == dwProcessesID && g_port[i] == openport)
                    if(tcpudp >= TCPUDP_FLAG && g_tcpudp[i] >= TCPUDP_FLAG || tcpudp < TCPUDP_FLAG && g_tcpudp[i] < TCPUDP_FLAG)
                    return;
     &bsp;      }

            g_pid[i] = dwProcessesID;
            g_port[i] = openport;
            g_handle[i] = Handle;
            g_tcpudp[i] = tcpudp;
            g_num++;
   if (wcscmp(ObjectName->Name.Buffer, L"file://Device//Tcp") == 0)
   {
    g_tu[i] = 0;
   }
   if (wcscmp(ObjectName->Name.Buffer, L"file://Device//Udp") == 0)
   {
    g_tu[i] = 1;
   }
       }
    }
    if(NoCache==0x1)
    {
     ZwQueryObject(DupHandle, ObjectNameInformation, ObjectName, sizeof(ObjectNameBuf), &ReturnLen);

  TdiConnInformation.RemoteAddressLength= 3;
        status = NtDeviceIoControlFile((HANDLE)DupHandle,       
        NULL,
        NULL,
        NULL,
        &IoStatusBlock,
        0x210012,  // Command code
        &TdiConnInformation,
        sizeof(TdiConnInformation),
        &TdiConnInfo,
        sizeof(TdiConnInfo));                    
        //进行TDI查询,得到连接的相关信息
         if(status == 0)
        {
            openport = ntohs((USHORT)TdiConnInfo.ReceivedTsdus);

            if(openport == 0)
                return;

            for(i=0;i            {
                if(g_pid[i] == dwProcessesID && g_port[i] == openport)
                    if(tcpudp >= TCPUDP_FLAG && g_tcpudp[i] >= TCPUDP_FLAG || tcpudp < TCPUDP_FLAG && g_tcpudp[i] < TCPUDP_FLAG)
                    return;
            }

            g_pid[i] = dwProcessesID;
            g_port[i] = openport;
            g_handle[i] = Handle;
            g_tcpudp[i] = tcpudp;
            g_num++;
   if (wcscmp(ObjectName->Name.Buffer, L"file://Device//Tcp") == 0)
   {
    g_tu[i] = 0;
   }
   if (wcscmp(ObjectName->Name.Buffer, L"file://Device//Udp") == 0)
   {
    g_tu[i] = 1;
   }
       }
    }
}

void Start(ULONG pBuffer)
{
    ULONG i;
 //头4个字节是所有的句柄的数目UNONG 32位
 //从第5个字节开始就是结构体了
    PSYSTEM_HANDLE_INFORMATION pProcesses = (PSYSTEM_HANDLE_INFORMATION)(pBuffer+4);
    ULONG nocache;
    ULONG tcpudp;
    PEPROCESS epro;
    char *p;
    ULONG uMajorVersion;
    ULONG uMinorVersion;
    ULONG uBuildNumber;
    ULONG uOsVer;

    DbgPrint("Start11\n");

 PsGetVersion(&uMajorVersion, &uMinorVersion, &uBuildNumber, NULL);
 if(uMajorVersion == 5)
 {
  if(uMinorVersion == 0)
  {
   DbgPrint("2k\n");
   uOsVer = 0;//2k
  }
  else if(uMinorVersion == 1)
  {
   uOsVer = 1;//xp
   DbgPrint("xp\n");
  }
  else if(uMinorVersion == 2)
  {
   uOsVer = 2;//2k3
   DbgPrint("2k3\n");
  }
  else
  {
   uOsVer = 3;//nt
   DbgPrint("NT\n");
  }
 }
 else
 {
  uOsVer = 99;
  DbgPrint("Unknow OS\n");
 }

    for (i=0;i<((ULONG)(*(ULONG*)pBuffer));i++)
    {
  //2000 xp 2003 三种操作系统
        if(pProcesses[i].ObjectTypeNumber == WIN2K_SOCKET_FLAG
   || pProcesses[i].ObjectTypeNumber == WINXP_SOCKET_FLAG
   || pProcesses[i].ObjectTypeNumber == WIN2K3_SOCKET_FLAG)
       {           
//得到SYSTEM_HANDLE_INFORMATION.object的相关数据
//这里要密切注意内存情况，一不小心就蓝屏。因为句柄经常变化，有些可能已经被销毁了
            nocache = (ULONG)pProcesses[i].Object;
            if(!MmIsAddressValid((VOID*)nocache))
                continue;
            nocache = (ULONG)(*((ULONG*)(nocache)+4));

            tcpudp = (ULONG)(*((ULONG*)(pProcesses[i].Object)+1));
            if(!MmIsAddressValid((VOID*)tcpudp))
                continue;
            tcpudp = (ULONG)(*((ULONG*)(tcpudp)+1));

            if(nocache == 2 || nocache == 1)
            {
                GetOpenPort(pProcesses[i].ProcessID,pProcesses[i].Handle,nocache,tcpudp);
            }
        }
    }

    for(i=0;i    {
//根据PID得到进程名
    nbsp;   PsLookupProcessByProcessId(g_pid[i],&epro);

  if(uOsVer == 0)
  { //2k中进程名在EPROCESS结构中的位置
   p = (char*)epro + WIN2K_EPROCESS_NAMEOFFSET;
   //DbgPrint("2k\n");
  }
  if(uOsVer == 1)
  { //xp中进程名在EPROCESS结构中的位置
   p = (char*)epro + WINXP_EPROCESS_NAMEOFFSET;
   //DbgPrint("xp\n");
  }
  if(uOsVer == 2)
  { //2k3中进程名在EPROCESS结构中的位置
   p = (char*)epro + WIN2K3_EPROCESS_NAMEOFFSET;
   //DbgPrint("2k3\n");
  }
  if(uOsVer == 3)
  {
   p = (char*)epro + WIN2K_EPROCESS_NAMEOFFSET; //NT
   //DbgPrint("nt\n");
  }

  if(uOsVer == 99)
  {
   //DbgPrint("Unknow OS\n");
   break;
  }

   if(g_tu[i] == 0)
   DbgPrint("TCP:\tProcName=%s\tPID=%d\tport=%d\t%d\n",p,g_pid[i],g_port[i],g_tcpudp[i]);
        if(g_tu[i] == 1)
     DbgPrint("UDP:\tProcName=%s\tPID=%d\tport=%d\t%d\n",p,g_pid[i],g_port[i],g_tcpudp[i]);
    
    }

    return;
}
//////////////////////////////////

NTSTATUS
DriverEntry(IN PDRIVER_OBJECT DriverObject,
            IN PUNICODE_STRING RegistryPath)
{
    ULONG pbuf;

    DbgPrint("DriverEntry\n");
   
    DriverObject->DriverUnload = DriverUnload;
   
    pbuf = GetHandleList();
    Start(pbuf);
   
    return STATUS_SUCCESS;
}

void DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
    NTSTATUS            status;
    //ResumeDestFunction();
    if(pDriverObject->DeviceObject != NULL)
 {
  IoDeleteDevice( pDriverObject->DeviceObject );
 }

 DbgPrint("DriverUnload\n");
}

参考文献：
1 Windows DDK
2 http://coffeeqiqi.blogchina.com/
3 Leven-端口关联进程-在核心态的实现方法
4 Msdn
5 port/connection hiding   http://dev.csdn.net/Develop/article/28/84294.shtm
6 在NT系列操作系统里让自己“消失”
7 http://www.rootkit.com/