在应用层,枚举进程及其通信端口一般可以用iphlpapi.dll中提供的函数来获取。如获取Tcp连接,则调用GetTcpTable或者AllocateAndGetTcpTableFromStack来查询。这些API都是通过调用NtDeviceIoControlFile这个NativeAPI来进入内核查询信息的,如果在内核用SSDT Hook来挂钩此函数,从而隐藏特定的IP、端口信息的话,那么在应用层,常规的查询方法就查不到隐藏的端口了。
本文通过直接向设备对象\Device\Tcp发送IOCTL Code=IOCTL_TCP_QUERY_INFORMATION_EX的命令,直接获取进程,端口信息。本文也同时实现了UDP端口的查询。
具体请参考下面的代码,使用WinDDK 6001.18001编译。
1
#include <ntddk.h>
2
#include <tdiinfo.h>
3
#include <tdistat.h>
4![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
5
#define DD_TCP_DEVICE_NAME L"\\Device\\Tcp"
6
#define DD_UDP_DEVICE_NAME L"\\Device\\Udp"
7![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
8
#define TCP_MIB_ADDRTABLE_ENTRY_EX_ID 0x102
9![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
10![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
/**//* TCP/UDP/RawIP IOCTL code definitions */
11![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
12
#define FSCTL_TCP_BASE FILE_DEVICE_NETWORK
13![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
14
#define _TCP_CTL_CODE(function, method, access) \
15
CTL_CODE(FSCTL_TCP_BASE, function, method, access)
16![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
17
#define IOCTL_TCP_QUERY_INFORMATION_EX \
18
_TCP_CTL_CODE(0, METHOD_NEITHER, FILE_ANY_ACCESS)
19![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
20
#define ntohs(s) \
21
(((s >> 8) & 0x00FF) | \
22
((s << 8) & 0xFF00))
23
24![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
enum
{TCPPORT, UDPPORT};
25![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
26
typedef ULONG DWORD;
27![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
28
typedef struct _MIB_TCPROW_OWNER_PID
29![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
![](http://www.cppblog.com/Images/OutliningIndicators/ContractedBlock.gif)
{
30
DWORD dwState;
31
DWORD dwLocalAddr;
32
DWORD dwLocalPort;
33
DWORD dwRemoteAddr;
34
DWORD dwRemotePort;
35
DWORD dwOwningPid;
36
} MIB_TCPROW_OWNER_PID, *PMIB_TCPROW_OWNER_PID;
37![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
38![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
/**//////////////////////////////////////////////////////////////////////////////////// 39
//
40
// 功能实现:根据设备名获取文件句柄或文件对象指针
41
// 输入参数:FileHandle是要输出的文件句柄指针;
42
// FileObject是要输出的文件对象指针
43
// DeviceName是要获取设备的设备名
44
// 输出参数:返回NTSTATUS类型的值
45
//
46![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
/**//////////////////////////////////////////////////////////////////////////////////// 47
NTSTATUS
48
GetObjectByName(OUT HANDLE *FileHandle, OUT PFILE_OBJECT *FileObject, IN WCHAR *DeviceName)
49![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
![](http://www.cppblog.com/Images/OutliningIndicators/ContractedBlock.gif)
{
50
UNICODE_STRING deviceTCPUnicodeString;
51
OBJECT_ATTRIBUTES TCP_object_attr;
52
NTSTATUS status;
53
IO_STATUS_BLOCK IoStatus;
54
55
ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL);
56
RtlInitUnicodeString(&deviceTCPUnicodeString, DeviceName);
57
InitializeObjectAttributes(&TCP_object_attr,
58
&deviceTCPUnicodeString,
59
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
60
0,
61
0);
62
status = ZwCreateFile(FileHandle,
63
GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE,
64
&TCP_object_attr,
65
&IoStatus,
66
0,
67
FILE_ATTRIBUTE_NORMAL,
68
FILE_SHARE_READ,
69
FILE_OPEN,
70
0,
71
0,
72
0);
73
if(!NT_SUCCESS(status))
74![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
75
KdPrint(("Failed to open"));
76
return STATUS_UNSUCCESSFUL;
77
}
78
status = ObReferenceObjectByHandle(*FileHandle,
79
FILE_ANY_ACCESS,
80
0,
81
KernelMode,
82
(PVOID*)FileObject,
83
NULL);
84
85
return status;
86
}
87![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
88![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
/**//////////////////////////////////////////////////////////////////////////////////// 89
//
90
// 功能实现:枚举网络连接端口信息
91
// 输入参数:OutLength为输出缓冲区的大小
92
// PortType为要枚举的端口类型
93
// TCPPORT-TCP端口
94
// UDPPORT-UDP端口
95
// 输出参数:输出端口信息,在函数内部分配空间,需要在外部释放
96
//
97![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
/**//////////////////////////////////////////////////////////////////////////////////// 98
PVOID
99
EnumPortInformation(OUT PULONG OutLength, IN USHORT PortType)
100![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
![](http://www.cppblog.com/Images/OutliningIndicators/ContractedBlock.gif)
{
101
ULONG BufLen = PAGE_SIZE;
102
PVOID pInputBuff=NULL;
103
PVOID pOutputBuff=NULL;
104
PVOID pOutBuf=NULL;
105
NTSTATUS status = STATUS_SUCCESS;
106
HANDLE FileHandle=NULL;
107
UNICODE_STRING DeviceName;
108
PFILE_OBJECT pFileObject=NULL;
109
PDEVICE_OBJECT pDeviceObject=NULL;
110
KEVENT Event ;
111
IO_STATUS_BLOCK StatusBlock;
112
PIRP pIrp;
113
PIO_STACK_LOCATION StackLocation ;
114
ULONG NumOutputBuffers;
115
ULONG i;
116
TCP_REQUEST_QUERY_INFORMATION_EX TdiId;
117![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
118
RtlZeroMemory(&TdiId, sizeof(TCP_REQUEST_QUERY_INFORMATION_EX));
119![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
120
if(TCPPORT == PortType)
121![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
122
TdiId.ID.toi_entity.tei_entity = CO_TL_ENTITY;
123
}
124
else if(UDPPORT == PortType)
125![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
126
TdiId.ID.toi_entity.tei_entity = CL_TL_ENTITY;
127
}
128
else
129![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
130
KdPrint(("需要获取的端口类型无效\n"));
131
return NULL;
132
}
133![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
134
TdiId.ID.toi_entity.tei_instance = ENTITY_LIST_ID;
135
TdiId.ID.toi_class = INFO_CLASS_PROTOCOL;
136
TdiId.ID.toi_type = INFO_TYPE_PROVIDER;
137
TdiId.ID.toi_id = TCP_MIB_ADDRTABLE_ENTRY_EX_ID;
138![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
139
pInputBuff = (PVOID)&TdiId;
140![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
141
__try
142![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
143
if(UDPPORT == PortType)
144![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
145
BufLen *= 3;
146
}
147
pOutputBuff = ExAllocatePool(NonPagedPool, BufLen);
148
if(NULL == pOutputBuff)
149![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
150
KdPrint(("输出缓冲区内存分配失败!\n"));
151
*OutLength = 0;
152
__leave;
153
}
154![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
155
if(TCPPORT == PortType)
156![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
157
status = GetObjectByName(&FileHandle, &pFileObject, DD_TCP_DEVICE_NAME);
158
}
159
else if(UDPPORT == PortType)
160![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
161
status = GetObjectByName(&FileHandle, &pFileObject, DD_UDP_DEVICE_NAME);
162
}
163
if (!NT_SUCCESS(status))
164![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
165
KdPrint(("获取设备名失败!\n"));
166
*OutLength = 0;
167
__leave;
168
}
169![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
170
pDeviceObject = IoGetRelatedDeviceObject(pFileObject);
171
if (NULL == pDeviceObject)
172![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
173
KdPrint(("获取设备对象失败!\n"));
174
*OutLength = 0;
175
__leave;
176
}
177![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
178
KdPrint(("Tcpip Driver Object:%08lX\n", pDeviceObject->DriverObject));
179
180
KeInitializeEvent(&Event, NotificationEvent, FALSE);
181
182
pIrp = IoBuildDeviceIoControlRequest(IOCTL_TCP_QUERY_INFORMATION_EX, \
183
pDeviceObject, pInputBuff, sizeof(TCP_REQUEST_QUERY_INFORMATION_EX), \
184
pOutputBuff, BufLen, FALSE, &Event, &StatusBlock);
185
if (NULL == pIrp)
186![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
187
KdPrint(("IRP生成失败!\n"));
188
*OutLength = 0;
189
__leave;
190
}
191![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
192
StackLocation = IoGetNextIrpStackLocation(pIrp);
193
StackLocation->FileObject = pFileObject;//不设置这里会蓝屏
194
StackLocation->DeviceObject = pDeviceObject;
195![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
196
status = IoCallDriver(pDeviceObject, pIrp);
197
198
KdPrint(("STATUS:%08lX\n", status));
199
200
if (STATUS_BUFFER_OVERFLOW == status)
201![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
202
KdPrint(("缓冲区太小!%d\n",StatusBlock.Information));
203
}
204![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
205
if (STATUS_PENDING == status)
206![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
207
KdPrint(("STATUS_PENDING"));
208
KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE, NULL);
209
status = StatusBlock.Status;
210
}
211![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
212
if(STATUS_CANCELLED == status)
213![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
214
KdPrint(("STATUS_CANCELLED"));
215
}
216
217
if(status == STATUS_SUCCESS)
218![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
219
*OutLength = StatusBlock.Information;
220
pOutBuf = pOutputBuff;
221
}
222
}
223
__finally
224![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
225
ObDereferenceObject(pFileObject);
226
if(FileHandle)
227![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
228
ZwClose(FileHandle);
229
}
230
}
231
return pOutBuf;
232
}
233
234
NTSTATUS DriverUnload(PDRIVER_OBJECT pDrvObj)
235![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
![](http://www.cppblog.com/Images/OutliningIndicators/ContractedBlock.gif)
{
236
DbgPrint("DriverUnload\n");
237
return STATUS_SUCCESS;
238
}
239
240
NTSTATUS DriverEntry(PDRIVER_OBJECT pDrvObj, PUNICODE_STRING pRegPath)
241![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
![](http://www.cppblog.com/Images/OutliningIndicators/ContractedBlock.gif)
{
242
PVOID pTcpBuf = NULL;
243
ULONG ulTcpBuf = 0;
244
245
DbgPrint("DriverEntry\n");
246
247
pDrvObj->DriverUnload = DriverUnload;
248![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
249
pTcpBuf = EnumPortInformation(&ulTcpBuf, TCPPORT);
250
251
if (pTcpBuf != NULL)
252![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
253
PMIB_TCPROW_OWNER_PID pTcpInfo = NULL;
254
// 打印tcp端口信息
255
pTcpInfo = (PMIB_TCPROW_OWNER_PID)pTcpBuf;
256
257
for(; pTcpInfo->dwOwningPid; pTcpInfo++)
258![](http://www.cppblog.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
259
KdPrint(("Pid:%d,Port:%d\n", pTcpInfo->dwOwningPid, ntohs(pTcpInfo->dwLocalPort)));
260
}
261
ExFreePool(pTcpBuf);
262
}
263![](http://www.cppblog.com/Images/OutliningIndicators/InBlock.gif)
264
return STATUS_SUCCESS;
265
}
266![](http://www.cppblog.com/Images/OutliningIndicators/None.gif)
posted on 2010-07-09 18:28
水 阅读(5812)
评论(3) 编辑 收藏 引用 所属分类:
windows驱动