Posted on 2009-10-28 14:49
S.l.e!ep.¢% 阅读(294)
评论(0) 编辑 收藏 引用 所属分类:
RootKit
应用层的代码,与之前的代码不同之前,并没有直接使用 ZwQuerySystemInformation() 而是公开的API EnumProcess
#include
<
windows.h
>
#include
<
stdio.h
>
#include
"
psapi.h
"
#pragma comment(lib,
"
psapi.lib
"
)
void
PrintModules( DWORD processID )
{
HMODULE hMods[
1024
];
HANDLE hProcess;
DWORD cbNeeded;
unsigned
int
i;
//
Print the process identifier.
printf(
"
Process ID: %u\n
"
, processID );
//
Get a list of all the modules in this process.
hProcess
=
OpenProcess( PROCESS_QUERY_INFORMATION
|
PROCESS_VM_READ,
FALSE, processID );
if
(NULL
==
hProcess)
return
;
if
( EnumProcessModules(hProcess, hMods,
sizeof
(hMods),
&
cbNeeded))
{
for
( i
=
0
; i
<
(cbNeeded
/
sizeof
(HMODULE)); i
++
)
{
char
szModName[MAX_PATH];
//
Get the full path to the module's file.
if
( GetModuleFileNameEx( hProcess, hMods[i], szModName,
sizeof
(szModName)))
{
//
Print the module name and handle value.
printf(
"
\t%s (0x%08X)\n
"
, szModName, hMods );
}
}
}
CloseHandle( hProcess );
}
void
main( )
{
//
Get the list of process identifiers.
DWORD aProcesses[
1024
], cbNeeded, cProcesses;
unsigned
int
i;
if
(
!
EnumProcesses( aProcesses,
sizeof
(aProcesses),
&
cbNeeded ) )
return
;
//
Calculate how many process identifiers were returned.
cProcesses
=
cbNeeded
/
sizeof
(DWORD);
//
Print the name of the modules for each process.
for
( i
=
0
; i
<
cProcesses; i
++
)
PrintModules( aProcesses[i] );
}