关于进程间的访问权限等进程间控制资料收集

http://www.vckbase.com/

DUPLICATEHANDLE函数可以实现将同步内核对象被拷贝并且将原内核对象关闭， 从而达到可以自由控制内核对象的目的， 这可以实现使得只能单一启用的进程成为多启用的进程的目的。

实现方法：

只要用钩子WH_GETMESSAGE挂钩并实现如下代码即可

LRESULT HookProc(int code, WPARAM wParam, LPARAM lParam)    
{   
  STARTUPINFO startUpInfo;
 GetStartupInfo(&startUpInfo);

 char str[MAX_PATH];
 LPSTR lpStr = startUpInfo.lpTitle;
 if (!g_bFounded)
 {
  if (lpStr != NULL)
  {
   _splitpath(lpStr,NULL, NULL, str, NULL);

   DWORD iStrLen = MAX_PATH;
   DWORD dwRegType = 0;
   RegQueryValueExA(HKEY_CURRENT_USER, "PeHook//HookedProcessName", NULL, &dwRegType, (LPBYTE)g_strAppName, &iStrLen);
   if (strcmp(str,/*"wmplayer"*/g_strAppName) == 0)
   {
    HANDLE hToken;
    TOKEN_PRIVILEGES tp;
    DWORD rl;
    BOOL Result = FALSE;

    //打开进程令牌环
    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);

    //获得进程本地唯一ID
    if (LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &tp.Privileges[0].Luid) )
    {
     tp.PrivilegeCount = 1;
     tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
     //调整权限
     Result = AdjustTokenPrivileges(hToken, false, &tp, sizeof(tp), NULL, &rl);
    }

    if (Result)
    {
     char  buffer[200];
     HANDLE hSrcProc = GetCurrentProcess();
     DWORD dwError = GetLastError();
     HANDLE hSrcHandle = (HANDLE)0x38;
     HANDLE hCurProc= GetCurrentProcess();
     HANDLE hTargetHandle = 0;
     BOOL bRet = DuplicateHandle(hSrcProc, hSrcHandle, hCurProc, &hTargetHandle, DUPLICATE_SAME_ACCESS, FALSE, DUPLICATE_CLOSE_SOURCE);
     
     if (bRet)
     {
      CloseHandle(hTargetHandle);
      g_bFounded = TRUE;
     }

}

}
 return CallNextHookEx(glhHook,code,wParam,lParam);
}
/

资料:

CSDN: http://cache.baidu.com/c?m=9f65cb4a8c8507ed4fece76310408a23450add306ac0d0622e95c51484642c1d1020fefa7a65505584d87f6001ad4356e8e4732f77552fa0edca9f3caaace22238f92123716c913164c46da5dc3624d651e14de8df0e97bfe74392b9a3a4c82520dd52756df1fa9c290a03bb1be76246&p=8e6ed55f86cc4bf30be2943848&user=baidu

CSDN:  http://cache.baidu.com/c?m=9f65cb4a8c8507ed4fece7631046893b4c4380146d96864968d4e414c4224627003ab8f12422141980852d3d5aeb1e41eaf234762a0022aa98cb9549dcba902f2b8e3034074fc70358c75cf28b102a9660d007a9b81897adf74684afa2808e05048b12127bf0e78c2e1715ba39a7486ab4f08e48640252edb17225a2082068de&p=c933891985cc44f508e2937c505d&user=baidu

简单算法遍历PspCidTable句柄表

ULONG GetPspCidTable()
{
  ULONG PspCidTable=0;
  ULONG FuncAddr=NULL;
  UNICODE_STRING FuncName={0};
  
  RtlInitUnicodeString(&FuncName,L"PsLookupProcessByProcessId");
  FuncAddr=(ULONG)MmGetSystemRoutineAddress(&FuncName);
  for (;;FuncAddr++)
  {
    if ((0x35ff==(*(PUSHORT)FuncAddr)) && (0xe8==(*(PUCHAR)(FuncAddr+6))))
    {  
      PspCidTable=*(PULONG)(FuncAddr+2);
      break;
    }  
    
  }
  return PspCidTable;
}

#define OBJECT_BODY_TO_TYPE 0x10
//从3级表开始遍历
ULONG BrowseTableL3(ULONG TableAddr)
{
  ULONG Object=0;
  ULONG ItemCount=511;

  do 
  {
    TableAddr+=8;
    Object=*(PULONG)TableAddr;
    Object&=0xfffffff8;
    
    if (Object==0)
    {
      continue;
    }
    if ((*PsProcessType)==(*(PULONG)(Object-OBJECT_BODY_TO_TYPE)))
    {
      KdPrint(("%s",PsGetProcessImageFileName((PEPROCESS)Object)));
    }    
  } while (--ItemCount>0);
  
  return 0;
}

//从二级表开始遍历
ULONG BrowseTableL2(ULONG TableAddr)
{
  do 
  {
    BrowseTableL3(*(PULONG)TableAddr);
    TableAddr+=4;
  } while ((*(PULONG)TableAddr)!=0);

  return 0;
}

//从1级表开始遍历
ULONG BrowseTableL1(ULONG TableAddr)
{
  do 
  {
    BrowseTableL2(*(PULONG)TableAddr);
    TableAddr+=4;
  } while ((*(PULONG)TableAddr)!=0);

  return 0;
}

VOID RefreshProcessByPspCidTable()
{
  ULONG PspCidTable=0;
  ULONG HandleTable=0;
  ULONG TableCode=0;
  ULONG flag=0;

  PspCidTable=GetPspCidTable();
  HandleTable=*(PULONG)PspCidTable;
  TableCode=*(PULONG)HandleTable;
  flag=TableCode&3;
  TableCode&=0xfffffffc;  
  
  switch (flag)
  {
  case 0:
    BrowseTableL3(TableCode);
    break;
  case 1:
    BrowseTableL2(TableCode);
    break;
  case 2:
    BrowseTableL1(TableCode);
    break;    
  }
  
  
}

劫持内核句柄