c++ 32位 64位 获得进程peb的方法

小子不忘记

  基于上一篇文章，大概了解了peb的获取方法，但是那个方法只能获得当前进程的PEB，不能获得其他的进程的PEB。根据那个思想，获得其他进程PEB则需要注入，得到进程信息，然后进程间通信，将信息返回来，经过考虑，这个方法太复杂。

下面介绍的方法是 用了一个未公开的函数NtQueryInformationProcess，获得进程信息，然后去读对方进程ReadProcessMemory。

结构体是使用的一个模板，从别处借鉴的

1. 
   
2. #pragma once
   
3. 
   
4. #include <Windows.h>
   
5. #include <Strsafe.h>
   
6. #include <wchar.h>
   
7. #include <vector>
   
8. 
   
9. #define NT_SUCCESS(x) ((x) >= 0)
   
10. 
    
11. #define ProcessBasicInformation 0
    
12. typedef
    
13. NTSTATUS(WINAPI *pfnNtWow64QueryInformationProcess64)
    
14. (HANDLE ProcessHandle, UINT32 ProcessInformationClass,
    
15.     PVOID ProcessInformation, UINT32 ProcessInformationLength,
    
16.     UINT32* ReturnLength);
    
17. 
    
18. typedef
    
19. NTSTATUS(WINAPI *pfnNtWow64ReadVirtualMemory64)
    
20. (HANDLE ProcessHandle, PVOID64 BaseAddress,
    
21.     PVOID BufferData, UINT64 BufferLength,
    
22.     PUINT64 ReturnLength);
    
23. 
    
24. typedef
    
25. NTSTATUS(WINAPI *pfnNtQueryInformationProcess)
    
26. (HANDLE ProcessHandle, ULONG ProcessInformationClass,
    
27.     PVOID ProcessInformation, UINT32 ProcessInformationLength,
    
28.     UINT32* ReturnLength);
    
29. 
    
30. template <typename T>
    
31. struct _UNICODE_STRING_T
    
32. {
    
33.     WORD Length;
    
34.     WORD MaximumLength;
    
35.     T Buffer;
    
36. };
    
37. 
    
38. template <typename T>
    
39. struct _LIST_ENTRY_T
    
40. {
    
41.     T Flink;
    
42.     T Blink;
    
43. };
    
44. 
    
45. template <typename T, typename NGF, int A>
    
46. struct _PEB_T
    
47. {
    
48.     typedef T type;
    
49. 
    
50.     union
    
51.     {
    
52.         struct
    
53.         {
    
54.             BYTE InheritedAddressSpace;
    
55.             BYTE ReadImageFileExecOptions;
    
56.             BYTE BeingDebugged;
    
57.             BYTE BitField;
    
58.         };
    
59.         T dummy01;
    
60.     };
    
61.     T Mutant;
    
62.     T ImageBaseAddress;
    
63.     T Ldr;
    
64.     T ProcessParameters;
    
65.     T SubSystemData;
    
66.     T ProcessHeap;
    
67.     T FastPebLock;
    
68.     T AtlThunkSListPtr;
    
69.     T IFEOKey;
    
70.     T CrossProcessFlags;
    
71.     T UserSharedInfoPtr;
    
72.     DWORD SystemReserved;
    
73.     DWORD AtlThunkSListPtr32;
    
74.     T ApiSetMap;
    
75.     T TlsExpansionCounter;
    
76.     T TlsBitmap;
    
77.     DWORD TlsBitmapBits[2];
    
78.     T ReadOnlySharedMemoryBase;
    
79.     T HotpatchInformation;
    
80.     T ReadOnlyStaticServerData;
    
81.     T AnsiCodePageData;
    
82.     T OemCodePageData;
    
83.     T UnicodeCaseTableData;
    
84.     DWORD NumberOfProcessors;
    
85.     union
    
86.     {
    
87.         DWORD NtGlobalFlag;
    
88.         NGF dummy02;
    
89.     };
    
90.     LARGE_INTEGER CriticalSectionTimeout;
    
91.     T HeapSegmentReserve;
    
92.     T HeapSegmentCommit;
    
93.     T HeapDeCommitTotalFreeThreshold;
    
94.     T HeapDeCommitFreeBlockThreshold;
    
95.     DWORD NumberOfHeaps;
    
96.     DWORD MaximumNumberOfHeaps;
    
97.     T ProcessHeaps;
    
98.     T GdiSharedHandleTable;
    
99.     T ProcessStarterHelper;
    
100.     T GdiDCAttributeList;
     
101.     T LoaderLock;
     
102.     DWORD OSMajorVersion;
     
103.     DWORD OSMinorVersion;
     
104.     WORD OSBuildNumber;
     
105.     WORD OSCSDVersion;
     
106.     DWORD OSPlatformId;
     
107.     DWORD ImageSubsystem;
     
108.     DWORD ImageSubsystemMajorVersion;
     
109.     T ImageSubsystemMinorVersion;
     
110.     T ActiveProcessAffinityMask;
     
111.     T GdiHandleBuffer[A];
     
112.     T PostProcessInitRoutine;
     
113.     T TlsExpansionBitmap;
     
114.     DWORD TlsExpansionBitmapBits[32];
     
115.     T SessionId;
     
116.     ULARGE_INTEGER AppCompatFlags;
     
117.     ULARGE_INTEGER AppCompatFlagsUser;
     
118.     T pShimData;
     
119.     T AppCompatInfo;
     
120.     _UNICODE_STRING_T<T> CSDVersion;
     
121.     T ActivationContextData;
     
122.     T ProcessAssemblyStorageMap;
     
123.     T SystemDefaultActivationContextData;
     
124.     T SystemAssemblyStorageMap;
     
125.     T MinimumStackCommit;
     
126.     T FlsCallback;
     
127.     _LIST_ENTRY_T<T> FlsListHead;
     
128.     T FlsBitmap;
     
129.     DWORD FlsBitmapBits[4];
     
130.     T FlsHighIndex;
     
131.     T WerRegistrationData;
     
132.     T WerShipAssertPtr;
     
133.     T pContextData;
     
134.     T pImageHeaderHash;
     
135.     T TracingFlags;
     
136.     T CsrServerReadOnlySharedMemoryBase;
     
137. };
     
138. 
     
139. typedef _PEB_T<DWORD, DWORD64, 34> _PEB32;
     
140. typedef _PEB_T<DWORD64, DWORD, 30> _PEB64;
     
141. 
     
142. typedef struct _STRING_32
     
143. {
     
144.     WORD Length;
     
145.     WORD MaximumLength;
     
146.     UINT32 Buffer;
     
147. } STRING32, *PSTRING32;
     
148. 
     
149. typedef struct _STRING_64
     
150. {
     
151.     WORD Length;
     
152.     WORD MaximumLength;
     
153.     UINT64 Buffer;
     
154. } STRING64, *PSTRING64;
     
155. 
     
156. typedef struct _RTL_DRIVE_LETTER_CURDIR_32
     
157. {
     
158.     WORD Flags;
     
159.     WORD Length;
     
160.     ULONG TimeStamp;
     
161.     STRING32 DosPath;
     
162. } RTL_DRIVE_LETTER_CURDIR32, *PRTL_DRIVE_LETTER_CURDIR32;
     
163. 
     
164. typedef struct _RTL_DRIVE_LETTER_CURDIR_64
     
165. {
     
166.     WORD Flags;
     
167.     WORD Length;
     
168.     ULONG TimeStamp;
     
169.     STRING64 DosPath;
     
170. } RTL_DRIVE_LETTER_CURDIR64, *PRTL_DRIVE_LETTER_CURDIR64;
     
171. 
     
172. typedef struct _UNICODE_STRING_32
     
173. {
     
174.     WORD Length;
     
175.     WORD MaximumLength;
     
176.     UINT32 Buffer;
     
177. } UNICODE_STRING32, *PUNICODE_STRING32;
     
178. 
     
179. typedef struct _UNICODE_STRING_64
     
180. {
     
181.     WORD Length;
     
182.     WORD MaximumLength;
     
183.     UINT64 Buffer;
     
184. } UNICODE_STRING64, *PUNICODE_STRING64;
     
185. 
     
186. 
     
187. typedef struct _CURDIR_32
     
188. {
     
189.     UNICODE_STRING32 DosPath;
     
190.     UINT32 Handle;
     
191. } CURDIR32, *PCURDIR32;
     
192. 
     
193. typedef struct _RTL_USER_PROCESS_PARAMETERS_32
     
194. {
     
195.     ULONG MaximumLength;
     
196.     ULONG Length;
     
197.     ULONG Flags;
     
198.     ULONG DebugFlags;
     
199.     UINT32 ConsoleHandle;
     
200.     ULONG ConsoleFlags;
     
201.     UINT32 StandardInput;
     
202.     UINT32 StandardOutput;
     
203.     UINT32 StandardError;
     
204.     CURDIR32 CurrentDirectory;
     
205.     UNICODE_STRING32 DllPath;
     
206.     UNICODE_STRING32 ImagePathName;
     
207.     UNICODE_STRING32 CommandLine;
     
208.     UINT32 Environment;
     
209.     ULONG StartingX;
     
210.     ULONG StartingY;
     
211.     ULONG CountX;
     
212.     ULONG CountY;
     
213.     ULONG CountCharsX;
     
214.     ULONG CountCharsY;
     
215.     ULONG FillAttribute;
     
216.     ULONG WindowFlags;
     
217.     ULONG ShowWindowFlags;
     
218.     UNICODE_STRING32 WindowTitle;
     
219.     UNICODE_STRING32 DesktopInfo;
     
220.     UNICODE_STRING32 ShellInfo;
     
221.     UNICODE_STRING32 RuntimeData;
     
222.     RTL_DRIVE_LETTER_CURDIR32 CurrentDirectores[32];
     
223.     ULONG EnvironmentSize;
     
224. } RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32;
     
225. 
     
226. 
     
227. typedef struct _CURDIR_64
     
228. {
     
229.     UNICODE_STRING64 DosPath;
     
230.     UINT64 Handle;
     
231. } CURDIR64, *PCURDIR64;
     
232. 
     
233. typedef struct _RTL_USER_PROCESS_PARAMETERS_64
     
234. {
     
235.     ULONG MaximumLength;
     
236.     ULONG Length;
     
237.     ULONG Flags;
     
238.     ULONG DebugFlags;
     
239.     UINT64 ConsoleHandle;
     
240.     ULONG ConsoleFlags;
     
241.     UINT64 StandardInput;
     
242.     UINT64 StandardOutput;
     
243.     UINT64 StandardError;
     
244.     CURDIR64 CurrentDirectory;
     
245.     UNICODE_STRING64 DllPath;
     
246.     UNICODE_STRING64 ImagePathName;
     
247.     UNICODE_STRING64 CommandLine;
     
248.     UINT64 Environment;
     
249.     ULONG StartingX;
     
250.     ULONG StartingY;
     
251.     ULONG CountX;
     
252.     ULONG CountY;
     
253.     ULONG CountCharsX;
     
254.     ULONG CountCharsY;
     
255.     ULONG FillAttribute;
     
256.     ULONG WindowFlags;
     
257.     ULONG ShowWindowFlags;
     
258.     UNICODE_STRING64 WindowTitle;
     
259.     UNICODE_STRING64 DesktopInfo;
     
260.     UNICODE_STRING64 ShellInfo;
     
261.     UNICODE_STRING64 RuntimeData;
     
262.     RTL_DRIVE_LETTER_CURDIR64 CurrentDirectores[32];
     
263.     ULONG EnvironmentSize;
     
264. } RTL_USER_PROCESS_PARAMETERS64, *PRTL_USER_PROCESS_PARAMETERS64;
     
265. 
     
266. typedef struct _PROCESS_BASIC_INFORMATION64 {
     
267.     NTSTATUS ExitStatus;
     
268.     UINT32 Reserved0;
     
269.     UINT64 PebBaseAddress;<a id="e_postbg" adv="1" title="帖子背景">Background</a>
     
270.     UINT64 AffinityMask;
     
271.     UINT32 BasePriority;
     
272.     UINT32 Reserved1;
     
273.     UINT64 UniqueProcessId;
     
274.     UINT64 InheritedFromUniqueProcessId;
     
275. } PROCESS_BASIC_INFORMATION64;
     
276. 
     
277. typedef struct _PROCESS_BASIC_INFORMATION32 {
     
278.     NTSTATUS ExitStatus;
     
279.     UINT32 PebBaseAddress;
     
280.     UINT32 AffinityMask;
     
281.     UINT32 BasePriority;
     
282.     UINT32 UniqueProcessId;
     
283.     UINT32 InheritedFromUniqueProcessId;
     
284. } PROCESS_BASIC_INFORMATION32;
     

复制代码

实现方法：

1. 
   
2. #include "stdafx.h"
   
3. #include "PEB.h"
   
4. #include <iostream>
   
5. 
   
6. using namespace std;
   
7. 
   
8. int main()
   
9. {
   
10.     HANDLE m_ProcessHandle;
    
11.     int PID;
    
12.     cout << "输入PID：";
    
13.     cin >> PID;
    
14. 
    
15.     m_ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID);
    
16. 
    
17.     BOOL bSource = FALSE;
    
18.     BOOL bTarget = FALSE;
    
19.     //判断自己的位数
    
20.     IsWow64Process(GetCurrentProcess(), &bSource);
    
21.     //判断目标的位数
    
22.     IsWow64Process(m_ProcessHandle, &bTarget);
    
23. 
    
24.     if(bTarget == FALSE && bSource == TRUE)
    
25.     {
    
26.         HMODULE NtdllModule = GetModuleHandle(L"ntdll.dll");
    
27.         pfnNtWow64QueryInformationProcess64 NtWow64QueryInformationProcess64 = (pfnNtWow64QueryInformationProcess64)GetProcAddress(NtdllModule, "NtWow64QueryInformationProcess64");
    
28.         pfnNtWow64ReadVirtualMemory64 NtWow64ReadVirtualMemory64 = (pfnNtWow64ReadVirtualMemory64)GetProcAddress(NtdllModule, "NtWow64ReadVirtualMemory64");
    
29. 
    
30.         PROCESS_BASIC_INFORMATION64 pbi = { 0 };
    
31.         UINT64 ReturnLength = 0;
    
32. 
    
33.         NTSTATUS Status = NtWow64QueryInformationProcess64(m_ProcessHandle, ProcessBasicInformation, &pbi, (UINT32)sizeof(pbi), (UINT32*)&ReturnLength);
    
34. 
    
35.         if (NT_SUCCESS(Status))
    
36.         {
    
37. 
    
38.             _PEB64* Peb = (_PEB64*)malloc(sizeof(_PEB64));
    
39.             RTL_USER_PROCESS_PARAMETERS64* ProcessParameters = (RTL_USER_PROCESS_PARAMETERS64*)malloc(sizeof(RTL_USER_PROCESS_PARAMETERS64));
    
40.             Status = NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)pbi.PebBaseAddress,
    
41.                 (_PEB64*)Peb, sizeof(_PEB64), &ReturnLength);
    
42. 
    
43. 
    
44.             cout << "PebBaseAddress:" << hex << pbi.PebBaseAddress << endl;
    
45.             cout << "Ldr:" << hex << Peb->Ldr << endl;
    
46.             cout << "ImageBaseAddress:" << hex << Peb->ImageBaseAddress << endl;
    
47.         }
    
48.     }
    
49. 
    
50.     //自己是32  目标是32
    
51.     else if (bTarget == TRUE && bSource == TRUE)
    
52.     {
    
53.         HMODULE NtdllModule = GetModuleHandle(L"ntdll.dll");
    
54.         pfnNtQueryInformationProcess NtQueryInformationProcess = (pfnNtQueryInformationProcess)GetProcAddress(NtdllModule,
    
55.             "NtQueryInformationProcess");
    
56.         PROCESS_BASIC_INFORMATION32 pbi = { 0 };
    
57.         UINT32  ReturnLength = 0;
    
58.         NTSTATUS Status = NtQueryInformationProcess(m_ProcessHandle,
    
59.             ProcessBasicInformation, &pbi, (UINT32)sizeof(pbi), (UINT32*)&ReturnLength);
    
60.         if (NT_SUCCESS(Status))
    
61.         {
    
62.             _PEB32* Peb = (_PEB32*)malloc(sizeof(_PEB32));
    
63.             ReadProcessMemory(m_ProcessHandle, (PVOID)pbi.PebBaseAddress, (_PEB32*)Peb, sizeof(_PEB32), NULL);
    
64.             printf("PEB:%x\r\n", pbi.PebBaseAddress);
    
65.             printf("LdrAddress:%x\r\n", ((_PEB32*)Peb)->Ldr);
    
66.             printf("ImageBaseAddress:%x\r\n", ((_PEB32*)Peb)->ImageBaseAddress);
    
67.         }
    
68.     }
    
69. 
    
70.     return 0;
    
71. }

复制代码

  有了PEB 则可以获得进程的各种信息，比如：模块、完整路径、命令行、环境变量、默认堆等等，参照结构体可得。

如何对PEB结构体不是很清楚，可以用windeg调试一下，attach到进程，然后使用!peb命令。