#pragma once

 #ifndef __PROCESSFUN_H__

 #define __PROCESSFUN_H__

 #include <iostream>

 #include <string>

 #include <algorithm>

 #include <windows.h>

 #include <psapi.h>

 using namespace std;

 #include "Ntdll.h"

 #pragma comment(lib, "psapi.lib")

 #pragma warning(disable: 4996)

 BOOL EnablePrivilege(ULONG Privilege = SE_DEBUG_PRIVILEGE, BOOL Enable = TRUE);

 DWORD NtEnumProcess(LPDWORD lpProcess);

 BOOL GetSystemProcess(DWORD dwPid, SYSTEM_PROCESSES &SystemProcess);

 HANDLE NtOpenProcess(DWORD dwPid);

 HANDLE DoOpenProcess(DWORD dwPid);

 HANDLE PowerOpenProcess(DWORD dwPid);

 BOOL IsProcessExit(HANDLE hProcess);

 BOOL NtTerminateProcess(HANDLE hProcess);

 BOOL JoTerminateProcess(HANDLE hProcess);

 BOOL CrtTerminateProcess(HANDLE hProcess);

 BOOL WvmTerminateProcess(HANDLE hProcess);

 BOOL PowerTerminateProcess(HANDLE hProcess);

 BOOL GetProcessFilePath(HANDLE hProcess, LPSTR lpFilePath);

 BOOL DosPathToNtPath(LPCSTR lpDosPath, LPSTR lpNtPath);

 DWORD GetEProcess(DWORD dwPid);

 DWORD GetParentProcessId(DWORD dwPid);

 BOOL GetProcessName(DWORD dwPid, LPSTR lpProcessName);

 LARGE_INTEGER GetProcessCreateTime(DWORD dwPid);

 #endif    //    __PROCESSFUN_H__

ProcessFun.h

 #include "ProcessFun.h"

 BOOL EnablePrivilege(ULONG Privilege, BOOL Enable)

 {

     HANDLE hToken = NULL;

     if (!NT_SUCCESS(NtOpenProcessToken(NtCurrentProcess(), TOKEN_ALL_ACCESS, &hToken)) || hToken == NULL)

         return FALSE;

     TOKEN_PRIVILEGES tp = {};

     tp.PrivilegeCount = ;

     tp.Privileges[].Luid.LowPart = Privilege;

     tp.Privileges[].Attributes = Enable ? SE_PRIVILEGE_ENABLED : SE_PRIVILEGE_REMOVED;

     return NT_SUCCESS(NtAdjustPrivilegesToken(hToken, FALSE, &tp, sizeof(tp), NULL, NULL));

 }

 DWORD NtEnumProcess(LPDWORD lpProcess)

 {

     DWORD dwSize = NULL;

     PSYSTEM_PROCESSES lpbaSP = NULL;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, NULL, NULL, &dwSize) || dwSize == NULL))

         return NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpbaSP,

                                             NULL,

                                             &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpbaSP == NULL)

         return NULL;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, (PVOID)lpbaSP, dwSize, NULL)))

     {

         NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

         return NULL;

     }

     DWORD dwLenth = ;

     PSYSTEM_PROCESSES lpSP = lpbaSP;

     while (lpSP->NextEntryDelta != NULL)

     {

         lpProcess[dwLenth++] = lpSP->ProcessId;

         lpSP = (PSYSTEM_PROCESSES)((ULONG)lpSP + lpSP->NextEntryDelta);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

     sort(lpProcess, lpProcess + dwLenth);

     return dwLenth;

 }

 BOOL GetSystemProcess(DWORD dwPid, SYSTEM_PROCESSES &SystemProcess)

 {

     SystemProcess = {};

     DWORD dwSize = NULL;

     PSYSTEM_PROCESSES lpbaSP = NULL;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, NULL, NULL, &dwSize) || dwSize == NULL))

         return FALSE;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpbaSP,

                                             NULL,

                                             &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpbaSP == NULL)

         return FALSE;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, (PVOID)lpbaSP, dwSize, NULL)))

     {

         NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

         return FALSE;

     }

     BOOL status = FALSE;

     PSYSTEM_PROCESSES lpSP = lpbaSP;

     while (lpSP->NextEntryDelta != NULL)

     {

         if (dwPid == lpSP->ProcessId)

         {

             SystemProcess = *lpSP;

             status = TRUE;

             break;

         }

         lpSP = (PSYSTEM_PROCESSES)((ULONG)lpSP + lpSP->NextEntryDelta);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

     return status;

 }

 HANDLE NtOpenProcess(DWORD dwPid)

 {

     HANDLE hProcess = NULL;

     OBJECT_ATTRIBUTES oa = {};

     oa.Length = sizeof(oa);

     CLIENT_ID cid = {};

     cid.UniqueProcess = (HANDLE)(dwPid %  ? dwPid : dwPid + );

     NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &oa, &cid);

     return hProcess;

 }

 HANDLE DoOpenProcess(DWORD dwPid)

 {

     PCHAR lpBuf = NULL;

     DWORD dwPreSize = 0x1000, dwSize = NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpBuf,

                                             NULL, &dwPreSize,

                                             MEM_COMMIT, PAGE_READWRITE)) ||

         lpBuf == NULL)

         return NULL;

     NtQuerySystemInformation(SystemHandleInformation, (PVOID)lpBuf, dwPreSize, &dwSize);

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, &dwPreSize, MEM_RELEASE);

     lpBuf = NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpBuf,

                                             NULL, &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpBuf == NULL)

         return NULL;

     NtQuerySystemInformation(SystemHandleInformation, (PVOID)lpBuf, dwSize, NULL);

     DWORD dwNumberOfHandle = *(DWORD *)lpBuf;

     PSYSTEM_HANDLE_INFORMATION lpSHI = (PSYSTEM_HANDLE_INFORMATION)((PCHAR)lpBuf + sizeof(dwNumberOfHandle));

     HANDLE hTgtProc = NULL;

     for (DWORD i = ; i < dwNumberOfHandle; i++, lpSHI++)

     {

         if (lpSHI->ObjectTypeNumber != OB_TYPE_PROCESS && lpSHI->ObjectTypeNumber != OB_TYPE_JOB)

             continue;

         HANDLE hSrcProc = NtOpenProcess(lpSHI->ProcessId);

         if (hSrcProc == NULL)

             continue;

         HANDLE hTmpProc = NULL;

         NtDuplicateObject(hSrcProc,

                           (HANDLE)lpSHI->Handle,

                           NtCurrentProcess(),

                           &hTmpProc,

                           PROCESS_ALL_ACCESS,

                           NULL,

                           NULL);

         PROCESS_BASIC_INFORMATION pbi = {};

         NtQueryInformationProcess(hTmpProc, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);

         if (hTmpProc != NULL && pbi.UniqueProcessId != NULL && pbi.UniqueProcessId == dwPid)

             /*{

                 hTgtProc = hTmpProc;

                 printf("%d %d 0x%llX\n", lpSHI->ProcessId, pbi.UniqueProcessId, (DWORD64)lpSHI->Object);

             }*/

             hTgtProc = hTmpProc;

         NtClose(hSrcProc);

         if (hTgtProc != NULL)

             break;

         if (hTmpProc != NULL)

             NtClose(hTmpProc);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, &dwSize, MEM_RELEASE);

     return hTgtProc;

 }

 HANDLE PowerOpenProcess(DWORD dwPid)

 {

     HANDLE hProcess = NtOpenProcess(dwPid);

     if (hProcess != NULL && GetProcessId(hProcess) == dwPid)

         return hProcess;

     hProcess = DoOpenProcess(dwPid);

     if (hProcess != NULL && GetProcessId(hProcess) == dwPid)

         return hProcess;

     return NULL;

 }

 BOOL IsProcessExit(HANDLE hProcess)

 {

     DWORD dwExitCode = NULL;

     GetExitCodeProcess(hProcess, &dwExitCode);

     return dwExitCode != STILL_ACTIVE;

 }

 BOOL NtTerminateProcess(HANDLE hProcess)

 {

     return NT_SUCCESS(NtTerminateProcess(hProcess, NULL)) && IsProcessExit(hProcess);

 }

 BOOL JoTerminateProcess(HANDLE hProcess)

 {

     HANDLE hJob = NULL;

     OBJECT_ATTRIBUTES oa = {};

     oa.Length = sizeof(oa);

     if (!NT_SUCCESS(NtCreateJobObject(&hJob, JOB_OBJECT_ALL_ACCESS, &oa)))

         return FALSE;

     BOOL status = NT_SUCCESS(NtAssignProcessToJobObject(hJob, hProcess));

     if (status)

         status |= NT_SUCCESS(NtTerminateJobObject(hJob, NULL));

     NtClose(hJob);

     return status && IsProcessExit(hProcess);

 }

 BOOL CrtTerminateProcess(HANDLE hProcess)

 {

     //

     return FALSE;

 }

 BOOL WvmTerminateProcess(HANDLE hProcess)

 {

     BOOL status = FALSE;

     PVOID lpBuf = NULL;

     DWORD dwSize = 0x1000, dwRet = NULL;

     NtAllocateVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, NULL, &dwSize, MEM_COMMIT, PAGE_READWRITE);

     for (INT64 i = 0x70000000; i < 0x7FFEFFFF; i += dwSize)

     {

         status |= NT_SUCCESS(NtUnmapViewOfSection(hProcess, (PVOID)i));

         status |= NT_SUCCESS(NtProtectVirtualMemory(hProcess, (PVOID *)i, &dwSize, PAGE_READWRITE, &dwRet));

         status |= NT_SUCCESS(NtWriteVirtualMemory(hProcess, (PVOID)i, lpBuf, dwSize, (PULONG)&dwRet));

     }

     NtFreeVirtualMemory(hProcess, (PVOID *)&lpBuf, &dwSize, MEM_RELEASE);

     if (status)

         Sleep();

     return status && IsProcessExit(hProcess);

 }

 BOOL PowerTerminateProcess(HANDLE hProcess)

 {

     if (NtTerminateProcess(hProcess))

         return TRUE;

     if (JoTerminateProcess(hProcess))

         return TRUE;

     if (WvmTerminateProcess(hProcess))

         return TRUE;

     return FALSE;

 }

 BOOL GetProcessFilePath(HANDLE hProcess, LPSTR lpFilePath)

 {

     if (hProcess == NULL || lpFilePath == NULL)

         return FALSE;

     strcpy(lpFilePath, "");

     CHAR szDosPath[MAX_PATH] = "";

     if (!GetProcessImageFileNameA(hProcess, szDosPath, MAX_PATH))

         return FALSE;

     return DosPathToNtPath(szDosPath, lpFilePath);

 }

 BOOL DosPathToNtPath(LPCSTR lpDosPath, LPSTR lpNtPath)

 {

     CHAR szDriveList[MAX_PATH] = "";

     if (!GetLogicalDriveStringsA(MAX_PATH, szDriveList))

         return FALSE;

     for (int i = ; szDriveList[i]; i += )

     {

         if (stricmp(&szDriveList[i], "A:\\") ==  || stricmp(&szDriveList[i], "B:\\") == )

             continue;

         CHAR szNtDrive[MAX_PATH] = "", szDosDrive[MAX_PATH] = "";

         strcpy(szNtDrive, &szDriveList[i]);

         szNtDrive[] = '\0';

         if (!QueryDosDeviceA(szNtDrive, szDosDrive, MAX_PATH) ||

             strncmp(szDosDrive, lpDosPath, strlen(szDosDrive)) != )

             continue;

         strcpy(lpNtPath, szNtDrive);

         strcat(lpNtPath, &lpDosPath[strlen(szDosDrive)]);

         return TRUE;

     }

     return FALSE;

 }

 DWORD GetEProcess(DWORD dwPid)

 {

     PCHAR lpBuf = NULL;

     DWORD dwPreSize = 0x1000, dwSize = NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpBuf,

                                             NULL, &dwPreSize,

                                             MEM_COMMIT, PAGE_READWRITE)) ||

         lpBuf == NULL)

         return NULL;

     NtQuerySystemInformation(SystemHandleInformation, (PVOID)lpBuf, dwPreSize, &dwSize);

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, &dwPreSize, MEM_RELEASE);

     lpBuf = NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpBuf,

                                             NULL, &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpBuf == NULL)

         return NULL;

     NtQuerySystemInformation(SystemHandleInformation, (PVOID)lpBuf, dwSize, NULL);

     DWORD dwNumberOfHandle = *(DWORD *)lpBuf;

     PSYSTEM_HANDLE_INFORMATION lpSHI = (PSYSTEM_HANDLE_INFORMATION)((PCHAR)lpBuf + sizeof(dwNumberOfHandle));

     DWORD dwEProcess = NULL;

     for (DWORD i = ; i < dwNumberOfHandle; i++, lpSHI++)

     {

         if (lpSHI->ObjectTypeNumber != OB_TYPE_PROCESS && lpSHI->ObjectTypeNumber != OB_TYPE_JOB)

             continue;

         HANDLE hSrcProc = NtOpenProcess(lpSHI->ProcessId);

         if (hSrcProc == NULL)

             continue;

         HANDLE hTmpProc = NULL;

         NtDuplicateObject(hSrcProc,

                           (HANDLE)lpSHI->Handle,

                           NtCurrentProcess(),

                           &hTmpProc,

                           PROCESS_ALL_ACCESS,

                           NULL,

                           NULL);

         PROCESS_BASIC_INFORMATION pbi = {};

         NtQueryInformationProcess(hTmpProc, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);

         if (hTmpProc != NULL && pbi.UniqueProcessId != NULL && pbi.UniqueProcessId == dwPid)

             dwEProcess = (DWORD)lpSHI->Object;

         NtClose(hSrcProc);

         if (dwEProcess != NULL)

             break;

         if (hTmpProc != NULL)

             NtClose(hTmpProc);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, &dwSize, MEM_RELEASE);

     return dwEProcess;

 }

 DWORD GetParentProcessId(DWORD dwPid)

 {

     SYSTEM_PROCESSES sp = {};

     GetSystemProcess(dwPid, sp);

     return sp.InheritedFromProcessId;

 }

 BOOL GetProcessName(DWORD dwPid, LPSTR lpProcessName)

 {

     strcpy(lpProcessName, "");

     DWORD dwSize = NULL;

     PSYSTEM_PROCESSES lpbaSP = NULL;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, NULL, NULL, &dwSize) || dwSize == NULL))

         return FALSE;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpbaSP,

                                             NULL,

                                             &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpbaSP == NULL)

         return FALSE;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, (PVOID)lpbaSP, dwSize, NULL)))

     {

         NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

         return FALSE;

     }

     BOOL status = FALSE;

     PSYSTEM_PROCESSES lpSP = lpbaSP;

     while (lpSP->NextEntryDelta != NULL)

     {

         if (dwPid == lpSP->ProcessId)

         {

             wcstombs(lpProcessName, lpSP->ProcessName.Buffer, MAX_PATH);

             status = TRUE;

             break;

         }

         lpSP = (PSYSTEM_PROCESSES)((ULONG)lpSP + lpSP->NextEntryDelta);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

     return status;

 }

 LARGE_INTEGER GetProcessCreateTime(DWORD dwPid)

 {

     SYSTEM_PROCESSES sp = {};

     GetSystemProcess(dwPid, sp);

     return sp.CreateTime;

 }

ProcessFun.cpp

ProcessFun的更多相关文章

  1. 网络编程并发 多进程 进程池,互斥锁,信号量,IO模型

    进程:程序正在执行的过程,就是一个正在执行的任务,而负责执行任务的就是cpu 操作系统:操作系统就是一个协调.管理和控制计算机硬件资源和软件资源的控制程序. 操作系统的作用: 1:隐藏丑陋复杂的硬件接 ...

  2. multimap的使用 in C++，同一个关键码存在多个值

    #include <iostream> #include <string> #include <vector> #include <algorithm> ...

  3. 入门大数据---Flink学习总括

    第一节 初识 Flink 在数据激增的时代,催生出了一批计算框架.最早期比较流行的有MapReduce,然后有Spark,直到现在越来越多的公司采用Flink处理.Flink相对前两个框架真正做到了高 ...

随机推荐

  1. Delphi直接读取XmL

    有时,只需要用XML作一些小的应用,比如只是简单地保存日志或者一些配置,这时我们只需要直接读写XML就好,效率第一. Delphi盒子有一个直接读写XML文件 (例子和代码),其核心函数为下面两个函数 ...

  2. CDN技术之--内容缓存工作原理

    有CDN前的网站服务技术–硬件扩展:高成本,灵活性和可扩展性比较差–镜像技术(mirroring):镜像服务器安装有一个可以进行自动远程备份的软件,每隔一定时间,各个镜像服务器就会到网站的源服务器上去 ...

  3. 筆記本 wifi走外网线 網卡走內網

    筆記本 wifi走外网线  網卡走內網 ,案列 -------------------------------------------------------- route print        ...

  4. Ubuntu安装可视化电脑配置视图工具neofetch

    安装步骤: sudo apt-get install software-properties-common python-software-propertiessudo add-apt-reposit ...

  5. HTML5: HTML5 介绍

    ylbtech-HTML5: HTML5 介绍 1. 什么是 HTML5?返回顶部   HTML5 是下一代 HTML 标准. HTML,HTML 4.01的上一个版本诞生于1999年.自从那儿以后, ...

  6. 实验吧关于隐写术的writeUp（二）

    0x01 Black Hole 1.下载文件后,发现打不开,放到kali中.用命令file 分析一下文件 root@trial:~/Documents# file blackhole.img blac ...

  7. 【React】react&&redux调试工具

    一.React调试工具 1.安装 react-developer-tools,在chrome应用商店进行下载,因为网络限制原因,我们可以使用火狐浏览器进行安装下载 a.打开火狐浏览器的附加组件 b.搜 ...

  8. linux 服务器内存占用统计

    当前内存占用率的计算,是根据top命令显示的Mem.used除以Mem.total得到. Mem.total:表示总物理内存. Mem.used: 表示内核控制的内存数,除了应用程序使用的内存外,还包 ...

  9. SQL才是世界上最牛逼的语言！

    身处互联网行业,SQL 可能是你需要掌握的核心技能之一. 最早的时候,SQL 作为一门查询数据库的语言,是程序员的必备技能,运维.开发.Web 以及数据等从业人员都需要用到 SQL,毕竟只有查询到正确 ...

  10. bootstrap学习（五）代码

    内联代码: <code>public static</code>void main 用户输入: to edit setting,press <kbd><kbd ...