ARK相关技术.pptxVIP

ARK相关技术(一)mallocfree:linxer目录进程线程进程模块进程其他项目驱动模块SSDTShadow SSDTFSD一.进程1.进程枚举2.EPROCESS识别3.TerminateProcess1.进程枚举A.Ring3枚举进程1.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS) / Process32First / Process32NextZwQuerySystemInformation(SystemProcessesAndThreadsInformation)EnumWindows / GetWindowThreadProcessIdfor(; ; ) OpenProcess……B. PspCidTable查找PspCidTableExEnumHandleTable解析PspCidTableHANDLE_TABLEHANDLE_TABLE_ENTRYKPCR. KdVersionBlock-PspCidTable (wdbgexts.h)2000 _HANDLE_TABLEtypedef struct _HANDLE_TABLE{ULONG Flags;LONGHandleCount;PHANDLE_TABLE_ENTRY **Table;================================PEPROCESSQuotaProcess;HANDLEUniqueProcessId;LONG FirstFreeTableEntry;LONG NextIndexNeedingPool;ERESOURCE HandleTableLock;LIST_ENTRY HandleTableList;KEVENT HandleContentionEvent;}_HANDLE_TABLE,*PHANDLE_TABLE;XP~Win7 HANDLE_TABLEnt!_HANDLE_TABLE +0x000 TableCode : Uint8B ===================================== +0x008 QuotaProcess : Ptr64 _EPROCESS +0x010 UniqueProcessId : Ptr64 Void +0x018 HandleLock : _EX_PUSH_LOCK +0x020 HandleTableList : _LIST_ENTRY +0x030 HandleContentionEvent : _EX_PUSH_LOCK +0x038 DebugInfo : Ptr64 _HANDLE_TRACE_DEBUG_INFO +0x040 ExtraInfoPages : Int4B +0x044 Flags : Uint4B +0x044 StrictFIFO : Pos 0, 1 Bit +0x048 FirstFreeHandle : Uint4B +0x050 LastFreeHandleEntry : Ptr64 _HANDLE_TABLE_ENTRY +0x058 HandleCount : Uint4B +0x05c NextHandleNeedingPool : Uint4B +0x060 HandleCountHighWatermark : Uint4BWin8 _HANDLE_TABLEnt!_HANDLE_TABLE +0x000 NextHandleNeedingPool : Uint4B +0x004 ExtraInfoPages : Int4B +0x008 TableCode : Uint4B================================================== +0x00c QuotaProcess : Ptr32 _EPROCESS +0x010 HandleTableList : _LIST_ENTRY +0x018 UniqueProcessId : Uint4B +0x01c Flags : Uint4B +0x01c StrictFIFO : Pos 0, 1 Bit +0x01c EnableHandleExceptions : Pos 1, 1 Bit +0x01c Rundown : Pos 2, 1 Bit +0x01c Duplicated : Pos 3, 1 Bit +0x020 HandleContentionEvent : _EX_PUSH_LOCK +0x024 HandleTableLock : _EX_PUSH_LOCK +0x