Windows 内核级进程隐藏、侦测技术最新 .pdf

Windows内核级进程隐藏、侦测技术(5)

Windowsxx内核级进程隐藏、侦测技术

LockOwner:0x98

UniqueProcessId:0x9c

ActiveProcessLinks:0xa0

QuotaPeakPoolUsage[0]:0xa8

QuotaPoolUsage[0]:0xb0

PagefileUsage:0xb8

CommitCharge:0xbc

PeakPagefileUsage:0xc0

PeakVirtualSize:0xc4

VirtualSize:0xc8

Vm:0xd0

DebugPort:0x120

ExceptionPort:0x124

ObjectTable:0x128

Token:0x12c

WorkingSetLock:0x130

WorkingSetPage:0x150

ProcessOutswapEnabled:0x154

ProcessOutswapped:0x155

AddressSpaceInitialized:0x156

AddressSpaceDeleted:0x157

AddressCreationLock:0x158

ForkInProgress:0x17c

VmOperation:0x180

VmOperationEvent:0x184

PageDirectoryPte:0x1f0

LastFaultCount:0x18c

VadRoot:0x194

VadHint:0x198

CloneRoot:0x19c

NumberOfPrivatePages:0x1a0

NumberOfLockedPages:0x1a4

ForkWasSuessful:0x182

ExitProcessCalled:0x1aa

CreateProcessReported:0x1ab

SectionHandle:0x1ac

Peb:0x1b0

SectionBaseAddress:0x1b4

QuotaBlock:0x1b8

LastThreadExitStatus:0x1bc

WorkingSetWatch:0x1c0

InheritedFromUniqueProcessId:0x1c8

GrantedAess:0x1

DefaultHardErrorProcessing0x1d0

LdtInformation:0x1d4

VadFreeHint:0x1d8

VdmObjects:0x1dc

DeviceMap:0x1e0

ImageFileName[0]:0x1fc

VmTrimFaultValue:0x20c

Win32Process:0x214

Win32WindowStation:0x1c4

3.什么是活动进程链表

EPROCESS块中有一个ActiveProcessLinks成员，它是一个

PLISTENTRY机构的双向链表。当一个新进程建立的时候父进程负责

完成EPROCESS块，然后把ActiveProcessLinks链接到一个全局内

核变量PsActiveProcessHead链表中。

在PspCreateProcess内核API中能清晰的找到:

InsertTailList(PsActiveProcessHead,Process-

ActiveProcessLinks);

当进程结束的时候，该进程的EPROCESS结构当从活动进程链上

摘除。（但是EPROCESS结构不一定就马上释放）。

在PspExitProcess内核API中能清晰的找到:

RemoveEntryList(Process-ActiveProcessLinks);

所以我们完全可以利用活动进程链表来对进程进行枚举。

4.进程枚举检测HookSSDT隐藏的进程。

事实上NactiveAPIZwQuerySystemInformation对进程查询也是

找到活动进程链表头，然后遍历活动进程链。最后把每一个

EPROCESS中包含的根本信息返回（包括进程ID名字等）。所以用

遍历活动进程链表的方法能有效的把HookSSDT进行隐藏的进程轻

而易举的查出来。但是PsActiveProcessHead并没被ntoskrnl.exe

导出来，