在windows 2003中,如何在驱动中取得当前进程完整路径?

大漠第一刀

由于这几年从事驱动开发,就发一些自已的心得.

在驱动开发中,有时候我们需要取得当前进程的路径,在之前,大家都是在抄xfilt的代码(xfilt是抄osr).
#define BASE_PROCESS_PEB_OFFSET     0x01B0
#define BASE_PEB_PROCESS_PARAMETER_OFFSET  0x0010
#define BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME 0x003C PCWSTR KfGetProcessFullName()
/*++
Arguments:
     pFullImageName - Pointer to get the process name, etc: \"C:\\WINNT\\notepad.exe\".
--*/
{
DWORD dwAddress;
  if(KeGetCurrentIrql() != PASSIVE_LEVEL)
  return NULL;
  dwAddress = (DWORD)PsGetCurrentProcess();
  if(dwAddress == 0 || dwAddress == 0xFFFFFFFF)
  return NULL;
dwAddress += BASE_PROCESS_PEB_OFFSET;
if((dwAddress = *(DWORD*)dwAddress) == 0) return 0;
dwAddress += BASE_PEB_PROCESS_PARAMETER_OFFSET;
if((dwAddress = *(DWORD*)dwAddress) == 0) return 0;
dwAddress += BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME;
if((dwAddress = *(DWORD*)dwAddress) == 0) return 0;
  return (PCWSTR)dwAddress;
}

这段代码在2k/xp能正确工作,可在2003上,一执行就蓝屏,为什么呢???

首先你要理想这段代码的工作原理(知道还看什么,快关IE.)

流程:
1.取得EPROCESS(PsGetCurrentProcess();)
2. 通过偏移量取得PEB, (Address + BASE_PROCESS_PEB_OFFSET )
3.通过PEB指针的偏移量取得RTL_USER_PROCESS_PARAMETER( Address + BASE_PEB_PROCESS_PARAMETER_OFFSET)
最后是取得其ImagePathName, 得到是UNICODE_STRING结构.

知道原理后,下面演示我是如何在2003上取得:


调试心得记录：使用Ｗindbg 分析2003的全路径存在哪儿？
1.　在主机安装2003 sym,不知道,可以去死了.
2.启动2003,并开一个IE.
3. 先得到结构参数
dt nt!_EPROCESS
+0x000 Pcb : _KPROCESS
+0x06c ProcessLock : _EX_PUSH_LOCK
+0x070 CreateTime : _LARGE_INTEGER
+0x078 ExitTime : _LARGE_INTEGER
+0x080 RundownProtect : _EX_RUNDOWN_REF
+0x084 UniqueProcessId : Ptr32 Void
+0x088 ActiveProcessLinks : _LIST_ENTRY
+0x090 QuotaUsage : [3] Uint4B
+0x09c QuotaPeak : [3] Uint4B
+0x0a8 CommitCharge : Uint4B
+0x0ac PeakVirtualSize : Uint4B
+0x0b0 VirtualSize : Uint4B
+0x0b4 SessionProcessLinks : _LIST_ENTRY
+0x0bc DebugPort : Ptr32 Void
+0x0c0 ExceptionPort : Ptr32 Void
+0x0c4 ObjectTable : Ptr32 _HANDLE_TABLE
+0x0c8 Token : _EX_FAST_REF
+0x0cc WorkingSetPage : Uint4B
+0x0d0 AddressCreationLock : _KGUARDED_MUTEX
+0x0f0 HyperSpaceLock : Uint4B
+0x0f4 ForkInProgress : Ptr32 _ETHREAD
+0x0f8 HardwareTrigger : Uint4B
+0x0fc PhysicalVadRoot : Ptr32 _MM_AVL_TABLE
+0x100 CloneRoot : Ptr32 Void
+0x104 NumberOfPrivatePages : Uint4B
+0x108 NumberOfLockedPages : Uint4B
+0x10c Win32Process : Ptr32 Void
+0x110 Job : Ptr32 _EJOB
+0x114 SectionObject : Ptr32 Void
+0x118 SectionBaseAddress : Ptr32 Void
+0x11c QuotaBlock : Ptr32 _EPROCESS_QUOTA_BLOCK
+0x120 WorkingSetWatch : Ptr32 _PAGEFAULT_HISTORY
+0x124 Win32WindowStation : Ptr32 Void
+0x128 InheritedFromUniqueProcessId : Ptr32 Void
+0x12c LdtInformation : Ptr32 Void
+0x130 VadFreeHint : Ptr32 Void
+0x134 VdmObjects : Ptr32 Void
+0x138 DeviceMap : Ptr32 Void
+0x13c Spare0 : [3] Ptr32 Void
+0x148 PageDirectoryPte : _HARDWARE_PTE
+0x148 Filler : Uint8B
+0x150 Session : Ptr32 Void
+0x154 ImageFileName : [16] UChar
+0x164 JobLinks : _LIST_ENTRY
+0x16c LockedPagesList : Ptr32 Void
+0x170 ThreadListHead : _LIST_ENTRY
+0x178 SecurityPort : Ptr32 Void
+0x17c PaeTop : Ptr32 Void
+0x180 ActiveThreads : Uint4B
+0x184 GrantedAccess : Uint4B
+0x188 DefaultHardErrorProcessing : Uint4B
+0x18c LastThreadExitStatus : Int4B
+0x190 Peb : Ptr32 _PEB
+0x194 PrefetchTrace : _EX_FAST_REF
+0x198 ReadOperationCount : _LARGE_INTEGER
+0x1a0 WriteOperationCount : _LARGE_INTEGER
+0x1a8 OtherOperationCount : _LARGE_INTEGER
+0x1b0 ReadTransferCount : _LARGE_INTEGER
+0x1b8 WriteTransferCount : _LARGE_INTEGER
+0x1c0 OtherTransferCount : _LARGE_INTEGER
+0x1c8 CommitChargeLimit : Uint4B
+0x1cc CommitChargePeak : Uint4B
+0x1d0 AweInfo : Ptr32 Void
+0x1d4 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
+0x1d8 Vm : _MMSUPPORT
+0x238 MmProcessLinks : _LIST_ENTRY
+0x240 ModifiedPageCount : Uint4B
+0x244 JobStatus : Uint4B
+0x248 Flags : Uint4B
+0x248 CreateReported : Pos 0, 1 Bit
+0x248 NoDebugInherit : Pos 1, 1 Bit
+0x248 ProcessExiting : Pos 2, 1 Bit
+0x248 ProcessDelete : Pos 3, 1 Bit
+0x248 Wow64SplitPages : Pos 4, 1 Bit
+0x248 VmDeleted : Pos 5, 1 Bit
+0x248 OutswapEnabled : Pos 6, 1 Bit
+0x248 Outswapped : Pos 7, 1 Bit
+0x248 ForkFailed : Pos 8, 1 Bit
+0x248 Wow64VaSpace4Gb : Pos 9, 1 Bit
+0x248 AddressSpaceInitialized : Pos 10, 2 Bits
+0x248 SetTimerResolution : Pos 12, 1 Bit
+0x248 BreakOnTermination : Pos 13, 1 Bit
+0x248 SessionCreationUnderway : Pos 14, 1 Bit
+0x248 WriteWatch : Pos 15, 1 Bit
+0x248 ProcessInSession : Pos 16, 1 Bit
+0x248 OverrideAddressSpace : Pos 17, 1 Bit
+0x248 HasAddressSpace : Pos 18, 1 Bit
+0x248 LaunchPrefetched : Pos 19, 1 Bit
+0x248 InjectInpageErrors : Pos 20, 1 Bit
+0x248 VmTopDown : Pos 21, 1 Bit
+0x248 ImageNotifyDone : Pos 22, 1 Bit
+0x248 PdeUpdateNeeded : Pos 23, 1 Bit
+0x248 VdmAllowed : Pos 24, 1 Bit
+0x248 Unused : Pos 25, 7 Bits
+0x24c ExitStatus : Int4B
+0x250 NextPageColor : Uint2B
+0x252 SubSystemMinorVersion : UChar
+0x253 SubSystemMajorVersion : UChar
+0x252 SubSystemVersion : Uint2B
+0x254 PriorityClass : UChar
+0x258 VadRoot : _MM_AVL_TABLE
　
kd> dt nt!_Peb
nt!_PEB
+0x000 InheritedAddressSpace : UChar
+0x001 ReadImageFileExecOptions : UChar
+0x002 BeingDebugged : UChar
+0x003 SpareBool : UChar
+0x004 Mutant : Ptr32 Void
+0x008 ImageBaseAddress : Ptr32 Void
+0x00c Ldr : Ptr32 _PEB_LDR_DATA
+0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS
+0x014 SubSystemData : Ptr32 Void
+0x018 ProcessHeap : Ptr32 Void
+0x01c FastPebLock : Ptr32 _RTL_CRITICAL_SECTION
+0x020 SparePtr1 : Ptr32 Void
+0x024 SparePtr2 : Ptr32 Void
+0x028 EnvironmentUpdateCount : Uint4B
+0x02c KernelCallbackTable : Ptr32 Void
+0x030 SystemReserved : [1] Uint4B
+0x034 ExecuteOptions : Pos 0, 2 Bits
+0x034 SpareBits : Pos 2, 30 Bits
+0x038 FreeList : Ptr32 _PEB_FREE_BLOCK
+0x03c TlsExpansionCounter : Uint4B
+0x040 TlsBitmap : Ptr32 Void
+0x044 TlsBitmapBits : [2] Uint4B
+0x04c ReadOnlySharedMemoryBase : Ptr32 Void
+0x050 ReadOnlySharedMemoryHeap : Ptr32 Void
+0x054 ReadOnlyStaticServerData : Ptr32 Ptr32 Void
+0x058 AnsiCodePageData : Ptr32 Void
+0x05c OemCodePageData : Ptr32 Void
+0x060 UnicodeCaseTableData : Ptr32 Void
+0x064 NumberOfProcessors : Uint4B
+0x068 NtGlobalFlag : Uint4B
+0x070 CriticalSectionTimeout : _LARGE_INTEGER
+0x078 HeapSegmentReserve : Uint4B
+0x07c HeapSegmentCommit : Uint4B
+0x080 HeapDeCommitTotalFreeThreshold : Uint4B
+0x084 HeapDeCommitFreeBlockThreshold : Uint4B
+0x088 NumberOfHeaps : Uint4B
+0x08c MaximumNumberOfHeaps : Uint4B
+0x090 ProcessHeaps : Ptr32 Ptr32 Void
+0x094 GdiSharedHandleTable : Ptr32 Void
+0x098 ProcessStarterHelper : Ptr32 Void
+0x09c GdiDCAttributeList : Uint4B
+0x0a0 LoaderLock : Ptr32 _RTL_CRITICAL_SECTION
+0x0a4 OSMajorVersion : Uint4B
+0x0a8 OSMinorVersion : Uint4B
+0x0ac OSBuildNumber : Uint2B
+0x0ae OSCSDVersion : Uint2B
+0x0b0 OSPlatformId : Uint4B
+0x0b4 ImageSubsystem : Uint4B
+0x0b8 ImageSubsystemMajorVersion : Uint4B
+0x0bc ImageSubsystemMinorVersion : Uint4B
+0x0c0 ImageProcessAffinityMask : Uint4B
+0x0c4 GdiHandleBuffer : [34] Uint4B
+0x14c PostProcessInitRoutine : Ptr32
+0x150 TlsExpansionBitmap : Ptr32 Void
+0x154 TlsExpansionBitmapBits : [32] Uint4B
+0x1d4 SessionId : Uint4B
+0x1d8 AppCompatFlags : _ULARGE_INTEGER
+0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER
+0x1e8 pShimData : Ptr32 Void
+0x1ec AppCompatInfo : Ptr32 Void
+0x1f0 CSDVersion : _UNICODE_STRING
+0x1f8 ActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
+0x1fc ProcessAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
+0x200 SystemDefaultActivationContextData : Ptr32 _ACTIVATION_CONTEXT_DATA
+0x204 SystemAssemblyStorageMap : Ptr32 _ASSEMBLY_STORAGE_MAP
+0x208 MinimumStackCommit : Uint4B
+0x20c FlsCallback : Ptr32 Ptr32 Void
+0x210 FlsListHead : _LIST_ENTRY
+0x218 FlsBitmap : Ptr32 Void
+0x21c FlsBitmapBits : [4] Uint4B
+0x22c FlsHighIndex : Uint4B
　
kd> dt nt!_RTL_USER_PROCESS_PARAMETERS
+0x000 MaximumLength : Uint4B
+0x004 Length : Uint4B
+0x008 Flags : Uint4B
+0x00c DebugFlags : Uint4B
+0x010 ConsoleHandle : Ptr32 Void
+0x014 ConsoleFlags : Uint4B
+0x018 StandardInput : Ptr32 Void
+0x01c StandardOutput : Ptr32 Void
+0x020 StandardError : Ptr32 Void
+0x024 CurrentDirectory : _CURDIR
+0x030 DllPath : _UNICODE_STRING
+0x038 ImagePathName : _UNICODE_STRING
+0x040 CommandLine : _UNICODE_STRING
+0x048 Environment : Ptr32 Void
+0x04c StartingX : Uint4B
+0x050 StartingY : Uint4B
+0x054 CountX : Uint4B
+0x058 CountY : Uint4B
+0x05c CountCharsX : Uint4B
+0x060 CountCharsY : Uint4B
+0x064 FillAttribute : Uint4B
+0x068 WindowFlags : Uint4B
+0x06c ShowWindowFlags : Uint4B
+0x070 WindowTitle : _UNICODE_STRING
+0x078 DesktopInfo : _UNICODE_STRING
+0x080 ShellInfo : _UNICODE_STRING
+0x088 RuntimeData : _UNICODE_STRING
+0x090 CurrentDirectores : [32] _RTL_DRIVE_LETTER_CURDIR
　
此时,不用我告诉你了吧!,去抄费尔提到用的方法.把偏移量改一改就可以.


所有,从上面可以看出来,xfilt的第一个PEB偏移量是错的,2003里,正确是:0x0190,而不是0x01B0.

注:有人会问,从你的结构上看,最后是0x38,可上面代码是0x03C???,
老兄,0x38是UNICODE_STRING, UNICODE_STRING 的结构是:
typedef struct _UNICODE_STRING {
  USHORT  Length;
  USHORT  MaximumLength;
  PWSTR  Buffer;
} UNICODE_STRING *PUNICODE_STRING;

所有返回其字符串指针要加上4个字节的偏移量:


附上完整代码:
/////////////////////////////////////////////////////////////////
//  类别:
//         文件系统操作
//  功能:
//         取得当前进程名完整路径名（例:C:\\WINNT\\notepad.exe）
//  参数：
//         
//  返回值：
//         STATUS_SUCCESS 成功
//  原理：取得EPROCESS->PEB->RTL_USER_PROCESS_PARAMETER->ImagePathName
//   从这原理也可以取出Command Line
//  注意：目前只支持Windows 2000/XP/2003
/////////////////////////////////////////////////////////////////

/////////////////////////////////////////////////////////////////
#define BASE_PROCESS_PEB_OFFSET     0x01B0
#define BASE_PEB_PROCESS_PARAMETER_OFFSET  0x0010
#define BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME 0x003C
#define W2003_BASE_PROCESS_PEB_OFFSET   0x0190
PCWSTR FsdGetProcessFullName()
{
DWORD dwAddress;
  if(KeGetCurrentIrql() != PASSIVE_LEVEL)
  return NULL;
  dwAddress = (DWORD)PsGetCurrentProcess();
  if(dwAddress == 0 || dwAddress == 0xFFFFFFFF)
  return NULL;
  //目前只支持Win 2000/xp/2003
if( (g_OsMajorVersion < 5) || (g_OsMinorVersion > 2 ) )
  return NULL;
  //取得PEB，不同平台的位置是不同的。
if( (g_OsMajorVersion == 5) && (g_OsMinorVersion < 2) )
  dwAddress += BASE_PROCESS_PEB_OFFSET;
else
  dwAddress += W2003_BASE_PROCESS_PEB_OFFSET;

if((dwAddress = *(DWORD*)dwAddress) == 0) return 0;
// 通过peb取得RTL_USER_PROCESS_PARAMETERS
dwAddress += BASE_PEB_PROCESS_PARAMETER_OFFSET;
if((dwAddress = *(DWORD*)dwAddress) == 0) return 0;

//在RTL_USER_PROCESS_PARAMETERS->ImagePathName保存了路径，偏移为38,
dwAddress += BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME;
if((dwAddress = *(DWORD*)dwAddress) == 0) return 0;
  return (PCWSTR)dwAddress;
}