论坛: 编程破解 标题: 端口到进程实现的源代码的问题 复制本贴地址    
作者: dongle2001 [dongle2001]    论坛用户   登录
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <Aclapi.h>
#include <comdef.h>
#include <winioctl.h>
#pragma comment ( lib, "ws2_32.lib" )
#define NT_HANDLE_LIST 16
#define MAX_HANDLE_LIST_BUF 0x200000
typedef struct _HandleInfo
{
USHORT dwPid;  
USHORT CreatorBackTraceIndex;
BYTE  ObjType;
BYTE  HandleAttributes;
USHORT HndlOffset;
DWORD dwKeObject;
ULONG GrantedAccess;
}HANDLEINFO, *PHANDLEINFO;
typedef struct _IO_STATUS_BLOCK {
DWORD Status;
ULONG Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
typedef struct _LSA_UNICODE_STRING {
  USHORT Length;
  USHORT MaximumLength;
  PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
  UNICODE_STRING *ObjectName;
ULONG Attributes;
PSECURITY_DESCRIPTOR SecurityDescriptor;
PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
} OBJECT_ATTRIBUTES,*POBJECT_ATTRIBUTES;
// 申明NtQuerySystemInformation()函数
typedef DWORD (CALLBACK* NTQUERYSYSTEMINFORMATION)( DWORD, PDWORD, DWORD, PVOID );
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
typedef VOID (CALLBACK* RTLINITUNICODESTRING)(PUNICODE_STRING,PCWSTR);
RTLINITUNICODESTRING RtlInitUnicodeString;
typedef DWORD (CALLBACK* ZWOPENSECTION)(PVOID, DWORD,POBJECT_ATTRIBUTES);
ZWOPENSECTION ZwOpenSection;
typedef VOID(CALLBACK* INITIALIZEOBJECTATTRIBUTES)(POBJECT_ATTRIBUTES,PUNICODE_STRING,ULONG,HANDLE,PSECURITY_DESCRIPTOR);
INITIALIZEOBJECTATTRIBUTES InitializeObjectAttributes;
typedef DWORD (CALLBACK* ZWOPENFILE)(PHANDLE,DWORD,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
ZWOPENFILE ZwOpenFile;
DWORD getmap(PHANDLEINFO get1,LPVOID addr,HANDLE pm,char * buf)
{
DWORD readset;
LPVOID pmaddr1;
int i;
readset = (get1->dwKeObject>>0x16);
readset = *((LPDWORD)((DWORD)addr + 4*readset));
if((readset&0x000000ff)==1)
{
 return 0;
}
else
{
 if((readset&0x000000ff)==0x80)
 {
  pmaddr1 = MapViewOfFile(pm,4,0,readset&0xfffff000,0x1000);
  readset = (get1->dwKeObject>>0x0c) & 0x3ff;
  readset = *((LPDWORD)((DWORD)pmaddr1 + 4*readset));
  UnmapViewOfFile(pmaddr1);
  readset = readset & 0x0FFFFF000;
 }
 else
 {
  readset=(readset&0xfffff000)+(get1->dwKeObject&0x003ff000);
 }
 pmaddr1 =MapViewOfFile(pm,4,0,readset,0x1000);
 if(pmaddr1!=NULL)
 {
  readset = get1->dwKeObject&0x00000fff;
  readset = (DWORD)pmaddr1+readset;
  for(i=0;i<0x70;i++)
  buf[i] = *((char *)(readset + i));
  UnmapViewOfFile(pmaddr1);
 }
 else
 {
  return 0;
 }
}
return readset;
}
int main( )
{
DWORD readset1;
DWORD readset2;
DWORD readset3;
OVERLAPPED la;
HMODULE hNtdll = NULL;
DWORD dwNumEntries;
PHANDLEINFO pHandleInfo;
HANDLE htcp;
HANDLE pmy;
HANDLE hudp;
HANDLE myhand;
HANDLE h1=NULL;
hNtdll = LoadLibrary( "ntdll.dll" );
DWORD status;
LPVOID pmaddr;
TOKEN_PRIVILEGES NewState;
DWORD dwNumBytes = MAX_HANDLE_LIST_BUF;
PDWORD pdwHandleList;
PDWORD pdwHandInfo;
DWORD dwNumBytesRet;
HANDLE hToken;
BOOL isok;
UNICODE_STRING dn;
IO_STATUS_BLOCK ch3;
int port1;
int port2;
HANDLE hProc;
wchar_t * ch1 = L"\\Device\\Tcp";
wchar_t * ch2 = L"\\Device\\Udp"; 
OBJECT_ATTRIBUTES ofs;
DWORD i;
DWORD p=0;
char buf1[0x70];
char buf2[0x70];
char buf3[0x70];
char in[0x18];
char in1[0x18];
char out[0x38];
char out1[0x30];
PHANDLEINFO tcpdnum;
PHANDLEINFO udpdnum;
if ( !hNtdll )
{
 printf( "LoadLibrary( NTDLL.DLL ) Error:%d\n", GetLastError() );
 return false;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)
 GetProcAddress( hNtdll, "NtQuerySystemInformation");
RtlInitUnicodeString = (RTLINITUNICODESTRING)
 GetProcAddress( hNtdll, "RtlInitUnicodeString");
ZwOpenSection = (ZWOPENSECTION)
 GetProcAddress( hNtdll, "ZwOpenSection");;
InitializeObjectAttributes = (INITIALIZEOBJECTATTRIBUTES)
 GetProcAddress( hNtdll, "InitializeObjectAttributes");
ZwOpenFile = (ZWOPENFILE)
 GetProcAddress( hNtdll, "ZwOpenFile");;
RtlInitUnicodeString(&dn,L"\\Device\\PhysicalMemory");
OBJECT_ATTRIBUTES udm= {
     sizeof(OBJECT_ATTRIBUTES),     // Length
     NULL,                // RootDirectory
     &dn,                // ObjectName
     0,                 // Attributes
     NULL,                // SecurityDescriptor
     NULL,                // SecurityQualityOfService
     };
status = ZwOpenSection(&h1,SECTION_MAP_READ,&udm);
if(status == 0)
{
 pmy = GetCurrentProcess();
 pmaddr =MapViewOfFile(h1,4,0,0x30000,0x1000);
 NewState.PrivilegeCount=1;
 NewState.Privileges[0].Attributes=2;
 NewState.Privileges[0].Luid.HighPart=0;
 NewState.Privileges[0].Luid.LowPart=0;
 isok=LookupPrivilegeValue(0,SE_DEBUG_NAME,&NewState.Privileges[0].Luid);
 isok=OpenProcessToken(pmy,0x20,&hToken);
 isok=AdjustTokenPrivileges(hToken,0,&NewState,0x10,0,0);
 CloseHandle(hToken);
 RtlInitUnicodeString(&dn,ch1);
 ofs.SecurityDescriptor = 0;
 ofs.ObjectName = &dn;
 ofs.Length =0x18;
 ofs.RootDirectory = 0;
 ofs.Attributes =0x40;
 ofs.SecurityQualityOfService =0;
 status=ZwOpenFile(&htcp,0x100000,&ofs,&ch3,3,0);
 RtlInitUnicodeString(&dn,ch2);
 ofs.ObjectName = &dn;
 status=ZwOpenFile(&hudp,0x100000,&ofs,&ch3,3,0); 
 pdwHandleList = (PDWORD)malloc(dwNumBytes);
 pdwHandInfo = (PDWORD)malloc(2048);
 dwNumBytesRet = 0x10;
 isok = (*NtQuerySystemInformation)(0x10,pdwHandleList,dwNumBytes,&dwNumBytesRet);
 if( !isok)
 {
  dwNumEntries = pdwHandleList[0];
  pHandleInfo = (PHANDLEINFO)( pdwHandleList + 1 );
  for (i = 0; i < dwNumEntries; i++ )
  {
  if(pHandleInfo->dwPid == GetCurrentProcessId() && pHandleInfo->HndlOffset ==(int)htcp)
  {
   tcpdnum = pHandleInfo;
   break;
  }
  pHandleInfo++;
  }
  pHandleInfo = (PHANDLEINFO)( pdwHandleList + 1 );
  for (i = 0; i < dwNumEntries; i++ )
  {
  if(pHandleInfo->dwPid == GetCurrentProcessId() && pHandleInfo->HndlOffset ==(int)hudp)
  {
   udpdnum = pHandleInfo;
   break;
  }
  pHandleInfo++;
  }
  ZeroMemory(buf1,0x70);
  ZeroMemory(buf2,0x70);
  readset1 = getmap(tcpdnum,pmaddr,h1,buf1);
  if(readset1==0)
  {
  printf("map tcp faile\n");
  return 0;
  }
  readset2 = getmap(udpdnum,pmaddr,h1,buf2);
  if(readset2==0)
  {
  printf("map udp faile\n");
  return 0;
  }
  la.hEvent = CreateEvent(0,1,0,0);;
  la.Internal = 0;
  la.InternalHigh=0;
  la.Offset = 0;
  la.OffsetHigh = 0;
  pHandleInfo = (PHANDLEINFO)( pdwHandleList + 1 );
  for (i = 0; i < dwNumEntries; i++ )
  {
  ZeroMemory(buf3,0x70);
  if(pHandleInfo->ObjType == tcpdnum->ObjType)
  {
   readset3 = getmap(pHandleInfo,pmaddr,h1,buf3);
   if(readset3==0)
   {
   pHandleInfo++;
   continue;
   }
   if(buf3[4]==buf1[4] && buf3[5]==buf1[5]&& buf3[6]==buf1[6]&& buf3[7]==buf1[7])
   {
   if((buf3[16]==1 || buf3[16]==2) && buf3[17]==0 && buf3[18]==0 && buf3[19]==0)
   {
    hProc = OpenProcess(0x40,0,pHandleInfo->dwPid);
    if(hProc==NULL)
    {
    pHandleInfo++;
    continue;
    }
    DuplicateHandle(hProc,(HANDLE)pHandleInfo->HndlOffset,pmy,&myhand,0,0,2);
    CloseHandle(hProc);
    if(myhand==NULL)
    {
    pHandleInfo++;
    continue;
    }
    ZeroMemory(out1,0x30);
    ZeroMemory(out,0x38);
    ZeroMemory(in,0x18);
    ZeroMemory(in1,0x18);
    in[0x10] = 4;
    in1[0x10]=3;
    if(buf3[16]==2)
    {
    p = 0;
    isok = DeviceIoControl(myhand,0x210012,&in,0x18,&out,0x38,&p,&la);
    if(isok==FALSE)
    {
     pHandleInfo++;
     continue;
    }
    }
    isok = DeviceIoControl(myhand,0x210012,&in1,0x18,&out1,0x30,&p,&la);
    if(isok)  
    {
    port1 = out1[12];
    if(port1<0)
     port1 = 256 + port1;
    port1 = port1*256;
    port2 = out1[13];
    if(port2<0)
     port1 = port1 + 256 + port2;
    else
     port1 = port1 + port2;
    printf("TCP    PID:%d;      PORT:%d\n",pHandleInfo->dwPid,port1);
    }
    CloseHandle(myhand);
   }     
   }      
  }  
  pHandleInfo++;
  }
  pHandleInfo = (PHANDLEINFO)( pdwHandleList + 1 );
  for (i = 0; i < dwNumEntries; i++ )
  {
  ZeroMemory(buf3,0x70);
  if(pHandleInfo->ObjType == udpdnum->ObjType)
  {
   readset3 = getmap(pHandleInfo,pmaddr,h1,buf3);
   if(readset3==0)
   {
   pHandleInfo++;
   continue;
   }
   if(buf3[4]==buf2[4] && buf3[5]==buf2[5]&& buf3[6]==buf2[6]&& buf3[7]==buf2[7])
   {
   if((buf3[16]==1 || buf3[16]==2) && buf3[17]==0 && buf3[18]==0 && buf3[19]==0)
   {
    hProc = OpenProcess(0x40,0,pHandleInfo->dwPid);
    if(hProc==NULL)
    {
    pHandleInfo++;
    continue;
    }
    DuplicateHandle(hProc,(HANDLE)pHandleInfo->HndlOffset,pmy,&myhand,0,0,2);
    CloseHandle(hProc);
    if(myhand==NULL)
    {
    pHandleInfo++;
    continue;
    }
    ZeroMemory(out1,0x30);
    ZeroMemory(out,0x38);
    ZeroMemory(in,0x18);
    ZeroMemory(in1,0x18);
    in[0x10] = 4;
    in1[0x10]=3;
    if(buf3[16]==2)
    {
    p = 0;
    isok = DeviceIoControl(myhand,0x210012,&in,0x18,&out,0x38,&p,&la);
    if(isok==FALSE)
    {
     pHandleInfo++;
     continue;
    }
    }
    isok = DeviceIoControl(myhand,0x210012,&in1,0x18,&out1,0x30,&p,&la);
    if(isok)  
    {
    port1 = out1[12];
    if(port1<0)
     port1 = 256 + port1;
    port1 = port1*256;
    port2 = out1[13];
    if(port2<0)
     port1 = port1 + 256 + port2;
    else
     port1 = port1 + port2;
    printf("UDP    PID:%d;    PORT:%d\n",pHandleInfo->dwPid,(unsigned short)port1);
    }
    CloseHandle(myhand);
   }     
   }    
  }
  pHandleInfo++;
  }  
  CloseHandle(la.hEvent);
  free(pdwHandleList);
  free(pdwHandInfo);
  CloseHandle(h1);
  CloseHandle(pmy);
  CloseHandle(htcp);
  CloseHandle(hudp);
  UnmapViewOfFile(pmaddr);
 }
 else
  printf("error open handlelist\n");
}
else
 printf("error open physcalmemory\n");
return true;
}
以上是编程技巧文摘中端口到进程实现的源代码,为什麽我调不通,运行得不到正确的结果,那位运行这段代码得到正确了结果,能帮帮我吗,把调好代码发给我,谢谢?

地主 发表时间: 05-02-03 14:50

回复: 286 [unique]   版主   登录
不错,程序是没错的。
看看是不是你调试出的问题。

B1层 发表时间: 05-02-04 09:18

回复: dongle2001 [dongle2001]   论坛用户   登录
能帮忙发个调好的代码给我吗,我调了几天了,急用呀。 我的邮箱dongle1@sohu.com,先谢谢斑竹了

B2层 发表时间: 05-02-04 12:24

回复: 286 [unique]   版主   登录
已发,请查收。

B3层 发表时间: 05-02-05 09:06

回复: dongle2001 [dongle2001]   论坛用户   登录
没收到,麻烦斑竹再给发一下好吗,或者加我qq:95778598。

B4层 发表时间: 05-02-05 11:12

回复: 286 [unique]   版主   登录
http://www.20cn.org/~unique/Temp/PortToProcess.rar
二十日内有效。

B5层 发表时间: 05-02-05 13:07

回复: bailove [bailove]   论坛用户   登录
这里就因为有了 286 编程破解才变的生机勃勃
  虽然上面是看的一头雾水 是vc++的吗? 实现  端口  然后 查找到 开着端口的进程吗?


[此贴被 bailove(bailove) 在 02月05日22时32分 编辑过]

B6层 发表时间: 05-02-05 22:29

论坛: 编程破解

20CN网络安全小组版权所有
Copyright © 2000-2010 20CN Security Group. All Rights Reserved.
论坛程序编写:NetDemon

粤ICP备05087286号