admin/mirror-processhacker
1
0
Fork 0
mirror of https://github.com/mirror/processhacker synced 2026-06-08 16:03:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

implemented KphReadVirtualMemory!

Browse Source 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@987 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
wj32
2009-04-01 10:27:41 +00:00
parent 5c479cfd10
commit a59eedfb65
8 changed files with 100 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
trunk/KProcessHacker/i386/kprocesshacker.sys
BIN
View File
Binary file not shown.
trunk/KProcessHacker/kph_nt.c
+38
View File
@@ -457,3 +457,41 @@ NTSTATUS KphTerminateProcess(
return status;
}
NTSTATUS KphReadVirtualMemory(
HANDLE ProcessHandle,
PVOID BaseAddress,
PVOID Buffer,
ULONG BufferLength,
PULONG ReturnLength,
KPROCESSOR_MODE AccessMode
)
{
NTSTATUS status = STATUS_SUCCESS;
PEPROCESS processObject;
ULONG returnLength = 0;
if (BufferLength)
{
status = ObReferenceObjectByHandle(ProcessHandle, 0, *PsProcessType, KernelMode, &processObject, NULL);
if (!NT_SUCCESS(status))
return status;
status = MmCopyVirtualMemory(
processObject,
BaseAddress,
PsGetCurrentProcess(),
Buffer,
BufferLength,
AccessMode,
&returnLength
);
ObDereferenceObject(processObject);
}
if (ReturnLength)
*ReturnLength = returnLength;
return status;
}
trunk/KProcessHacker/kph_nt.h
+20 -2
View File
@@ -26,7 +26,6 @@
#include "kprocesshacker.h"
#include "kernel_types.h"
/* Kernel API */
NTSTATUS NTAPI ObOpenObjectByName(
POBJECT_ATTRIBUTES ObjectAttributes,
POBJECT_TYPE ObjectType,
@@ -37,6 +36,16 @@ NTSTATUS NTAPI ObOpenObjectByName(
PHANDLE Handle
);
NTSTATUS NTAPI MmCopyVirtualMemory(
PEPROCESS FromProcess,
PVOID FromAddress,
PEPROCESS ToProcess,
PVOID ToAddress,
ULONG BufferLength,
KPROCESSOR_MODE AccessMode,
PULONG ReturnLength
);
NTSTATUS NTAPI PsLookupProcessThreadByCid(
PCLIENT_ID ClientId,
PEPROCESS *Process,
@@ -62,7 +71,7 @@ NTSTATUS PsResumeProcess(
PEPROCESS Process
);
/* KProcessHacker versions */
/* KProcessHacker */
NTSTATUS KphOpenProcess(
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
@@ -107,6 +116,15 @@ NTSTATUS KphTerminateProcess(
NTSTATUS ExitStatus
);
NTSTATUS KphReadVirtualMemory(
HANDLE ProcessHandle,
PVOID BaseAddress,
PVOID Buffer,
ULONG BufferLength,
PULONG ReturnLength,
KPROCESSOR_MODE AccessMode
);
NTSTATUS OpenProcess(
PHANDLE ProcessHandle,
int DesiredAccess,
trunk/KProcessHacker/kprocesshacker.c
+11 -26
View File
@@ -268,8 +268,8 @@ char *GetIoControlName(ULONG ControlCode)
return "KphSuspendProcess";
else if (ControlCode == KPH_RESUMEPROCESS)
return "KphResumeProcess";
else if (ControlCode == KPH_READPROCESSMEMORY)
return "Read Process Memory";
else if (ControlCode == KPH_READVIRTUALMEMORY)
return "KphReadVirtualMemory";
else if (ControlCode == KPH_SETPROCESSTOKEN)
return "Set Process Token";
else if (ControlCode == KPH_GETTHREADWIN32STARTADDRESS)
@@ -651,41 +651,26 @@ NTSTATUS KphIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
}
break;
case KPH_READPROCESSMEMORY:
case KPH_READVIRTUALMEMORY:
{
HANDLE processHandle;
PVOID baseAddress;
PKPROCESS processObject;
KAPC_STATE apcState;
PVOID buffer;
ULONG bufferLength;
if (inLength < 8)
if (inLength < 8 || outLength < 4)
{
status = STATUS_BUFFER_TOO_SMALL;
goto IoControlEnd;
}
processHandle = *(HANDLE *)dataBuffer;
baseAddress = *(PVOID *)(dataBuffer + 4);
baseAddress = *(PVOID *)(dataBuffer + 0x4);
buffer = *(PVOID *)(dataBuffer + 0x8);
bufferLength = *(PULONG)(dataBuffer + 0xc);
status = ObReferenceObjectByHandle(processHandle, 0, *PsProcessType, KernelMode, &processObject, 0);
if (!NT_SUCCESS(status))
goto IoControlEnd;
KeStackAttachProcess(processObject, &apcState);
__try
{
RtlCopyMemory(dataBuffer, baseAddress, outLength);
retLength = outLength;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
status = STATUS_ACCESS_VIOLATION;
}
KeUnstackDetachProcess(&apcState);
ObDereferenceObject(processObject);
status = KphReadVirtualMemory(processHandle, baseAddress, buffer, bufferLength, (PULONG)dataBuffer, UserMode);
retLength = 4;
}
break;
trunk/KProcessHacker/kprocesshacker.h
+1 -1
View File
@@ -53,7 +53,7 @@ typedef struct _SYSTEM_HANDLE_INFORMATION
#define KPH_TERMINATEPROCESS KPH_CTL_CODE(8)
#define KPH_SUSPENDPROCESS KPH_CTL_CODE(9)
#define KPH_RESUMEPROCESS KPH_CTL_CODE(10)
#define KPH_READPROCESSMEMORY KPH_CTL_CODE(11)
#define KPH_READVIRTUALMEMORY KPH_CTL_CODE(11)
#define KPH_SETPROCESSTOKEN KPH_CTL_CODE(12)
#define KPH_GETTHREADWIN32STARTADDRESS KPH_CTL_CODE(13)
#define KPH_GETOBJECTNAME KPH_CTL_CODE(14)
trunk/ProcessHacker/Forms/ThreadWindow.cs
+2 -2
View File
@@ -259,8 +259,8 @@ namespace ProcessHacker
{
try
{
Array.Copy(Program.KPH.ReadProcessMemory(Win32.ProcessHandle.FromHandle(processHandle),
baseAddress, size), buffer, size);
Program.KPH.KphReadVirtualMemory(Win32.ProcessHandle.FromHandle(processHandle),
baseAddress, buffer, size, out bytesRead);
bytesRead = size;
return true;
}
trunk/ProcessHacker/KProcessHacker.cs
+19 -14
View File
@@ -52,7 +52,7 @@ namespace ProcessHacker
KphTerminateProcess,
KphSuspendProcess,
KphResumeProcess,
ReadProcessMemory,
KphReadVirtualMemory,
SetProcessToken,
GetThreadWin32StartAddress,
GetObjectName,
@@ -261,6 +261,24 @@ namespace ProcessHacker
_fileHandle.IoControl(CtlCode(Control.KphOpenThread), inData, outData);
return Misc.BytesToInt(outData, Misc.Endianness.Little);
}
public unsafe void KphReadVirtualMemory(Win32.ProcessHandle processHandle, int baseAddress, byte[] buffer, int length, out int bytesRead)
{
byte[] data = new byte[16];
byte[] result = new byte[4];
fixed (byte* bufferPointer = buffer)
{
Array.Copy(Misc.IntToBytes(processHandle, Misc.Endianness.Little), 0, data, 0, 4);
Array.Copy(Misc.IntToBytes(baseAddress, Misc.Endianness.Little), 0, data, 4, 4);
Array.Copy(Misc.IntToBytes((int)bufferPointer, Misc.Endianness.Little), 0, data, 8, 4);
Array.Copy(Misc.IntToBytes(length, Misc.Endianness.Little), 0, data, 12, 4);
_fileHandle.IoControl(CtlCode(Control.KphReadVirtualMemory), data, result);
bytesRead = Misc.BytesToInt(result, Misc.Endianness.Little);
}
}
public void KphResumeProcess(Win32.ProcessHandle processHandle)
@@ -304,19 +322,6 @@ namespace ProcessHacker
return buffer;
}
public byte[] ReadProcessMemory(Win32.ProcessHandle processHandle, int baseAddress, int length)
{
byte[] data = new byte[8];
byte[] readData = new byte[length];
Array.Copy(Misc.IntToBytes(processHandle, Misc.Endianness.Little), 0, data, 0, 4);
Array.Copy(Misc.IntToBytes(baseAddress, Misc.Endianness.Little), 0, data, 4, 4);
_fileHandle.IoControl(CtlCode(Control.ReadProcessMemory), data, readData);
return readData;
}
public void SetProcessProtected(int pid, bool protecte)
{
byte[] data = new byte[5];
trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs
+9 -2
View File
@@ -643,8 +643,15 @@ namespace ProcessHacker
byte[] buf = new byte[length];
int readLen;
if (!ReadProcessMemory(this, offset, buf, length, out readLen))
ThrowLastWin32Error();
if (Program.KPH != null)
{
Program.KPH.KphReadVirtualMemory(this, offset, buf, length, out readLen);
}
else
{
if (!ReadProcessMemory(this, offset, buf, length, out readLen))
ThrowLastWin32Error();
}
return buf;
}