我已经挂了TerminateProcess次来确定正在终止的进程,但是我从TerminateProcess
获得了与真实进程句柄不匹配的意外句柄我试图拦截。
我正在使用 Deviare 库,但我认为这个问题可以通过知道TerminateProcess
函数如何工作以及我需要做什么来执行正确的句柄比较来解决。
如果我知道要识别其终止的进程的句柄,我如何从hProcess
函数的TerminateProcess
param识别该句柄?
请注意我尝试比较句柄的部分:
If Process.GetProcessesByName("notepad").FirstOrDefault.Handle = hProcessValue Then ...
它永远不会是相同的句柄(我也尝试使用MainWindowHandle
和进程ID ID
)
因此,hProcess
参数的值对我来说是未知的。
Imports Nektra.Deviare2
Public NotInheritable Class Form1
Public WithEvents SpyMgr As NktSpyMgr
Public Hook As NktHook
ReadOnly libName As String = "kernel32.dll"
ReadOnly funcName As String = "TerminateProcess"
ReadOnly hookFlags As eNktHookFlags = eNktHookFlags.flgOnlyPreCall
' Processes to attach the hook.
ReadOnly processesToAttach As IEnumerable(Of Process) =
Process.GetProcessesByName("taskmgr")
Private Sub Test() Handles MyBase.Load
If Me.processesToAttach.Count = 0 Then
MsgBox("Any process found.")
Else
Me.SpyMgr = New NktSpyMgr()
Me.SpyMgr.Initialize()
Me.Hook = SpyMgr.CreateHook(String.Format("{0}!{1}", libName, funcName), hookFlags)
Me.Hook.Hook(sync:=True)
For Each proc As Process In processesToAttach
Debug.WriteLine("Attaching to: " & proc.ProcessName)
Me.Hook.Attach(procOrId:=proc.Id, sync:=True)
Next proc
End If
End Sub
<MTAThread>
Private Sub OnTerminateProcess_Called(ByVal hook As NktHook,
ByVal proc As NktProcess,
ByVal callInfo As NktHookCallInfo) Handles SpyMgr.OnFunctionCalled
' Function params.
Dim hProcessParam As NktParam = DirectCast(callInfo.Params(0), NktParam)
Dim uExitCodeParam As NktParam = DirectCast(callInfo.Params(1), NktParam)
' Param values.
Dim hProcessValue As IntPtr = New IntPtr(CInt(hProcessParam.Value))
Dim uExitCodeValue As UInteger = CUInt(uExitCodeParam.Value)
' Debuf info.
Trace.WriteLine(String.Format("hProcess : '{0}'", hProcessValue))
Trace.WriteLine(String.Format("uExitCode: '{0}'", uExitCodeValue))
' Handle Comparison
If Process.GetProcessesByName("notepad").FirstOrDefault.Handle = hProcessValue Then
' Skip precall to avoid process termination.
If callInfo.IsPreCall Then
callInfo.Result.Value = 1
callInfo.SkipCall()
End If
End If
End Sub
End Class
我一直在阅读TerminateProcess的MSDN文档。
注意它所说的部分:
句柄必须具有PROCESS_TERMINATE访问权限
我不确定我是否错过了比较手柄的东西。
我也一直在这里读书,但我没有明白:
Hooking TerminateProcess & Getting Info From The Handle It Supplies
如果可能需要执行良好的句柄比较,我也设计了这个枚举:
Public Enum ProcessAccessFlags As UInteger
All = &H1F0FFF
Terminate = &H1
CreateThread = &H2
VirtualMemoryOperation = &H8
VirtualMemoryRead = &H10
VirtualMemoryWrite = &H20
DuplicateHandle = &H40
CreateProcess = &H80
SetQuota = &H100
SetInformation = &H200
QueryInformation = &H400
QueryLimitedInformation = &H1000
Synchronize = &H100000
End Enum
答案 0 :(得分:2)
您的代码假设每个进程只有一个句柄。这个不对。每个进程有一个进程ID。但每当有人请求进程的句柄时,例如OpenProcess(..., ..., procid)
,他就会获得一个新的进程句柄(这也取决于所需的访问权限)。
因此您无法比较句柄,您应该检查模块名称或进程ID。