我创建了一个暂停的进程test.exe，如下所示：
CreateProcess(
TEXT( "C:\\Documents and Settings\\willy\\桌面\\project\\test.exe" ),
TEXT( "test.exe" ),
NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi
);
如何在创建进程test.exe后获取进程点/启动/主地址？
我应该查找PE文件信息还是使用ReadProcessMemory()或VirtualQueryEx()
答案 0 :(得分：7)
好的，我已经破解了一个只有32位的解决方案，它从进程'PEB获取映像基地址。
档案 EntryPt.c ：
#include <windows.h>
#include <tchar.h>
#include <psapi.h>
#include <stdio.h>
#include <stddef.h>
// To ensure correct resolution of symbols, add Psapi.lib to TARGETLIBS
// and compile with -DPSAPI_VERSION=1
NTSTATUS (NTAPI *pNtQueryInformationProcess)(HANDLE, /*enum _PROCESSINFOCLASS*/DWORD, PVOID, ULONG, PULONG) = NULL;
extern PVOID GetPeb(HANDLE ProcessHandle);
// PEB definition comes from winternl.h. This is a 32-bit PEB.
typedef struct _PEB
{
BYTE Reserved1[2];
BYTE BeingDebugged;
BYTE Reserved2[1];
PVOID Reserved3[2]; // Reserved3[1] points to PEB
/*
PPEB_LDR_DATA Ldr;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
BYTE Reserved4[104];
PVOID Reserved5[52];
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
BYTE Reserved6[128];
PVOID Reserved7[1];
ULONG SessionId;
*/
} PEB, *PPEB;
int main(int argc, TCHAR* argv[])
{
STARTUPINFO StartupInfo;
PROCESS_INFORMATION ProcessInfo;
PPEB pPeb;
PVOID pImage, pEntry;
PIMAGE_NT_HEADERS pNtHeaders;
LONG e_lfanew;
SIZE_T NumberOfBytesRead;
pNtQueryInformationProcess = (NTSTATUS(NTAPI*)(HANDLE, /*enum _PROCESSINFOCLASS*/DWORD, PVOID, ULONG, PULONG))
GetProcAddress(
GetModuleHandle(TEXT("ntdll.dll")),
TEXT("NtQueryInformationProcess"));
if (pNtQueryInformationProcess == NULL)
{
printf("GetProcAddress(ntdll.dll, NtQueryInformationProcess) failed with error 0x%08X\n",
GetLastError());
return -1;
}
memset(&StartupInfo, 0, sizeof(StartupInfo));
memset(&ProcessInfo, 0, sizeof(ProcessInfo));
if (!CreateProcess(
NULL,
(argc > 1) ? argv[1] : argv[0],
NULL,
NULL,
FALSE,
CREATE_SUSPENDED,
NULL,
NULL,
&StartupInfo,
&ProcessInfo))
{
printf("CreateProcess() failed with error 0x%08X\n", GetLastError());
return -1;
}
printf("Current process:\n");
pPeb = GetPeb(GetCurrentProcess());
printf("PEB: 0x%08X\n", pPeb);
pImage = pPeb->Reserved3[1];
printf("Image base: 0x%08X\n", pImage);
pNtHeaders = (PIMAGE_NT_HEADERS)((PCHAR)pImage + ((PIMAGE_DOS_HEADER)pImage)->e_lfanew);
pEntry = (PVOID)((PCHAR)pImage + pNtHeaders->OptionalHeader.AddressOfEntryPoint);
printf("Image entry point: 0x%08X\n", pEntry);
printf("\n");
printf("Child process:\n");
pPeb = GetPeb(ProcessInfo.hProcess);
printf("PEB: 0x%08X\n", pPeb);
if (!ReadProcessMemory(
ProcessInfo.hProcess,
&pPeb->Reserved3[1],
&pImage,
sizeof(pImage),
&NumberOfBytesRead) || NumberOfBytesRead != sizeof(pImage))
{
printf("ReadProcessMemory(&pImage) failed with error 0x%08X\n", GetLastError());
goto End;
}
printf("Image base: 0x%08X\n", pImage);
if (!ReadProcessMemory(
ProcessInfo.hProcess,
(PCHAR)pImage + offsetof(IMAGE_DOS_HEADER, e_lfanew),
&e_lfanew,
sizeof(e_lfanew),
&NumberOfBytesRead) || NumberOfBytesRead != sizeof(e_lfanew))
{
printf("ReadProcessMemory(&e_lfanew) failed with error 0x%08X\n", GetLastError());
goto End;
}
pNtHeaders = (PIMAGE_NT_HEADERS)((PCHAR)pImage + e_lfanew);
if (!ReadProcessMemory(
ProcessInfo.hProcess,
(PCHAR)pNtHeaders + offsetof(IMAGE_NT_HEADERS, OptionalHeader.AddressOfEntryPoint),
&pEntry,
sizeof(pEntry),
&NumberOfBytesRead) || NumberOfBytesRead != sizeof(pEntry))
{
printf("ReadProcessMemory(&pEntry) failed with error 0x%08X\n", GetLastError());
goto End;
}
pEntry = (PVOID)((PCHAR)pImage + (SIZE_T)pEntry);
printf("Image entry point: 0x%08X\n", pEntry);
End:
TerminateProcess(ProcessInfo.hProcess, 0);
CloseHandle(ProcessInfo.hThread);
CloseHandle(ProcessInfo.hProcess);
return 0;
}
档案 GetPeb.c ：
#include <ntddk.h>
extern NTSTATUS (NTAPI *pNtQueryInformationProcess)(
HANDLE ProcessHandle,
PROCESSINFOCLASS ProcessInformationClass,
PVOID ProcessInformation,
ULONG ProcessInformationLength,
PULONG ReturnLength);
PVOID GetPeb(HANDLE ProcessHandle)
{
NTSTATUS status;
PROCESS_BASIC_INFORMATION pbi;
PVOID pPeb;
memset(&pbi, 0, sizeof(pbi));
status = pNtQueryInformationProcess(
ProcessHandle,
ProcessBasicInformation,
&pbi,
sizeof(pbi),
NULL);
pPeb = NULL;
if (NT_SUCCESS(status))
{
pPeb = pbi.PebBaseAddress;
}
return pPeb;
}
通过此批处理文件与Open Watcom 1.9一起编译：
set INCLUDE=%INCLUDE%;%WATCOM%\H\NT;%WATCOM%\H\NT\DDK;
wcl386 /we /wx /q /d2 -DPSAPI_VERSION=1 EntryPt.c GetPeb.c %WATCOM%\lib386\nt\psapi.lib
输出（在Windows XP上运行）：
>EntryPt.exe
Current process:
PEB: 0x7FFDD000
Image base: 0x00400000
Image entry point: 0x004013E8
Child process:
PEB: 0x7FFDC000
Image base: 0x00400000
Image entry point: 0x004013E8
>EntryPt.exe calc.exe
Current process:
PEB: 0x7FFDC000
Image base: 0x00400000
Image entry point: 0x004013E8
Child process:
PEB: 0x7FFDB000
Image base: 0x01000000
Image entry point: 0x01012475
此代码使用NtQueryInformationProcess()，可能会在未来版本的操作系统中发生变化。它还使用undocumented definition的PEB。除非适当修改（可能考虑到WOW64），否则此代码将无法在64位Windows上运行，并且可能无法与未来版本的Windows一起使用。
答案 1 :(得分：1)
当您使用CREATE_SUSPENDED执行进程时，它将从ntdll初始化代码开始。这对于找到.exe的入口点几乎没有用;你必须直接检查exe文件的标题：
#include <Windows.h>
#include <WinNT.h>
DWORD FindEntryPointAddress(_TCHAR *exeFile)
{
BY_HANDLE_FILE_INFORMATION bhfi;
HANDLE hMapping;
char *lpBase;
HANDLE hFile = CreateFile(exeFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
if (hFile == INVALID_HANDLE_VALUE)
fail("Opening exe file", GetLastError());
if (!GetFileInformationByHandle(hFile, &bhfi))
fail("GetFileInformationByHandle", GetLastError());
hMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, bhfi.nFileSizeHigh, bhfi.nFileSizeLow, NULL);
if (!hMapping)
fail("CreateFileMapping", GetLastError());
lpBase = (char *)MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, bhfi.nFileSizeLow);
if (!lpBase)
fail("MapViewOfFile", GetLastError());
PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)lpBase;
if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE)
fail("bad dos header signature", 0);
PIMAGE_NT_HEADERS32 ntHeader = (PIMAGE_NT_HEADERS32)(lpBase + dosHeader->e_lfanew);
if (ntHeader->Signature != IMAGE_NT_SIGNATURE)
fail("bad nt header signature", 0);
DWORD pEntryPoint = ntHeader->OptionalHeader.ImageBase + ntHeader->OptionalHeader.AddressOfEntryPoint;
UnmapViewOfFile((LPCVOID)lpBase);
CloseHandle(hMapping);
CloseHandle(hFile);
return pEntryPoint;
}
请注意，此地址是DLL初始化完成后执行的第一个代码。它可能不是（通常不是）等于main或WinMain的地址;它通常是一些静态链接到EXE的C库启动代码。
另请注意，如果EXE可重定位且启用了ASLR，则此操作将失败，因为EXE可能会加载到不同的基址。您必须找到EXE基址的位置，并在这种情况下使用{而不是ntHeader->OptionalHeader.ImageBase。