阅读:1458回复:0
hook ZwWriteVirtualMemory如何获取目的进程路径
ZwWriteVirtualMemory(
IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN PVOID Buffer, IN ULONG BufferLength, OUT PULONG ReturnLength OPTIONAL) hook了这个函数,想要从第一个参数得到目的进程的路径,我是这么做的: void GetMemFullName(HANDLE hProcess,char *pname) { POBJECT pMemObj; ULONG ReturnLength; NTSTATUS ns; ANSI_STRING procname; WCHAR Buffer[sizeof(OBJECT_NAME_INFORMATION)+(MAXPROCNAME*sizeof(WCHAR))]; POBJECT_NAME_INFORMATION ObjectNameInfo = (POBJECT_NAME_INFORMATION)Buffer; ObReferenceObjectByHandle( hProcess, 0, NULL, KernelMode, &pMemObj, NULL ); if(pMemObj==NULL) { DbgPrint("no object\n"); return; } ns=ObQueryNameString(pMemObj, ObjectNameInfo, sizeof(Buffer), &ReturnLength); if (!NT_SUCCESS(ns)) { DbgPrint("get the name error"); return; } ReleasePointer( POBJECT pMemObj ); RtlUnicodeStringToAnsiString( &procname, ObjectNameInfo, TRUE );// strncpy(pname,procname->Buffer,MAXPROCNAME-1);// strcat(pname,"\0"); RtlFreeAnsiString( &procname ); } 代码差不多就这样了,但是这样貌似得不到目的进程的路径,不知道为什么。 多谢各位大侠指点! |
|