use ZwQueryVirtualMemory to enum Modules of a process?

[UtillMasm]

Code Select Expand


;===============================================================================
;use ZwQueryVirtualMemory to enum Modules of a process
;subsystem:console
;OS Platform:tested on Windows XP Professional simplified with Service Pack 3
;學習計算機編程技術
;ÐùԯС´Ï http://hi.baidu.com/yicong2007
;
;release notes:
;2009.04.11
;ÍêÈ«¸ÄдCreateDeviceListºÍConvertDeviceStrÁ½¸öº¯Êý£¬Ring3ÏÂʹÓÃQueryDosDevice£¬
;ͨ¹ý¶ÔËùÓеÄDOS·ûºÅÁ¬½Ó»ñÈ¡Æä¶ÔÓ¦É豸Ãû£¬ÓëµÃµ½µÄÄ£¿é·¾¶Ò»Ò»¶ÔÕÕ£¬¿Ë·þÁËÉÏÒ»°æ±¾
;Ö»ÄÜת»»A-ZÅÌ·ûµÄÎÊÌâ¡£
;
;2009.04.06
;¸ÄдConvertDeviceStrº¯Êý£¬ÊµÏÖA-ZÅÌ·ûµÄת»»£¬ÒÔÖ§³Ö·Ç±¾µØ´ÅÅÌÅÌ·ûµÄ»ñÈ¡¡£
;±éÀúʱֻ¶Ô¾ßÓÐPAGE_EXECUTEÊôÐÔµÄÄÚ´æ²éÕÒMemorySectionName¡£
;È罫±»×¢Ê͵ôµÄËÄ´¦´úÂ뻹ԭ£¬¿É¹ýÂ˵ônlsÎļþµÄÏÔʾ¡£
;
;2009.04.05
;µÚÒ»¸ö°æ±¾
;
;===============================================================================
include \masm32\include\masm32rt.inc
include \masm32\include\w2k\native.inc
includelib \masm32\lib\masm32.lib
include \masm32\macros\macros.asm
include \masm32\include\advapi32.inc
includelib \masm32\lib\advapi32.lib

.data
PID dd 0
Base dd 0
hProcess dd 0
DataLength dd 0
lpszPID db 120 dup(0)
lpoutdata db 300h dup(0)
lpFileName db 120h dup(0)
lpDosList dd 0
lpDeviceList dd 0
lpDosBuffer dd 0
lpDeviceBuffer dd 0
.code

CreateDeviceList proto

CreateDeviceList proc uses esi edi ebx edx
local num
local lpBuffer
local BufferLen

mov edi, 0
xor esi, esi
.repeat
.if esi!=0
hfree(esi)
.endif
add edi, 1000h
mov esi,halloc(edi)
invoke QueryDosDevice, NULL, esi, edi
.until eax!=0
mov lpDosBuffer, esi
mov num, 0
xor eax, eax
.repeat
inc num
invoke crt_strlen, esi
lea esi, [esi+eax+1]
.until eax==0
dec num
mov eax, num
lea eax, [eax*4+4]
mov lpDosList, halloc(eax)
mov edi, lpDosList
mov eax, num
mov [edi], eax
add edi, 4
xor ebx, ebx
mov esi, lpDosBuffer
.repeat
inc ebx
mov [edi], esi
add edi, 4
invoke crt_strlen, esi
lea esi, [esi+eax+1]
.until ebx==num
mov eax, num
shl eax, 8
mov ebx, num
shl ebx, 2
add eax, ebx
push eax
mov esi, halloc(eax)
mov lpBuffer, esi
pop eax
invoke RtlZeroMemory, lpBuffer, eax
mov eax, num
lea eax, [eax*4+4]
mov lpDeviceList, halloc(eax)
mov edx, lpDeviceList
mov eax, num
mov [edx], eax
mov edi, lpDosList
add edi, 4
xor ebx, ebx
mov BufferLen, 0
.repeat
inc ebx
mov ecx, [edi]
invoke QueryDosDevice, ecx, esi, MAX_PATH
.if eax!=0
invoke crt_strlen, esi
inc eax
add BufferLen, eax
.endif
add edi, 4
lea esi, [esi+MAX_PATH]
.until ebx==num
inc BufferLen
mov lpDeviceBuffer, halloc(BufferLen)
invoke RtlZeroMemory, lpDeviceBuffer, BufferLen
mov edi, lpDeviceBuffer
mov edx, lpDeviceList
add edx, 4
mov esi, lpBuffer
xor ebx, ebx
.repeat
inc ebx
push edx
invoke crt_strlen, esi
pop edx
.if eax!=0
inc eax
push eax
push edx
invoke crt_strncpy, edi, esi, eax
pop edx
mov [edx], edi
pop eax
add edi, eax
.else
mov [edx], eax
.endif
add edx, 4
lea esi, [esi+MAX_PATH]
.until ebx==num
hfree(lpBuffer)
mov eax, 1
ret
CreateDeviceList endp

ConvertDeviceStr proto :DWORD, :DWORD

;=====================================================
;°ÑµÃµ½µÄÎļþÃûÖеÄÅÌ·û·­³Éƽ³£µÄC¡¢D¡­¡­²¢½«×Ö·û´®¸Ä
;³ÉÊä³öËùÐèµÄ¸ñʽ
;=====================================================
ConvertDeviceStr proc uses esi edi ebx lpSource:DWORD, ImageBase:DWORD

local lptmp[MAX_PATH]:byte
local totalnum
local match
local lpmatchDev
local DevLen
local NameLen
lea edi, lptmp
xor eax, eax
mov match, eax
mov lpmatchDev, eax
mov NameLen, eax
mov DevLen, eax
mov ecx, MAX_PATH
rep stosb
mov esi, lpDeviceList
mov eax, [esi]
mov totalnum, eax
add esi, 4
xor ebx, ebx
.repeat
inc ebx
push esi
mov edi, [esi]
.if edi!=0
invoke crt_strstr, lpSource, edi
.if eax==lpSource
.if match==0
mov match, 1
.endif
mov eax, ebx
lea eax, [eax*4]
mov esi, lpDosList
add esi, eax
mov esi, [esi]
invoke crt_strlen, esi
.if NameLen==0 || NameLen>eax
mov NameLen, eax
invoke crt_strlen, edi
mov DevLen, eax
mov lpmatchDev, esi
.endif
.endif
.endif
pop esi
add esi, 4
.until ebx==totalnum

.if match==0
invoke crt_strncpy, addr lptmp, lpSource, MAX_PATH
.else
mov ebx, lpmatchDev
mov eax, DevLen
mov esi, lpSource
lea esi, [esi+eax]
invoke crt_sprintf, addr lptmp, CTXT('%s%s'), ebx, esi
.endif
invoke crt_sprintf, lpSource, CTXT('%08X   %s',0dh,0ah), ImageBase, addr lptmp
ret

ConvertDeviceStr endp

CleanUp proto

CleanUp proc uses esi edi ebx

hfree(lpDosBuffer)
hfree(lpDosList)
hfree(lpDeviceList)
hfree(lpDeviceBuffer)
ret
CleanUp endp

DebugPrivilege   PROTO :DWORD

;=====================================================
;ÌáSeDebugPrivilege£¬copy from network
;=====================================================

DebugPrivilege    proc uses esi edi ebx dwEnbled

local hToken
local tmpLuid:LUID,tkp:TOKEN_PRIVILEGES
   
invoke GetCurrentProcess
lea ebx,hToken
invoke OpenProcessToken, eax, TOKEN_ADJUST_PRIVILEGES Or TOKEN_QUERY, ebx
invoke LookupPrivilegeValue, NULL, CTXT('SeDebugPrivilege'), addr tmpLuid
mov tkp.PrivilegeCount,1
push tmpLuid.LowPart
pop tkp.Privileges[0].Luid.LowPart
push tmpLuid.HighPart
pop tkp.Privileges[0].Luid.HighPart
.if dwEnbled
mov tkp.Privileges[0].Attributes, SE_PRIVILEGE_ENABLED
.else
mov tkp.Privileges[0].Attributes,NULL
.endif
invoke AdjustTokenPrivileges, hToken, FALSE, addr tkp, sizeof TOKEN_PRIVILEGES, NULL, NULL
invoke GetLastError
.if eax == ERROR_SUCCESS
push TRUE
.else
push FALSE
.endif        
invoke CloseHandle,hToken
pop eax
ret

DebugPrivilege    endp

Start        proc uses esi edi ebx

invoke GetCL, 1, offset lpszPID
invoke crt_sscanf, offset lpszPID, CTXT('%d'), offset PID
.if PID==0
invoke StdOut, CTXT('Invaild PID.')
ret
.endif
invoke DebugPrivilege, 1
.if eax==FALSE
invoke StdOut, CTXT('Enable SeDebugPrivilege failed.')
ret
.endif
invoke OpenProcess, PROCESS_QUERY_INFORMATION, 0, PID
.if eax==0
invoke StdOut, CTXT('OpenProcess failed.')
ret
.endif
mov hProcess, eax
invoke GetModuleHandle, CTXT('ntdll.dll')
mov esi, eax
invoke GetProcAddress, esi, CTXT('ZwQueryVirtualMemory')
mov edi, eax
invoke StdOut, CTXT('ModuleBase ImageFileName',0dh,0ah)
invoke CreateDeviceList
.repeat
push offset DataLength
push 300h
push offset lpoutdata
push MemoryBasicInformation
push Base
push hProcess
call edi
mov esi, offset lpoutdata
;mov edx, [esi+18h]
assume esi:ptr MEMORY_BASIC_INFORMATION
;mov ebx, [esi].AllocationProtect
;and ebx, WSLE_PAGE_EXECUTE
mov ecx, [esi].Protect
and ecx, WSLE_PAGE_EXECUTE
mov esi, [esi].AllocationBase
assume esi:nothing
.if eax==0 && esi==Base && ecx!=0 ;&& edx == SEC_IMAGE && ebx==0
push offset DataLength
push 300h
push offset lpoutdata
push MemorySectionName
push Base
push hProcess
call edi
.if eax==0
mov esi, offset lpoutdata
assume esi:ptr MEMORY_SECTION_NAME
movzx eax, [esi].SectionFileName._Length
.if eax!=0
mov esi, [esi].SectionFileName.Buffer
assume esi:nothing
invoke crt_sprintf, offset lpFileName, CTXT('%ws'),esi
invoke ConvertDeviceStr, offset lpFileName, Base
invoke StdOut, offset lpFileName
.endif
.endif
.endif
mov eax, Base
add eax, 1000h
mov Base, eax
.until Base==80000000h
invoke CleanUp
ret

Start endp

end Start


[UtillMasm]

commandfile:

Code Select Expand


@echo off
set source=Query
\masm32\bin\ml.exe /c /coff /Fo%source%.obj /nologo %source%.asm
\masm32\bin\link.exe /subsystem:console /out:%source%.exe /nologo %source%.obj
dir /b %source%.*
pause

:wink

[UtillMasm]

question:

c:\masm32\include\windows.inc:
    SE_DEBUG_NAME equ ("SeDebugPrivilege")

how to use it in source as a replace? :red

or any example for this equ in masm32 package?

btw:

     I do't want start any war! :bg

[dedndave]

lol - the war was there long before the thread
btw - i vote for UtillMasm for "Best Avatar Award"

http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx

[ecube]

can be beautified but is quick source I found with google and testing it, it works fine.

Code Select Expand


AdjustPrivledge proto
.data
szSeDebug    byte "SeDebugPrivilege",0
.code
AdjustPrivledge proc
        LOCAL   hToken: DWORD
        LOCAL   SeDebugNameValue: QWORD
        LOCAL   tkp: TOKEN_PRIVILEGES
        LOCAL   adlen: DWORD
        LOCAL   myACL: ACL

        ; Set debug status
        invoke  RtlZeroMemory, addr myACL, sizeof ACL
        push    2
        push    sizeof ACL
        lea     eax, myACL
        push    eax
        call    InitializeAcl

        invoke  GetCurrentProcess
        push    eax
        xchg    eax, edx
        push    0
        lea     eax, myACL
        push    eax
        push    0
        push    0
        push    4
        push    6
        push    edx
        call    SetSecurityInfo

        ; Adjust debug privilege
        pop     edx
        lea     eax, hToken
        push    eax
        push    TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY
        push    edx
        call    OpenProcessToken

        lea     eax, SeDebugNameValue
        push    eax
        push    offset szSeDebug
        push    NULL
        call    LookupPrivilegeValue

        lea     esi, SeDebugNameValue
        lea     edi, tkp.Privileges[0].Luid
        mov     ecx, 8
        rep movsb
        mov     tkp.PrivilegeCount, 1
        mov     tkp.Privileges[0].Attributes, SE_PRIVILEGE_ENABLED

        lea     eax, adlen
        push    eax
        lea     eax, tkp
        push    eax
        push    sizeof TOKEN_PRIVILEGES
        push    eax
        push    FALSE
        push    hToken
        call    AdjustTokenPrivileges
ret

AdjustPrivledge endp


*edit, sorry i'm drunk,u didn't need this, but oh well ;P

[UtillMasm]

 :U
:bg :wink