;===============================================================================
;use ZwQueryVirtualMemory to enum Modules of a process
;subsystem:console
;OS Platform:tested on Windows XP Professional simplified with Service Pack 3
;學習計算機編程技術
;ÐùԯС´Ï http://hi.baidu.com/yicong2007
;
;release notes:
;2009.04.11
;ÍêÈ«¸ÄдCreateDeviceListºÍConvertDeviceStrÁ½¸öº¯Êý£¬Ring3ÏÂʹÓÃQueryDosDevice£¬
;ͨ¹ý¶ÔËùÓеÄDOS·ûºÅÁ¬½Ó»ñÈ¡Æä¶ÔÓ¦É豸Ãû£¬ÓëµÃµ½µÄÄ£¿é·¾¶Ò»Ò»¶ÔÕÕ£¬¿Ë·þÁËÉÏÒ»°æ±¾
;Ö»ÄÜת»»A-ZÅÌ·ûµÄÎÊÌâ¡£
;
;2009.04.06
;¸ÄдConvertDeviceStrº¯Êý£¬ÊµÏÖA-ZÅÌ·ûµÄת»»£¬ÒÔÖ§³Ö·Ç±¾µØ´ÅÅÌÅÌ·ûµÄ»ñÈ¡¡£
;±éÀúʱֻ¶Ô¾ßÓÐPAGE_EXECUTEÊôÐÔµÄÄÚ´æ²éÕÒMemorySectionName¡£
;È罫±»×¢Ê͵ôµÄËÄ´¦´úÂ뻹ԣ¬¿É¹ýÂ˵ônlsÎļþµÄÏÔʾ¡£
;
;2009.04.05
;µÚÒ»¸ö°æ±¾
;
;===============================================================================
include \masm32\include\masm32rt.inc
include \masm32\include\w2k\native.inc
includelib \masm32\lib\masm32.lib
include \masm32\macros\macros.asm
include \masm32\include\advapi32.inc
includelib \masm32\lib\advapi32.lib
.data
PID dd 0
Base dd 0
hProcess dd 0
DataLength dd 0
lpszPID db 120 dup(0)
lpoutdata db 300h dup(0)
lpFileName db 120h dup(0)
lpDosList dd 0
lpDeviceList dd 0
lpDosBuffer dd 0
lpDeviceBuffer dd 0
.code
CreateDeviceList proto
CreateDeviceList proc uses esi edi ebx edx
local num
local lpBuffer
local BufferLen
mov edi, 0
xor esi, esi
.repeat
.if esi!=0
hfree(esi)
.endif
add edi, 1000h
mov esi,halloc(edi)
invoke QueryDosDevice, NULL, esi, edi
.until eax!=0
mov lpDosBuffer, esi
mov num, 0
xor eax, eax
.repeat
inc num
invoke crt_strlen, esi
lea esi, [esi+eax+1]
.until eax==0
dec num
mov eax, num
lea eax, [eax*4+4]
mov lpDosList, halloc(eax)
mov edi, lpDosList
mov eax, num
mov [edi], eax
add edi, 4
xor ebx, ebx
mov esi, lpDosBuffer
.repeat
inc ebx
mov [edi], esi
add edi, 4
invoke crt_strlen, esi
lea esi, [esi+eax+1]
.until ebx==num
mov eax, num
shl eax, 8
mov ebx, num
shl ebx, 2
add eax, ebx
push eax
mov esi, halloc(eax)
mov lpBuffer, esi
pop eax
invoke RtlZeroMemory, lpBuffer, eax
mov eax, num
lea eax, [eax*4+4]
mov lpDeviceList, halloc(eax)
mov edx, lpDeviceList
mov eax, num
mov [edx], eax
mov edi, lpDosList
add edi, 4
xor ebx, ebx
mov BufferLen, 0
.repeat
inc ebx
mov ecx, [edi]
invoke QueryDosDevice, ecx, esi, MAX_PATH
.if eax!=0
invoke crt_strlen, esi
inc eax
add BufferLen, eax
.endif
add edi, 4
lea esi, [esi+MAX_PATH]
.until ebx==num
inc BufferLen
mov lpDeviceBuffer, halloc(BufferLen)
invoke RtlZeroMemory, lpDeviceBuffer, BufferLen
mov edi, lpDeviceBuffer
mov edx, lpDeviceList
add edx, 4
mov esi, lpBuffer
xor ebx, ebx
.repeat
inc ebx
push edx
invoke crt_strlen, esi
pop edx
.if eax!=0
inc eax
push eax
push edx
invoke crt_strncpy, edi, esi, eax
pop edx
mov [edx], edi
pop eax
add edi, eax
.else
mov [edx], eax
.endif
add edx, 4
lea esi, [esi+MAX_PATH]
.until ebx==num
hfree(lpBuffer)
mov eax, 1
ret
CreateDeviceList endp
ConvertDeviceStr proto :DWORD, :DWORD
;=====================================================
;°ÑµÃµ½µÄÎļþÃûÖеÄÅÌ·û·³Éƽ³£µÄC¡¢D¡¡²¢½«×Ö·û´®¸Ä
;³ÉÊä³öËùÐèµÄ¸ñʽ
;=====================================================
ConvertDeviceStr proc uses esi edi ebx lpSource:DWORD, ImageBase:DWORD
local lptmp[MAX_PATH]:byte
local totalnum
local match
local lpmatchDev
local DevLen
local NameLen
lea edi, lptmp
xor eax, eax
mov match, eax
mov lpmatchDev, eax
mov NameLen, eax
mov DevLen, eax
mov ecx, MAX_PATH
rep stosb
mov esi, lpDeviceList
mov eax, [esi]
mov totalnum, eax
add esi, 4
xor ebx, ebx
.repeat
inc ebx
push esi
mov edi, [esi]
.if edi!=0
invoke crt_strstr, lpSource, edi
.if eax==lpSource
.if match==0
mov match, 1
.endif
mov eax, ebx
lea eax, [eax*4]
mov esi, lpDosList
add esi, eax
mov esi, [esi]
invoke crt_strlen, esi
.if NameLen==0 || NameLen>eax
mov NameLen, eax
invoke crt_strlen, edi
mov DevLen, eax
mov lpmatchDev, esi
.endif
.endif
.endif
pop esi
add esi, 4
.until ebx==totalnum
.if match==0
invoke crt_strncpy, addr lptmp, lpSource, MAX_PATH
.else
mov ebx, lpmatchDev
mov eax, DevLen
mov esi, lpSource
lea esi, [esi+eax]
invoke crt_sprintf, addr lptmp, CTXT('%s%s'), ebx, esi
.endif
invoke crt_sprintf, lpSource, CTXT('%08X %s',0dh,0ah), ImageBase, addr lptmp
ret
ConvertDeviceStr endp
CleanUp proto
CleanUp proc uses esi edi ebx
hfree(lpDosBuffer)
hfree(lpDosList)
hfree(lpDeviceList)
hfree(lpDeviceBuffer)
ret
CleanUp endp
DebugPrivilege PROTO :DWORD
;=====================================================
;ÌáSeDebugPrivilege£¬copy from network
;=====================================================
DebugPrivilege proc uses esi edi ebx dwEnbled
local hToken
local tmpLuid:LUID,tkp:TOKEN_PRIVILEGES
invoke GetCurrentProcess
lea ebx,hToken
invoke OpenProcessToken, eax, TOKEN_ADJUST_PRIVILEGES Or TOKEN_QUERY, ebx
invoke LookupPrivilegeValue, NULL, CTXT('SeDebugPrivilege'), addr tmpLuid
mov tkp.PrivilegeCount,1
push tmpLuid.LowPart
pop tkp.Privileges[0].Luid.LowPart
push tmpLuid.HighPart
pop tkp.Privileges[0].Luid.HighPart
.if dwEnbled
mov tkp.Privileges[0].Attributes, SE_PRIVILEGE_ENABLED
.else
mov tkp.Privileges[0].Attributes,NULL
.endif
invoke AdjustTokenPrivileges, hToken, FALSE, addr tkp, sizeof TOKEN_PRIVILEGES, NULL, NULL
invoke GetLastError
.if eax == ERROR_SUCCESS
push TRUE
.else
push FALSE
.endif
invoke CloseHandle,hToken
pop eax
ret
DebugPrivilege endp
Start proc uses esi edi ebx
invoke GetCL, 1, offset lpszPID
invoke crt_sscanf, offset lpszPID, CTXT('%d'), offset PID
.if PID==0
invoke StdOut, CTXT('Invaild PID.')
ret
.endif
invoke DebugPrivilege, 1
.if eax==FALSE
invoke StdOut, CTXT('Enable SeDebugPrivilege failed.')
ret
.endif
invoke OpenProcess, PROCESS_QUERY_INFORMATION, 0, PID
.if eax==0
invoke StdOut, CTXT('OpenProcess failed.')
ret
.endif
mov hProcess, eax
invoke GetModuleHandle, CTXT('ntdll.dll')
mov esi, eax
invoke GetProcAddress, esi, CTXT('ZwQueryVirtualMemory')
mov edi, eax
invoke StdOut, CTXT('ModuleBase ImageFileName',0dh,0ah)
invoke CreateDeviceList
.repeat
push offset DataLength
push 300h
push offset lpoutdata
push MemoryBasicInformation
push Base
push hProcess
call edi
mov esi, offset lpoutdata
;mov edx, [esi+18h]
assume esi:ptr MEMORY_BASIC_INFORMATION
;mov ebx, [esi].AllocationProtect
;and ebx, WSLE_PAGE_EXECUTE
mov ecx, [esi].Protect
and ecx, WSLE_PAGE_EXECUTE
mov esi, [esi].AllocationBase
assume esi:nothing
.if eax==0 && esi==Base && ecx!=0 ;&& edx == SEC_IMAGE && ebx==0
push offset DataLength
push 300h
push offset lpoutdata
push MemorySectionName
push Base
push hProcess
call edi
.if eax==0
mov esi, offset lpoutdata
assume esi:ptr MEMORY_SECTION_NAME
movzx eax, [esi].SectionFileName._Length
.if eax!=0
mov esi, [esi].SectionFileName.Buffer
assume esi:nothing
invoke crt_sprintf, offset lpFileName, CTXT('%ws'),esi
invoke ConvertDeviceStr, offset lpFileName, Base
invoke StdOut, offset lpFileName
.endif
.endif
.endif
mov eax, Base
add eax, 1000h
mov Base, eax
.until Base==80000000h
invoke CleanUp
ret
Start endp
end Start
commandfile:
@echo off
set source=Query
\masm32\bin\ml.exe /c /coff /Fo%source%.obj /nologo %source%.asm
\masm32\bin\link.exe /subsystem:console /out:%source%.exe /nologo %source%.obj
dir /b %source%.*
pause
:wink
question:
c:\masm32\include\windows.inc:
SE_DEBUG_NAME equ ("SeDebugPrivilege")
how to use it in source as a replace? :red
or any example for this equ in masm32 package?
btw:
I do't want start any war! :bg
lol - the war was there long before the thread
btw - i vote for UtillMasm for "Best Avatar Award"
http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx
can be beautified but is quick source I found with google and testing it, it works fine.
AdjustPrivledge proto
.data
szSeDebug byte "SeDebugPrivilege",0
.code
AdjustPrivledge proc
LOCAL hToken: DWORD
LOCAL SeDebugNameValue: QWORD
LOCAL tkp: TOKEN_PRIVILEGES
LOCAL adlen: DWORD
LOCAL myACL: ACL
; Set debug status
invoke RtlZeroMemory, addr myACL, sizeof ACL
push 2
push sizeof ACL
lea eax, myACL
push eax
call InitializeAcl
invoke GetCurrentProcess
push eax
xchg eax, edx
push 0
lea eax, myACL
push eax
push 0
push 0
push 4
push 6
push edx
call SetSecurityInfo
; Adjust debug privilege
pop edx
lea eax, hToken
push eax
push TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY
push edx
call OpenProcessToken
lea eax, SeDebugNameValue
push eax
push offset szSeDebug
push NULL
call LookupPrivilegeValue
lea esi, SeDebugNameValue
lea edi, tkp.Privileges[0].Luid
mov ecx, 8
rep movsb
mov tkp.PrivilegeCount, 1
mov tkp.Privileges[0].Attributes, SE_PRIVILEGE_ENABLED
lea eax, adlen
push eax
lea eax, tkp
push eax
push sizeof TOKEN_PRIVILEGES
push eax
push FALSE
push hToken
call AdjustTokenPrivileges
ret
AdjustPrivledge endp
*edit, sorry i'm drunk,u didn't need this, but oh well ;P
:U
:bg :wink