利用windbg探索进程和进程上下文.docx

1、利用 windbg 探索进程和进程上下文 版权声明：本文为博主原创文章，未经博主允许不得转载。目录 (?)+1.列出所有活动进程使用!process 命令可以打印出活动进程的信息。第一个参数是要打印的 EPROCESS 的地址，如果指定为 0 则表示打印所有的进程。第二个参数用于说明打印进程信息的详细级别。指定 0 则表示打印最简单的信息。plain view plaincopyprint?1. 0: kd !process 0 0 2. * NT ACTIVE PROCESS DUMP * 3. PROCESS 821b7490 SessionId: none Cid: 0004 Peb:

2、00000000 ParentCid: 0000 4. DirBase: 02b80020 ObjectTable: e1003e30 HandleCount: 350. 5. Image: System 6. 7. PROCESS 82072da0 SessionId: none Cid: 0234 Peb: 7ffd4000 ParentCid: 0004 8. DirBase: 02b80040 ObjectTable: e14323d0 HandleCount: 19. 9. Image: smss.exe 10. 11. PROCESS 8204ab28 SessionId: 0 C

3、id: 0264 Peb: 7ffd6000 ParentCid: 0234 12. DirBase: 02b80060 ObjectTable: e156e898 HandleCount: 434. 13. Image: csrss.exe 14. 15. PROCESS 81e87580 SessionId: 0 Cid: 027c Peb: 7ffde000 ParentCid: 0234 16. DirBase: 02b80080 ObjectTable: e1478c18 HandleCount: 294. 17. Image: winlogon.exe 18. 19. PROCES

4、S 820b5378 SessionId: 0 Cid: 02a8 Peb: 7ffde000 ParentCid: 027c 20. DirBase: 02b800a0 ObjectTable: e16d3480 HandleCount: 273. 21. Image: services.exe 22. .省略部分输出 输出结果中我可以看到几个重要的字段:Cid : 进程 idPeb : 进程环境块的地址ParentCid : 父进程 idDirBase : 目录表 (用于转换虚拟地址和物理地址 PDT)ObjectTable : 进程的句柄表如果要针对某个进程查看更详细的信息，可以按照如下

5、方式指定 EPROCESS 块地址，并提高信息的详细级别plain view plaincopyprint?1. 0: kd !process 81f8e4b8 1 2. PROCESS 81f8e4b8 SessionId: 0 Cid: 0134 Peb: 7ffdf000 ParentCid: 02a8 3. DirBase: 02b802a0 ObjectTable: e1b49790 HandleCount: 101. 4. Image: TPAutoConnSvc.exe 5. VadRoot 81f85208 Vads 88 Clone 0 Private 276. Modifi

6、ed 1. Locked 0. 6. DeviceMap e1003118 7. Token e1afe528 8. ElapsedTime 00:00:08.218 9. UserTime 00:00:00.031 10. KernelTime 00:00:00.031 11. QuotaPoolUsagePagedPool 55852 12. QuotaPoolUsageNonPagedPool 3520 13. Working Set Sizes (now,min,max) (1012, 50, 345) (4048KB, 200KB, 1380KB) 14. PeakWorkingSe

7、tSize 1012 15. VirtualSize 33 Mb 16. PeakVirtualSize 34 Mb 17. PageFaultCount 1028 18. MemoryPriority BACKGROUND 19. BasePriority 8 20. CommitCharge 393 2.切换进程上下文因为进程的地址空间都是相互独立的，所以我们使用 dd 0x400000 之类的指令是没有意义的。因为我们不确定当前用户地址空间就是我们的目标进程地址空间。因此我们首先要切换到我们想查看的进程上下文。之 后才能查看它私有的地址空间。如果不按这个规定的话，有可能得出的结果是很多?

8、plain view plaincopyprint?1. 0: kd .process 81f8e4b8 2. Implicit process is now 81f8e4b8 3. WARNING: .cache forcedecodeuser is not enabled 4. 0: kd dd 0x400000 5. 00400000 00905a4d 00000003 00000004 0000ffff 6. 00400010 000000b8 00000000 00000040 00000000 7. 00400020 00000000 00000000 00000000 00000

9、000 8. 00400030 00000000 00000000 00000000 00000100 9. 00400040 0eba1f0e cd09b400 4c01b821 685421cd 10. 00400050 70207369 72676f72 63206d61 6f6e6e61 11. 00400060 65622074 6e757220 206e6920 20534f44 12. 00400070 65646f6d 0a0d0d2e 00000024 00000000 13. 0: kd .process 14. Implicit process is now 8055d0

10、c0 15. 0: kd dd 0x400000 16. 00400000 ? ? ? ? 17. 00400010 ? ? ? ? 18. 00400020 ? ? ? ? 19. 00400030 ? ? ? ? 20. 00400040 ? ? ? ? 21. 00400050 ? ? ? ? 22. 00400060 ? ? ? ? 23. 00400070 ? ? ? ? 3.列出进程已经加载的 dll切换到目标进程上下文之后，我们可以使用!peb 或者!dlls 命令列出进程已经加载的 dll。进程加载的 dll 列表保存在 peb 中，所以这两条命令都能很好的工作。只是显示格式不

11、同罢了。比如我要查看我本机的 TPAutoConnSvc.exeplain view plaincopyprint?1. 0: kd !peb 2. PEB at 7ffdf000 3. InheritedAddressSpace: No 4. ReadImageFileExecOptions: No 5. BeingDebugged: No 6. ImageBaseAddress: 00400000 7. Ldr 00251e90 8. Ldr.Initialized: Yes 9. Ldr.InInitializationOrderModuleList: 00251f28 . 002533

12、c8 10. Ldr.InLoadOrderModuleList: 00251ec0 . 00253550 11. Ldr.InMemoryOrderModuleList: 00251ec8 . 00253558 12. Base TimeStamp Module 13. 400000 4a76ebe1 Aug 03 21:53:37 2009 C:Program FilesVMwareVMware ToolsTPAutoConnSvc.exe 14. 7c920000 4802bdc5 Apr 14 10:13:25 2008 C:WINDOWSsystem32ntdll.dll 15. 7

13、c800000 4802bdc6 Apr 14 10:13:26 2008 C:WINDOWSsystem32kernel32.dll 16. 41000000 4a76ebcf Aug 03 21:53:19 2009 C:WINDOWSsystem32TPSvc.dll 17. 695d0000 4802bd9d Apr 14 10:12:45 2008 C:WINDOWSSystem32Wbemframedyn.dll 18. 77be0000 4802be3f Apr 14 10:15:27 2008 C:WINDOWSsystem32msvcrt.dll 19. 77da0000 4

14、802bd89 Apr 14 10:12:25 2008 C:WINDOWSsystem32ADVAPI32.dll 20. 77e50000 4802bdae Apr 14 10:13:02 2008 C:WINDOWSsystem32RPCRT4.dll 21. 77fc0000 4802bdc1 Apr 14 10:13:21 2008 C:WINDOWSsystem32Secur32.dll 22. 77d10000 4802bdbd Apr 14 10:13:17 2008 C:WINDOWSsystem32USER32.dll 23. 77ef0000 4802bd81 Apr 1

15、4 10:12:17 2008 C:WINDOWSsystem32GDI32.dll 24. 770f0000 4802bdbd Apr 14 10:13:17 2008 C:WINDOWSsystem32OLEAUT32.dll 25. 76990000 4802bdbc Apr 14 10:13:16 2008 C:WINDOWSsystem32ole32.dll 26. 77bd0000 4802bdbf Apr 14 10:13:19 2008 C:WINDOWSsystem32VERSION.dll 27. 759d0000 4802bdbe Apr 14 10:13:18 2008

16、 C:WINDOWSsystem32USERENV.dll 28. 76320000 4802bda2 Apr 14 10:12:50 2008 C:WINDOWSsystem32comdlg32.dll 4.查看进程的内存映射情况虚拟地址描述符(Virtual Adderss Descriptor)包含一个进程中用户空间已分配地址信息。 Vad能够帮助我们快速的定位隐藏或者注入的代码。但是首先我们需要找到 Vadroot。 不过这个在 EPROCESS 中已经明确指出了。直接把 Vadroot 的地址作为参数，使用 !vad 命令即可得出进程用户空间已分配的内存信息。plain view p

17、laincopyprint?1. 0: kd !vad 81f85208 2. VAD level start end commit 3. 82060128 ( 4) 10 10 1 Private READWRITE 4. 81ae0760 ( 5) 20 20 1 Private READWRITE 5. 81ae95b0 ( 3) 30 12f 4 Private READWRITE 6. 81ed7a20 ( 5) 130 132 0 Mapped READONLY Pagefile-backed section 7. 81ffebc8 ( 4) 140 141 0 Mapped RE

18、ADONLY Pagefile-backed section 8. 81f89578 ( 6) 150 24f 24 Private READWRITE 9. 82012798 ( 5) 250 25f 6 Private READWRITE 10. 82003408 ( 7) 260 26f 0 Mapped READWRITE Pagefile-backed section 11. 82002e98 ( 6) 270 285 0 Mapped READONLY WINDOWSsystem32unicode.nls 12. 81ae9370 ( 8) 290 2d0 0 Mapped REA

19、DONLY WINDOWSsystem32locale.nls 13. 81c050d8 ( 7) 2e0 320 0 Mapped READONLY WINDOWSsystem32sortkey.nls 14. 81ed79b8 ( 9) 330 335 0 Mapped READONLY WINDOWSsystem32sorttbls.nls 15. 81ed7b58 ( 8) 340 380 0 Mapped READONLY Pagefile-backed section 16. 81c03260 ( 9) 390 39f 5 Private READWRITE 17. 81c0575

20、8 (10) 3a0 3a2 0 Mapped READONLY WINDOWSsystem32ctype.nls 18. 81e7f460 (11) 3b0 3bf 8 Private READWRITE 19. 81e1d168 (12) 3c0 3c0 1 Private READWRITE 20. 81bd5bd0 (13) 3d0 3d0 1 Private READWRITE 21. 81f8e868 (15) 3e0 3e1 0 Mapped READONLY Pagefile-backed section 22. 81e1b0e8 (14) 3f0 3f1 0 Mapped R

21、EADONLY Pagefile-backed section 23. 81e43cd0 ( 2) 400 440 13 Mapped Exe EXECUTE_WRITECOPY Program FilesVMwareVMware ToolsTPAutoConnSvc.exe 24. . 25. 81bdc0c8 ( 5) 9e0 9fb 23 Mapped Exe EXECUTE_WRITECOPY WINDOWSsystem32TPVMW32.dll 26. 81e18b28 ( 4) a00 a0f 4 Private READWRITE 27. 81f85208 ( 0) a10 a1

22、0 0 Mapped READWRITE Pagefile-backed section 28. 81e840b8 ( 5) a20 a23 0 Mapped READWRITE Pagefile-backed section 29. 81e17178 ( 4) a30 b2f 10 Private READWRITE 30. 81e19128 ( 6) b30 c2f 3 Private READWRITE 31. 81bd02b0 ( 5) c30 d2f 5 Private READWRITE 32. 82003a28 ( 7) d30 e2f 2 Private READWRITE 3

23、3. 81e17988 ( 6) e30 e6f 3 Private READWRITE 34. 81e1a548 ( 7) e70 e7f 12 Private READWRITE 35. 81adfc70 ( 8) e80 e8d 0 Mapped READWRITE Pagefile-backed section 36. 81a968e0 ( 9) e90 e90 1 Private READWRITE 37. 81ed5e50 ( 3) 10000 10023 10 Mapped Exe EXECUTE_WRITECOPY WINDOWSsystem32tprdpw32.dll 38.

24、 81e7d200 ( 2) 41000 41078 25 Mapped Exe EXECUTE_WRITECOPY WINDOWSsystem32TPSvc.dll 39. 81f86980 ( 5) 5adc0 5adf6 2 Mapped Exe EXECUTE_WRITECOPY WINDOWSsystem32uxtheme.dll 40. . 41. 81ed5220 ( 2) 7c920 7c9b2 5 Mapped Exe EXECUTE_WRITECOPY WINDOWSsystem32ntdll.dll 42. . 如果要计算出每个 vad 节点的虚拟地址，只需要将开始地址和

25、结束地址乘以 0x1000 即可。我们来看看 0x81ed5220 处的 vad，他的位于 0x7c920000 和 0x7c9b2000 这个区间段。并且映射了可执行文件 tprdpw32.dll。用 lm 查看一下这个地址。plain view plaincopyprint?1. 0: kd lm vt a 0x7c920000 2. start end module name 3. 7c920000 7c9b3000 ntdll 4. Loaded symbol image file: ntdll.dll 5. Image path: ntdll.dll 6. Image name: n

26、tdll.dll 7. Timestamp: Mon Apr 14 10:13:25 2008 (4802BDC5) 8. CheckSum: 00097CB7 9. ImageSize: 00093000 10. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 5.查看进程句柄表使用!handle 命令可以列出当前进程所有已经打开的句柄信息。!handle 命令的第一个参数是句柄值(如果是 0 则列出所有句柄)，第二个参数是所需信息的详细程度(跟!process 一样) 。如下命令列出了当前进程上下文中所有的句柄信息plain vi

27、ew plaincopyprint?1. 0: kd !handle 0 0 2. 3. PROCESS 81f8e4b8 SessionId: 0 Cid: 0134 Peb: 7ffdf000 ParentCid: 02a8 4. DirBase: 02b802a0 ObjectTable: e1b49790 HandleCount: 101. 5. Image: TPAutoConnSvc.exe 6. 7. Handle table at e1b0c000 with 101 entries in use 8. 9. 0004: Object: e1009540 GrantedAcces

28、s: 000f0003 Entry: e1b0c008 10. Object: e1009540 Type: (821b3730) KeyedEvent 11. ObjectHeader: e1009528 (old version) 12. HandleCount: 28 PointerCount: 29 13. Directory Object: e1009f58 Name: CritSecOutOfMemoryEvent 14. 15. 0008: Object: e14d00d8 GrantedAccess: 00000003 Entry: e1b0c010 16. Object: e

29、14d00d8 Type: (821b7040) Directory 17. ObjectHeader: e14d00c0 (old version) 18. HandleCount: 28 PointerCount: 64 19. Directory Object: e1003350 Name: KnownDlls 20. 21. 000c: Object: 81f88b38 GrantedAccess: 00100020 (Inherit) Entry: e1b0c018 22. Object: 81f88b38 Type: (821e9900) File 23. ObjectHeader: 81f88b20 (old version) 24. HandleCount: 1 PointerCount: 1 25. Directory Object: 00000000 Name: WINDOWSsystem32 HarddiskVolume1 26. . 其中 type 指出了句柄关联的对象的类型，object 字段表明了对象的地址。handlecount 和pointercount 分别记录了句柄引用次数和指针引用次数(ObrefrenceObjectByHandle、ByName)。