OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Topic created on: June 15, 2010 10:40 CDT by Genius .

Hi there ,
there's bunch of methods for acquiring specific process image name (like NtQuerySystemInformation, using PEB, or EPROCESS).
I should implement all of them, using various methods for specific task, just acquiring current running process image name .
I already implemented the first method (NtQuerySystemInformation) but the dark side i've encountered is EPROCESS .
the EPROCESS (& well of course a pointer to it) has already defined in ntifs.h (from WDK/DDK) but the problem is where's the image name of the process .
the sectionObject, segment , controldata, fileObject & in last filename.buffer doesn't exist for me (as intelliSense told me) .
I'm confusing how to acquire image name using EPROCESS strucure .
thank you .

Piotr		June 15, 2010 11:05.17 CDT
The EPROCESS's filename (ImageFileName) address changes among different windows versions - on XP-32 it is 0x174 bytes from the start of EPROCESS structure but for example on WIN7-32 it is located at a different offset - 0x16C. The most obvious way to cover all of the windows systems without trying multiple offsets would be to: 1) get the EPROCESS structre pointer for a system process (by using PsInitialSystemProcess or whatsoever) 2) scan it for "System" text string. The rel. offset (found text string) will be your ImageFileName offset for this machine. - piotr --------------------------------------------- kd> dt _EPROCESS poi(PsInitialSystemProcess) nt!_EPROCESS +0x000 Pcb : _KPROCESS +0x06c ProcessLock : _EX_PUSH_LOCK +0x070 CreateTime : _LARGE_INTEGER 0x0 +0x078 ExitTime : _LARGE_INTEGER 0x0 +0x080 RundownProtect : _EX_RUNDOWN_REF +0x084 UniqueProcessId : 0x00000004 +0x088 ActiveProcessLinks : _LIST_ENTRY [ 0x82077638 - 0x8055a1d8 ] +0x090 QuotaUsage : [3] 0 +0x09c QuotaPeak : [3] 0 +0x0a8 CommitCharge : 7 +0x0ac PeakVirtualSize : 0x2a1000 +0x0b0 VirtualSize : 0x1d9000 +0x0b4 SessionProcessLinks : _LIST_ENTRY [ 0x0 - 0x0 ] +0x0bc DebugPort : (null) +0x0c0 ExceptionPort : (null) +0x0c4 ObjectTable : 0xe1001c50 _HANDLE_TABLE +0x0c8 Token : _EX_FAST_REF +0x0cc WorkingSetLock : _FAST_MUTEX +0x0ec WorkingSetPage : 0 +0x0f0 AddressCreationLock : _FAST_MUTEX +0x110 HyperSpaceLock : 0 +0x114 ForkInProgress : (null) +0x118 HardwareTrigger : 0 +0x11c VadRoot : 0x825c3220 +0x120 VadHint : 0x823b86c8 +0x124 CloneRoot : (null) +0x128 NumberOfPrivatePages : 3 +0x12c NumberOfLockedPages : 0 +0x130 Win32Process : (null) +0x134 Job : (null) +0x138 SectionObject : (null) +0x13c SectionBaseAddress : (null) +0x140 QuotaBlock : 0x8055a280 _EPROCESS_QUOTA_BLOCK +0x144 WorkingSetWatch : (null) +0x148 Win32WindowStation : (null) +0x14c InheritedFromUniqueProcessId : (null) +0x150 LdtInformation : (null) +0x154 VadFreeHint : (null) +0x158 VdmObjects : (null) +0x15c DeviceMap : 0xe1005440 +0x160 PhysicalVadList : _LIST_ENTRY [ 0x825c77c0 - 0x825c77c0 ] +0x168 PageDirectoryPte : _HARDWARE_PTE +0x168 Filler : 0 +0x170 Session : (null) +0x174 ImageFileName : [16] "System" <-- your thing ----------------------------------------------------

Genius		June 15, 2010 18:10.23 CDT
Hi Piotr . thanks, the method you're mentioned is good but I'm not be so reliable way . btw, as you might already know there's another methods you could use to achieve the process image path, it's not only dependent on 16 bit ImageFile name, look at this full structure which I obtained from ntifs.h: typedef struct _EPROCESS { KPROCESS Pcb; // +0x000 EX_PUSH_LOCK ProcessLock; // +0x06c LARGE_INTEGER CreateTime; // +0x070 LARGE_INTEGER ExitTime; // +0x078 EX_RUNDOWN_REF RundownProtect; // +0x080 ULONG UniqueProcessId; // +0x084 LIST_ENTRY ActiveProcessLinks; // +0x088 ULONG QuotaUsage[3]; // +0x090 ULONG QuotaPeak[3]; // +0x09c ULONG CommitCharge; // +0x0a8 ULONG PeakVirtualSize; // +0x0ac ULONG VirtualSize; // +0x0b0 LIST_ENTRY SessionProcessLinks; // +0x0b4 PVOID DebugPort; // +0x0bc PVOID ExceptionPort; // +0x0c0 PHANDLE_TABLE ObjectTable; // +0x0c4 EX_FAST_REF Token; // +0x0c8 ULONG WorkingSetPage; // +0x0cc KGUARDED_MUTEX AddressCreationLock; // +0x0d0 ULONG HyperSpaceLock; // +0x0f0 PETHREAD ForkInProgress; // +0x0f4 ULONG HardwareTrigger; // +0x0f8 PMM_AVL_TABLE PhysicalVadRoot; // +0x0fc PVOID CloneRoot; // +0x100 ULONG NumberOfPrivatePages; // +0x104 ULONG NumberOfLockedPages; // +0x108 PVOID Win32Process; // +0x10c PEJOB Job; // +0x110 PVOID SectionObject; // +0x114 PVOID SectionBaseAddress; // +0x118 PEPROCESS_QUOTA_BLOCK QuotaBlock; // +0x11c PPAGEFAULT_HISTORY WorkingSetWatch; // +0x120 PVOID Win32WindowStation; // +0x124 ULONG InheritedFromUniqueProcessId; // +0x128 PVOID LdtInformation; // +0x12c PVOID VadFreeHint; // +0x130 PVOID VdmObjects; // +0x134 PVOID DeviceMap; // +0x138 PVOID Spare0[3]; // +0x13c union { HARDWARE_PTE PageDirectoryPte; // +0x148 UINT64 Filler; // +0x148 }; PVOID Session; // +0x150 UCHAR ImageFileName[16]; // +0x154 LIST_ENTRY JobLinks; // +0x164 PVOID LockedPagesList; // +0x16c LIST_ENTRY ThreadListHead; // +0x170 PVOID SecurityPort; // +0x178 PVOID PaeTop; // +0x17c ULONG ActiveThreads; // +0x180 ULONG GrantedAccess; // +0x184 ULONG DefaultHardErrorProcessing; // +0x188 SHORT LastThreadExitStatus; // +0x18c PPEB Peb; // +0x190 EX_FAST_REF PrefetchTrace; // +0x194 LARGE_INTEGER ReadOperationCount; // +0x198 LARGE_INTEGER WriteOperationCount; // +0x1a0 LARGE_INTEGER OtherOperationCount; // +0x1a8 LARGE_INTEGER ReadTransferCount; // +0x1b0 LARGE_INTEGER WriteTransferCount; // +0x1b8 LARGE_INTEGER OtherTransferCount; // +0x1c0 ULONG CommitChargeLimit; // +0x1c8 ULONG CommitChargePeak; // +0x1cc PVOID AweInfo; // +0x1d0 SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo; // +0x1d4 MMSUPPORT Vm; // +0x1d8 LIST_ENTRY MmProcessLinks; // +0x238 ULONG ModifiedPageCount; // +0x240 ULONG JobStatus; // +0x244 union { ULONG Flags; // 0x248 struct { ULONG CreateReported : 1; ULONG NoDebugInherit : 1; ULONG ProcessExiting : 1; ULONG ProcessDelete : 1; ULONG Wow64SplitPages : 1; ULONG VmDeleted : 1; ULONG OutswapEnabled : 1; ULONG Outswapped : 1; ULONG ForkFailed : 1; ULONG Wow64VaSpace4Gb : 1; ULONG AddressSpaceInitialized : 2; ULONG SetTimerResolution : 1; ULONG BreakOnTermination : 1; ULONG SessionCreationUnderway : 1; ULONG WriteWatch : 1; ULONG ProcessInSession : 1; ULONG OverrideAddressSpace : 1; ULONG HasAddressSpace : 1; ULONG LaunchPrefetched : 1; ULONG InjectInpageErrors : 1; ULONG VmTopDown : 1; ULONG ImageNotifyDone : 1; ULONG PdeUpdateNeeded : 1; ULONG VdmAllowed : 1; ULONG Unused : 7; }; }; NTSTATUS ExitStatus; // +0x24c USHORT NextPageColor; // +0x250 union { struct { UCHAR SubSystemMinorVersion; // +0x252 UCHAR SubSystemMajorVersion; // +0x253 }; USHORT SubSystemVersion; // +0x252 }; UCHAR PriorityClass; // +0x254 MM_AVL_TABLE VadRoot; // +0x258 } EPROCESS, PEPROCESS; // 0x278 in total There's a member in EPROCESS structure named SectionObject, if you can access to it then you would like to see segment and if you walk through this member you can finally access to a sub-member named "filename" which contains a buffer that is related to processName . I mean something like this code : NtStatus = PsLookupProcessByProcessId((HANDLE)5600, (PEEPROCESS)&Process); if (!NT_SUCCESS(NtStatus)) return 0; psSection = (PSECTION_OBJECT)(Process + 0x110); if (MmIsAddressValid(psSection)) { if (MmIsAddressValid(psSection->Segment)) { if (MmIsAddressValid(((PSEGMENT)psSection->Segment)->ControlArea)) { flObj = ((PSEGMENT)psSection->Segment)->ControlArea->FilePointer; if (MmIsAddressValid(flObj) == 0) return 0; NtStatus = ObQueryNameString(flObj, (POBJECT_NAME_INFORMATION)processName, 0, &returnLength); if (NtStatus != STATUS_INFO_LENGTH_MISMATCH) return 0; processName = (PUNICODE_STRING)ExAllocatePoolWithTag(NonPagedPool, returnLength, 'blah'); if (!processName) return 0; NtStatus = ObQueryNameString(flObj, (POBJECT_NAME_INFORMATION)processName, returnLength, &returnLength); This is actually what I did and what I looked for . I have already implemented this technique but it's not working as well (regardless of the right idea & implementation aspect) . anyway, that's it . (where 5600 is our PID, but in this case I don't know it's right or not!) regards, __Genius__

Note: Registration is required to post to the forums.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit