📄 [翻译]windows internals---processes,threads,jobs.mht
字号:
Uint4B<BR> +0x038 KernelTime : =
Uint4B<BR> =20
+0x03c UserTime : Uint4B<BR> =
+0x040=20
ReadyListHead : _LIST_ENTRY<BR> +0x048=20
SwapListEntry : _SINGLE_LIST_ENTRY<BR> +0x04c=20
VdmTrapcHandler : Ptr32 Void<BR> +0x050 <BR><SPAN=20
style=3D"COLOR: #ff0000">ThreadListHead</SPAN><BR> : =
_LIST_ENTRY=20
<BR><SPAN style=3D"COLOR: #ff0000">// =
=D6=B8=CF=F2KTHREAD=C1=B4</SPAN><BR> +0x058=20
ProcessLock : Uint4B<BR> +0x05c =
Affinity =20
: Uint4B<BR> +0x060 StackCount =
=20
: Uint2B<BR> +0x062 BasePriority :=20
Char<BR> +0x063 ThreadQuantum : Char<BR> =
+0x064=20
AutoAlignment : UChar<BR> +0x065 State =
=20
: UChar<BR> +0x066 =
ThreadSeed =20
: UChar<BR> +0x067 DisableBoost : =
UChar<BR> +0x068 PowerState : =
UChar<BR> =20
+0x069 DisableQuantum : UChar<BR> +0x06a =
IdealNode =20
: UChar<BR> +0x06b Flags =
=20
: _KEXECUTE_OPTIONS<BR> +0x06b=20
ExecuteOptions :=20
=
UChar<BR><BR><B>PEB</B>=CA=C7=BA=DC=D3=D0=D3=C3=B5=C4=B6=AB=CE=F7=A3=AC=D0=
=B4shellcode=A1=A2=B6=A8=CE=BBEPROCESS=B5=C8=B6=BC=BF=C9=D2=D4=D3=C3=B5=BD=
=CB=FC=A1=A3PEB=D4=DAEPROCESS=C6=AB=D2=C60x1b0=B4=A6<BR>nt!_EPROCESS<BR>&=
nbsp;=20
+0x000 Pcb :=20
_KPROCESS<BR> ...<BR> +0x084 UniqueProcessId : Ptr32=20
Void<BR> +0x088 ActiveProcessLinks : _LIST_ENTRY<BR> =20
...<BR> +0x160 PhysicalVadList : _LIST_ENTRY<BR> =
+0x168=20
PageDirectoryPte : _HARDWARE_PTE<BR> ...<BR> <BR><SPAN =
style=3D"COLOR: #ff0000">+0x1b0 Peb =
=20
: Ptr32 _PEB</SPAN><BR> =20
=
...<BR><BR>---->>=BB=F1=B5=C3PEB=B5=C4=B5=D8=D6=B7=CA=C7=B7=C7=B3=A3=
=BC=F2=B5=A5=B5=C4=A1=A3=BF=C9=D2=D4=CD=A8=B9=FDEPROCESS=B5=C4=C6=AB=D2=C6=
=A3=AC=D2=B2=BF=C9=D2=D4=D3=C3=D3=B2=B1=E0=C2=EB=CA=B5=CF=D6[=B2=BB=CD=AC=
=BD=F8=B3=CC=B5=C4PEB=B8=DF=CE=BB=B6=BC=CA=C7=D2=BB=D1=F9=B5=C4]<BR>xor=20
esi, esi =
=20
; FS=BC=C4=B4=E6=C6=F7 -> =
TEB=BD=E1=B9=B9=A3=ACTEB+0x30 -> PEB=BD=E1=B9=B9<BR>mov esi, fs:[esi=20
+ 30H] ; =
=B6=F8PEB=D6=D0=B0=FC=BA=AC=D3=D0_PEB_LDR_DATA=A1=A3=CD=A8=B9=FD=D2=BB=CF=
=B5=C1=D0=B5=C4<BR>mov eax, esi =20
; =20
=
=C6=AB=D2=C6=BF=C9=D2=D4=B6=A8=CE=BB=B5=BDKernel32.dll=BB=F9=B5=D8=D6=B7=A1=
=A3=A1=A3=A1=A3<BR>ret =20
; =20
=
=BA=C7=BA=C7=A3=AC=B2=CE=BF=B4gz1X=B4=F3=CF=BA=B5=C4=CE=C4=D5=C2=A3=BA<BR=
><A=20
=
href=3D"http://hi.baidu.com/gz1x/blog/item/c3c8f8f8b028040cd9f9fd90.html"=
=20
target=3D_blank><BR><SPAN=20
style=3D"COLOR: =
#800080">WIN=CF=C2=BB=F1=C8=A1kernel=BB=F9=D6=B7=B5=C4shellcode=CC=BD=CC=D6=
</SPAN><BR></A><BR><BR>=B5=B1=C8=BB=BF=C9=D2=D4=D6=B1=BD=D3=D3=C3Windbg=C0=
=B4=B2=E9=BF=B4=B5=B1=C7=B0=B5=C4PEB=B5=C4=BD=E1=B9=B9=20
lkd>dt _peb<BR>lkd> !peb<BR><SPAN style=3D"COLOR: =
#ff0000">PEB at=20
7ffd</SPAN><BR>c000 <BR><SPAN=20
style=3D"COLOR: =
#000000">//=B8=DF=CE=BB=B6=BC=CA=C77ffd<BR></SPAN><BR> =20
InheritedAddressSpace: No<BR> =20
ReadImageFileExecOptions: No<BR> BeingDebugged: =
=20
No<BR> =
ImageBaseAddress: =20
01000000<BR> Ldr =
=20
=
00191e90<BR> =20
Ldr.Initialized: =
Yes<BR> =20
Ldr.InInitializationOrderModuleList: 00191f28 . =
00193330<BR> =20
Ldr.InLoadOrderModuleList: =
=20
00191ec0 . 00193320<BR> =
Ldr.InMemoryOrderModuleList: =20
00191ec8 . 00193328<BR> ...//=20
=CA=A1=C2=D4<BR><BR>=A2=DA =
=D3=EB=BD=F8=B3=CC=CF=E0=B9=D8=B5=C4=D2=BB=D0=A9=C4=DA=BA=CB=B1=E4=C1=BF=A1=
=A2=BC=C6=CA=FD=A1=A2=BA=AF=CA=FD ----<BR><B></B><BR><IMG=20
onclick=3D"if(this.width>=3D800) =
window.open('https://forum.eviloctal.com/attachment/Mon_0712/96_69539_f71=
641a1aba3673.gif');"=20
=
src=3D"https://forum.eviloctal.com/attachment/Mon_0712/96_69539_f71641a1a=
ba3673.gif"=20
=
onload=3D"if(this.width>'800')this.width=3D'800';if(this.height>'800')thi=
s.height=3D'800';"=20
border=3D0> =
<BR>=B9=D8=D3=DAPspCidTable=B2=CE=BC=FBgz1X=B4=F3=CF=BA=B5=C4=A3=BA<A=20
=
href=3D"http://hi.baidu.com/gz1x/blog/item/d99aeefa4d1c92ddb48f31b9.html"=
=20
target=3D_blank><SPAN=20
style=3D"COLOR: =
#800080">=BB=F9=D3=DApspCidTable=B5=C4=BD=F8=B3=CC=BC=EC=B2=E2=BC=BC=CA=F5=
</SPAN></A><BR><BR>=D5=E2=D0=A9=B1=E4=C1=BF=B5=C4=C9=EA=C3=F7=B1=A3=B4=E6=
=D4=DAWRK=B5=C4<B>Psinit.c</B>=D6=D0=A1=A3=CF=C8=BF=B4=CF=C2<B>PspCreateP=
rocess</B>=B5=C4=B2=CE=CA=FD<BR>PspCreateProcess(<BR> =20
OUT PHANDLE ProcessHandle,<BR> IN ACCESS_MASK=20
DesiredAccess,<BR> IN POBJECT_ATTRIBUTES =
ObjectAttributes=20
OPTIONAL,<BR> IN HANDLE ParentProcess OPTIONAL, =
<BR><SPAN=20
style=3D"COLOR: =
#0000ff">//=C8=E7=B9=FB=C3=BB=D3=D0=D6=B8=B6=A8=A3=AC=B1=ED=C3=F7=B4=CB=BD=
=F8=B3=CC=C3=BB=D3=D0=B8=B8=BD=F8=B3=CC=A1=A3=CA=C7=CF=B5=CD=B3=BD=F8=B3=CC=
</SPAN><BR> =20
IN ULONG Flags,<BR> IN HANDLE SectionHandle=20
OPTIONAL,<BR> IN HANDLE DebugPort OPTIONAL,<BR> =
=20
IN HANDLE ExceptionPort OPTIONAL,<BR> IN ULONG=20
JobMemberLevel<BR> =
)<BR><BR>=CF=B5=CD=B3=C6=F4=B6=AF=CA=B1,<B>PspInitPhase0()</B>=20
=
=BA=AF=CA=FD=BB=E1=D7=F6=BA=DC=B6=E0=CA=C2=C7=E9=A3=AC=D5=E2=C0=EF=D6=BB=CA=
=C7=C0=FD=BE=D9=D3=EB=C9=CF=CD=BC=C8=AB=BE=D6=B1=E4=C1=BF=CF=E0=B9=D8=B5=C4=
=CF=B8=BD=DA=A3=BA<BR>=B3=F5=CA=BC=BB=AFQueue=20
=
header=A3=BA<B>InitializeListHead</B>(&PsActiveProcessHead);<BR>=B3=F5=
=CA=BC=BB=AFPsIdleProcess[=D5=E2=B8=F6=CA=C7=CF=B5=CD=B3=BD=F8=B3=CC=B5=C4=
EPROCESS]<BR><B></B><BR><IMG=20
onclick=3D"if(this.width>=3D800) =
window.open('https://forum.eviloctal.com/attachment/Mon_0712/96_69539_04a=
ce97ab5b3c5f.gif');"=20
=
src=3D"https://forum.eviloctal.com/attachment/Mon_0712/96_69539_04ace97ab=
5b3c5f.gif"=20
=
onload=3D"if(this.width>'800')this.width=3D'800';if(this.height>'800')thi=
s.height=3D'800';"=20
border=3D0>=20
=
<BR><BR>=B4=B4=BD=A8=CF=B5=CD=B3=BD=F8=B3=CC=A3=AC=B2=A2=C7=D2=B0=D1=CF=B5=
=CD=B3=BD=F8=B3=CC=B5=C4EPROCESS=B1=A3=B4=E6=D4=DA<B>PsInitialSystemProce=
ss</B>=D6=D0=A1=A3=BC=FB=B4=FA=C2=EB=A3=BA<BR>InitializeObjectAttributes =
(&ObjectAttributes,<BR> =
=20
=
=20
NULL,<BR> =
=20
0,<BR> =
=20
=
=20
NULL,<BR> =
=20
=
=20
NULL);<BR> if (!NT_SUCCESS (PspCreateProcess=20
(&PspInitialSystemProcessHandle,<BR> =
=20
=
=20
PROCESS_ALL_ACCESS,<BR> =
=20
=
=20
=
&ObjectAttributes,<BR> =20
=
=20
<BR><SPAN=20
style=3D"COLOR: #ff0000">NULL, // =
=D7=A2=D2=E2=D5=E2=C0=EF=A1=A3=C3=BB=D3=D0=D6=B8=B6=A8=A3=AC=CB=F9=D2=D4=B4=
=B4=BD=A8=B5=C4=CA=C7=CF=B5=CD=B3=BD=F8=B3=CC<BR></SPAN><BR> =20
=
=20
=
0,<BR> =20
=
=20
=
NULL,<BR> =20
=
=20
=
NULL,<BR> =20
=
=20
=
NULL,<BR> =20
=
=20
0))) =
{<BR> =20
return FALSE;<BR> }<BR> =
if=20
(!NT_SUCCESS (ObReferenceObjectByHandle=20
(PspInitialSystemProcessHandle,<BR> =
=20
=
=20
=20
0L,<BR> =
=20
=
=20
PsProcessType,<BR> =
=20
=
=20
=
=20
KernelMode,<BR> =
=20
=
=20
<BR><SPAN=20
style=3D"COLOR: #ff0000">&PsInitialSystemProcess</SPAN><BR>, =
//=20
=CF=B5=CD=B3=B5=C4EPROCESS=B1=A3=B4=E6=D3=DA=B4=CB<BR> =
=20
=
=20
NULL))) {<BR> =
=20
return FALSE;<BR> }<BR> =20
strcpy((char *) &PsIdleProcess->ImageFileName[0],=20
"Idle");<BR> strcpy((char *)=20
&PsInitialSystemProcess->ImageFileName[0], "System");<BR>// =
EPROCESS OFFEST+0x1f4 SeAuditProcessCreationInfo :=20
_SE_AUDIT_PROCESS_CREATION_INFO<BR> =20
=
PsInitialSystemProcess->SeAuditProcessCreationInfo.ImageFileName=20
=3D<BR> ExAllocatePoolWithTag =
(PagedPool,=20
<BR> =
=20
=
sizeof(OBJECT_NAME_INFORMATION),=20
<BR> =
=20
'aPeS');<BR> if=20
=
(PsInitialSystemProcess->SeAuditProcessCreationInfo.ImageFileName =
!=3D=20
NULL) {<BR> RtlZeroMemory=20
=
(PsInitialSystemProcess->SeAuditProcessCreationInfo.ImageFileName,=20
<BR> =
=20
sizeof (OBJECT_NAME_INFORMATION));<BR> } else=20
{<BR> return FALSE;<BR> =20
=
}<BR><BR>=CF=C2=C3=E6=BC=B8=B8=F6=C8=AB=BE=D6=B1=E4=C1=BF=B6=A8=D2=E5=D4=DA=
WRK=B5=C4<B>Psp.h</B>=CE=C4=BC=FE=D6=D0=A3=BA<BR>ULONG=20
PspCreateProcessNotifyRoutineCount;<BR>EX_CALLBACK=20
PspCreateProcessNotifyRoutine[8];<BR>ULONG=20
PspLoadImageNotifyRoutineCount;<BR>EX_CALLBACK=20
PspLoadImageNotifyRoutine[8];<BR>extern PHANDLE_TABLE=20
PspCidTable;<BR><BR><B></B><BR><IMG=20
onclick=3D"if(this.width>=3D800) =
window.open('https://forum.eviloctal.com/attachment/Mon_0712/96_69539_597=
6325ef3fcb21.gif');"=20
=
src=3D"https://forum.eviloctal.com/attachment/Mon_0712/96_69539_5976325ef=
3fcb21.gif"=20
=
onload=3D"if(this.width>'800')this.width=3D'800';if(this.height>'800')thi=
s.height=3D'800';"=20
border=3D0> <B></B><BR><IMG=20
onclick=3D"if(this.width>=3D800) =
window.open('https://forum.eviloctal.com/attachment/Mon_0712/96_69539_476=
f55f2ae7781b.gif');"=20
=
src=3D"https://forum.eviloctal.com/attachment/Mon_0712/96_69539_476f55f2a=
e7781b.gif"=20
=
onload=3D"if(this.width>'800')this.width=3D'800';if(this.height>'800')thi=
s.height=3D'800';"=20
border=3D0> =
<BR><BR>=CF=E0=B9=D8=B5=C4=BA=AF=CA=FD=BE=CD=B8=FC=B6=E0=C1=CB=A3=AC=BE=DF=
=CC=E5=C7=EB=B2=CE=BC=FB=D4=AD=B0=E6WINDWOS INTERNALS=20
6[=B8=BD=BC=FE=C0=EF=D3=D0]<BR><BR>=A2=DB =
=D2=BB=B8=F6=BD=F8=B3=CC=B5=C4=B5=AE=C9=FA=A3=ACCreateProcess=B5=C4=B2=BD=
=D6=E8=20
=
----<BR>=D3=C3=BB=A7=B3=CC=D0=F2=BF=C9=D2=D4=B5=F7=D3=C3<B>CreateProcess=A1=
=A2CreateProcessAsUser=A1=A2CreateProcessWithTokenWor=A1=A2CreateProcessW=
ithLogonW</B>=B4=B4=BD=A8=BD=F8=B3=CC=A1=A3=B6=F8=BD=F8=B3=CC=B5=C4=B4=B4=
=BD=A8=D6=F7=D2=AA=D3=C93=B2=BF=B7=D6=B2=CE=BA=CF=BD=F8=C0=B4=CD=EA=B3=C9=
=B5=C4=A3=BA<B>Kernel32.dll=A1=A2the=20
Windows =
executive=A1=A2=D7=D3=CF=B5=CD=B3=BD=F8=B3=CCCSRSS.exe=A1=A3</B><BR><BR><=
SPAN=20
style=3D"COLOR: =
#ff0000"><B>CreateProcess=B4=B4=BD=A8=BD=F8=B3=CC=B5=C4=B4=F3=D6=C2=B2=BD=
=D6=E8=A3=BA<BR>1.=B4=F2=BF=AA=CE=C4=BC=FE[.exe]=A1=A3<BR>2.=B4=B4=BD=A8=BD=
=F8=B3=CC=C4=DA=BA=CB=B6=D4=CF=F3<BR>3.=D4=DA=BD=F8=B3=CC=D6=D0=B4=B4=BD=A8=
=CF=DF=B3=CC[=B6=D1=D5=BB=A1=A2=CF=DF=B3=CC=C9=CF=CF=C2=CE=C4=A1=A2=CF=DF=
=B3=CC=C4=DA=BA=CB=B6=D4=CF=F3]<BR>4.=CD=A8=D6=AAWINDOWS=D7=D3=CF=B5=CD=B3=
=D2=D1=BE=AD=B4=B4=BD=A8=C1=CB=D2=BB=B8=F6=D0=C2=BD=F8=B3=CC=A3=AC=B1=E3=D3=
=DA=CB=FC=BD=F8=D2=BB=B2=BD=B5=C4=B3=F5=CA=BC=BB=AF<BR>5.=C8=E7=B9=FB=B1=EA=
=D6=C2=B2=BB=CA=C7CREATE_=20
=
SUSPENDED=A3=AC=C4=C7=C3=B4=BE=CD=BF=AA=CA=BC=D6=B4=D0=D0=BD=F8=B3=CC=D6=D0=
=B5=C4=CF=DF=B3=CC<BR>6.=D4=DA=BD=F8=B3=CC=BA=CD=CF=DF=B3=CC=B5=C4context=
=C0=EF=A3=AC=CD=EA=B3=C9=B5=D8=D6=B7=BF=D5=BC=E4=B5=C4=B3=F5=CA=BC=BB=AF[=
eg.=BC=D3=D4=D8=D0=E8=D2=AA=B5=C4DLL]=A3=AC=BF=AA=CA=BC=D6=B4=D0=D0=B3=CC=
=D0=F2</B></SPAN><BR><BR><B></B><BR><IMG=20
onclick=3D"if(this.width>=3D800) =
window.open('https://forum.eviloctal.com/attachment/Mon_0712/96_69539_953=
63ec5a9e3ee3.gif');"=20
=
src=3D"https://forum.eviloctal.com/attachment/Mon_0712/96_69539_95363ec5a=
9e3ee3.gif"=20
=
onload=3D"if(this.width>'800')this.width=3D'800';if(this.height>'800')thi=
s.height=3D'800';"=20
border=3D0>=20
=
<BR><BR>CreateProces⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -