|
楼主要是写过遍历链表的小POC就会发现 Process Explorer 其实也就是分析 UniqueProcessId 和 InheritedFromUniqueProcessId 之间的关系来显示那棵进程树的。下面是我的某小POC的部分输出（请注意 UID 和 IID 的关系）：
"0x826D73B0" NEXT="0x825B97C0", EPROCESS=0x827BA830, UID=0x00000004, IID=0x00000000. ; System
"0x825B97C0" NEXT="0x82640DC8", EPROCESS=0x826432F8, UID=0x0000019C, IID=0x00000004.
"0x82640DC8" NEXT="0x82666078", EPROCESS=0x824F5DA0, UID=0x00000290, IID=0x0000019C.
"0x82666078" NEXT="0x826E3890", EPROCESS=0x82517DA0, UID=0x000002AC, IID=0x0000019C.
"0x826E3890" NEXT="0x8265D3C0", EPROCESS=0x82524A78, UID=0x000002DC, IID=0x000002AC.
"0x8265D3C0" NEXT="0x826E0C88", EPROCESS=0x825F2550, UID=0x000002E8, IID=0x000002AC.
"0x826E0C88" NEXT="0x8252A5C0", EPROCESS=0x824FF670, UID=0x00000380, IID=0x000002DC.
"0x8252A5C0" NEXT="0x82533218", EPROCESS=0x826C4790, UID=0x000003D0, IID=0x000002DC.
"0x82533218" NEXT="0x826DBA20", EPROCESS=0x8261ADA0, UID=0x00000444, IID=0x000002DC.
"0x826DBA20" NEXT="0x825A1A88", EPROCESS=0x8263B020, UID=0x00000484, IID=0x000002DC.
"0x825A1A88" NEXT="0x826A4F80", EPROCESS=0x826BE978, UID=0x000004DC, IID=0x000002DC.
"0x826A4F80" NEXT="0x826C4C18", EPROCESS=0x825F2DA0, UID=0x000005E8, IID=0x000005A4. ; explorer.exe
"0x826C4C18" NEXT="0x8271E168", EPROCESS=0x8252F708, UID=0x00000634, IID=0x000002DC.
"0x8271E168" NEXT="0x82720D18", EPROCESS=0x825AC978, UID=0x0000064C, IID=0x000002DC.
"0x82720D18" NEXT="0x826DD078", EPROCESS=0x8253E690, UID=0x0000070C, IID=0x000005E8.
"0x826DD078" NEXT="0x826DDA20", EPROCESS=0x823D8810, UID=0x0000071C, IID=0x000005E8.
"0x826DDA20" NEXT="0x8257A200", EPROCESS=0x825BD5D0, UID=0x000000C0, IID=0x000002DC.
"0x8257A200" NEXT="0x826131D8", EPROCESS=0x823F8020, UID=0x000007A4, IID=0x00000444.
"0x826131D8" NEXT="0x825EA490", EPROCESS=0x823F3020, UID=0x00000114, IID=0x000002DC.
"0x825EA490" NEXT="0x823EF758", EPROCESS=0x82588DA0, UID=0x00000468, IID=0x000005E8.
"0x823EF758" NEXT="0x00000000", EPROCESS=0x825764B8, UID=0x00000704, IID=0x000005E8.
为了验证上述猜想，我们可以 DKOM 一下 _EPROCESS。如图：
图中，我不但修改了一些进程的 InheritedFromUniqueProcessId，还抹掉了 _SE_AUDIT_PROCESS_CREATION_INFO，所以进程没名字（类似于什么 PEB、SectionObject - PsReferenceProcessFilePointer 里的等等等等名字我一样可以抹去）。
最后，不知道您是什么平台，给您一些我代码里的硬编码：
//
// windows 2000
//
g_HardCode.flags_system_version = WINDOWS_VERSION_5_0;
g_HardCode.offset_eprocess_unique_id = 0x09C;
g_HardCode.offset_eprocess_debug_port = 0x120;
g_HardCode.offset_eprocess_object_table = 0x128;
g_HardCode.offset_eprocess_active_links = 0x0A0;
g_HardCode.offset_eprocess_win32_process = 0x214;
g_HardCode.offset_eprocess_security_port = 0x22C;
g_HardCode.offset_eprocess_priority_class = 0x211;
g_HardCode.offset_eprocess_image_file_name = 0x1FC;
g_HardCode.offset_eprocess_inherited_unique_id = 0x1C8;
g_HardCode.offset_eprocess_win32_window_station = 0x1C4;
g_HardCode.offset_eprocess_section_base_address = 0x1B4;
//
// windows xp
//
g_HardCode.flags_system_version = WINDOWS_VERSION_5_1;
g_HardCode.offset_eprocess_unique_id = 0x084;
g_HardCode.offset_eprocess_debug_port = 0x0BC;
g_HardCode.offset_eprocess_object_table = 0x0C4;
g_HardCode.offset_eprocess_active_links = 0x088;
g_HardCode.offset_eprocess_win32_process = 0x130;
g_HardCode.offset_eprocess_security_port = 0x198;
g_HardCode.offset_eprocess_priority_class = 0x254;
g_HardCode.offset_eprocess_image_file_name = 0x174;
g_HardCode.offset_eprocess_inherited_unique_id = 0x14C;
g_HardCode.offset_eprocess_win32_window_station = 0x148;
g_HardCode.offset_eprocess_section_base_address = 0x13C;
//
// windows 2003
//
g_HardCode.flags_system_version = WINDOWS_VERSION_5_2;
g_HardCode.offset_eprocess_unique_id = 0x094;
g_HardCode.offset_eprocess_debug_port = 0x0CC;
g_HardCode.offset_eprocess_object_table = 0x0D4;
g_HardCode.offset_eprocess_active_links = 0x098;
g_HardCode.offset_eprocess_win32_process = 0x11C;
g_HardCode.offset_eprocess_security_port = 0x188;
g_HardCode.offset_eprocess_priority_class = 0x24C;
g_HardCode.offset_eprocess_image_file_name = 0x164;
g_HardCode.offset_eprocess_inherited_unique_id = 0x138;
g_HardCode.offset_eprocess_win32_window_station = 0x134;
g_HardCode.offset_eprocess_section_base_address = 0x128;
//
// windows vista
//
g_HardCode.flags_system_version = WINDOWS_VERSION_6_0;
g_HardCode.offset_eprocess_unique_id = 0x09C;
g_HardCode.offset_eprocess_debug_port = 0x0D4;
g_HardCode.offset_eprocess_object_table = 0x0DC;
g_HardCode.offset_eprocess_active_links = 0x0A0;
g_HardCode.offset_eprocess_win32_process = 0x108;
g_HardCode.offset_eprocess_security_port = 0x170;
g_HardCode.offset_eprocess_priority_class = 0x234;
g_HardCode.offset_eprocess_image_file_name = 0x14C;
g_HardCode.offset_eprocess_inherited_unique_id = 0x124;
g_HardCode.offset_eprocess_win32_window_station = 0x120;
g_HardCode.offset_eprocess_section_base_address = 0x114;
至于如何调试（在可调试环境下）或者拦截启动那方法太多了，微软官方的方法是 NotifyRoutine 源代码位于 \ntos\ps\create.c
|