如何获取进程入口点地址

Question

我像这样创建一个暂停的进程test.exe ：

CreateProcess(
    TEXT( "C:\\Documents and Settings\\willy\\桌面\\project\\test.exe" ), 
    TEXT( "test.exe" ),
    NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi
);

如何在创建进程test.exe后获取进程点/启动/主地址？

我应该查找PE文件信息还是使用ReadProcessMemory()或VirtualQueryEx()等API

Answer 1

好的，我已经破解了一个只有32位的解决方案，它从进程'PEB获取映像基地址。

文件EntryPt.c ：

#include <windows.h>
#include <tchar.h>
#include <psapi.h>
#include <stdio.h>
#include <stddef.h>

// To ensure correct resolution of symbols, add Psapi.lib to TARGETLIBS
// and compile with -DPSAPI_VERSION=1

NTSTATUS (NTAPI *pNtQueryInformationProcess)(HANDLE, /*enum _PROCESSINFOCLASS*/DWORD, PVOID, ULONG, PULONG) = NULL;

extern PVOID GetPeb(HANDLE ProcessHandle);

// PEB definition comes from winternl.h. This is a 32-bit PEB.
typedef struct _PEB
{
  BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2]; // Reserved3[1] points to PEB
/*
  PPEB_LDR_DATA                 Ldr;
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  BYTE                          Reserved4[104];
  PVOID                         Reserved5[52];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved6[128];
  PVOID                         Reserved7[1];
  ULONG                         SessionId;
*/
} PEB, *PPEB;

int main(int argc, TCHAR* argv[])
{
    STARTUPINFO StartupInfo;
    PROCESS_INFORMATION ProcessInfo;

    PPEB pPeb;
    PVOID pImage, pEntry;
    PIMAGE_NT_HEADERS pNtHeaders;
    LONG e_lfanew;
    SIZE_T NumberOfBytesRead;

    pNtQueryInformationProcess = (NTSTATUS(NTAPI*)(HANDLE, /*enum _PROCESSINFOCLASS*/DWORD, PVOID, ULONG, PULONG))
        GetProcAddress(
            GetModuleHandle(TEXT("ntdll.dll")), 
            TEXT("NtQueryInformationProcess"));

    if (pNtQueryInformationProcess == NULL)
    {
        printf("GetProcAddress(ntdll.dll, NtQueryInformationProcess) failed with error 0x%08X\n",
               GetLastError());
        return -1;
    }

    memset(&StartupInfo, 0, sizeof(StartupInfo));
    memset(&ProcessInfo, 0, sizeof(ProcessInfo));

    if (!CreateProcess(
      NULL,
      (argc > 1) ? argv[1] : argv[0],
      NULL,
      NULL,
      FALSE,
      CREATE_SUSPENDED,
      NULL,
      NULL,
      &StartupInfo,
      &ProcessInfo))
    {
        printf("CreateProcess() failed with error 0x%08X\n", GetLastError());
        return -1;
    }

    printf("Current process:\n");
    pPeb = GetPeb(GetCurrentProcess());
    printf("PEB: 0x%08X\n", pPeb);
    pImage = pPeb->Reserved3[1];
    printf("Image base: 0x%08X\n", pImage);
    pNtHeaders = (PIMAGE_NT_HEADERS)((PCHAR)pImage + ((PIMAGE_DOS_HEADER)pImage)->e_lfanew);
    pEntry = (PVOID)((PCHAR)pImage + pNtHeaders->OptionalHeader.AddressOfEntryPoint);
    printf("Image entry point: 0x%08X\n", pEntry);

    printf("\n");

    printf("Child process:\n");
    pPeb = GetPeb(ProcessInfo.hProcess);
    printf("PEB: 0x%08X\n", pPeb);

    if (!ReadProcessMemory(
      ProcessInfo.hProcess,
      &pPeb->Reserved3[1],
      &pImage,
      sizeof(pImage),
      &NumberOfBytesRead) || NumberOfBytesRead != sizeof(pImage))
    {
        printf("ReadProcessMemory(&pImage) failed with error 0x%08X\n", GetLastError());
        goto End;
    }
    printf("Image base: 0x%08X\n", pImage);

    if (!ReadProcessMemory(
      ProcessInfo.hProcess,
      (PCHAR)pImage + offsetof(IMAGE_DOS_HEADER, e_lfanew),
      &e_lfanew,
      sizeof(e_lfanew),
      &NumberOfBytesRead) || NumberOfBytesRead != sizeof(e_lfanew))
    {
        printf("ReadProcessMemory(&e_lfanew) failed with error 0x%08X\n", GetLastError());
        goto End;
    }
    pNtHeaders = (PIMAGE_NT_HEADERS)((PCHAR)pImage + e_lfanew);

    if (!ReadProcessMemory(
      ProcessInfo.hProcess,
      (PCHAR)pNtHeaders + offsetof(IMAGE_NT_HEADERS, OptionalHeader.AddressOfEntryPoint),
      &pEntry,
      sizeof(pEntry),
      &NumberOfBytesRead) || NumberOfBytesRead != sizeof(pEntry))
    {
        printf("ReadProcessMemory(&pEntry) failed with error 0x%08X\n", GetLastError());
        goto End;
    }
    pEntry = (PVOID)((PCHAR)pImage + (SIZE_T)pEntry);
    printf("Image entry point: 0x%08X\n", pEntry);

End:

    TerminateProcess(ProcessInfo.hProcess, 0);
    CloseHandle(ProcessInfo.hThread);
    CloseHandle(ProcessInfo.hProcess);

    return 0;
}

文件GetPeb.c ：

#include <ntddk.h>

extern NTSTATUS (NTAPI *pNtQueryInformationProcess)(
  HANDLE ProcessHandle,
  PROCESSINFOCLASS ProcessInformationClass,
  PVOID ProcessInformation,
  ULONG ProcessInformationLength,
  PULONG ReturnLength);

PVOID GetPeb(HANDLE ProcessHandle)
{
  NTSTATUS status;
  PROCESS_BASIC_INFORMATION pbi;
  PVOID pPeb;

  memset(&pbi, 0, sizeof(pbi));

  status = pNtQueryInformationProcess(
    ProcessHandle,
    ProcessBasicInformation,
    &pbi,
    sizeof(pbi),
    NULL);

  pPeb = NULL;

  if (NT_SUCCESS(status))
  {
    pPeb = pbi.PebBaseAddress;
  }

  return pPeb;
}

通过此批处理文件与Open Watcom 1.9一起编译：

set INCLUDE=%INCLUDE%;%WATCOM%\H\NT;%WATCOM%\H\NT\DDK;
wcl386 /we /wx /q /d2 -DPSAPI_VERSION=1 EntryPt.c GetPeb.c %WATCOM%\lib386\nt\psapi.lib

输出（在Windows XP上运行）：

>EntryPt.exe

Current process:
PEB: 0x7FFDD000
Image base: 0x00400000
Image entry point: 0x004013E8

Child process:
PEB: 0x7FFDC000
Image base: 0x00400000
Image entry point: 0x004013E8

>EntryPt.exe calc.exe
Current process:
PEB: 0x7FFDC000
Image base: 0x00400000
Image entry point: 0x004013E8

Child process:
PEB: 0x7FFDB000
Image base: 0x01000000
Image entry point: 0x01012475

此代码使用NtQueryInformationProcess（） ，可能会在操作系统的未来版本中更改。 它还使用未记录的PEB 定义 。 除非适当修改（可能考虑到WOW64 ），否则此代码将无法在64位Windows上运行，并且可能无法与未来版本的Windows一起使用。

Answer 2

当您使用CREATE_SUSPENDED执行进程时，它将从ntdll初始化代码开始。 这对于找到.exe的入口点几乎没有用; 你必须直接检查exe文件的标题：

#include <Windows.h>
#include <WinNT.h>

DWORD FindEntryPointAddress(_TCHAR *exeFile)
{
    BY_HANDLE_FILE_INFORMATION bhfi;
    HANDLE hMapping;
    char *lpBase;
    HANDLE hFile = CreateFile(exeFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
    if (hFile == INVALID_HANDLE_VALUE)
        fail("Opening exe file", GetLastError());

    if (!GetFileInformationByHandle(hFile, &bhfi))
        fail("GetFileInformationByHandle", GetLastError());

    hMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, bhfi.nFileSizeHigh, bhfi.nFileSizeLow, NULL);
    if (!hMapping)
        fail("CreateFileMapping", GetLastError());
    lpBase = (char *)MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, bhfi.nFileSizeLow);
    if (!lpBase)
        fail("MapViewOfFile", GetLastError());

    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)lpBase;
    if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE)
        fail("bad dos header signature", 0);

    PIMAGE_NT_HEADERS32 ntHeader = (PIMAGE_NT_HEADERS32)(lpBase + dosHeader->e_lfanew);
    if (ntHeader->Signature != IMAGE_NT_SIGNATURE)
        fail("bad nt header signature", 0);

    DWORD pEntryPoint = ntHeader->OptionalHeader.ImageBase + ntHeader->OptionalHeader.AddressOfEntryPoint;

    UnmapViewOfFile((LPCVOID)lpBase);
    CloseHandle(hMapping);
    CloseHandle(hFile);

    return pEntryPoint;
}

请注意，此地址是DLL初始化完成后执行的第一个代码。 它可能不是（通常不是）等于main或WinMain的地址; 它通常是一些静态链接到EXE的C库启动代码。

另请注意，如果EXE可重定位且启用了ASLR，则此操作将失败，因为EXE可能会加载到不同的基址。 在这种情况下，您必须找到EXE基址的位置并使用它而不是ntHeader->OptionalHeader.ImageBase 。