[英]Using Debugger how to get child process's PID from Parent
我想知道,使用windbg或任何其他調試器如何獲取由父進程創建的子進程的PID。
范例:
調試器附加到任意運行的“進程A”。
將調試器附加到進程A(父進程)后,進程A使用kernel32!CreateProcess *或kernel32!CreateProcessInternal創建另一個子進程(進程B)。
那么如何從進程A獲取進程B的PID?
主要是我想使用pydbg做到這一點,但是如果我知道如何使用windbg手動實現這一點,我希望我能夠使用pydbg做到這一點。
提前致謝,
在WinDbg中,還有.childdbg 1
命令,因此您只需調試所有子進程。
這是進行用戶模式調試時使用斷點的較長版本:
0:000> .symfix e:\debug\symbols
0:000> .reload
Reloading current modules
.....
0:000> bp kernel32!CreateProcessW
0:000> g
Breakpoint 0 hit
*** WARNING: Unable to verify checksum for GetChildPID.exe
eax=00467780 ebx=7efde000 ecx=00467804 edx=00000004 esi=003af960 edi=003afa94
eip=755c103d esp=003af934 ebp=003afa94 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
kernel32!CreateProcessW:
755c103d 8bff mov edi,edi
0:000> kb
ChildEBP RetAddr Args to Child
003af930 0138148d 00000000 00467804 00000000 kernel32!CreateProcessW
0:000> dp esp
003af934 0138148d 00000000 00467804 00000000 // ReturnAddress AppName CommandLine ProcAttr
003af944 00000000 00000000 00000000 00000000 // ThreadAttr InheritHandles CreationFlags Environment
003af954 00000000 003afa48 003afa30 00000000 // CurrentDir StartupInfo ProcessInfo
0:000> du 00467804
00467804 "notepad.exe"
0:000> dt 003afa30 PROCESS_INFORMATION
GetChildPID!PROCESS_INFORMATION
+0x000 hProcess : (null)
+0x004 hThread : (null)
+0x008 dwProcessId : 0
+0x00c dwThreadId : 0
0:000> ***// Empty before the call
0:000> p;gu
eax=00000001 ebx=7efde000 ecx=755d4964 edx=0000008b esi=003af960 edi=003afa94
eip=0138148d esp=003af960 ebp=003afa94 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
GetChildPID!wmain+0xad:
0138148d 3bf4 cmp esi,esp
0:000> dt 003afa30 PROCESS_INFORMATION
GetChildPID!PROCESS_INFORMATION
+0x000 hProcess : 0x00000038 Void
+0x004 hThread : 0x00000034 Void
+0x008 dwProcessId : 0x102c
+0x00c dwThreadId : 0xfb0
102c
是子進程的進程ID。 如果該過程沒有立即終止,則可以使用.tlist
進行交叉檢查。
如果沒有符號,您仍然可以轉儲內存
0:000> p;gu
eax=00000001 ebx=7efde000 ecx=755d4964 edx=0000008b esi=003ef910 edi=003efa44
eip=0138148d esp=003ef910 ebp=003efa44 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
GetChildPID!wmain+0xad:
0138148d 3bf4 cmp esi,esp
0:000> dp esp-4 L1
003ef90c 003ef9e0
0:000> dp 003ef9e0 L4
003ef9e0 00000038 00000034 00000cc0 00001320
您可以使用windbg的handle命令搜索帶有標志0xf的Process以獲得子進程的pid
使用cl / Zi / nologo / W4 / analyze%1%/ link / RELEASE編譯的代碼
C:\>type codesnips\childdbg\childdbg.cpp
#include <stdio.h>
#include <windows.h>
int main (void)
{
STARTUPINFO si;
PROCESS_INFORMATION pi;
ZeroMemory( &si, sizeof(si) );
si.cb = sizeof(si);
ZeroMemory( &pi, sizeof(pi) );
if( !CreateProcess( "c:\\windows\\system32\\calc.exe",NULL,NULL, NULL, FALSE
,0,NULL,NULL,&si,&pi ) )
{
printf( "CreateProcess failed (%d).\n", GetLastError() );
return 0;
}
printf("waiting and watching when calc.exe will be no more\n");
WaitForSingleObject( pi.hProcess, INFINITE );
printf("calc.exe no more i am free to quit watching\n");
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
return 0;
}
C:\> childdbg.exe
waiting and watching when calc.exe will be no more
上面運行的過程如下運行(注意pid或父子)
tlist -t顯示樹視圖**
C:\>tlist -t | grep -A 1 child
opera.exe (1164) windows - How Internet Explorer(IE11)Creates low Integrity child process without CreateProcess Call - Stack Overflow - Opera
childdbg.exe (6992) C:\codesnips\childdbg\childdbg.exe
calc.exe (7040) Calculator
打開windbg或cdb提示附加到父進程,檢索所有類型為Process和.parent與父進程分離的句柄(比較通過tlist和cdb獲取的pid)
C:> cdb -c“!handle 0 f進程; .detach; q” -pn childdbg.exe
0:001> cdb: Reading initial command '!handle 0 f Process;.detach;q'
Handle 28
Type Process
Attributes 0
GrantedAccess 0x1f0fff:
Delete,ReadControl,WriteDac,WriteOwner,Synch
Terminate,CreateThread,,VMOp,VMRead,VMWrite,DupHandle,CreateProcess,Set
Quota,SetInfo,QueryInfo,SetPort
HandleCount 4
PointerCount 18
Name <none>
Object Specific Information
Process Id 7040
Parent Process 6992
Base Priority 8
1 handles of type Process
Detached
quit:
C:\>
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.