TOKEN_PRIVILEGES tp;
tp.PrivilegeCount = 1;
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
tp.Privileges[0].Attributes = fEnable SE_PRIVILEGE_ENABLED : 0;
AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
fOk = (GetLastError() == ERROR_SUCCESS);
CloseHandle(hToken);
}
else
{
return 0;
}
return(fOk);
}
void EnumModlueAll(DWORD dwPID)
{
HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS,false,dwPID);
if(hProcess==INVALID_HANDLE_VALUE)
{ printf(" open process failed!\n");
return;
}
DWORD size=0,ret=0;
EnumProcessModules(hProcess,NULL,size,&ret);
HMODULE *parry=(HMODULE*)malloc(ret+4);
memset(parry,0,ret+4);
if(EnumProcessModules(hProcess,parry,ret+4,&ret))
{
char* path=new char[MAX_PATH];
memset(path,0,MAX_PATH);
UINT i=0;
while(GetModuleFileNameEx(hProcess,parry[i],path,MAX_PATH))
{
printf("方法3模块：%s\n",path);
memset(path,0,MAX_PATH);
i++;
}
delete path;
}
free(parry);
CloseHandle(hProcess);
}
void EnumModuleEx(DWORD dwPID)
{
DWORD status;
HMODULE hMod=GetModuleHandle("ntdll.dll");
RTLCREATEQUERYDEBUGBUFFER RtlCreateQueryDebugBuffer=(RTLCREATEQUERYDEBUGBUFFER )GetProcAddress(hMod,"RtlCreateQueryDebugBuffer");
RTLQUERYPROCESSDEBUGINFORMATION RtlQueryProcessDebugInformation=(RTLQUERYPROCESSDEBUGINFORMATION)GetProcAddress(hMod,"RtlQueryProcessDebugInformation");
RTLDESTROYDEBUGBUFFER RtlDestroyQueryDebugBuffer =(RTLDESTROYDEBUGBUFFER )GetProcAddress(hMod,"RtlDestroyQueryDebugBuffer");
if((hMod==NULL)||(RtlDestroyQueryDebugBuffer==NULL)||(RtlQueryProcessDebugInformation==NULL)||(RtlCreateQueryDebugBuffer==NULL))
{
printf("函数定位失败！\n");
return ;
}
PDEBUG_BUFFER Buffer=RtlCreateQueryDebugBuffer(0,FALSE);
status=RtlQueryProcessDebugInformation(dwPID,PDI_MODULES ,Buffer);
if(status<0)
{
printf("RtlQueryProcessDebugInformation函数调用失败，进程开了保护\n");
return ;
}
ULONG count=*(PULONG)(Buffer->ModuleInformation);
ULONG hModule=NULL;
PDEBUG_MODULE_INFORMATION ModuleInfo=(PDEBUG_MODULE_INFORMATION)((ULONG)Buffer->ModuleInformation+4);
for(ULONG i=0;i<count;i++)
{
printf("方法4列出的模块：%s\n",ModuleInfo->ImageName);
ModuleInfo++;
}
RtlDestroyQueryDebugBuffer(Buffer);
}
void EnumSelfModule()
{
void *PEB = NULL,
*Ldr = NULL,
*Flink = NULL,
*p = NULL,
*BaseAddress = NULL,
*FullDllName = NULL;
printf("列举自身模块！\n");
__asm
{
mov eax,fs:[0x30]
mov PEB,eax
}
printf( "PEB = 0x%08X\n", PEB );
Ldr = *( ( void ** )( ( unsigned char * )PEB + 0x0c ) );
printf( "Ldr = 0x%08X\n", Ldr );
Flink = *( ( void ** )( ( unsigned char * )Ldr + 0x0c ) );
printf( "Flink = 0x%08X\n", Flink );
p = Flink;
do
{