吾爱破解 - 52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

查看: 169|回复: 3
上一主题 下一主题
收起左侧

[求助] 求助关于暴力枚举pid检测隐藏进程

[复制链接]
跳转到指定楼层
楼主
你好,再见 发表于 2025-3-16 18:18 回帖奖励
本帖最后由 你好,再见 于 2025-3-16 18:23 编辑

请教各位关于暴力枚举pid检测隐藏进程
我翻看了OpenArk的源代码,为什么它的代码当中pid每次+4而不是+1呢,有没有相关资料说明?

另外它设置的pid上限为65536,我也没查到相关资料。
很久之前看到过一篇关于进程隐藏的文章,里面提到过4个pid对应一个进程(当时没看懂表述可能有错误)
求大佬们解惑

[C++] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
bool PsGetAllProcessV2(__out std::vector<DWORD> &pids)
{
        pids.clear();
        bool result = true;
        for (DWORD i = 8; i < 65536; i += 4) {
                if (!PsIsDeleted(i))    // 通过OpenProcess判断pid对应进程是否存在
                        pids.push_back(i);
        }
        return !pids.empty();
}


https://github.com/BlackINT3/none/blob/master/src/unone/process/unone-ps.cpp#L1348

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

沙发
董督秀 发表于 2025-3-16 18:26
为什么它的代码当中pid每次+4而不是+1呢

pid的十进制值需要是4的整数倍。

免费评分

参与人数 1吾爱币 +2 热心值 +1 收起 理由
你好,再见 + 2 + 1 谢谢@Thanks!

查看全部评分

3#
AntelopeE 发表于 2025-3-16 19:26
4#
爱飞的猫 发表于 2025-3-16 19:51
本帖最后由 爱飞的猫 于 2025-3-16 19:56 编辑

可以看微软的技术博客:
https://devblogs.microsoft.com/oldnewthing/20080228-00/?p=23283

总结:都是巧合。

上面的链接有提到一个更老的文章(连接没了,要找快照):
Not very well known is that the bottom two bits of kernel HANDLEs are always zero; in other words, their numeric value is always a multiple of 4. Note that this applies only to kernel HANDLEs; it does not apply to pseudo-handles or to any other type of handle (USER handles, GDI handles, multimedia handles...) Kernel handles are things you can pass to the CloseHandle function.

The availability of the bottom two bits is buried in the ntdef.h header file:

//
// Low order two bits of a handle are ignored by the system and available
// for use by application code as tag bits.  The remaining bits are opaque
// and used to store a serial number and table index.
//

#define OBJ_HANDLE_TAGBITS  0x00000003L
That at least the bottom bit of kernel HANDLEs is always zero is implied by the GetQueuedCompletionStatus function, which indicates that you can set the bottom bit of the event handle to suppress completion port notification. In order for this to work, the bottom bit must normally be zero.

This information is not useful for most application writers, which should continue to treat HANDLEs as opaque values. The people who would be interested in tag bits are those who are implementing low-level class libraries or are wrapping kernel objects inside a larger framework.
内核句柄低二位有其他作用,而进程 id 等也是内核句柄。所以低 2 位为零,也就是都是 4 的倍数。

免费评分

参与人数 1吾爱币 +3 热心值 +1 收起 理由
你好,再见 + 3 + 1 谢谢@Thanks!

查看全部评分

您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则

返回列表

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2025-3-17 05:11

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表