PeTools开发(一)

介绍:

完成进程的列举和模块的列举(1221)

主要功能介绍:

01对话框的载入DialogBox

02按钮的响应 WM_COMMAND

03加载listBox

04listBox的初始化

05WM_NOTIFY (List的响应)

06进程的权限提升

07CreateToolhelp32Snapshot

08Module32Next

主要是一些知识点的运用

展示图片:

主要代码:

// 20171217_01.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include "resource.h"
#include <windows.h>
#include <stdio.h>
#include <stdlib.h> 
#include "tlhelp32.h"
#include <commctrl.h>
#include <shellapi.h>
#pragma comment(lib,"comctl32.lib") 

HINSTANCE hAppInstance;


//提升进程权限
BOOL EnableDebugPrivilege(BOOL bEnable)
{
	BOOL status=FALSE;
	HANDLE hToken;
	//打开当前进程的访问令牌
	if(OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken))
	{
		LUID uID;
		LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&uID);
		//调整特权级别
		TOKEN_PRIVILEGES tp;
		tp.PrivilegeCount =1;
		tp.Privileges[0].Luid=uID;
		tp.Privileges[0].Attributes=bEnable?SE_PRIVILEGE_ENABLED:0;
		AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);
		status =(GetLastError() ==ERROR_SUCCESS);
		CloseHandle(hToken);
	}
	return status;
}

BOOL EnumProcess(HWND hListProcess)
{
	HWND hProLV =hListProcess;
	LVITEM lvi;
	DWORD dwIdx=0;
	TCHAR szPath[MAX_PATH];         //进程路径
	TCHAR szPID[10];                        //PID
	TCHAR szBaseAddr[10];               //镜像基址
	TCHAR szBaseSize[10];                //镜像大小
	HANDLE hProSnapshot =NULL;		//进程快照句柄
	HANDLE hModSnapshot=NULL;	//模块快照句柄
	PROCESSENTRY32 pe32={0};
	MODULEENTRY32 me32 = {0};
	//SHFILEINFO fi;

	//清空列表
	ListView_DeleteAllItems(hProLV);
	//创建进程快照
	hProSnapshot =CreateToolhelp32Snapshot(TH32CS_SNAPALL,0); 
	if(hProSnapshot==INVALID_HANDLE_VALUE)
	{
		return FALSE;
	}

	pe32.dwSize =sizeof(pe32);
	ZeroMemory(&lvi,sizeof(lvi));
	lvi.mask		= LVIF_TEXT | LVIF_IMAGE | LVIF_PARAM | LVIF_STATE;
	lvi.state		= 0;
	lvi.stateMask	= 0;
	//枚举进程
	BOOL fOk =Process32First(hProSnapshot,&pe32);
	for (; fOk; fOk =Process32Next(hProSnapshot,&pe32),dwIdx++)
	{
		//StringCchPrintf(szPID,sizeof(szPID),_T("%08x"),pe32.th32ProcessID);
		sprintf(szPID,"%d",pe32.th32ProcessID);

		hModSnapshot =CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pe32.th32ProcessID);
		if (hModSnapshot !=INVALID_HANDLE_VALUE)
		{
			ZeroMemory(&me32,sizeof(me32));
			me32.dwSize = sizeof(me32);
			if(Module32First(hModSnapshot, &me32) && pe32.th32ProcessID !=0)
			{
				
				sprintf(szBaseAddr,"%08X",me32.modBaseAddr);
				sprintf(szBaseSize,"%08X",me32.modBaseSize);
				sprintf(szPath,"%s",pe32.szExeFile);

			}else{
				sprintf(szBaseAddr,"%08X",0);
				sprintf(szBaseSize,"%08X",0);
				sprintf(szPath,"%s",pe32.szExeFile);
				
			}
		}else{
			sprintf(szBaseAddr,"%08X",0);
			sprintf(szBaseSize,"%08X",0);
			sprintf(szPath,"%s",pe32.szExeFile);
		}
		lvi.pszText =szPath;
		lvi.cchTextMax=MAX_PATH;
		lvi.iItem =dwIdx;
	    ListView_InsertItem(hProLV,&lvi);
		ListView_SetItemText(hProLV,dwIdx,1,szPID);
		ListView_SetItemText(hProLV,dwIdx,2,szBaseAddr);
		ListView_SetItemText(hProLV,dwIdx,3,szBaseSize);
	}
	return TRUE;
}

BOOL EnumModules(HWND hListProcess,HWND hListModule,WPARAM wParam,LPARAM lParam)
{
	DWORD dwRowId;
	TCHAR szPid[0x20];
	LV_ITEM lv;
	//HWND hListModule;
	ListView_DeleteAllItems(hListModule);
	memset(&lv,0,sizeof(LV_ITEM));
	memset(szPid,0,0x20);
	
	dwRowId = SendMessage(hListProcess,LVM_GETNEXTITEM,-1,LVNI_SELECTED);
	//HWND hWnd = AfxGetMainWnd()->m_hWnd;
	//hListModule = GetDlgItem((HWND)hAppInstance,IDC_LIST_MODULE);
	
	if(dwRowId == -1)
	{
		MessageBox(NULL,TEXT("请选择进程"),TEXT("出错了"),MB_OK);
		return FALSE;
 
	}

	//获取PID
	lv.iSubItem = 1;
	lv.pszText = szPid;
	lv.cchTextMax = 0x20;
	SendMessage(hListProcess,LVM_GETITEMTEXT,dwRowId,(DWORD)&lv);

	DWORD dwPID = atoi(szPid);

	//通过pid列出所有的Modules
	HANDLE               hModuleSnap = INVALID_HANDLE_VALUE;
    MODULEENTRY32        me32;
 
    //给进程所引用的模块信息设定一个快照 
    hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
    if(hModuleSnap == INVALID_HANDLE_VALUE)
    {
		int i = GetLastError();
        return FALSE;
    }
 
    me32.dwSize = sizeof(MODULEENTRY32);
 
    if(!Module32First(hModuleSnap, &me32))
    {
        CloseHandle(hModuleSnap);
        return FALSE;
    }
	
	DWORD dwIdx= 0;
    do
    {
		/*
        printf("\n\n     MODULE NAME:     %s", me32.szModule);
        printf("\n     executable     = %s", me32.szExePath);
        printf("\n     process ID     = 0x%08X", me32.th32ProcessID);
        printf("\n     ref count (g)  =     0x%04X", me32.GlblcntUsage);
        printf("\n     ref count (p)  =     0x%04X", me32.ProccntUsage);
        printf("\n     base address   = 0x%08X", (DWORD)me32.modBaseAddr);
        printf("\n     base size      = %d", me32.modBaseSize);
		*/

		lv.pszText =me32.szModule;
		lv.iItem =dwIdx;
		lv.iSubItem = 0;
		SendMessage(hListModule,LVM_INSERTITEM,dwIdx,(DWORD)&lv);

	    lv.pszText = me32.szExePath;
		lv.iItem=dwIdx;
		lv.iSubItem = 1;
		SendMessage(hListModule,LVM_SETITEM,dwIdx,(DWORD)&lv);

		dwIdx++;
    } while(Module32Next(hModuleSnap, &me32));
 
    CloseHandle(hModuleSnap);
	
	return TRUE;
	//MessageBox(NULL,szPid,TEXT("pid"),MB_OK);
}

BOOL CALLBACK AboutDialogProc(
  HWND hwndDlg,  // handle to dialog box
  UINT uMsg,     // message
  WPARAM wParam, // first message parameter
  LPARAM lParam  // second message parameter
)
{
	switch(uMsg)
	{
		case WM_CLOSE:
		{
			//EndDeferWindowPos()
			EndDialog(hwndDlg,0);
			break;
		}
	}

	return FALSE;
}

VOID InitProcessListView(HWND hDlg)
{
	LV_COLUMN lv;
	HWND hListProcess;

	//初始化
	memset(&lv,0,sizeof(LV_COLUMN));
	hListProcess = GetDlgItem(hDlg,IDC_LIST_PROCESS);
	SendMessage(hListProcess,LVM_SETEXTENDEDLISTVIEWSTYLE,LVS_EX_FULLROWSELECT,LVS_EX_FULLROWSELECT);
	
	//第一列
	lv.mask = LVCF_TEXT | LVCF_WIDTH | LVCF_SUBITEM;
	lv.pszText = TEXT("进程");
	lv.cx = 150;
	lv.iSubItem = 0;
	SendMessage(hListProcess,LVM_INSERTCOLUMN,0,(DWORD)&lv);
	
	//第二列
	lv.mask = LVCF_TEXT | LVCF_WIDTH | LVCF_SUBITEM;
	lv.pszText = TEXT("PID");
	lv.cx = 50;
	lv.iSubItem = 1;
	SendMessage(hListProcess,LVM_INSERTCOLUMN,1,(DWORD)&lv);
	
	//第三列
	lv.mask =  LVCF_TEXT | LVCF_WIDTH | LVCF_SUBITEM;
	lv.pszText = TEXT("镜像基址");
	lv.cx = 100;
	lv.iSubItem = 2;
	SendMessage(hListProcess,LVM_INSERTCOLUMN,2,(DWORD)&lv);

	//第四列
	
	lv.mask =  LVCF_TEXT | LVCF_WIDTH | LVCF_SUBITEM;
	lv.pszText = TEXT("镜像大小");
	lv.cx = 100;
	lv.iSubItem = 3 ;
	SendMessage(hListProcess,LVM_INSERTCOLUMN,3,(DWORD)&lv);

	EnumProcess(hListProcess);

}

VOID InitMuduleListView(HWND hDlg)
{
	LV_COLUMN lv;
	HWND hListModule;

	//初始化
	memset(&lv,0,sizeof(LV_COLUMN));
	hListModule = GetDlgItem(hDlg,IDC_LIST_MODULE);
	SendMessage(hListModule,LVM_SETEXTENDEDLISTVIEWSTYLE,LVS_EX_FULLROWSELECT,LVS_EX_FULLROWSELECT);
	
	//第一列
	lv.mask = LVCF_TEXT | LVCF_WIDTH | LVCF_SUBITEM;
	lv.pszText = TEXT("模块名称");
	lv.cx = 150;
	lv.iSubItem = 0;
	SendMessage(hListModule,LVM_INSERTCOLUMN,0,(DWORD)&lv);
	
	//第二列
	lv.mask = LVCF_TEXT | LVCF_WIDTH | LVCF_SUBITEM;
	lv.pszText = TEXT("模块位置");
	lv.cx = 300;
	lv.iSubItem = 1;
	SendMessage(hListModule,LVM_INSERTCOLUMN,1,(DWORD)&lv);

}

BOOL CALLBACK MainDialogProc(
  HWND hwndDlg,  // handle to dialog box
  UINT uMsg,     // message
  WPARAM wParam, // first message parameter
  LPARAM lParam  // second message parameter
)
{
	HICON hSmallIcon = NULL;
	HICON hBigIcon = NULL;

	switch(uMsg)
	{
	case WM_CLOSE:
		{
			//EndDeferWindowPos()
			EndDialog(hwndDlg,0);
			break;
		}
	case WM_INITDIALOG:
		{
			//舒适化消息窗口
			//图标加载
			HICON hSmallIcon = LoadIcon(hAppInstance,MAKEINTRESOURCE(IDI_ICON_SMALL));
			HICON hBigIcon = LoadIcon(hAppInstance,MAKEINTRESOURCE(IDI_ICON_BIG));
			
			SendMessage(hwndDlg,WM_SETICON,ICON_BIG,(long)hBigIcon);
			SendMessage(hwndDlg,WM_SETICON,ICON_SMALL,(long)hSmallIcon);
			
			InitProcessListView(hwndDlg);
			InitMuduleListView(hwndDlg);

			break;
		}
	case WM_COMMAND:
		{
			switch(LOWORD(wParam))
			{
			case IDC_BUTTON_EXIT:
				{
					EndDialog(hwndDlg,0);
					break;
				}
			case IDC_BUTTON_ABOUT:
				{
					//MessageBox(0,0,0,0);
					DialogBox(hAppInstance,MAKEINTRESOURCE(IDD_DIALOG_ABOUT),NULL,AboutDialogProc);
					break;
				}
			}
		break;

		}

	case WM_NOTIFY:
		{
			NMHDR* pNMHDR = (NMHDR*)lParam;
			if(wParam == IDC_LIST_PROCESS && pNMHDR->code == NM_CLICK)
			{
				EnumModules(GetDlgItem(hwndDlg,IDC_LIST_PROCESS),GetDlgItem(hwndDlg,IDC_LIST_MODULE),wParam,lParam);	
			}
			break;
		}

	}
	return FALSE;

}


int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
 	// TODO: Place code here.
	hAppInstance = hInstance;
	INITCOMMONCONTROLSEX icex;
	icex.dwSize  = sizeof(INITCOMMONCONTROLSEX);
	icex.dwICC = ICC_WIN95_CLASSES;
	InitCommonControlsEx(&icex);

	EnableDebugPrivilege(TRUE);

	DialogBox(hInstance,MAKEINTRESOURCE(IDD_DIALOG_MAIN),NULL,MainDialogProc);
	
	return 0;
}