delphi R3下 跨进程获取DLL信息 NtQueryInformationProcess

unit APIUnit;
{
GetProcessModuleHandle API Unit

Ring3调用NtQueryInformationProcess实现跨进程获取DLL句柄

}
interface
USES
Winapi.Windows,System.SysUtils;
type
USHORT = Word;
UNICODE_STRING = packed Record
Length : USHORT;
MaximumLength: USHORT;
Buffer : PWideString;
end;
RTL_USER_PROCESS_PARAMETERS = packed record
Reserved1 : array[0..15] of Byte;
Reserved2 : array[0..9] of Pointer;
ImagePathName: UNICODE_STRING;
CommandLine : UNICODE_STRING;
end;
PRTL_USER_PROCESS_PARAMETERS = ^RTL_USER_PROCESS_PARAMETERS;

_PEB_LDR_DATA = record
Length: ULONG;
Initialized: BOOLEAN;
SsHandle: pointer;//PVOID;
InLoadOrderModuleList: LIST_ENTRY;
InMemoryOrderModuleList: LIST_ENTRY;
InInitializationOrderModuleList: LIST_ENTRY;
end {_PEB_LDR_DATA};
PEB_LDR_DATA = _PEB_LDR_DATA;
PPEB_LDR_DATA = ^_PEB_LDR_DATA;

_LDR_MODULE = record
InLoadOrderModuleList: LIST_ENTRY;
InMemoryOrderModuleList: LIST_ENTRY;
InInitializationOrderModuleList: LIST_ENTRY;
BaseAddress: pointer;
EntryPoint:  pointer;
SizeOfImage: ULONG;
FullDllName: UNICODE_STRING;
BaseDllName: UNICODE_STRING;
Flags: ULONG;
LoadCount: SmallInt;
TlsIndex: SmallInt;
HashTableEntry: LIST_ENTRY;
TimeDateStamp: ULONG;
end {_LDR_MODULE};
LDR_MODULE = _LDR_MODULE;
PLDR_MODULE = ^_LDR_MODULE;

_PEB_FREE_BLOCK = record
Next:Pointer;
Size:ULONG;
end;
PPEB_FREE_BLOCK = ^_PEB_FREE_BLOCK;

PEB = packed record
InheritedAddressSpace:Boolean;// 00h
ReadImageFileExecOptions:Boolean; // 01h
BeingDebugged:Boolean; //02H
Spare:Boolean;
Mutant:THandle;
ImageBaseAddress:Pointer;
LoaderData:Pointer;  //0C
ProcessParameters:Pointer;
SubSystemData:Pointer;
ProcessHeap:Pointer;
FastPebLock:Pointer;
FastPebLockRoutine:PPointer;
FastPebUnlockRoutine:PPointer;
EnvironmentUpdateCount:ULONG;
KernelCallbackTable:^Pointer;
EventLogSection:Pointer;
EventLog:Pointer;
FreeList:PPEB_FREE_BLOCK;
TlsExpansionCounter:ULONG;
TlsBitmap:Pointer;
TlsBitmapBits:array [0..$2] of ULONG;
ReadOnlySharedMemoryBase:Pointer;
ReadOnlySharedMemoryHeap:Pointer;
ReadOnlyStaticServerData:^Pointer;
AnsiCodePageData:Pointer;
OemCodePageData:Pointer;
UnicodeCaseTableData:Pointer;
NumberOfProcessors:ULONG;
NtGlobalFlag:ULONG;
Spare2:array [0..$4] of Byte;
CriticalSectionTimeout:LARGE_INTEGER;
HeapSegmentReserve:ULONG;
HeapSegmentCommit:ULONG;
HeapDeCommitTotalFreeThreshold:ULONG;
HeapDeCommitFreeBlockThreshold:Ulong;
NumberOfHeaps:ULONG;
MaximumNumberOfHeaps:ULONG;
ProcessHeaps:PPointer;
GdiSharedHandleTable:Pointer;
ProcessStarterHelper:Pointer;
GdiDCAttributeList:Pointer;
LoaderLock:Pointer;
OSMajorVersion:ULONG;
OSMinorVersion:ULONG;
OSBuildNumber:ULONG;
OSPlatformId:ULONG;
ImageSubSystem:ULONG;
ImageSubSystemMajorVersion:ULONG;
ImageSubSystemMinorVersion:ULONG;
GdiHandleBuffer:array [0..$22] of ULONG;
PostProcessInitRoutine:ULONG;
TlsExpansionBitmap:ULONG;
TlsExpansionBitmapBits: array [0..$80] of Byte;
SessionId:ULONG;
end;
PPEB = ^PEB;

PROCESS_BASIC_INFORMATION = packed record
ExitStatus : DWORD;
PebBaseAddress: PPEB;
AffinityMask : DWORD;
BasePriority : DWORD;
uUniqueProcessId: ULong;
uInheritedFromUniqueProcessId: ULong;
end;
TProcessBasicInformation = PROCESS_BASIC_INFORMATION;

function NtQueryInformationProcess(
ProcessHandle: THandle; {进程句柄}
ProcessInformationClass: Byte; {信息类型}
ProcessInformation: Pointer;   {缓冲指针}
ProcessInformationLength: ULONG; {以字节为单位的缓冲大小}
ReturnLength: PULONG  {写入缓冲的字节数}
): DWORD; stdcall; external 'ntdll.dll';
function GetProcessModuleHandle(dwProcessID:DWORD;DllName:PChar):DWORD;
implementation
function EnablePrivilege(hToken: Cardinal; PrivName: string; bEnable: Boolean):Boolean;
var
TP: TOKEN_PRIVILEGES;
Dummy: Cardinal;
begin
try
TP.PrivilegeCount := 1;
LookupPrivilegeValue(nil, pchar(PrivName), TP.Privileges[0].Luid);
if bEnable then
TP.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED
else TP.Privileges[0].Attributes := 0;
AdjustTokenPrivileges(hToken, False, TP, SizeOf(TP), nil, Dummy);
except
end;
Result :=True;
end;
function EnableDebugPrivilege: Boolean;
var
hToken: THandle;
begin
Result := False;
try
OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES, hToken);
EnablePrivilege(hToken, 'SeDebugPrivilege', True);
CloseHandle(hToken);
Result :=True;
except
end;
end;
function GetProcessModuleHandle(dwProcessID:DWORD;DllName:PChar):DWORD;
var
hProcess:DWORD;
PBI:TProcessBasicInformation;
r,ret:DWORD;
readByte: SIZE_T;
PEBType:PPEB;
PLD :PPEB_LDR_DATA;
PME :PLDR_MODULE;
PEBDLLName:PChar;
const
Size:DWORD = 255;
begin
Result := 0;
GetMem(PEBType,SizeOf(PEB));
ZeroMemory(PEBType,SizeOf(PEB));
GetMem(PLD,SizeOf(PEB_LDR_DATA));
ZeroMemory(PLD,SizeOf(PEB_LDR_DATA));
GetMem(PME,SizeOf(LDR_MODULE));
ZeroMemory(PME,SizeOf(LDR_MODULE));
GetMem(PEBDLLName,Size);
try
//提升进程权限
if not EnableDebugPrivilege then
begin
OutputDebugStringW('Do not have Debug privilege');   //无法提升调试权限
end;
//如果PID为0则获取自身的伪句柄，如果不是则获取指定PID的句柄
if dwProcessID <> 0 then
//打开进程，需要PROCESS_QUERY_INFORMATION和PROCESS_VM_READ权限
hProcess := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, FALSE,dwProcessID)
else
hProcess := GetCurrentProcess;
//调用NtQueryInformationProcess获取结构信息
ret := NtQueryInformationProcess(hProcess,0,@PBI,SizeOf(PBI),@r);
//正常情况下ret是0，如果不是则认为错误
if ret = 0 then
begin
//获取PEB结构
ReadProcessMemory(hProcess,PBI.PebBaseAddress,PEBType,SizeOf(PEB),readByte);
//获取PLD结构
ReadProcessMemory(hProcess,PEBType.LoaderData,PLD,SizeOf(PEB_LDR_DATA),readByte);
//获取第一个PME
ReadProcessMemory(hProcess,PLD.InLoadOrderModuleList.Flink,PME,SizeOf(LDR_MODULE),readByte);
//循环
while True do
begin
//清零缓冲区
ZeroMemory(PEBDLLName,Size);
//读取buff到内存中，获取当前结构的DLL名
if not ReadProcessMemory(hProcess,PME.BaseDllName.Buffer,PEBDLLName,PME.BaseDllName.Length,readByte) then Break;
//对比DLL名称，不区分大小写
if LowerCase(AnsiString(PEBDLLName)) = LowerCase(AnsiString(DllName)) then
begin
//调试信息
OutputDebugStringW(PEBDLLName);
//返回DLL的句柄
Result := dword(pme.BaseAddress);
//退出循环
Break;
end;
//调试信息
OutputDebugStringW(PEBDLLName);
//如果下一个结构为开始的结构，则认为链表已经枚举完了
if PME.InLoadOrderModuleList.Flink = PLD.InLoadOrderModuleList.Flink then Break;
//读取下一个结构
if not ReadProcessMemory(hProcess,PME.InLoadOrderModuleList.Flink,PME,SizeOf(LDR_MODULE),readByte) then Break;
end;
end
else
begin
//返回错误信息
OutputDebugStringW('Error!NtQueryInformationProcess Error!');
end;
finally
//释放使用的内存
FreeMem(PEBDLLName,Size);
FreeMem(PME,SizeOf(LDR_MODULE));
FreeMem(PLD,SizeOf(PEB_LDR_DATA));
FreeMem(PEBType,SizeOf(PEB));
end;
end;
end.