LORDPE Dump Process Memory implementation

Tag:snapshot   lordpe   dump    memory    

#include <windows.h> #include <tlhelp32.h> #include <stdio.h> #include <string.h>// The first module of the process is the base address of the process (this way gets the size of the process memory image) DWORD Getprocessbaseandimagesize (DWORD Dwpid, DWORD *dwimagesize) {HANDLE Hmodulesnap = Invalid_handle_value; MODULEENTRY32 me32;//Take a snapshot of all modules in the specified PROCESS.HMODULESNAP = createtoolhelp32snapshot (TH32 Cs_snapmodule, Dwpid); if (Hmodulesnap = = Invalid_handle_value) {printf ("createtoolhelp32snapshot (of modules), error Co De:%d\n ", GetLastError ()); return FALSE;} Set the size of the structure before using it.me32.dwSize = sizeof (MODULEENTRY32);//Retrieve information about the F Irst module,//and exit if Unsuccessfulif (!  Module32first (Hmodulesnap, &me32)) {printf ("Module32first");           Show cause of Failureclosehandle (HMODULESNAP); Clean the snapshot Objectreturn FALSE;}   printf ("\ n Base address = 0x%08X", (DWORD) me32.modbaseaddr); The first module is a process base closehandle (HMODULESNAP); if (dwimagesize! = NULL) *dwimagesize = me32.modbasesize; Process image size return (DWORD) me32.modbaseaddr;} Take a snapshot of all processes and find the Piddword getprocesspid (char strpocname[]) {HANDLE Hprocesssnap of the specified process; HANDLE hprocess; PROCESSENTRY32 pe32;//Take a snapshot of all processes in the SYSTEM.HPROCESSSNAP = CreateToolhelp32Snapshot (th32cs_snap PROCESS, 0); if (Hprocesssnap = = Invalid_handle_value) {printf ("Failed to createtoolhelp32snapshot...\n"); return FALSE;} Set the size of the structure before using it.pe32.dwSize = sizeof (PROCESSENTRY32);//Retrieve information about the First process,//and exit if Unsuccessfulif (! Process32First (Hprocesssnap, &pe32)) {printf ("Error in process32first...\n");          CloseHandle (HPROCESSSNAP); Clean the snapshot Objectreturn FALSE;} Now walk the snapshot of processes, and//display information on each process in turndo{//printf ("Process name:%s\ n ", pe32.szexefile); if (stricmp (strpocname, pe32.szexefile) = = 0)//Ignore case {//printf (" process name:%s\n ", Pe32.szexefile ); ClosehanDle (HPROCESSSNAP); return pe32.th32processid;}} while (Process32Next (Hprocesssnap, &pe32)); CloseHandle (HPROCESSSNAP); return FALSE;} Mode one://through the PE file header to determine the size of the image, if the file header is modified by Shell can not get the mirror size DWORD getimagesize (HANDLE Hproc, DWORD dwimagebase) {DWORD Dwretsize;image_ Dos_header imagedosheader;image_nt_headers imagentheader;if (readprocessmemory (hproc, char*) dwImageBase, & Imagedosheader, sizeof (Image_dos_header), NULL) = = 0) {printf ("LastError:%d\n", GetLastError ());} Pimage_nt_headers Pntheader = (pimage_nt_headers) (dwimagebase + imagedosheader.e_lfanew); if (ReadProcessMemory (HProc , (char*) (Pntheader), &imagentheader, sizeof (image_nt_headers), NULL) = = 0) {printf ("LastError:%d\n", GetLastError ()); return FALSE;} Dwretsize = Imagentheader.optionalheader.sizeofimage;return dwretsize;} Mode two:////gets the program image size by grabbing the process snapshot (see function Getprocessbaseandimagesize)//dword getimagesize (DWORD dwpid)//{//handle Hmoudlesnap = Invalid_handle_value;//moduleentry32 Me32;//memset (&me32, 0, sizeof (MODULEENTRY32));//me32.dwsize = sizeof (MODULEENTRY32),////snapshot process all modules//hmoudlesnap = CreateToolhelp32Snapshot (Th32cs_snapmodule, dwpid); /if (Hmoudlesnap = = Invalid_handle_value)//{//printf ("Failed to createtoolhelp32snapshot of process modules...\n");// Return false;//}////retrieve information about the first Module////and exit if unsucessful//if (! Module32first (Hmoudlesnap, &me32))//{//printf ("Failed to module32first...\n");//closehandle (HMOUDLESNAP);//   Return False;//}//closehandle (HMOUDLESNAP);//return me32.modbasesize; The size of the process image//}//modifies the file offset file size value in the chunk header structure of the dump file, making it offset with memory, memory size equal bool Modifysectionheader (char *strdumpfilename) {HANDLE hfile ; HANDLE hfilemapping; LPVOID lpfilebase;hfile = CreateFile (Strdumpfilename,generic_read | Generic_write,file_share_read | file_share_write,null,open_existing,file_attribute_normal,0), if (hfile = = Invalid_handle_value) {printf ("Failed to CreateFile. \ n "); return FALSE;} Map the file to memory Hfilemapping = createfilemapping (hfile,null,page_readwrite,0, 0, NULL); if (hfilemapping = = 0) {CloSehandle (hfile);p rintf ("Failed to createfilemapping...\n"); return FALSE;} Lpfilebase = MapViewOfFile (hfilemapping,file_map_all_access,0, 0, 0); if (lpfilebase = = 0) {CloseHandle (hFileMapping); CloseHandle (hfile);p rintf ("Failed to mapviewoffile...\n"); return FALSE;} Pimage_dos_header Pdosheader = (pimage_dos_header) lpfilebase; Pimage_nt_headers Pntheader = (pimage_nt_headers) ((DWORD) lpfilebase + pdosheader->e_lfanew);D word DwSectionCount; Dwsectioncount = pntheader->fileheader.numberofsections; Pimage_section_header Psectionheader = (Pimage_section_header) ((DWORD) Pntheader + sizeof (image_nt_headers)); for (int i = 0; i < Dwsectioncount; i++) {//printf ("before:\nsection%d VOffset:%x vsize:%x roffset:%x rsize:%x \ n",//i,//psectionheader->vir Tualaddress,//psectionheader->misc.virtualsize,//psectionheader->pointertorawdata,//psectionheader-> Sizeofrawdata)//modify data//The value should remain consistent with the section memory offset and size when the dump is out of memory Psectionheader->pointertorawdata = Psectionheader->virtualAddress;psectionheader->sizeofrawdata = psectionheader->misc.virtualsize;psectionheader++; Next Section}//flushviewoffile () UnmapViewOfFile (lpfilebase); CloseHandle (hfilemapping); CloseHandle (hfile); return TRUE;} Dump Processdword dumpprocess (char strprocname[]) {DWORD Dwpid;dword Dwimagesize;dword dwprocbase;dwpid = Getprocesspid (strProcName); if (dwpid = = FALSE) return false;dwprocbase = Getprocessbaseandimagesize (Dwpid, & Dwimagesize); if (dwprocbase = = FALSE) return false;printf ("\nbase address = 0x%08X, pid =%d, ImageSize =%d ... \ n",   Dwprocbase, Dwpid, dwimagesize); The first module is the process base//dump process image Handle hproc = OpenProcess (Process_vm_read, FALSE, Dwpid), if (hproc = = NULL) {printf ("Failed to Ope N%d process...\n ", dwpid); return false;} Dwimagesize = 0;//dwimagesize = getimagesize (hproc, dwprocbase);//if (dwimagesize = = 0)//return false;//printf ("Image Size:%d\n ", dwimagesize), char *procbuff = (char*) malloc (dwimagesize), if (ReadProcessMemory (Hproc, (char*) Dwprocbase, Procbuff, DWImageSize, NULL) = = 0) {printf ("LastError:%d\n", GetLastError ()); return false;} Char Strfile[max_path] = "dump."; strcat (strfile, strProcName); FILE *FP;FP = fopen (strfile, "WB"); Fwrite (Procbuff, dwimagesize, 1, FP); fclose (FP); if (procbuff! = NULL) free (procbuff); CloseHandle (hproc); Modifysectionheader (strfile); return true;} void Main (int argc, char** argv) {if (argc! = 2) {printf ("error argv...\n"); return;} printf ("Dump%s...\n", argv[1]);D umpprocess (argv[1]); System ("pause");

LORDPE Dump Process Memory implementation