未公开函数 NtQuerySystemInfoMation 遍历进程信息,获得进程的用户名

#include <windows.h> 
#include <iostream>
#include <COMDEF.H> 
#include <stdio.h> 
#include <Tlhelp32.h>
using namespace std;


typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR   Buffer;
} UNICODE_STRING, * PUNICODE_STRING;

//SystemProcessInformation 
typedef struct _SYSTEM_PROCESS_INFORMATION
{
    DWORD             dwNextEntryOffset;
    DWORD             dwNumberOfThreads;
    LARGE_INTEGER     qSpareLi1;
    LARGE_INTEGER     qSpareLi2;
    LARGE_INTEGER     qSpareLi3;
    LARGE_INTEGER     qCreateTime;
    LARGE_INTEGER     qUserTime;
    LARGE_INTEGER     qKernelTime;
    UNICODE_STRING     ImageName;
    int                 nBasePriority;
    DWORD             dwProcessId;
    DWORD             dwInheritedFromUniqueProcessId;
    DWORD             dwHandleCount;
    DWORD             dwSessionId;
    ULONG             dwSpareUl3;
    SIZE_T             tPeakVirtualSize;
    SIZE_T             tVirtualSize;
    DWORD             dwPageFaultCount;
    DWORD             dwPeakWorkingSetSize;
    DWORD             dwWorkingSetSize;
    SIZE_T             tQuotaPeakPagedPoolUsage;
    SIZE_T             tQuotaPagedPoolUsage;
    SIZE_T             tQuotaPeakNonPagedPoolUsage;
    SIZE_T             tQuotaNonPagedPoolUsage;
    SIZE_T             tPagefileUsage;
    SIZE_T             tPeakPagefileUsage;
    SIZE_T             tPrivatePageCount;
    LARGE_INTEGER     qReadOperationCount;
    LARGE_INTEGER     qWriteOperationCount;
    LARGE_INTEGER     qOtherOperationCount;
    LARGE_INTEGER     qReadTransferCount;
    LARGE_INTEGER     qWriteTransferCount;
    LARGE_INTEGER     qOtherTransferCount;
}SYSTEM_PROCESS_INFORMATION;


/*----------------------------------------------------
       函数说明： 动态加载动库文件
           输入参数： pDllName 库文件名称，pProcName导出函数名字
           输出参数： 无
           返回值   ： 返回函数的的地址
----------------------------------------------------*/

VOID* GetDllProc(const TCHAR* pDllName, const CHAR* pProcName)
{
    HMODULE         hMod;
    hMod = LoadLibrary(pDllName);
    if (hMod == NULL)
        return NULL;

    return GetProcAddress(hMod, pProcName);
}

//宏定义函数的指针 
typedef LONG(WINAPI* Fun_NtQuerySystemInformation) (int   SystemInformationClass,
    OUT PVOID SystemInformation,
    IN ULONG SystemInformationLength,
    OUT ULONG* pReturnLength OPTIONAL);

typedef BYTE(WINAPI* Fun_WinStationGetProcessSid)(HANDLE hServer, DWORD   ProcessId,

    FILETIME   ProcessStartTime, PBYTE pProcessUserSid, PDWORD dwSidSize);

typedef VOID(WINAPI* Fun_CachedGetUserFromSid)(PSID pSid, PWCHAR pUserName, PULONG cbUserName);

#define STATUS_INFO_LENGTH_MISMATCH         ((LONG)0xC0000004L)

#define SystemProcessInformation         5 


/*------------------------------------------------------------------
     函数说明： 获取系统进程的信息
         输入参数： SYSTEM_PROCESS_INFORMATION
         输出参数： 无

--------------------------------------------------------------------*/
BOOL GetSysProcInfo(SYSTEM_PROCESS_INFORMATION * *ppSysProcInfo)
{
    Fun_NtQuerySystemInformation     _NtQuerySystemInformation;
    _NtQuerySystemInformation = (Fun_NtQuerySystemInformation)::GetDllProc(TEXT("NTDLL.DLL"), "NtQuerySystemInformation");
    if (_NtQuerySystemInformation == NULL)
        return FALSE;

    DWORD         dwSize = 1024 * 1024;
    VOID* pBuf = NULL;
    LONG         lRetVal;

    while(true)
    {
        if (pBuf)
            free(pBuf);

        pBuf = (VOID*)malloc(dwSize);

        lRetVal = _NtQuerySystemInformation(SystemProcessInformation,pBuf, dwSize, NULL);

        if (STATUS_INFO_LENGTH_MISMATCH != lRetVal)
            break;
        dwSize *= 2;
    }

    if (lRetVal == 0)
    {
        *ppSysProcInfo = (SYSTEM_PROCESS_INFORMATION*)pBuf;
        return TRUE;
    }
    free(pBuf);
    return FALSE;
}



BOOL GetProcessUser(DWORD dwPid, _bstr_t* pbStrUser)
{
    Fun_WinStationGetProcessSid         _WinStationGetProcessSid;
    Fun_CachedGetUserFromSid         _CachedGetUserFromSid;

    _WinStationGetProcessSid = (Fun_WinStationGetProcessSid)
        GetDllProc(TEXT("Winsta.dll"), "WinStationGetProcessSid");
    _CachedGetUserFromSid = (Fun_CachedGetUserFromSid)
        GetDllProc(TEXT("utildll.dll"), "CachedGetUserFromSid");

    if (_WinStationGetProcessSid == NULL || _CachedGetUserFromSid == NULL)
        return FALSE;

    BYTE         cRetVal;
    FILETIME     ftStartTime;
    DWORD         dwSize;
    BYTE* pSid;
    BOOL         bRetVal, bFind;
    SYSTEM_PROCESS_INFORMATION* pProcInfo, * pCurProcInfo;

    bRetVal = GetSysProcInfo(&pProcInfo);
    if (bRetVal == FALSE || pProcInfo == NULL)
        return FALSE;

    bFind = FALSE;
    pCurProcInfo = pProcInfo;
    for (;;)
    {
        if (pCurProcInfo->dwProcessId == dwPid)
        {
            memcpy(&ftStartTime, &pCurProcInfo->qCreateTime, sizeof(ftStartTime));
            bFind = TRUE;
            break;
        }

        if (pCurProcInfo->dwNextEntryOffset == 0)
            break;
        pCurProcInfo = (SYSTEM_PROCESS_INFORMATION*)((BYTE*)pCurProcInfo +
            pCurProcInfo->dwNextEntryOffset);
    }
    if (bFind == FALSE)
    {
        free(pProcInfo);
        return FALSE;
    }

    
    cRetVal = _WinStationGetProcessSid(NULL, dwPid, ftStartTime, NULL, &dwSize);
    if (cRetVal != 0)
        return FALSE;

    pSid = new BYTE[dwSize];
    cRetVal = _WinStationGetProcessSid(NULL, dwPid, ftStartTime, pSid, &dwSize);
    if (cRetVal == 0)
    {
        delete[] pSid;
        return FALSE;
    }

    WCHAR   szUserName[1024];
    
    _CachedGetUserFromSid(pSid, szUserName, &dwSize);
    delete[] pSid;
    if (dwSize == 0)
        return FALSE;

    *pbStrUser = szUserName;
    return TRUE;
}


int main()
{
    /*
    1.遍历所有进程.
    2.遍历这个进程下的所有模块.
    3.读取模块特征.
    4.结束掉这个进程.
    
    */
    //services.exe conhost.exe

    TCHAR szProcessName[] = TEXT("services.exe");
    BOOL bFind = FALSE;
    TCHAR ch[256] = { 0 };
    _bstr_t bs;
    memcpy(&bs, ch, sizeof(bs));

            GetProcessUser(pi.th32ProcessID, &bs); //第一个参数写的是你的进程ID 
            
}