当前页面位置: » 丰搜网 » 文档中心 » 详细内容
走进windows 2000 内部(一)
--windows 源代码解读与发现
拿到 windows2000 的源代码有些日子了 , 业余时间就看看 , 总结出了一些东西 . 我先发表一些比较有实用价值的 , 希望能对大家的学习与工作有所帮助 . 如果大家觉得有必要 , 我会陆陆续续发表解读出来的一些东西与大家共同进步 .
这一次主要讲讲 user32 模块里的一些东西 .
首先 , 我们需要一个能访问内核内存的工具函数库 . 令我感到奇怪的是 ,user32 大量的代码在 kernel mode 下运行 . 不过那是 ms 的事 , 先说说这个工具函数库 . 我用 ddk 构建的它 . 很简单 . 有两个功能地 : 读 , 写内核内存 .
为了不偏离主题 , 只列出最后的函数原形
bool writesysmemroy(pvoid paddr , pvoid pbuff , dword dwlen);
bool readsysmemroy(pvoid pbuff , pvoid paddr , dword dwlen);
1 关于 threadinfo
先列出这个结构的原形
// 大部分都有注释 , 它们的意意慢慢说
typedef struct tagthreadinfo
{
//w32thread;
//ptl ptl; // listhead for thread lock list
// w32thread 和 ptl 是我所不知道的结构 , 通过 softice 的帮助 , 我知道了它们的大小 ,
// 于是我弄了个东东来填充它
padding(padding1 , 0x2c);
pvoid ppi; // process info struct for this thread
// type is pprocessinfo
pvoid rpdesk; // type is pdesktop
pdesktopinfo pdeskinfo; // desktop info visible to client
// type is pdesktopinfo
pclientinfo pclientinfo; // client info stored in teb
// type is pclientinfo
dword tif_flags; // tif_ flags go here.
punicode_string pstrappname; // application module name.
pvoid psmssent; // most recent sms this thread has sent
// type is psms
pvoid psmscurrent; // received sms this thread is currently processing
// type is psms
pvoid psmsreceivelist; // smss to be processed
// type is psms
long timelast; // time, position, and id of last message
ulong_ptr idlast;
int cquit;
int exitcode;
hdesk hdesk; // desktop handle
// hdesk
int cpaintsready;
uint ctimersready;
pvoid pmenustate; // type is pmenustate
union {
pvoid ptdb; // win16task schedule data for wow thread
// type is ptdb
pvoid pwinsta; // window station for system thread
// type is pwindowstation
};
pvoid psiilist; // thread ddeml instance list
// type is psvr_instance_info
dword dwexpwinver;
dword dwcompatflags; // the win 3.1 compat flags
dword dwcompatflags2; // new dword to extend compat flags for nt5+ features
pvoid pqattach; // calculation variabled used in
// type is pq
// zzzattachthreadinput()
pthreadinfo ptisibling; // pointer to sibling thread info
pvoid pmsd; // type is pmovesizedata
dword fshooks; // whf_ flags for which hooks are installed
phook sphkcurrent; // hook this thread is currently processing
// type is phook
pvoid psbtrack; // type is psbtrack
handle heventqueueclient;
pvoid peventqueueserver; // type is pkevent
pvoid ptilink; // link to other threads on desktop
// type is list_entry
int icursorlevel; // keep track of each thread's level
padding(padding2 , 4);
point ptlast;
pwnd spwnddefaultime; // default ime window for this thread
// type is pwnd
pvoid spdefaultimc; // default input context for this thread
// type is pimc
handle hklprev; // previous active keyboard layout
// type is hkl
int centercount;
mlist mlpost; // posted message list.
ushort fschangebitsremoved;// bits removed during peekmessage
wchar wchinjected; // character from last vk_packet
dword fsreservekeys; // keys that must be sent to the active
// active console window.
pvoid *apevent; // wait array for xxxpollandwaitforsingleobject
// type is pkevent
access_mask amdesk; // granted desktop access
uint cwindows; // number of windows owned by this thread
uint cviswindows; // number of visible windows on this thread
phook aphkstart[cwinhooks]; // hooks registered for this thread
// type is phook
byte cti; // use this when no desktop is available
// type is clientthreadinfo
}threadinfo ,* pthreadinfo;
这个结构用来保存线程的一些信息 , 它怎么得到呢 , 请看下面的代码
pthreadinfo winapi ntpticurrent(void)
{
pthreadinfo pti = null;
__asm
{
mov eax,fs:[00000018h]
mov eax,[eax+40h]
mov pti , eax ; 现在 pti 保存的就是当前线程的 threadinfo.
}
return pti;
}
知道这个结构很重要 , 下面我就说一个这个结构的应用 .
大家都知道 windows 的消息 hook 吧 , 下面这段代码可是让你的线程不被 hook, 也就是让 hook 失效
// 这个宏得到一个结构指针的成员地址
#define memaddr(p , s , m) (pvoid) ( (dword ) p + offsetof(s , m) )
pthreadinfo pti = ntpticurrent();
if (pti == null)
return false;
dword tif_flags;
if (!readsysmemroy(
&tif_flags ,
memaddr(pti , threadinfo , tif_flags) ,
sizeof(tif_flags))
)
return false;
tif_flags = 0x20000000;
return writesysmemroy(
memaddr(pti , threadinfo , tif_flags) ,
&tif_flags ,
sizeof(tif_flags)
);
原理很简单 , 就是设了一个标志 , 告诉 windows hook , 别来惹我
好了 , 先开个头 , 看看反响 , 如果可以的话 , 再接着说 .
