windows 如何获取进程入口点地址
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/8336214/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How can I get a process entry point address
提问by user1021319
I create a suspended process test.exelike this:
我创建了一个test.exe像这样的暂停进程：
CreateProcess(
TEXT( "C:\Documents and Settings\willy\桌面\project\test.exe" ),
TEXT( "test.exe" ),
NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi
);
How can I get the entry point/startup/main address for the process test.exeafter it has been created?
test.exe创建进程后，如何获取该进程的入口点/启动/主地址？
Should I look up PE file information or use API like ReadProcessMemory()or VirtualQueryEx()
我应该查找 PE 文件信息还是使用 API 之类的ReadProcessMemory()或VirtualQueryEx()
采纳答案by bdonlan
When you execute a process with CREATE_SUSPENDED, it starts out in ntdll initialization code. This is of little use for finding the .exe's entry point; you must examine the exe file's headers directly for this:
当您使用 执行进程时CREATE_SUSPENDED，它从 ntdll 初始化代码开始。这对于查找 .exe 的入口点几乎没有用；为此，您必须直接检查 exe 文件的标头：
#include <Windows.h>
#include <WinNT.h>
DWORD FindEntryPointAddress(_TCHAR *exeFile)
{
BY_HANDLE_FILE_INFORMATION bhfi;
HANDLE hMapping;
char *lpBase;
HANDLE hFile = CreateFile(exeFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
if (hFile == INVALID_HANDLE_VALUE)
fail("Opening exe file", GetLastError());
if (!GetFileInformationByHandle(hFile, &bhfi))
fail("GetFileInformationByHandle", GetLastError());
hMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, bhfi.nFileSizeHigh, bhfi.nFileSizeLow, NULL);
if (!hMapping)
fail("CreateFileMapping", GetLastError());
lpBase = (char *)MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, bhfi.nFileSizeLow);
if (!lpBase)
fail("MapViewOfFile", GetLastError());
PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)lpBase;
if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE)
fail("bad dos header signature", 0);
PIMAGE_NT_HEADERS32 ntHeader = (PIMAGE_NT_HEADERS32)(lpBase + dosHeader->e_lfanew);
if (ntHeader->Signature != IMAGE_NT_SIGNATURE)
fail("bad nt header signature", 0);
DWORD pEntryPoint = ntHeader->OptionalHeader.ImageBase + ntHeader->OptionalHeader.AddressOfEntryPoint;
UnmapViewOfFile((LPCVOID)lpBase);
CloseHandle(hMapping);
CloseHandle(hFile);
return pEntryPoint;
}
Note that this address is of the first code that executes after DLL initialization completes. It may not be (and usually isn't) equal to the address of mainor WinMain; it's usually some C library startup code statically linked into the EXE.
请注意，此地址是 DLL 初始化完成后执行的第一个代码的地址。它可能不（通常不）等于mainor的地址WinMain；它通常是一些静态链接到 EXE 的 C 库启动代码。
Also note that this will fail if the EXE is relocatable and ASLR is enabled, as the EXE may be loaded at a different base address. You'll have to find where the EXE base address is and use that instead of ntHeader->OptionalHeader.ImageBasein this case.
另请注意，如果 EXE 可重定位且启用了 ASLR，这将失败，因为 EXE 可能加载到不同的基地址。您必须找到 EXE 基地址的位置并使用它而不是ntHeader->OptionalHeader.ImageBase在这种情况下。
回答by Alexey Frunze
OK, I've hacked up a 32-bit only solution that gets the image base address from the process' PEB.
好的，我已经破解了一个仅 32 位的解决方案，它从进程的 PEB 中获取图像基址。
File EntryPt.c:
文件EntryPt.c:
#include <windows.h>
#include <tchar.h>
#include <psapi.h>
#include <stdio.h>
#include <stddef.h>
// To ensure correct resolution of symbols, add Psapi.lib to TARGETLIBS
// and compile with -DPSAPI_VERSION=1
NTSTATUS (NTAPI *pNtQueryInformationProcess)(HANDLE, /*enum _PROCESSINFOCLASS*/DWORD, PVOID, ULONG, PULONG) = NULL;
extern PVOID GetPeb(HANDLE ProcessHandle);
// PEB definition comes from winternl.h. This is a 32-bit PEB.
typedef struct _PEB
{
BYTE Reserved1[2];
BYTE BeingDebugged;
BYTE Reserved2[1];
PVOID Reserved3[2]; // Reserved3[1] points to PEB
/*
PPEB_LDR_DATA Ldr;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
BYTE Reserved4[104];
PVOID Reserved5[52];
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
BYTE Reserved6[128];
PVOID Reserved7[1];
ULONG SessionId;
*/
} PEB, *PPEB;
int main(int argc, TCHAR* argv[])
{
STARTUPINFO StartupInfo;
PROCESS_INFORMATION ProcessInfo;
PPEB pPeb;
PVOID pImage, pEntry;
PIMAGE_NT_HEADERS pNtHeaders;
LONG e_lfanew;
SIZE_T NumberOfBytesRead;
pNtQueryInformationProcess = (NTSTATUS(NTAPI*)(HANDLE, /*enum _PROCESSINFOCLASS*/DWORD, PVOID, ULONG, PULONG))
GetProcAddress(
GetModuleHandle(TEXT("ntdll.dll")),
TEXT("NtQueryInformationProcess"));
if (pNtQueryInformationProcess == NULL)
{
printf("GetProcAddress(ntdll.dll, NtQueryInformationProcess) failed with error 0x%08X\n",
GetLastError());
return -1;
}
memset(&StartupInfo, 0, sizeof(StartupInfo));
memset(&ProcessInfo, 0, sizeof(ProcessInfo));
if (!CreateProcess(
NULL,
(argc > 1) ? argv[1] : argv[0],
NULL,
NULL,
FALSE,
CREATE_SUSPENDED,
NULL,
NULL,
&StartupInfo,
&ProcessInfo))
{
printf("CreateProcess() failed with error 0x%08X\n", GetLastError());
return -1;
}
printf("Current process:\n");
pPeb = GetPeb(GetCurrentProcess());
printf("PEB: 0x%08X\n", pPeb);
pImage = pPeb->Reserved3[1];
printf("Image base: 0x%08X\n", pImage);
pNtHeaders = (PIMAGE_NT_HEADERS)((PCHAR)pImage + ((PIMAGE_DOS_HEADER)pImage)->e_lfanew);
pEntry = (PVOID)((PCHAR)pImage + pNtHeaders->OptionalHeader.AddressOfEntryPoint);
printf("Image entry point: 0x%08X\n", pEntry);
printf("\n");
printf("Child process:\n");
pPeb = GetPeb(ProcessInfo.hProcess);
printf("PEB: 0x%08X\n", pPeb);
if (!ReadProcessMemory(
ProcessInfo.hProcess,
&pPeb->Reserved3[1],
&pImage,
sizeof(pImage),
&NumberOfBytesRead) || NumberOfBytesRead != sizeof(pImage))
{
printf("ReadProcessMemory(&pImage) failed with error 0x%08X\n", GetLastError());
goto End;
}
printf("Image base: 0x%08X\n", pImage);
if (!ReadProcessMemory(
ProcessInfo.hProcess,
(PCHAR)pImage + offsetof(IMAGE_DOS_HEADER, e_lfanew),
&e_lfanew,
sizeof(e_lfanew),
&NumberOfBytesRead) || NumberOfBytesRead != sizeof(e_lfanew))
{
printf("ReadProcessMemory(&e_lfanew) failed with error 0x%08X\n", GetLastError());
goto End;
}
pNtHeaders = (PIMAGE_NT_HEADERS)((PCHAR)pImage + e_lfanew);
if (!ReadProcessMemory(
ProcessInfo.hProcess,
(PCHAR)pNtHeaders + offsetof(IMAGE_NT_HEADERS, OptionalHeader.AddressOfEntryPoint),
&pEntry,
sizeof(pEntry),
&NumberOfBytesRead) || NumberOfBytesRead != sizeof(pEntry))
{
printf("ReadProcessMemory(&pEntry) failed with error 0x%08X\n", GetLastError());
goto End;
}
pEntry = (PVOID)((PCHAR)pImage + (SIZE_T)pEntry);
printf("Image entry point: 0x%08X\n", pEntry);
End:
TerminateProcess(ProcessInfo.hProcess, 0);
CloseHandle(ProcessInfo.hThread);
CloseHandle(ProcessInfo.hProcess);
return 0;
}
File GetPeb.c:
文件GetPeb.c：
#include <ntddk.h>
extern NTSTATUS (NTAPI *pNtQueryInformationProcess)(
HANDLE ProcessHandle,
PROCESSINFOCLASS ProcessInformationClass,
PVOID ProcessInformation,
ULONG ProcessInformationLength,
PULONG ReturnLength);
PVOID GetPeb(HANDLE ProcessHandle)
{
NTSTATUS status;
PROCESS_BASIC_INFORMATION pbi;
PVOID pPeb;
memset(&pbi, 0, sizeof(pbi));
status = pNtQueryInformationProcess(
ProcessHandle,
ProcessBasicInformation,
&pbi,
sizeof(pbi),
NULL);
pPeb = NULL;
if (NT_SUCCESS(status))
{
pPeb = pbi.PebBaseAddress;
}
return pPeb;
}
Compiled with Open Watcom 1.9 via this batch file:
通过此批处理文件使用 Open Watcom 1.9 编译：
set INCLUDE=%INCLUDE%;%WATCOM%\H\NT;%WATCOM%\H\NT\DDK;
wcl386 /we /wx /q /d2 -DPSAPI_VERSION=1 EntryPt.c GetPeb.c %WATCOM%\lib386\nt\psapi.lib
Output (run on Windows XP):
输出（在 Windows XP 上运行）：
>EntryPt.exe
Current process:
PEB: 0x7FFDD000
Image base: 0x00400000
Image entry point: 0x004013E8
Child process:
PEB: 0x7FFDC000
Image base: 0x00400000
Image entry point: 0x004013E8
>EntryPt.exe calc.exe
Current process:
PEB: 0x7FFDC000
Image base: 0x00400000
Image entry point: 0x004013E8
Child process:
PEB: 0x7FFDB000
Image base: 0x01000000
Image entry point: 0x01012475
This code uses NtQueryInformationProcess()that may change in future versions of the OS. It also uses undocumented definitionof the PEB. This code won't work on 64-bit Windows unless modified appropriately (possibly taking into account WOW64) and it may not work with future versions of Windows.
此代码使用NtQueryInformationProcess()可能会在操作系统的未来版本中更改。它还使用未记录的PEB定义。除非适当修改（可能考虑到WOW64），否则此代码将无法在 64 位 Windows 上运行，并且它可能不适用于未来版本的 Windows。
