这几天在编写个后门，利用远程线程注入，每次要查看指定进程的加载模块，要反复人工查找，很麻烦，便借鉴pmc工具，自己动手编写了一个获取进程模块、和pid的控制台程序，这里与联盟的同志一起分享
功能:
1, getpid ... 获取进程pid
2, getpid -l 获取进程列表
3, getpid -m processname 获取进程加载的所有模块
4, getpid -c processname dllname 判断某模块是否被进程加载
Last edited by rs369007 on 2010-3-11 at 19:38 ]
可以使用
wmic process get
直接获取更多有关进程的信息，也可以对其属性（CSName,CommandLine,Description,ExecutablePath,ExecutionState,Handle,HandleCount,InstallDate,KernelModeTime,MaximumWorkingSetSize,MinimumWorkingSetSize,Name,OSName,OtherOperationCount,OtherTransferCount,PageFaults,PageFileUsage,ParentProcessId,PeakPageFileUsage,PeakVirtualSize,PeakWorkingSetSize,Priority,PrivatePageCount,ProcessId,QuotaNonPagedPoolUsage,QuotaPagedPoolUsage,QuotaPeakNonPagedPoolUsage,QuotaPeakPagedPoolUsage,ReadOperationCount,ReadTransferCount,SessionId,Status,TerminationDate,ThreadCount,UserModeTime,VirtualSize,WindowsVersion,WorkingSetSize,WriteOperationCount,WriteTransferCount）
进行指定查询
例如要只查询进程qq.exe的绝对路径,可运行
wmic process get Caption,commandline | findstr /b /i "qq.exe"
Last edited by Hanyeguxing on 2010-3-12 at 15:32 ]
Options:
-h to get help infomation.
-l to list all the process and it's pid.
-c to check if the specified dll just in the process.
-load to inject one dll into a process.
-free to free the specified dll from a process.
-m processname to list All the Modules in a Process.
Usage: getpid ...
getpid -l.
getpid -m processname or processname -m.
getpid -c processname dllname
getpid -load notepad.exe c:\test.dll
getpid -free notepad.exe test.dll.
Remarks:
when you specified -load , you have to use full
path for the dll. otherwise, unknown errors maybe ...
Last edited by rs369007 on 2010-3-12 at 15:35 ]
getpid.rar (2010-3-11 19:37, 6.5 KiB,下载次数： 40)