• 枚举进程句柄File,Section,Mutant,Timer关闭Mutex句柄实现游戏多开

    标 题: 枚举进程句柄File,Section,Mutant,Timer关闭Mutex句柄实现游戏多开
    作 者: Y4ng
    时 间: 2012-09-06 19:50:32 星期四
    链 接: http://www.cnblogs.com/Y4ng/archive/2012/09/06/EnumProcessHandle_EnumMutex.html

       相信做过游戏多开的朋友就会发现，很多游戏普遍使用互斥mutex来防止程序多开，说实话这种方式已经非常OUT了。但是由于时间和技术的沉淀关系，留下来的游戏依然会存在这种方式。 最近接触到一款游戏是N前非常火热的对战游戏，可以称为经典之作；它就是用的Mutant来实现游戏防止多开的，一般咱们测试的时候都是用Xuetr来关闭游戏，但是要作为成品发布不可能要求客户拿Xuetr来列进程对象句柄，关句柄吧~

       网上搜索了半天都没有找到枚举进程句柄的例子，经过群里的大牛提点指到 ZwQuerySystemInformation SystemHandleInformation 可以实现句柄枚举功能；经过一番搜索编码测试 于是有了本文代码；

      1 /*头文件声明*/
  2 typedef LONG NTSTATUS;
  3 #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
  4 #define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
  5 
  6 typedef enum _SYSTEM_INFORMATION_CLASS {
  7     SystemBasicInformation,              // 0        Y        N
  8     SystemProcessorInformation,          // 1        Y        N
  9     SystemPerformanceInformation,        // 2        Y        N
 10     SystemTimeOfDayInformation,          // 3        Y        N
 11     SystemNotImplemented1,               // 4        Y        N
 12     SystemProcessesAndThreadsInformation, // 5       Y        N
 13     SystemCallCounts,                    // 6        Y        N
 14     SystemConfigurationInformation,      // 7        Y        N
 15     SystemProcessorTimes,                // 8        Y        N
 16     SystemGlobalFlag,                    // 9        Y        Y
 17     SystemNotImplemented2,               // 10       Y        N
 18     SystemModuleInformation,             // 11       Y        N
 19     SystemLockInformation,               // 12       Y        N
 20     SystemNotImplemented3,               // 13       Y        N
 21     SystemNotImplemented4,               // 14       Y        N
 22     SystemNotImplemented5,               // 15       Y        N
 23     SystemHandleInformation,             // 16       Y        N
 24     SystemObjectInformation,             // 17       Y        N
 25     SystemPagefileInformation,           // 18       Y        N
 26     SystemInstructionEmulationCounts,    // 19       Y        N
 27     SystemInvalidInfoClass1,             // 20
 28     SystemCacheInformation,              // 21       Y        Y
 29     SystemPoolTagInformation,            // 22       Y        N
 30     SystemProcessorStatistics,           // 23       Y        N
 31     SystemDpcInformation,                // 24       Y        Y
 32     SystemNotImplemented6,               // 25       Y        N
 33     SystemLoadImage,                     // 26       N        Y
 34     SystemUnloadImage,                   // 27       N        Y
 35     SystemTimeAdjustment,                // 28       Y        Y
 36     SystemNotImplemented7,               // 29       Y        N
 37     SystemNotImplemented8,               // 30       Y        N
 38     SystemNotImplemented9,               // 31       Y        N
 39     SystemCrashDumpInformation,          // 32       Y        N
 40     SystemExceptionInformation,          // 33       Y        N
 41     SystemCrashDumpStateInformation,     // 34       Y        Y/N
 42     SystemKernelDebuggerInformation,     // 35       Y        N
 43     SystemContextSwitchInformation,      // 36       Y        N
 44     SystemRegistryQuotaInformation,      // 37       Y        Y
 45     SystemLoadAndCallImage,              // 38       N        Y
 46     SystemPrioritySeparation,            // 39       N        Y
 47     SystemNotImplemented10,              // 40       Y        N
 48     SystemNotImplemented11,              // 41       Y        N
 49     SystemInvalidInfoClass2,             // 42
 50     SystemInvalidInfoClass3,             // 43
 51     SystemTimeZoneInformation,           // 44       Y        N
 52     SystemLookasideInformation,          // 45       Y        N
 53     SystemSetTimeSlipEvent,              // 46       N        Y
 54     SystemCreateSession,                 // 47       N        Y
 55     SystemDeleteSession,                 // 48       N        Y
 56     SystemInvalidInfoClass4,             // 49
 57     SystemRangeStartInformation,         // 50       Y        N
 58     SystemVerifierInformation,           // 51       Y        Y
 59     SystemAddVerifier,                   // 52       N        Y
 60     SystemSessionProcessesInformation    // 53       Y        N
 61 } SYSTEM_INFORMATION_CLASS;
 62 
 63 typedef struct _CLIENT_ID
 64 {
 65     HANDLE UniqueProcess;
 66     HANDLE UniqueThread;
 67 }CLIENT_ID,*PCLIENT_ID;
 68 
 69 typedef struct
 70 {
 71     USHORT Length;
 72     USHORT MaxLen;
 73     USHORT *Buffer;
 74 }UNICODE_STRING, *PUNICODE_STRING;
 75 
 76 typedef struct _OBJECT_ATTRIBUTES 
 77 {
 78     ULONG Length;
 79     HANDLE RootDirectory;
 80     PUNICODE_STRING ObjectName;
 81     ULONG Attributes;
 82     PVOID SecurityDescriptor;
 83     PVOID SecurityQualityOfService;
 84 } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; 
 85 
 86 typedef struct _IO_COUNTERSEX {
 87     LARGE_INTEGER ReadOperationCount;
 88     LARGE_INTEGER WriteOperationCount;
 89     LARGE_INTEGER OtherOperationCount;
 90     LARGE_INTEGER ReadTransferCount;
 91     LARGE_INTEGER WriteTransferCount;
 92     LARGE_INTEGER OtherTransferCount;
 93 } IO_COUNTERSEX, *PIO_COUNTERSEX;
 94 
 95 typedef enum {
 96     StateInitialized,
 97     StateReady,
 98     StateRunning,
 99     StateStandby,
100     StateTerminated,
101     StateWait,
102     StateTransition,
103     StateUnknown
104 } THREAD_STATE;
105 
106 typedef struct _VM_COUNTERS {
107     SIZE_T PeakVirtualSize;
108     SIZE_T VirtualSize;
109     ULONG PageFaultCount;
110     SIZE_T PeakWorkingSetSize;
111     SIZE_T WorkingSetSize;
112     SIZE_T QuotaPeakPagedPoolUsage;
113     SIZE_T QuotaPagedPoolUsage;
114     SIZE_T QuotaPeakNonPagedPoolUsage;
115     SIZE_T QuotaNonPagedPoolUsage;
116     SIZE_T PagefileUsage;
117     SIZE_T PeakPagefileUsage;
118 } VM_COUNTERS;
119 typedef VM_COUNTERS *PVM_COUNTERS;
120 
121 typedef struct _SYSTEM_THREADS {
122     LARGE_INTEGER KernelTime;
123     LARGE_INTEGER UserTime;
124     LARGE_INTEGER CreateTime;
125     ULONG WaitTime;
126     PVOID StartAddress;
127     CLIENT_ID ClientId;
128     ULONG Priority;
129     ULONG BasePriority;
130     ULONG ContextSwitchCount;
131     THREAD_STATE State;
132     ULONG WaitReason;
133 } SYSTEM_THREADS, *PSYSTEM_THREADS;
134 
135 typedef struct _SYSTEM_PROCESSES { // Information Class 5
136     ULONG NextEntryDelta;
137     ULONG ThreadCount;
138     ULONG Reserved1[6];
139     LARGE_INTEGER CreateTime;
140     LARGE_INTEGER UserTime;
141     LARGE_INTEGER KernelTime;
142     UNICODE_STRING ProcessName;
143     ULONG BasePriority;
144     ULONG ProcessId;
145     ULONG InheritedFromProcessId;
146     ULONG HandleCount;
147     ULONG Reserved2[2];
148     VM_COUNTERS VmCounters;
149     IO_COUNTERSEX IoCounters;  // Windows 2000 only
150     SYSTEM_THREADS Threads[1];
151 } SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
152 
153 typedef struct _SYSTEM_HANDLE_INFORMATION
154 {
155     ULONG            ProcessId;
156     UCHAR            ObjectTypeNumber;
157     UCHAR            Flags;
158     USHORT            Handle;
159     PVOID            Object;
160     ACCESS_MASK        GrantedAccess;
161 } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
162 
163 typedef enum _OBJECT_INFORMATION_CLASS {
164     ObjectBasicInformation,
165     ObjectNameInformation,
166     ObjectTypeInformation,
167     ObjectAllInformation,
168     ObjectDataInformation
169 } OBJECT_INFORMATION_CLASS;
170 
171 typedef struct _OBJECT_NAME_INFORMATION {
172     UNICODE_STRING Name;
173 } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
174 
175 typedef NTSTATUS (NTAPI *NTQUERYOBJECT)(
176                        _In_opt_   HANDLE Handle,
177                        _In_       OBJECT_INFORMATION_CLASS ObjectInformationClass,
178                        _Out_opt_  PVOID ObjectInformation,
179                        _In_       ULONG ObjectInformationLength,
180                        _Out_opt_  PULONG ReturnLength
181                        );
182 
183 
184 typedef NTSTATUS
185 (NTAPI *ZWQUERYSYSTEMINFORMATION)(
186                                   IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
187                                   OUT PVOID SystemInformation,
188                                   IN ULONG SystemInformationLength,
189                                   OUT PULONG ReturnLength OPTIONAL
190                                   );
191 ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(GetModuleHandle("ntdll.dll"),"ZwQuerySystemInformation");
192 NTQUERYOBJECT    NtQueryObject = (NTQUERYOBJECT)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtQueryObject");
      1 /*功能函数体*/
  2 int _tmain(int argc, _TCHAR* argv[])
  3 {
  4     DWORD dwSize = 0;
  5     PSYSTEM_HANDLE_INFORMATION pmodule = NULL;
  6     POBJECT_NAME_INFORMATION pNameInfo;
  7     POBJECT_NAME_INFORMATION pNameType;
  8     PVOID pbuffer = NULL;
  9     NTSTATUS Status;
 10     int nIndex = 0;
 11     DWORD dwFlags = 0;
 12     char szType[128] = {0};
 13     char szName[512] = {0};
 14 
 15     if(!ZwQuerySystemInformation)
 16     {
 17         goto Exit0;
 18     }
 19 
 20     pbuffer = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
 21 
 22     if(!pbuffer)
 23     {
 24         goto Exit0;
 25     }
 26 
 27     Status = ZwQuerySystemInformation(SystemHandleInformation, pbuffer, 0x1000, &dwSize);
 28 
 29     if(!NT_SUCCESS(Status))
 30     {
 31         if (STATUS_INFO_LENGTH_MISMATCH != Status)
 32         {
 33             goto Exit0;
 34         }
 35         else
 36         {
 37             // 这里大家可以保证程序的正确性使用循环分配稍好
 38             if (NULL != pbuffer)
 39             {
 40                 VirtualFree(pbuffer, 0, MEM_RELEASE);
 41             }
 42 
 43             if (dwSize*2 > 0x4000000)  // MAXSIZE
 44             {
 45                 goto Exit0;
 46             }
 47 
 48             pbuffer = VirtualAlloc(NULL, dwSize*2, MEM_COMMIT, PAGE_READWRITE);
 49 
 50             if(!pbuffer)
 51             {
 52                 goto Exit0;
 53             }
 54 
 55             Status = ZwQuerySystemInformation(SystemHandleInformation, pbuffer, dwSize*2, NULL);
 56 
 57             if(!NT_SUCCESS(Status))
 58             {
 59                 goto Exit0;    
 60             }
 61         }
 62     }
 63 
 64     pmodule = (PSYSTEM_HANDLE_INFORMATION)((PULONG)pbuffer+1);
 65     dwSize = *((PULONG)pbuffer);
 66 
 67     for(nIndex = 0; nIndex < dwSize; nIndex++)
 68     {
 69         
 70         Status = NtQueryObject((HANDLE)pmodule[nIndex].Handle, ObjectNameInformation, szName, 512, &dwFlags);
 71 
 72         if (!NT_SUCCESS(Status))
 73         {
 74             goto Exit0;
 75         }
 76 
 77         Status = NtQueryObject((HANDLE)pmodule[nIndex].Handle, ObjectTypeInformation, szType, 128, &dwFlags);
 78 
 79         if (!NT_SUCCESS(Status))
 80         {
 81             goto Exit0;
 82         }
 83 
 84         pNameInfo = (POBJECT_NAME_INFORMATION)szName;
 85         pNameType = (POBJECT_NAME_INFORMATION)szType;
 86 
 87         printf("%wZ   %wZ\n", pNameType, pNameInfo);
 88 
 89         // 匹配是否为需要关闭的句柄名称
 90         if (0 == wcscmp((wchar_t *)pNameType->Name.Buffer, L"Mutant"))
 91         {
 92             if (wcsstr((wchar_t *)pNameInfo->Name.Buffer, CLOSEMUTEXNAME))
 93             {
 94                 CloseHandle((HANDLE)pmodule[nIndex].Handle);
 95                 goto Exit0;
 96             }
 97         }
 98     }
 99 
100 Exit0:
101     if (NULL != pbuffer)
102     {
103         VirtualFree(pbuffer, 0, MEM_RELEASE);
104     }
105 
106     return 0;
107 }

    CLOSEMUTEXNAME 为互斥的句柄名称，需要为宽字节；

    程序执行结果如下：

    为了测试方便直接把程序写入了main函数中，大家使用的时候稍微修改便可， 不过！得理解程序意思才行啊。 copy代码不做思考的程序员不是好裁缝！

    参考文章列表：

    ZwQuerySystemInformation枚举内核模块及简单应用 http://hi.baidu.com/_achillis/item/8b33ead8ccac28ea3cc2cb17
  • 相关阅读:
    tritoninferenceserver
    GPU A10 driver, CUDA 安装
    TensorRT trtexec的用法说明
    nvidiasmi 命令参数含义
    Python3 执行系统命令并获取实时回显功能
    模型推理部署——基础概念篇
    docker 构建 TensorRT 指定版本 image
    9个写作技巧
    苹果 快捷指令Workflow
    Linux下编写mystat
  • 原文地址：https://www.cnblogs.com/Y4ng/p/EnumProcessHandle_EnumMutex.html
Copyright © 2020-2023  润新知