Foro de elhacker.net

  Dim processEx As Process = System.Diagnostics.Process.GetProcessById(4080)
 
        For Each pT As ProcessThread In processEx.Threads
 
            Dim TID As IntPtr = pT.Id
            Dim StarAdress As IntPtr = pT.StartAddress
 
            ' aqui , por lo que investigue , se tiene que buscar la informacion de los simbolos o algo asi
            ' Usando la API dbghelp.dll
            ' Pero no hacer como hacerlo , tambien lei sobre otras cosas. como por ejemplo NtQueryInformationThread o algo asi
 
 
        Next

IntPtr hThread = OpenThread(0x0040, false, idHilo);

IntPtr startAddress = Marshal.AllocHGlobal(IntPtr.Size);
NtQueryInformationThread(hThread, 9, startAddress, IntPtr.Size, IntPtr.Zero);

CloseHandle(hThread);

 <DllImport("ntdll.dll", CharSet:=CharSet.Unicode, SetLastError:=True)>
    Public Shared Function NtQueryInformationThread(ByVal ThreadHandle As IntPtr, ByVal ThreadInformationClass As ThreadInfoClass, ByRef ThreadInformation As IntPtr, ByVal ThreadInformationLength As IntPtr, ByVal ReturnLength As IntPtr) As IntPtr
    End Function
 
    Public Enum ThreadInfoClass
        ThreadBasicInformation
        ThreadTimes
        ThreadPriority
        ThreadBasePriority
        ThreadAffinityMask
        ThreadImpersonationToken
        ThreadDescriptorTableEntry
        ThreadEnableAlignmentFaultFixup
        ThreadEventPair_Reusable
        ThreadQuerySetWin32StartAddress
        ThreadZeroTlsCell
        ThreadPerformanceCount
        ThreadAmILastThread
        ThreadIdealProcessor
        ThreadPriorityBoost
        ThreadSetTlsArrayAddress
        ThreadIsIoPending
        ThreadHideFromDebugger
        MaxThreadInfoClass
    End Enum

[DllImport("ntdll.dll", CharSet = CharSet.Unicode, SetLastError = true)]
static extern int NtQueryInformationThread(IntPtr ThreadHandle, ThreadInfoClass ThreadInformationClass, IntPtr ThreadInformation, int ThreadInformationLength, IntPtr ReturnLength);

HANDLE hProcess = GetCurrentProcess();
SymInitialize(hProcess, NULL, TRUE);
 
/* En C llamariamos a CreateToolhelp32Snapshot() y Module32First()/Module32Next() para obtener los modulos cargados.
En .NET creo que los obtienes directamente en Process.Modules */
For cada Modulo en proceso.Modules
	SymLoadModule64(hProcess, NULL, Modulo.FileName, Modulo.ModuleName, Modulo.BaseAddress, Modulo.ModuleMemorySize);
Next Modulo

/* En C, Thread32First()/Thread32Next(). En .NET, en la coleccion Threads */
IMAGEHLP_SYMBOL64 *pSym = NULL;
For cada thread en proceso.ProcessThreads
 

	HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, false, thread.id);
	CONTEXT context;
	context.ContextFlags = CONTEXT_FULL;
 
	// Comparar el id, NO el handle
	if (thread.id == System.Threading.Thread.CurrentThread.ManagedThreadId)
              RtlCaptureContext(&context);
	else {
              SuspendThread(hThread);
              GetThreadContext(hThread, &context);
              ResumeThread(hThread);
	}

       size_t startAddress;
 
       NtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, &startAddress, sizeof(startAddress), NULL);

       STACKFRAME64 sf64;
       sf64.AddrPC.Offset = context.Eip;
       sf64.AddrPC.Mode = AddrModeFlat;
       sf64.AddrFrame.Offset = context.Ebp;
       sf64.AddrFrame.Mode = AddrModeFlat;
       sf64.AddrStack.Offset = context.Esp;
       sf64.AddrStack.Mode = AddrModeFlat;
 
       StackWalk64(IMAGE_FILE_MACHINE_I386, hProcess, hThread, &sf64, &context, NULL, SymFunctionTableAccess64, SymGetModuleBase64, NULL);

       IMAGEHLP_MODULE64 module;
       memset(&module, 0, sizeof(module));
       module.SizeOfStruct = sizeof(module);
       SymGetModuleInfo64(hProcess, sf64.AddrPC.Offset, &module);
 

       IMAGEHLP_MODULE64 module;
       memset(&module, 0, sizeof(module));
       module.SizeOfStruct = sizeof(module);
       SymGetModuleInfo64(hProcess, startAddress, &module);
 

       if (!pSym) (IMAGEHLP_SYMBOL64*)malloc(sizeof(IMAGEHLP_SYMBOL64) + MAX_SYM_NAME * sizeof(TCHAR));
 
       memset(pSym, 0, sizeof(IMAGEHLP_SYMBOL64) + MAX_SYM_NAME);
       pSym->SizeOfStruct = sizeof(IMAGEHLP_SYMBOL64);
       pSym->MaxNameLength = MAX_SYM_NAME;
 
       SymGetSymFromAddr64(hProcess, startAddress, NULL, pSym);

	Console.WriteLine(module.ModuleName & "!" & pSym.Name & "+" (startAddress - pSym.Address).ToString("x"))
	CloseHandle(hThread);
Next thread
free(pSym);
 

miEjecutable!mainCRTStartup+0
ntdll!TpCallbackIndependent+140

   public static String GetThreadStartAddress(IntPtr hProc, uint threadId)
        {
            IntPtr hThread = IntPtr.Zero;
            GCHandle handle = default(GCHandle);
 
            try
            {
                hThread = DbgHelpNative.OpenThread(DbgHelpNative.ThreadAccess.QUERY_INFORMATION, false, threadId);
 
                if (hThread == IntPtr.Zero)
                {
                    throw new Win32Exception("OpenThread failed");
                }
 
                var threadAddress = new IntPtr[1];
 
                handle = GCHandle.Alloc(threadAddress, GCHandleType.Pinned);
                var result = NtQueryInformationThread(hThread, ThreadInfomationClass.threadquerysetwin32startaddress, handle.AddrOfPinnedObject(), IntPtr.Size, IntPtr.Zero);
 
                if (result != 0)
                {
                    throw new Win32Exception(string.Format("NtQueryInformationThread failed; NTSTATUS = {0:X8}", result));
                }
 
                DbgHelpNative.SymSetOptions(DbgHelpNative.Options.SYMOPT_UNDNAME | DbgHelpNative.Options.SYMOPT_DEFERRED_LOADS);
 
                if (!DbgHelpNative.SymInitialize(hProc, null, true))
                {
                    throw new Win32Exception("SymInitialize failed");
                }
 
                DbgHelpNative.SYMBOL_INFO symbolInfo = new DbgHelpNative.SYMBOL_INFO();
 
                symbolInfo.SizeOfStruct = (uint)Marshal.SizeOf(typeof(DbgHelpNative.SYMBOL_INFO)) - 1024;
 
                symbolInfo.MaxNameLen = 1024;
 
                ulong displacement;
 
                if (!DbgHelpNative.SymFromAddr(hProc, (ulong)threadAddress[0], out displacement, ref symbolInfo))
                {
                    throw new Win32Exception("SymFromAddr failed");
                }
                return symbolInfo.Name;
                //return threadAddress[0];
            }
            finally
            {
                if (hThread != IntPtr.Zero)
                {
                    DbgHelpNative.CloseHandle(hThread);
                }
 
                if (handle.IsAllocated)
                {
                    handle.Free();
                }
            }
        }

  if (!DbgHelpNative.SymFromAddr(hProc, (ulong)threadAddress[0], out displacement, ref symbolInfo))
                {
                    throw new Win32Exception("SymFromAddr failed");
                }

threadAddress[0] - module.BaseAddress

      if (!DbgHelpNative.SymFromAddr(hProc, (ulong)threadAddress[0], out displacement, ref symbolInfo))

                if (!DbgHelpNative.SymInitialize(hProc, null, true))
                {
                    throw new Win32Exception("SymInitialize failed");
                }

       [StructLayout(LayoutKind.Sequential)]
        public struct MODULEENTRY32
        {
            public uint dwSize;
            uint th32ModuleID;
            uint th32ProcessID;
            uint GlblcntUsage;
            uint ProccntUsage;
            public IntPtr modBaseAddr;
            public uint modBaseSize;
            IntPtr hModule;
            [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
            public string szModule;
            [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
            public string szExePath;
        }
 
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
        public static extern IntPtr CreateToolhelp32Snapshot(uint flags, uint processid);
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
        public static extern bool Module32First(IntPtr hSnapshot, ref MODULEENTRY32 lpme);
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
        public static extern bool Module32Next(IntPtr hSnapshot, ref MODULEENTRY32 lpme);

        private void get_process_thread_Click(object sender, EventArgs e)
        {
            Process proc = Process.GetProcessById(int.Parse(proc_txt.Text));
 
 
            // Los flags: TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32
            IntPtr hSnap = DbgHelpNative.CreateToolhelp32Snapshot(0x00000008 | 0x00000010, (uint)proc.Id);
 
            // INVALID_HANDLE_VALUE
            if ((long)hSnap == -1)
            {
                // Error
            }
 
            if (!DbgHelpNative.SymInitialize(proc.Handle, null, true))
            {
                throw new Win32Exception("SymInitialize failed");
            }
 
            DbgHelpNative.MODULEENTRY32 me = new DbgHelpNative.MODULEENTRY32();
 
            me.dwSize = (uint)Marshal.SizeOf(me);
 
            if (DbgHelpNative.Module32First(hSnap, ref me))
            {
                do
                {
                    if (0 == DbgHelpNative.SymLoadModule64(proc.Handle, IntPtr.Zero, me.szExePath, me.szModule, (ulong)me.modBaseAddr, (uint)me.modBaseSize))
                    {
                        /* Esta segunda verificacion es necesaria, ya que cuando SymLoadModule64
                         * devuelve 0, si TAMBIEN GetLastError es 0, simplemente significa
                         * que el modulo ya habia sido cargado*/
 
                        // En caso contrario, hay error
                        if (Marshal.GetLastWin32Error() != 0)
                        {
                            // Error: no se cargo el modulo
                        }
 
                    }
                } while (DbgHelpNative.Module32Next(hSnap, ref me));
            }
 
 
            ProcessThreadCollection procThread = proc.Threads;
            threadinfo_list.Items.Clear();
            int idx = 0;
            foreach (ProcessThread i in procThread)
            {
                threadinfo_list.Items.Add(i.Id.ToString());
                threadinfo_list.Items[idx].SubItems.Add(DbgHelp.GetThreadStartAddress(proc.Handle, (uint)i.Id));
                threadinfo_list.Items[idx].SubItems.Add(i.PriorityLevel.ToString());
                idx++;
            }
 
            DbgHelpNative.SymCleanup(proc.Handle);
            DbgHelpNative.CloseHandle(hSnap);
        }

 Private WithEvents _threadP As ThreadProvider = Nothing
 
    Private Sub buttonWalk_Click(sender As Object, e As EventArgs) Handles buttonWalk.Click
        Dim processEx As Process = System.Diagnostics.Process.GetProcessById(TextBox1.Text)
        listViewCallStack.Items.Clear()
 
        _threadP = New ThreadProvider(processEx.Id)
        _threadP.LoadKernelSymbols()
        _threadP.Run()
    End Sub
 
    Private Sub _threadP_BeforeUpdate() Handles _threadP.BeforeUpdate
        listViewCallStack.Items.Clear()
    End Sub
 
    Private Sub _threadP_ResolveSybol(sender As Object, e As ThreadProvider.ResolveSybolData) Handles _threadP.ResolveSybol
 
        Me.BeginInvoke(Sub()
                           Debug.WriteLine("TID: " & e.TID & "  StartAdress: " & e.ResolveInfo.Symbol)
                           Dim ItemN As New ListViewItem
                           ItemN.Text = e.TID
                           ItemN.SubItems.Add(e.ResolveInfo.Symbol)
                           listViewCallStack.Items.Add(ItemN)
                       End Sub)
 
    End Sub
 
    Private Sub _threadP_Error(ex As Exception) Handles _threadP.[Error]
        MsgBox(ex.Message)
    End Sub