@@ -564,15 +564,6 @@ function system_handleInfomation()
564
564
sizeof_SYSTEM_HANDLE_TABLE_ENTRY_INFO = 0x10 ;
565
565
}
566
566
567
- if ( 'x64' == process . arch )
568
- {
569
- entryBaseOffset = 8 ;
570
- }
571
- else
572
- {
573
- entryBaseOffset = 4 ;
574
- }
575
-
576
567
NumberOfHandles = lpBuffer . readUInt32LE ( 0 ) ;
577
568
578
569
for ( entryIndex = 0 ; entryIndex < NumberOfHandles ; entryIndex ++ )
@@ -598,25 +589,200 @@ function system_handleInfomation()
598
589
599
590
stHandleNode . HandleValue = lpBuffer . readUInt16LE ( entryBaseOffset + offset_SYSTEM_HANDLE_TABLE_ENTRY_INFO_HandleValue ) ;
600
591
592
+ stHandleNode . ObjectAddress = lpBuffer . readULONG_PTR ( entryBaseOffset + offset_SYSTEM_HANDLE_TABLE_ENTRY_INFO_Object ) ;
593
+
594
+ stHandleNode . GrantedAccess = lpBuffer . readUInt32LE ( entryBaseOffset + offset_SYSTEM_HANDLE_TABLE_ENTRY_INFO_GrantedAccess ) ;
595
+
596
+
597
+ // push node
598
+ handleArray . push ( stHandleNode ) ;
599
+ }
600
+
601
+ if ( lpBuffer )
602
+ {
603
+ lpBuffer . free ( ) ;
604
+ lpBuffer = null ;
605
+ }
606
+
607
+ return handleArray ;
608
+ }
609
+ exports . handleInfomation = system_handleInfomation ;
610
+
611
+
612
+ function fix_module_path ( arg_src_path )
613
+ {
614
+ if ( 0 == arg_src_path . length )
615
+ {
616
+ return arg_src_path ;
617
+ }
618
+
619
+ var windows_folder = process . env [ "SystemRoot" ] ;
620
+
621
+ var windows_folder_lower = windows_folder . toLowerCase ( ) ;
622
+
623
+ var src_path = arg_src_path . replace ( / \/ / g , "\\\\" ) ;
624
+ var src_path_lower = src_path . toLowerCase ( ) ;
625
+ var dest_path = '' ;
626
+
627
+ if ( 0 == src_path_lower . indexOf ( '\\systemroot\\' ) )
628
+ {
629
+ dest_path = windows_folder + src_path . substring ( 11 , src_path . length ) ;
630
+ }
631
+ else if ( 0 == src_path_lower . indexOf ( '\\??\\' ) )
632
+ {
633
+ dest_path = src_path . substring ( 4 , src_path . length ) ;
634
+ }
635
+ else if ( 0 == src_path_lower . indexOf ( '\\\\?\\' ) )
636
+ {
637
+ dest_path = src_path . substring ( 4 , src_path . length ) ;
638
+ }
639
+ else if ( 0 == src_path_lower . indexOf ( '\\windows\\' ) )
640
+ {
641
+ dest_path = windows_folder + src_path . substring ( 8 , src_path . length ) ;
642
+ }
643
+ else if ( 0 == src_path_lower . indexOf ( '\\program files\\' ) )
644
+ {
645
+ dest_path = process . env [ "SystemDrive" ] + src_path ;
646
+ }
647
+ else
648
+ {
649
+ dest_path = src_path ;
650
+ }
651
+
652
+ return dest_path ;
653
+ }
654
+
655
+ function system_moduleInformation ( )
656
+ {
657
+ var lpBuffer = null ;
658
+
659
+ var entryBaseOffset = 0 ;
660
+
661
+ var stModuleNode = { } ;
662
+ var moduleArray = [ ] ;
663
+
664
+ var NumberOfModules = 0 ;
665
+ var entryIndex = 0 ;
666
+
667
+ lpBuffer = helper_querySystemInfomation2 ( 11 , 1024 * 10 ) ;
668
+ if ( ! lpBuffer )
669
+ {
670
+ return moduleArray ;
671
+ }
672
+
673
+ // init offsets
674
+ var offset_RTL_PROCESS_MODULE_INFORMATION_Section = 0x00 ;
675
+
676
+ var offset_RTL_PROCESS_MODULE_INFORMATION_MappedBase = 0x00 ;
677
+
678
+ var offset_RTL_PROCESS_MODULE_INFORMATION_ImageBase = 0x00 ;
679
+
680
+ var offset_RTL_PROCESS_MODULE_INFORMATION_ImageSize = 0x00 ;
681
+
682
+ var offset_RTL_PROCESS_MODULE_INFORMATION_Flags = 0x00 ;
683
+
684
+ var offset_RTL_PROCESS_MODULE_INFORMATION_LoadOrderIndex = 0x00 ;
685
+
686
+ var offset_RTL_PROCESS_MODULE_INFORMATION_InitOrderIndex = 0x00 ;
687
+
688
+ var offset_RTL_PROCESS_MODULE_INFORMATION_LoadCount = 0x00 ;
689
+
690
+ var offset_RTL_PROCESS_MODULE_INFORMATION_OffsetToFileName = 0x00 ;
691
+
692
+ var offset_RTL_PROCESS_MODULE_INFORMATION_FullPathName = 0x00 ;
693
+
694
+ var sizeof_RTL_PROCESS_MODULE_INFORMATION = 0 ;
695
+
696
+
697
+ if ( 'x64' == process . arch )
698
+ {
699
+ offset_RTL_PROCESS_MODULE_INFORMATION_Section = 0x00 ;
700
+
701
+ offset_RTL_PROCESS_MODULE_INFORMATION_MappedBase = 0x08 ;
702
+
703
+ offset_RTL_PROCESS_MODULE_INFORMATION_ImageBase = 0x10 ;
704
+
705
+ offset_RTL_PROCESS_MODULE_INFORMATION_ImageSize = 0x18 ;
706
+
707
+ offset_RTL_PROCESS_MODULE_INFORMATION_Flags = 0x1C ;
708
+
709
+ offset_RTL_PROCESS_MODULE_INFORMATION_LoadOrderIndex = 0x20 ;
710
+
711
+ offset_RTL_PROCESS_MODULE_INFORMATION_InitOrderIndex = 0x22 ;
712
+
713
+ offset_RTL_PROCESS_MODULE_INFORMATION_LoadCount = 0x24 ;
714
+
715
+ offset_RTL_PROCESS_MODULE_INFORMATION_OffsetToFileName = 0x26 ;
716
+
717
+ offset_RTL_PROCESS_MODULE_INFORMATION_FullPathName = 0x28 ;
718
+
719
+ sizeof_RTL_PROCESS_MODULE_INFORMATION = 0x128 ;
720
+ }
721
+ else
722
+ {
723
+ offset_RTL_PROCESS_MODULE_INFORMATION_Section = 0x00 ;
724
+
725
+ offset_RTL_PROCESS_MODULE_INFORMATION_MappedBase = 0x04 ;
726
+
727
+ offset_RTL_PROCESS_MODULE_INFORMATION_ImageBase = 0x08 ;
728
+
729
+ offset_RTL_PROCESS_MODULE_INFORMATION_ImageSize = 0x0C ;
730
+
731
+ offset_RTL_PROCESS_MODULE_INFORMATION_Flags = 0x10 ;
732
+
733
+ offset_RTL_PROCESS_MODULE_INFORMATION_LoadOrderIndex = 0x14 ;
734
+
735
+ offset_RTL_PROCESS_MODULE_INFORMATION_InitOrderIndex = 0x16 ;
736
+
737
+ offset_RTL_PROCESS_MODULE_INFORMATION_LoadCount = 0x18 ;
738
+
739
+ offset_RTL_PROCESS_MODULE_INFORMATION_OffsetToFileName = 0x1A ;
740
+
741
+ offset_RTL_PROCESS_MODULE_INFORMATION_FullPathName = 0x1C ;
742
+
743
+ sizeof_RTL_PROCESS_MODULE_INFORMATION = 0x11C ;
744
+ }
745
+
746
+
747
+ NumberOfModules = lpBuffer . readUInt32LE ( 0 ) ;
748
+
749
+ for ( entryIndex = 0 ; entryIndex < NumberOfModules ; entryIndex ++ )
750
+ {
601
751
if ( 'x64' == process . arch )
602
752
{
603
- stHandleNode . ObjectAddress = lpBuffer . readUInt64LE ( entryBaseOffset + offset_SYSTEM_HANDLE_TABLE_ENTRY_INFO_Object ) ;
753
+ entryBaseOffset = 8 + entryIndex * sizeof_RTL_PROCESS_MODULE_INFORMATION ;
604
754
}
605
755
else
606
756
{
607
- stHandleNode . ObjectAddress = Number64 ( lpBuffer . readUInt32LE ( entryBaseOffset + offset_SYSTEM_HANDLE_TABLE_ENTRY_INFO_Object ) ) ;
757
+ entryBaseOffset = 4 + entryIndex * sizeof_RTL_PROCESS_MODULE_INFORMATION ;
608
758
}
759
+
760
+ stModuleNode = { } ;
761
+
762
+ //stModuleNode.Section = lpBuffer.readULONG_PTR( entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_Section );
763
+
764
+ //stModuleNode.MappedBase = lpBuffer.readULONG_PTR( entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_MappedBase );
609
765
610
- stHandleNode . GrantedAccess = lpBuffer . readUInt32LE ( entryBaseOffset + offset_SYSTEM_HANDLE_TABLE_ENTRY_INFO_GrantedAccess ) ;
766
+ stModuleNode . ImageBase = lpBuffer . readULONG_PTR ( entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_ImageBase ) ;
611
767
612
-
613
- // push node
614
- handleArray . push ( stHandleNode ) ;
768
+ stModuleNode . ImageSize = lpBuffer . readUInt32LE ( entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_ImageSize ) ;
769
+
770
+ stModuleNode . Flags = lpBuffer . readUInt32LE ( entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_Flags ) ;
615
771
616
- if ( entryIndex > 10 )
617
- {
618
- break ;
619
- }
772
+ stModuleNode . LoadOrderIndex = lpBuffer . readUInt16LE ( entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_LoadOrderIndex ) ;
773
+
774
+ //stModuleNode.InitOrderIndex = lpBuffer.readUInt16LE( entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_InitOrderIndex );
775
+
776
+ stModuleNode . LoadCount = lpBuffer . readUInt16LE ( entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_LoadCount ) ;
777
+
778
+ //stModuleNode.OffsetToFileName = lpBuffer.readUInt16LE( entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_OffsetToFileName );
779
+
780
+ stModuleNode . FullPathName = lpBuffer . toString ( 'ascii' , entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_FullPathName , entryBaseOffset + offset_RTL_PROCESS_MODULE_INFORMATION_FullPathName + 256 ) ;
781
+
782
+ stModuleNode . FullPathName = fix_module_path ( stModuleNode . FullPathName ) ;
783
+
784
+ // push node
785
+ moduleArray . push ( stModuleNode ) ;
620
786
}
621
787
622
788
if ( lpBuffer )
@@ -625,15 +791,16 @@ function system_handleInfomation()
625
791
lpBuffer = null ;
626
792
}
627
793
628
- return handleArray ;
794
+ return moduleArray ;
629
795
}
630
- exports . handleInfomation = system_handleInfomation ;
796
+ exports . system_moduleInformation = system_moduleInformation ;
797
+
798
+
631
799
632
800
function main ( )
633
801
{
634
802
635
- printf ( system_handleInfomation ( ) ) ;
636
-
803
+
637
804
return 0 ;
638
805
}
639
806
0 commit comments