Keen的博客

记录所思、所想、所遇

欢迎来到我的个人站~


Process Monitor使用

1 监控应用程序启动退出模块加载卸载

1.1 控制台代码

#include "stdafx.h"
int main()
{
    return 0;
}

1.2 双击启动进程,explorer.exe做的事情

首先,双击动作是explorer.exe产生的,在真实执行到Process Create之前,还有一大堆操作,这里就省略了,大致包括过程如下:

1、检查文件后缀
2、检查是否支持筛选器SmartScreen
3、找到文件后缀打开方式注册表
HKCR\exefile\shell\open\command
(默认)              "%1" %*
IsolatedCommand     "%1" %*
注意这里的"%1" %*,注册表中%表示取参数,%1是第一个参数,这里是即将被打开的exe全路径。如果我们把这个路径替换成别的,比如c:\windows\notepad.exe,这样用explorer.exe启动(双击或者右键菜单-打开)任何程序,都将打开记事本,一种简单的启动劫持方法
4、找到进程的ICON
5、启动进程
explorer.exe	10768	5980	Process Create	G:\Project\ConsoleApplication1\Debug\ConsoleApplication1.exe	SUCCESS	PID: 5564, Command line: "G:\Project\ConsoleApplication1\Debug\ConsoleApplication1.exe" 
ConsoleApplication1.exe	5564	5980	Process Start		SUCCESS	Parent PID: 10768, Command line: "G:\Project\ConsoleApplication1\Debug\ConsoleApplication1.exe" , Current directory: G:\Project\ConsoleApplication1\Debug\, Environment: ... // 相关环境变量
ConsoleApplication1.exe	5564	5980	Thread Create		SUCCESS	Thread ID: 4624

这里5980是explorer.exe的当前线程ID,5564是新进程的进程ID

1.3 镜像加载及卸载过程

ConsoleApplication1.exe	5564	5980	Process Start		SUCCESS	Parent PID: 10768, Command line: "G:\Project\ConsoleApplication1\Debug\ConsoleApplication1.exe" , Current directory: G:\Project\ConsoleApplication1\Debug\, Environment: ... // (环境变量作为参数一次性传递)
ConsoleApplication1.exe	5564	5980	Thread Create		SUCCESS	Thread ID: 4624
ConsoleApplication1.exe	5564	4624	Load Image	G:\Project\ConsoleApplication1\Debug\ConsoleApplication1.exe	SUCCESS	Image Base: 0x180000, Image Size: 0x1e000
ConsoleApplication1.exe	5564	4624	Load Image	C:\Windows\System32\ntdll.dll	SUCCESS	Image Base: 0x770a0000, Image Size: 0x18f000
ConsoleApplication1.exe	5564	4624	Load Image	C:\Windows\System32\kernel32.dll	SUCCESS	Image Base: 0x77000000, Image Size: 0x98000
ConsoleApplication1.exe	5564	4624	Load Image	C:\Windows\System32\KernelBase.dll	SUCCESS	Image Base: 0x74410000, Image Size: 0x1e6000
ConsoleApplication1.exe	5564	4624	Process Create	C:\WINDOWS\System32\Conhost.exe	SUCCESS	PID: 3532, Command line: \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1
Conhost.exe	3532	4624	Process Start		SUCCESS	Parent PID: 5564, Command line: \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, Current directory: C:\WINDOWS, Environment: ... // (环境变量作为参数一次性传递)
Conhost.exe	3532	4624	Thread Create		SUCCESS	Thread ID: 4232
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\conhost.exe	SUCCESS	Image Base: 0x180000, Image Size: 0x74000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\ntdll.dll	SUCCESS	Image Base: 0x770a0000, Image Size: 0x18f000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\kernel32.dll	SUCCESS	Image Base: 0x77000000, Image Size: 0x98000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\KernelBase.dll	SUCCESS	Image Base: 0x74410000, Image Size: 0x1e6000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\msvcp_win.dll	SUCCESS	Image Base: 0x74160000, Image Size: 0x7d000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\ucrtbase.dll	SUCCESS	Image Base: 0x747d0000, Image Size: 0x11e000
Conhost.exe	3532	4232	Thread Create		SUCCESS	Thread ID: 10088
Conhost.exe	3532	10088	Thread Create		SUCCESS	Thread ID: 11724
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\SHCore.dll	SUCCESS	Image Base: 0x76cf0000, Image Size: 0x88000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\msvcrt.dll	SUCCESS	Image Base: 0x75730000, Image Size: 0xbf000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\rpcrt4.dll	SUCCESS	Image Base: 0x76d80000, Image Size: 0xc7000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\combase.dll	SUCCESS	Image Base: 0x75370000, Image Size: 0x25c000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\bcryptprimitives.dll	SUCCESS	Image Base: 0x74770000, Image Size: 0x58000
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\advapi32.dll	SUCCESS	Image Base: 0x74ac0000, Image Size: 0x78000
Conhost.exe	3532	11724	Thread Create		SUCCESS	Thread ID: 5300
Conhost.exe	3532	4232	Load Image	C:\Windows\System32\sechost.dll	SUCCESS	Image Base: 0x74b40000, Image Size: 0x44000
Conhost.exe	3532	36	Thread Create		SUCCESS	Thread ID: 1296
Conhost.exe	3532	4232	Thread Create		SUCCESS	Thread ID: 10412
Conhost.exe	3532	5300	Thread Exit		SUCCESS	Thread ID: 5300, User Time: 0.0000000, Kernel Time: 0.0000000
Conhost.exe	3532	11724	Thread Exit		SUCCESS	Thread ID: 11724, User Time: 0.0000000, Kernel Time: 0.0000000
Conhost.exe	3532	10088	Thread Exit		SUCCESS	Thread ID: 10088, User Time: 0.0000000, Kernel Time: 0.0000000
Conhost.exe	3532	4232	Thread Exit		SUCCESS	Thread ID: 4232, User Time: 0.0000000, Kernel Time: 0.0156250
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\user32.dll	SUCCESS	Image Base: 0x757f0000, Image Size: 0x174000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\win32u.dll	SUCCESS	Image Base: 0x74930000, Image Size: 0x1b000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\gdi32.dll	SUCCESS	Image Base: 0x76cc0000, Image Size: 0x22000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\gdi32full.dll	SUCCESS	Image Base: 0x74600000, Image Size: 0x167000
Conhost.exe	3532	10412	Thread Create		SUCCESS	Thread ID: 11968
Conhost.exe	3532	11968	Thread Create		SUCCESS	Thread ID: 6484
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\imm32.dll	SUCCESS	Image Base: 0x74b90000, Image Size: 0x26000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\shell32.dll	SUCCESS	Image Base: 0x75970000, Image Size: 0x134a000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\cfgmgr32.dll	SUCCESS	Image Base: 0x748f0000, Image Size: 0x39000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\windows.storage.dll	SUCCESS	Image Base: 0x73b50000, Image Size: 0x5ba000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\shlwapi.dll	SUCCESS	Image Base: 0x75320000, Image Size: 0x45000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\kernel.appcore.dll	SUCCESS	Image Base: 0x73b40000, Image Size: 0xf000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\profapi.dll	SUCCESS	Image Base: 0x73ac0000, Image Size: 0x18000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\powrprof.dll	SUCCESS	Image Base: 0x73af0000, Image Size: 0x45000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\fltLib.dll	SUCCESS	Image Base: 0x73ae0000, Image Size: 0x8000
Conhost.exe	3532	10412	Load Image	C:\Windows\System32\uxtheme.dll	SUCCESS	Image Base: 0x72070000, Image Size: 0x7c000
Conhost.exe	3532	10412	Thread Create		SUCCESS	Thread ID: 7188
Conhost.exe	3532	10412	Thread Create		SUCCESS	Thread ID: 9968
Conhost.exe	3532	9968	Load Image	C:\Windows\System32\msctf.dll	SUCCESS	Image Base: 0x76eb0000, Image Size: 0x143000
Conhost.exe	3532	9968	Load Image	C:\Windows\System32\oleaut32.dll	SUCCESS	Image Base: 0x751f0000, Image Size: 0x96000
Conhost.exe	3532	9968	Load Image	C:\Windows\System32\dwmapi.dll	SUCCESS	Image Base: 0x723d0000, Image Size: 0x23000
Conhost.exe	3532	9968	Load Image	C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17134.523_none_42edd4b044e3535c\comctl32.dll	SUCCESS	Image Base: 0x67920000, Image Size: 0x204000
Conhost.exe	3532	9968	Load Image	C:\Windows\System32\TextInputFramework.dll	SUCCESS	Image Base: 0x6d360000, Image Size: 0x7d000
Conhost.exe	3532	9968	Load Image	C:\Windows\System32\CoreMessaging.dll	SUCCESS	Image Base: 0x71ad0000, Image Size: 0xa6000
Conhost.exe	3532	11968	Load Image	C:\Windows\System32\CoreUIComponents.dll	SUCCESS	Image Base: 0x6cff0000, Image Size: 0x25d000
Conhost.exe	3532	11968	Thread Create		SUCCESS	Thread ID: 8848
Conhost.exe	3532	6484	Load Image	C:\Windows\System32\ntmarta.dll	SUCCESS	Image Base: 0x72de0000, Image Size: 0x29000
Conhost.exe	3532	8848	Load Image	C:\Windows\System32\WinTypes.dll	SUCCESS	Image Base: 0x70030000, Image Size: 0xd6000
Conhost.exe	3532	11968	Load Image	C:\Windows\System32\WinTypes.dll	SUCCESS	Image Base: 0x44a0000, Image Size: 0xd6000
Conhost.exe	3532	9968	Load Image	C:\Windows\System32\clbcatq.dll	SUCCESS	Image Base: 0x75290000, Image Size: 0x83000
ConsoleApplication1.exe	5564	4624	Thread Create		SUCCESS	Thread ID: 952
ConsoleApplication1.exe	5564	4624	Load Image	C:\Windows\System32\vcruntime140d.dll	SUCCESS	Image Base: 0x634c0000, Image Size: 0x1c000
ConsoleApplication1.exe	5564	4624	Load Image	C:\Windows\System32\ucrtbased.dll	SUCCESS	Image Base: 0xff00000, Image Size: 0x171000
ConsoleApplication1.exe	5564	4624	Load Image	C:\Windows\System32\kernel.appcore.dll	SUCCESS	Image Base: 0x73b40000, Image Size: 0xf000
ConsoleApplication1.exe	5564	4624	Load Image	C:\Windows\System32\msvcrt.dll	SUCCESS	Image Base: 0x75730000, Image Size: 0xbf000
ConsoleApplication1.exe	5564	4624	Load Image	C:\Windows\System32\rpcrt4.dll	SUCCESS	Image Base: 0x76d80000, Image Size: 0xc7000
ConsoleApplication1.exe	5564	4624	Thread Exit		SUCCESS	Thread ID: 4624, User Time: 0.0312500, Kernel Time: 0.0000000
ConsoleApplication1.exe	5564	952	Thread Exit		SUCCESS	Thread ID: 952, User Time: 0.0000000, Kernel Time: 0.0000000
ConsoleApplication1.exe	5564	952	Process Exit		SUCCESS	Exit Status: 0, User Time: 0.0312500 seconds, Kernel Time: 0.0000000 seconds, Private Bytes: 524,288, Peak Private Bytes: 524,288, Working Set: 2,306,048, Peak Working Set: 2,306,048
Conhost.exe	3532	11968	Thread Exit		SUCCESS	Thread ID: 11968, User Time: 0.0000000, Kernel Time: 0.0000000
Conhost.exe	3532	7188	Thread Exit		SUCCESS	Thread ID: 7188, User Time: 0.0000000, Kernel Time: 0.0000000
Conhost.exe	3532	9968	Thread Exit		SUCCESS	Thread ID: 9968, User Time: 0.0156250, Kernel Time: 0.0468750
Conhost.exe	3532	10412	Thread Exit		SUCCESS	Thread ID: 10412, User Time: 0.0000000, Kernel Time: 0.0156250
Conhost.exe	3532	6484	Thread Exit		SUCCESS	Thread ID: 6484, User Time: 0.0000000, Kernel Time: 0.0000000
Conhost.exe	3532	8848	Thread Exit		SUCCESS	Thread ID: 8848, User Time: 0.0000000, Kernel Time: 0.0000000
Conhost.exe	3532	1296	Thread Exit		SUCCESS	Thread ID: 1296, User Time: 0.0000000, Kernel Time: 0.0000000
Conhost.exe	3532	7188	Process Exit		SUCCESS	Exit Status: 0, User Time: 0.0156250 seconds, Kernel Time: 0.0781250 seconds, Private Bytes: 5,390,336, Peak Private Bytes: 5,828,608, Working Set: 13,242,368, Peak Working Set: 13,320,192

常规的加载模块,需要了解清楚,以便做病毒分析时,能迅速感知到异常模块加载。模块启动卸载过程依次:

ConsoleApplication1.exe:控制台主程序
ConsoleApplication1!ntdll.dll:内核打交道相关,比如LdrLoadDll
ConsoleApplication1!kernel32.dll:基本组件外壳,比如CopyFile、CreateProcess等,配合kernelBase.dll
ConsoleApplication1!KernelBase.dll:基本组件,比如CopyFile、CreateProcess等
Conhost.exe:控制台宿主程序,用于界面部分展示
Conhost!ntdll.dll
Conhost!kernel32.dll
Conhost!KernelBase.dll
Conhost!msvcp_win.dll:标准库std stream相关
Conhost!ucrtbase.dll:C运行时库,比如:strncpy
Conhost!SHCore.dll:Shell核心库,比如:CommandLineToArgv、SHDeleteKey
Conhost!msvcrt.dll:微软实现的C运行时库,比如:wprintf
Conhost!rpcrt4.dll:远程程序调用,用于对网络连接,比如:RpcServerListen
Conhost!combase.dll:COM组件接口,比如:CoInitializeEx
Conhost!bcryptprimitives.dll:大概是处理加密相关的,比如:GetAsymmetricEncryptionInterface
Conhost!advapi32.dll:跟核心组件exe交互的dll,以及一些事件日志性能监控等,比如:OpenSCManager、WmiQueryGuidInformation
Conhost!sechost.dll:服务相关,比如:StartService
Conhost!user32.dll:用户交互相关,比如:CreateWindowEx
Conhost!win32u.dll:内核界面交互相关,比如:NtGdiCreateSolidBrush
Conhost!gdi32.dll:图形绘制库,比如:CreateDC
Conhost!gdi32full.dll:图形绘制库,比如:CreateDC
Conhost!imm32.dll:输入法相关
Conhost!shell32.dll:Shell相关,比如:SHCreateDirectoryEx
Conhost!cfgmgr32.dll:设备交互相关,比如:CM_Setup_DevNode
Conhost!windows.storage.dll:WSS存储服务,大概是为了集群,例如:STORAGE_SHFileOperation
Conhost!kernel.appcore.dll:大概是Win10应用商店之类的程序要使用的
Conhost!profapi.dll:不晓得
Conhost!powrprof.dll:电源相关,例如:DevicePowerOpen
Conhost!fltLib.dll:过滤驱动调用相关,例如:FilterFindFirst
Conhost!uxtheme.dll:主题相关,例如:DrawThemeBackground
Conhost!msctf.dll:好像是系统输入法相关,可能是触屏输入法,例如:CtfNotifyIME
Conhost!oleaut32.dll:OLE组件相关,例如:OleIconToCursor
Conhost!dwmapi.dll:vista之后界面相关,毛玻璃、3d动画、高分辨率等,例如:DwmEnableComposition
Conhost!comctl32.dll:通用控件,例如:ImageList_Create
Conhost!TextInputFramework.dll:文本输入相关,例如:TextInputClientCreate
Conhost!CoreMessaging.dll:Win10下,处理系统组件交互的,例如:CoreUICreateEx
Conhost!CoreUIComponents.dll:可能也是Win10下处理UI组件相关,例如:CoreUIClientCreate
Conhost!ntmarta.dll:访问控制的,例如:AccConvertAccessToSD
Conhost!WinTypes.dll:UWP相关,例如:RoParseTypeName
Conhost!clbcatq.dll:COM+配置相关,例如:ComPlusMigrate
ConsoleApplication1!vcruntime140d.dll:VC运行时库,例如:__vcrt_GetModuleFileName
ConsoleApplication1!ucrtbased.dll
ConsoleApplication1!kernel.appcore.dll
ConsoleApplication1!msvcrt.dll
ConsoleApplication1!rpcrt4.dll

jpg

2、不同维度的性能分析工具

Procmon用于性能分析,主要是它的事件跟踪和统计特性,特别是统计特性。另外,它同时统计的是应用层和驱动层的事件信息,所以可以比较直观的观测到上下层谁的影响。

在Tools中,有几种统计方法:

(1)Process Active Summary:总图,有关进程的CPU占用情况、File Events总数及历史记录曲线、File I/O字节数、注册表Events总数及历史记录曲线、Network Events总数及历史记录曲线、内存使用情况。双击曲线中某个点,会自动跳转到对应的监控事件,这样,任何有波动的曲线,都能找到是由哪个event引起的,进一步查看回溯栈,可以找到最终影响性能的点

jpg

比如发现svchost大量文件IO,双击曲线中峰值点,发现是迅雷搞事情

jpg

(2)File Summary:文件操作情况,可以非常灵活的按照过滤,去选择自己关心的事件组合。按照文件操作耗时的排序,也方便的查看到性能影响点

jpg

图中可以看出,文件操作性能影响最大的,是Microsoft.photos.exe在大量的读写。当然,这个不能表达全部的性能影响,有时候,我们需要看的是单位时间的影响情况,这个就需要我们自己除时间运算,取平均看一下。

(3)Register Summary:注册表操作性能影响点,参考文件的

(4)Stack Summary:线程栈的性能影响,这个可以更加详细看到哪些API调用比较多,比较耗时等

jpg

(5)Network Summary:网络连接统计情况,包括字节数,这里主要关注的是流量

jpg
jpg

可以看到everything.exe在进行大量的数据包传输,仔细ping一下这个域名hub5btmain.sandai.net,发现是一个本地连接
jpg

(6)Cross Reference Summary:查看文件被交叉引用占用(读或者写操作)

jpg

(7)Count Occurrences:查看某种关键字的事件统计量,比如某进程事件总数、path总数

jpg

3、查看进程关系链

利用Procmon中的Tools里的Process Tree,可以方便查看到整个运行中的进程链(还可以包括退出的进程,这个是区别于Process Explorer)。通过这里的进程树,可以方便查看进程关系链,然后将整个关系链加入到Filter中

jpg

3 Procmon原理

运行时,会释放PROCMONX24.SYS等驱动文件到system32目录,监控信息本质是由驱动+ETW架构辅助完成
详细技术框架,未完待续

打赏一个呗

取消

感谢您的支持,我会继续努力的!

扫码支持
扫码支持
扫码打赏,你说多少就多少