Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs may be hooked in order to avoid my tests.
My question is: Can I get that information without using APIs? I cannot find any details about how zwQueryInformationProcess() functions.
Have a look at the Process Environment Block (PEB)
API functions like zwQueryInformationProcess() parse the data from intern structures. Some of them may provide the information you need and you should be able to find them without utilizing API functions.
You can also get a lot of information from the file header im memory, TEBs (Thread Environment Blocks) or you try a level deeper: EPROCESS. The later is utilized at kernel level.
You can find a lot of resources about the internals of zwQueryInformationProcess because that information is undocumented. As nordwald said, detecting malware with zwQueryInformationProcess is possible, and more so in several ways but I would like to focus on something slightly different for this answer.
The general task of detecting malware in a process is usually pretty complex, specially when you aim to perform it generically and for multiple malware families. There are books about the topic and articles upon articles on related subjects. There are dozens if not hundreds of techniques malware can avoid detection, bypass protections and prevent analysis. There are multiple ways to avoid or mitigate most of those tricks and successfully detect malware samples that employ them. There's a huge market for malware detection with dozens of products attempting to detect and block viruses. Some would say that industry is falling behind of malware writers and it is generally quite feasible to make a malware FUD (fully undetected).
This is a huge domain with a lot of written material and aggregated knowledge.
Detecting malware is not something you could do with something as simple as using raw data instead of calling an API. Companies fail at doing that after investing millions of dollars, and much more.
I do not aim to discourage you from pursuing that or similar goals, I do however think you should make some effort at reading existing material to quickly further your understanding of the malware and anti-virus world, good luck!
ZwQueryInformationProcessis not an "API"?zwQueryInformationProcesscopy. You might be able to get some of the information it provides, but that depends on what info exactly you're interested in.