EnumHideProcess(枚举隐藏进程源码)

爱民

1. 
   
2. //Author  :n0bele
   
3. //HomePage:bbs.chinapyg.com
   
4. 
   
5. #include<ntddk.h>
   
6. #include <windef.h>
   
7. #include "processenum.h"
   
8. ///////////////////////////不同的windows版本下面的偏移值不同
   
9. #define  EPROCESS_SIZE       0x0 //EPROCESS结构大小
   
10. #define  PEB_OFFSET          0x1
    
11. #define  FILE_NAME_OFFSET    0x2
    
12. #define  PROCESS_LINK_OFFSET 0x3
    
13. #define  PROCESS_ID_OFFSET   0x4
    
14. #define  EXIT_TIME_OFFSET    0x5
    
15. #define  OBJECT_HEADER_SIZE  0x018
    
16. #define  OBJECT_TYPE_OFFSET  0x008
    
17. //////////////////////////
    
18. #define PDE_INVALID 2
    
19. #define PTE_INVALID 1
    
20. #define VALID 0
    
21. 
    
22. Processinfo* pProcessPtr = NULL;
    
23. int nProcessCount = 0;
    
24. ULONG     pebAddress;         //PEB地址的前半部分
    
25. PEPROCESS pSystem;            //system进程
    
26. ULONG     pObjectTypeProcess; //进程对象类型
    
27. ULONG   VALIDpage(ULONG addr) ;  //该函数直接复制自 Ring0下搜索内存枚举隐藏进程
    
28. BOOLEAN IsaRealProcess(ULONG i); //该函数复制自 Ring0下搜索内存枚举隐藏进程
    
29. VOID    WorkThread(IN PVOID pContext);
    
30. //ULONG   GetPebAddress();          //得到PEB地址前半部分
    
31. VOID    EnumProcess();            //枚举进程
    
32. VOID    ShowProcess(ULONG pEProcess); //显示结果
    
33. DWORD GetPlantformDependentInfo(DWORD eprocessflag);
    
34. #define SYSNAME    "System"
    
35. ULONG ProcessNameOffset = 0; //进程名偏移量
    
36. ULONG   GetProcessNameOffset();
    
37. BOOLEAN GetProcess(PCHAR Name);
    
38. void EnumProcess2();
    
39. WCHAR gDeviceName[]=L"\\Device\\safepsenum";
    
40. WCHAR gDosDeviceName[]=L"\\??\\safepsenum";
    
41. NTSTATUS SafePsEnumCreate(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp);
    
42. NTSTATUS SafePsEnumClose(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp);
    
43. NTSTATUS
    
44. MyDeviceControl (
    
45.     IN PDEVICE_OBJECT   DeviceObject,
    
46.     IN PIRP             Irp );
    
47. /////////////////////////////////////////////////////////
    
48. VOID    OnUnload(IN PDRIVER_OBJECT DriverObject)
    
49. {
    
50. NTSTATUS status;
    
51. UNICODE_STRING DosDeviceName;
    
52. RtlInitUnicodeString(&DosDeviceName,gDosDeviceName);
    
53. if(DriverObject->DeviceObject)
    
54.   IoDeleteDevice(DriverObject->DeviceObject);
    
55. status = IoDeleteSymbolicLink(&DosDeviceName);
    
56. if(status)
    
57.   DbgPrint("IoDeleteSymbolicLink Return %0x\n",status);
    
58. if (pProcessPtr)
    
59. {
    
60.   ExFreePool(pProcessPtr);
    
61. }
    
62. }
    
63. /////////////////////////////////////////////////////////
    
64. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)
    
65. {
    
66. HANDLE hThread;
    
67. UNICODE_STRING DeviceName;
    
68. UNICODE_STRING DosDeviceName;
    
69. PDEVICE_OBJECT pDeviceObject=NULL;
    
70. NTSTATUS Status;
    
71. 
    
72. pSystem    = PsGetCurrentProcess();
    
73. // pebAddress = GetPebAddress();
    
74.     pebAddress = 0x7FFD0000;       //取了一个通用的低位地址
    
75. ProcessNameOffset = GetProcessNameOffset();
    
76. 
    
77. pObjectTypeProcess = *(PULONG)((ULONG)pSystem - OBJECT_HEADER_SIZE +OBJECT_TYPE_OFFSET);  
    
78. DbgPrint("type: %d \n", pObjectTypeProcess);
    
79. 
    
80. DriverObject -> DriverUnload = OnUnload;
    
81. DriverObject->MajorFunction[IRP_MJ_CREATE]         = SafePsEnumCreate;
    
82. DriverObject->MajorFunction[IRP_MJ_CLOSE]          = SafePsEnumClose;
    
83. DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = MyDeviceControl;
    
84. RtlInitUnicodeString(&DeviceName,gDeviceName);
    
85. RtlInitUnicodeString(&DosDeviceName,gDosDeviceName);
    
86. IoCreateDevice(DriverObject,0,&DeviceName,FILE_DEVICE_UNKNOWN,0,FALSE,&pDeviceObject);
    
87. pDeviceObject->Flags|=DO_BUFFERED_IO;
    
88. Status = IoCreateSymbolicLink(&DosDeviceName,&DeviceName);
    
89. if(Status)
    
90.   DbgPrint("IoCreateSymbolicLink Return %0x\n",Status);
    
91. 
    
92. nProcessCount = 0;
    
93. // 测试固定获取最大为1024
    
94. pProcessPtr =  ExAllocatePoolWithTag(NonPagedPool, 1024*sizeof(Processinfo), 'HpcM');
    
95. return STATUS_SUCCESS;
    
96. }
    
97. /////////////////////////////////////////////////////////
    
98. NTSTATUS SafePsEnumCreate(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
    
99. {
    
100.   Irp->iOStatus.Status = STATUS_SUCCESS;
     
101. Irp->IoStatus.Information = 0;
     
102. IoCompleteRequest(Irp,IO_NO_INCREMENT);
     
103. return STATUS_SUCCESS;
     
104. }
     
105. /////////////////////////////////////////////////////////
     
106. NTSTATUS SafePsEnumClose(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
     
107. {
     
108.   Irp->IoStatus.Status = STATUS_SUCCESS;
     
109. Irp->IoStatus.Information = 0;
     
110. IoCompleteRequest(Irp,IO_NO_INCREMENT);
     
111. return STATUS_SUCCESS;
     
112. }
     
113. /////////////////////////////////////////////////////////
     
114. /*
     
115. ULONG  GetPebAddress()
     
116. {
     
117. ULONG Address;
     
118. PEPROCESS pEProcess;
     
119. //由于system进程的peb总是零 我们只有到其他进程去找了
     
120. pEProcess = (PEPROCESS)((ULONG)((PLIST_ENTRY)((ULONG)pSystem + PROCESS_LINK_OFFSET))->Flink - PROCESS_LINK_OFFSET);
     
121. Address   = *(PULONG)((ULONG)pEProcess + PEB_OFFSET);
     
122. return (Address & 0xFFFF0000);  
     
123. }
     
124. */
     
125. ///////////////////////////////////////////////////////
     
126. VOID EnumProcess()
     
127. {
     
128. ULONG  uSystemAddress = (ULONG)pSystem;
     
129. ULONG  i;
     
130. ULONG  Address;
     
131. ULONG  ret;
     
132. nProcessCount = 0;
     
133. 
     
134. for(i = 0x80000000; i < uSystemAddress; i += 4) {//system进程的EPROCESS地址就是最大值了
     
135.   
     
136.   ret = VALIDpage(i);
     
137.   if (ret == VALID) {
     
138.    
     
139.    Address = *(PULONG)i;
     
140.    if (( Address & 0xFFFF0000) == 0x7FFD0000) {//每个进程的PEB地址都是在差不多的地方，地址前半部分是相同的      
     
141.    
     
142.     if(IsaRealProcess(i)) {
     
143.    
     
144.      ShowProcess(i - GetPlantformDependentInfo(PEB_OFFSET));
     
145.      i += GetPlantformDependentInfo(EPROCESS_SIZE);               
     
146.     }
     
147.    }
     
148.   }
     
149.   else if(ret == PTE_INVALID) {
     
150.    
     
151.    i -=4;
     
152.    i += 0x1000;//4k
     
153.   }
     
154.   else {
     
155.     i-=4;
     
156.     i+= 0x400000;//4mb
     
157.   }
     
158. }
     
159.   ShowProcess(uSystemAddress);//system的PEB总是零 上面的方法是枚举不到的 不过我们用PsGetCurrentProcess就能得到了
     
160. }
     
161. /////////////////////////////////////////////////////////
     
162. VOID    ShowProcess(ULONG pEProcess)
     
163. {
     
164. PLARGE_INTEGER ExitTime;
     
165. ULONG PID;
     
166. PUCHAR pFileName;
     
167. 
     
168. ExitTime = (PLARGE_INTEGER)(pEProcess + GetPlantformDependentInfo(EXIT_TIME_OFFSET));  
     
169. if(ExitTime->QuadPart != 0) //已经结束的进程的ExitTime为非零
     
170.   return ;
     
171. PID = *(PULONG)(pEProcess + GetPlantformDependentInfo(PROCESS_ID_OFFSET));
     
172. pFileName = (PUCHAR)(pEProcess + GetPlantformDependentInfo(FILE_NAME_OFFSET));
     
173.   pProcessPtr[nProcessCount].pEProcess = pEProcess;
     
174. pProcessPtr[nProcessCount].PId = PID;
     
175. strcpy(pProcessPtr[nProcessCount].Name, pFileName);  
     
176. nProcessCount++;
     
177. }
     
178. /////////////////////////////////////////////////////////////
     
179. ULONG VALIDpage(ULONG addr)
     
180. {
     
181. ULONG pte;
     
182. ULONG pde;
     
183. pde = 0xc0300000 + (addr>>22)*4;
     
184. if((*(PULONG)pde & 0x1) != 0){
     
185. //large page
     
186. if((*(PULONG)pde & 0x80) != 0){
     
187.   return VALID;
     
188. }
     
189. pte = 0xc0000000 + (addr>>12)*4;
     
190. if((*(PULONG)pte & 0x1) != 0){
     
191.   return VALID;
     
192. }else{
     
193.   return PTE_INVALID;
     
194. }
     
195. }
     
196. return PDE_INVALID;
     
197. }
     
198. ////////////////////////////////////////////////////////////////
     
199. BOOLEAN IsaRealProcess(ULONG i)
     
200. {
     
201. NTSTATUS STATUS;
     
202. PUNICODE_STRING pUnicode;
     
203. UNICODE_STRING Process;
     
204. ULONG pObjectType;
     
205. ULONG ObjectTypeAddress;
     
206. if (VALIDpage(i- GetPlantformDependentInfo(PEB_OFFSET)) != VALID){
     
207.   return FALSE;
     
208. }
     
209. ObjectTypeAddress = i - GetPlantformDependentInfo(PEB_OFFSET) - OBJECT_HEADER_SIZE + OBJECT_TYPE_OFFSET ;
     
210. if (VALIDpage(ObjectTypeAddress) == VALID){
     
211.   pObjectType = *(PULONG)ObjectTypeAddress;
     
212. }else{
     
213.   return FALSE;
     
214. }
     
215. if (pObjectTypeProcess == pObjectType){ //确定ObjectType是Process类型
     
216.   return TRUE;
     
217. }
     
218. return FALSE;
     
219. }
     
220. ////////////////////////////////////////////////////////////////////
     
221. #define  DWORD unsigned long
     
222. NTSTATUS
     
223. MyDeviceControl (
     
224.     IN PDEVICE_OBJECT   DeviceObject,
     
225.     IN PIRP             Irp
     
226.     )
     
227. {
     
228.     PIO_STACK_LOCATION  io_stack;
     
229.     NTSTATUS            status;
     
230. Irp->IoStatus.Information = 0;
     
231.     io_stack = IoGetCurrentIrpStackLocation(Irp);
     
232. if (io_stack->MajorFunction==IRP_MJ_DEVICE_CONTROL)
     
233. {
     
234.   switch (io_stack->Parameters.DeviceIoControl.IoControlCode)
     
235.   {
     
236.   case IOCTL_GETPROCESSPTR:
     
237.    {
     
238.      EnumProcess();
     
239.    // EnumProcess2();
     
240.     RtlCopyMemory((unsigned char*)Irp->UserBuffer, (unsigned char*)&nProcessCount, sizeof(DWORD));
     
241.     RtlCopyMemory((unsigned char*)Irp->UserBuffer+sizeof(DWORD), (unsigned char*)pProcessPtr, nProcessCount*sizeof(Processinfo));
     
242.     Irp->IoStatus.Information = nProcessCount*sizeof(Processinfo)+sizeof(DWORD);
     
243.    }
     
244.   }
     
245. }
     
246. Irp->IoStatus.Status = STATUS_SUCCESS;
     
247. IoCompleteRequest(Irp, IO_NO_INCREMENT);
     
248. return STATUS_SUCCESS;
     
249. }
     
250. //----------------------------------------------------------------------
     
251. //
     
252. // GetProcessNameOffset
     
253. //
     
254. // In an effort to remain version-independent, rather than using a
     
255. // hard-coded into the KPEB (Kernel Process Environment Block), we
     
256. // scan the KPEB looking for the name, which should match that
     
257. // of the GUI process
     
258. //
     
259. //----------------------------------------------------------------------
     
260. ULONG GetProcessNameOffset()
     
261. {
     
262.     PEPROCESS       curproc;
     
263.     int             i;
     
264.     DbgPrint(("GetProcessNameOffset\n"));
     
265.     curproc = PsGetCurrentProcess();
     
266.     //
     
267.     // Scan for 12KB, hopping the KPEB never grows that big!
     
268.     //
     
269.     for( i = 0; i < 3*PAGE_SIZE; i++ ) {
     
270.   if( !strncmp( SYSNAME, (PCHAR) curproc + i, strlen(SYSNAME) )) {
     
271.    DbgPrint("%d\n", i);
     
272.    return i;
     
273.   }
     
274. }
     
275. //
     
276. // Name not found - oh, well
     
277. //
     
278. DbgPrint("0\n");
     
279. return 0;
     
280. }
     
281. //----------------------------------------------------------------------
     
282. //
     
283. // GetProcess
     
284. //
     
285. // Uses undocumented data structure offsets to obtain the name of the
     
286. // currently executing process.
     
287. //
     
288. //----------------------------------------------------------------------
     
289. BOOLEAN GetProcess( PCHAR Name )
     
290. {
     
291. PEPROCESS curproc;
     
292. char *nameptr;
     
293. ULONG i;
     
294. //
     
295. // We only try and get the name if we located the name offset
     
296. //
     
297. if( ProcessNameOffset ) {
     
298.   curproc = PsGetCurrentProcess();
     
299.   nameptr = (PCHAR) curproc + ProcessNameOffset;
     
300.   strncpy( Name, nameptr, 16 );
     
301.   return TRUE;
     
302. } else {
     
303.   strcpy( Name, "???");
     
304.   return FALSE;
     
305. }
     
306. }
     
307. 
     
308. ////////////////////////////////////////////////////////////////////////
     
309. // EnumProcess2
     
310. #define BASE_PROCESS_PEB_OFFSET     0x01B0
     
311. #define BASE_PEB_PROCESS_PARAMETER_OFFSET  0x0010
     
312. #define BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME 0x003C
     
313. #define W2003_BASE_PROCESS_PEB_OFFSET   0x0190
     
314. #define W2003_BASE_PROCESS_PEB_OFFSET_SP1  0x01A0
     
315. #define VISTA_BASE_PROCESS_PEB_OFFSET   0x0188
     
316. 
     
317. void EnumProcess2()
     
318. {
     
319.    ULONG OsMajorVersion;
     
320.    ULONG OsMinorVersion ;
     
321.    DWORD dwAddress;
     
322.    PCWSTR Temp=NULL;
     
323.    ULONG uSystemAddress = (ULONG) pSystem;
     
324.    DWORD i;
     
325.    if (KeGetCurrentIrql() != PASSIVE_LEVEL) {
     
326.   return  ;
     
327.    }
     
328. 
     
329.    PsGetVersion( &OsMajorVersion,
     
330.     &OsMinorVersion,
     
331.     NULL,
     
332.     NULL );
     
333.    for(i = 0x80000000; i < uSystemAddress; i += 4) {//system进程的EPROCESS地址就是最大值了
     
334.     try {
     
335.      ULONG PID = 0;
     
336.      if ( *(DWORD*)(i+GetPlantformDependentInfo(PROCESS_ID_OFFSET)) == PID)
     
337.       continue;
     
338.      if (!IsaRealProcess(i))
     
339.       continue;
     
340.      dwAddress = i;
     
341. 
     
342.      if(dwAddress == 0 || dwAddress == 0xFFFFFFFF) {
     
343.      return  ;
     
344.      }
     
345.      //目前只支持Win 2000/xp/2003/VISTA
     
346.      if (OsMajorVersion < 5 || OsMinorVersion > 2 ) {
     
347.       return  ;
     
348.      }
     
349.      //取得PEB，不同平台的位置是不同的。
     
350.      //
     
351.      //2000   0X0500         XP 0X0501
     
352.      //
     
353.      if( OsMajorVersion == 5 && OsMinorVersion < 2) {
     
354.    
     
355.       dwAddress += BASE_PROCESS_PEB_OFFSET;
     
356.      }
     
357.      //
     
358.      //2003   0X0502
     
359.      //
     
360.      if (OsMajorVersion == 5 && OsMinorVersion ==2) {
     
361.        dwAddress += W2003_BASE_PROCESS_PEB_OFFSET;
     
362.      }
     
363.      //
     
364.      //VISTA   0X0600
     
365.      //
     
366.      if (OsMajorVersion == 6 && OsMinorVersion ==0) {
     
367.        dwAddress += VISTA_BASE_PROCESS_PEB_OFFSET;
     
368.      }
     
369.      if ((dwAddress = *(DWORD*)dwAddress) == 0) {
     
370.       continue;
     
371.      }
     
372.      //
     
373.      // 通过peb取得RTL_USER_PROCESS_PARAMETERS
     
374.      //
     
375.      dwAddress += BASE_PEB_PROCESS_PARAMETER_OFFSET;
     
376.      if((dwAddress = *(DWORD*)dwAddress) == 0) {
     
377.       continue;
     
378.      }
     
379.      //
     
380.      // 在RTL_USER_PROCESS_PARAMETERS->ImagePathName保存了路径，偏移为38,
     
381.      //
     
382.      dwAddress += BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME;
     
383.      if ((dwAddress = *(DWORD*)dwAddress) == 0) {
     
384.       continue;
     
385.      }
     
386.     // [10/14/2006]
     
387.      Temp=(PCWSTR)dwAddress;
     
388.      if (wcslen(Temp)>4) {
     
389.     if (Temp[0]==L'\\'&&
     
390.        Temp[1]==L'?'&&
     
391.        Temp[2]==L'?'&&
     
392.        Temp[3]==L'\\') {
     
393.        dwAddress+=8;
     
394.       }
     
395.       if (Temp[0]==L'\\'&&
     
396.        Temp[1]==L'\\'&&
     
397.        Temp[2]==L'?'&&
     
398.        Temp[3]==L'\\') {
     
399.        dwAddress+=8;
     
400.       }
     
401.       DbgPrint("%ws\n", dwAddress);
     
402.       i = dwAddress;
     
403.      }
     
404.     }
     
405.     except (EXCEPTION_EXECUTE_HANDLER) {
     
406.    try {
     
407.     if(OsMajorVersion == 5 && OsMinorVersion ==2) {
     
408.      dwAddress = (DWORD)PsGetCurrentProcess();
     
409.      dwAddress += W2003_BASE_PROCESS_PEB_OFFSET_SP1;
     
410.      if((dwAddress = *(DWORD*)dwAddress) == 0) {
     
411.         continue;
     
412.      }
     
413.      //
     
414.      // 通过peb取得RTL_USER_PROCESS_PARAMETERS
     
415.      //
     
416.      dwAddress += BASE_PEB_PROCESS_PARAMETER_OFFSET;
     
417.      if((dwAddress = *(DWORD*)dwAddress) == 0) {
     
418.         continue;
     
419.      }
     
420.      //
     
421.      // 在RTL_USER_PROCESS_PARAMETERS->ImagePathName保存了路径，偏移为38,
     
422.      //
     
423.      dwAddress += BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME;
     
424.      if((dwAddress = *(DWORD*)dwAddress) == 0) {
     
425.         continue;
     
426.      }
     
427.      // [10/14/2006]
     
428.      Temp=(PCWSTR)dwAddress;
     
429.      if (wcslen(Temp)>4) {
     
430.       if (Temp[0]==L'\\'&&
     
431.          Temp[1]==L'?'&&
     
432.          Temp[2]==L'?'&&
     
433.          Temp[3]==L'\\') {
     
434.          dwAddress+=8;
     
435.         }
     
436.         if (Temp[0]==L'\\'&&
     
437.          Temp[1]==L'\\'&&
     
438.          Temp[2]==L'?'&&
     
439.          Temp[3]==L'\\') {
     
440.          dwAddress+=8;
     
441.         }
     
442.      }
     
443.      DbgPrint("%ws\n", dwAddress);
     
444.      i = dwAddress;
     
445.     }
     
446.    }
     
447.    except (EXCEPTION_EXECUTE_HANDLER) {
     
448.    }     
     
449.     }
     
450.    }
     
451. }
     
452. DWORD GetPlantformDependentInfo(DWORD eprocessflag)
     
453. {
     
454. DWORD current_build;
     
455. DWORD ans = 0;
     
456. PsGetVersion(NULL, NULL, ¤t_build, NULL);
     
457. switch(eprocessflag){
     
458.   case EPROCESS_SIZE:
     
459.    if (current_build ==  2195) //2000
     
460.    {
     
461.     ans = 0x1FC;
     
462.    }
     
463.    if (current_build ==  2600) //XP
     
464.    {
     
465.     ans = 0x25C;
     
466.    }
     
467.    if (current_build ==  3790) //2003
     
468.    {
     
469.     ans = 0x270;   
     
470.    }
     
471.    break;
     
472.   case PEB_OFFSET:
     
473.    if (current_build ==  2195) //2000
     
474.    {
     
475.     ans = 0x09c;
     
476.    }
     
477.    if (current_build ==  2600) //XP
     
478.    {
     
479.     ans = 0x1b0;
     
480.    }
     
481.    if (current_build ==  3790) //2003
     
482.    {
     
483.     ans = 0x1a0;
     
484.    }
     
485.    break;
     
486.   case FILE_NAME_OFFSET:
     
487.    if (current_build ==  2195) //2000
     
488.    {
     
489.     ans = 0x09c;      
     
490.    }
     
491.    if (current_build ==  2600) //XP
     
492.    {
     
493.     ans = 0x174;
     
494.    }
     
495.    if (current_build ==  3790) //2003
     
496.    {
     
497.     ans = 0x164;
     
498.    }
     
499.    break;
     
500.   case PROCESS_LINK_OFFSET:
     
501.    if (current_build ==  2195) //2000
     
502.    {
     
503.     ans = 0x09c;      
     
504.    }
     
505.    if (current_build ==  2600) //XP
     
506.    {
     
507.     ans = 0x088;
     
508.    }
     
509.    if (current_build ==  3790) //2003
     
510.    {
     
511.     ans = 0x098;
     
512.    }
     
513.    break;
     
514.   case PROCESS_ID_OFFSET:
     
515.    if (current_build ==  2195) //2000
     
516.    {
     
517.     ans = 0x09c;      
     
518.    }
     
519.    if (current_build ==  2600) //XP
     
520.    {
     
521.     ans = 0x084;
     
522.    }
     
523.    if (current_build ==  3790) //2003
     
524.    {
     
525.     ans = 0x094;
     
526.    }
     
527.    break;
     
528.   case EXIT_TIME_OFFSET:
     
529.    if (current_build ==  2195) //2000
     
530.    {
     
531.     ans = 0x09c;      
     
532.    }
     
533.    if (current_build ==  2600) //XP
     
534.    {
     
535.     ans = 0x078;
     
536.    }
     
537.    if (current_build ==  3790) //2003
     
538.    {
     
539.     ans = 0x088;
     
540.    }
     
541.    break;
     
542.   default:
     
543.    break;
     
544. }
     
545. return ans;
     
546. }
     

复制代码