内核进程监控线程监控

唉最近学习感觉有点学不懂了有点头蒙

都有点想放弃了最后还是坚持一下吧看内核看不懂了就去pwn 昨天确实有点瞎想了有些东西未来再说现在为时太早

然后今天搞得是内核进程监控

然后还是根据看雪分享的教程写的作者是 Tesla.Angela

然后

这里并非是 HOOKSSDT 而是用的

VOID CreateProcessNotifyEx(
__inout PEPROCESS Process, //新进程 EPROCESS
__in HANDLE ProcessId, //新进程 PID
__in_opt PPS_CREATE_NOTIFY_INFO CreateInfo //新进程详细信息（仅在创建进程时有效） );

然后这里就能看得出来获取了很多信息然后那个结构体是

typedef struct _PS_CREATE_NOTIFY_INFO {
SIZE_T Size;
union {
ULONG Flags;
struct {
ULONG FileOpenNameAvailable :1;
ULONG Reserved :31;
};
};
HANDLE ParentProcessId;
CLIENT_ID CreatingThreadId;
struct _FILE_OBJECT *FileObject;
PCUNICODE_STRING ImageFileName;
PCUNICODE_STRING CommandLine;
NTSTATUS CreationStatus; } PS_CREATE_NOTIFY_INFO, *PPS_CREATE_NOTIFY_INFO

如果想阻止创建进程那么直接，直接把此结构体的 CreationStatus 成员改为 STATUS_UNSUCCESSFUL 就行

比较可惜的是阻止线程的话很容易失败这里引用作者原话把

在通知回调函数的时候，线程尚未初始化完毕，使用 PsLookupThreadByThreadId 获得 ETHREAD 有时会失败，即使侥幸成功，也不能调用 PspTerminateThreadByPointer 来结束新线程，否则会蓝屏

然后下面是代码

#include <ntddk.h>
NTKERNELAPI PCHAR PsGetProcessImageFileName(PEPROCESS Process);
NTKERNELAPI NTSTATUS PsLookupProcessByProcessId(HANDLE ProcessId, PEPROCESS *Process);
PCHAR GetProcessByProcessId(HANDLE hProcess)
{
 NTSTATUS status = STATUS_SUCCESS;
 PEPROCESS Processobj = NULL;
 PCHAR string = NULL;
 status = PsLookupProcessByProcessId(hProcess, &Processobj);
 if (!NT_SUCCESS(status))
 {
  string = PsGetProcessImageFileName(Processobj);
  ObfDereferenceObject(Processobj);
 }
 return string;
}
VOID LookCreateProcess(
 __inout   PEPROCESS Process,
 __in      HANDLE ProcessId,
 __in_opt  PPS_CREATE_NOTIFY_INFO CreateInfo
 )
{
 NTSTATUS status;
 HANDLE hProcess; 
 OBJECT_ATTRIBUTES ob = { 0 };
 CLIENT_ID CilendID = { 0 };
 char ProcessName[16] = { 0 };
 if (CreateInfo != NULL)
 {
  KdPrint(("%ld %s 创建进程 %wZ",
  CreateInfo->ParentProcessId,
  GetProcessByProcessId(CreateInfo->ParentProcessId),
  CreateInfo->ImageFileName
  ));
  strcpy(ProcessName, PsGetProcessImageFileName(Process));
  if (_stricmp(ProcessName, "calc.exe"))
  {
   KdPrint(("听说你是计算器？？\n"));
   CreateInfo->CreationStatus = STATUS_UNSUCCESSFUL;
  }
 }
 else
 {
  KdPrint(("进程退出: %s", PsGetProcessImageFileName(Process)));
 }

}
VOID LookCreateThread(
 IN HANDLE  ProcessId,
 IN HANDLE  ThreadId,
 IN BOOLEAN  Create
 )
{
 if (Create)
  KdPrint(("线程创建! PID=%ld;TID=%ld", ProcessId, ThreadId));
 else
  KdPrint(("线程退出! PID=%ld;TID=%ld", ProcessId, ThreadId));
}
VOID Unload(PDRIVER_OBJECT pDriverObj)
{
 KdPrint(("拜拜！\n"));
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString)
{ 
 NTSTATUS status;
 status = PsSetCreateProcessNotifyRoutineEx((PCREATE_PROCESS_NOTIFY_ROUTINE_EX)LookCreateProcess, FALSE);
 KdPrint(("%x",status));
 status = PsSetCreateThreadNotifyRoutine(LookCreateThread);
 KdPrint(("%x", status));
 return STATUS_SUCCESS;
}

内核 进程监控 线程监控

内核进程监控线程监控