进程回调

进程回调

PsSetCreateProcessNotifyRoutine
PsSetCreateProcessNotifyRoutineEx

进程创建的监视

VOID ProcessMonitorRoutine(
  HANDLE ParentId, // 父进程ID
  HANDLE ProcessId, // 当前进程ID
  BOOLEAN Create // 进程是创建,通知
)
{
  PEPROCESS dwProcess, dwParentProcess;
  dwProcess = dwParentProcess = NULL;

  if (Create)
  {
    // 获取进程的 PEPROCESS
    PsLookupProcessByProcessId(ProcessId, &dwProcess);
    KdPrint(("有进程创建: %s\r, Cr3: %X\n", 
      PsGetProcessImageFileName(dwProcess), *(PULONG_PTR)((ULONG_PTR)dwProcess + 0x28)));
  }
  else {
    // 获取进程的 PEPROCESS
    PsLookupProcessByProcessId(ProcessId, &dwProcess);
    KdPrint(("有进程退出: %s\r\n", PsGetProcessImageFileName(dwProcess)));
  }
}

// 进程创建的监控
NTSTATUS LgHeaderClass::CreateProcessMonitor()
{
  NTSTATUS dwStatus = STATUS_SUCCESS;

  // 注册进程创建和推出的消息通知函数
  dwStatus = PsSetCreateProcessNotifyRoutine(ProcessMonitorRoutine, FALSE/* FALSE为创建回调函数 */);

  return dwStatus;
}

// 取消进程创建监控
VOID LgHeaderClass::DeleteProcessMonitor()
{
  PsSetCreateProcessNotifyRoutine(ProcessMonitorRoutine, TRUE/* TRUE为取消回调函数 */);
}

然后我们在主函数中调用：

LgHeaderClass * dwLg;
EXTERN_C VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
  KdPrint(("驱动卸载\r\n"));
  dwLg->DeleteProcessMonitor();
  delete dwLg;
}

EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING pReg)
{
  KdPrint(("驱动加载\r\n"));
  NTSTATUS dwStatus = STATUS_SUCCESS;
  DriverObject->DriverUnload = DriverUnload;

  dwLg = new LgHeaderClass();
  dwStatus = dwLg->CreateProcessMonitor();
  
  return dwStatus;
}

最后查看监控效果：

‍