线程回调

线程回调

监控线程创建和退出

PsSetCreateThreadNotifyRoutin
PsSetCreateThreadNotifyRoutineEx

0环驱动代码

#include <Ntifs.h>
// 导出未声明函数
PCHAR PsGetProcessImageFileName(PEPROCESS Process);
void PcreateProcessNotifyRoutine(
       HANDLE ParentId, // 父进程ID
       HANDLE ProcessId, // 当前进程ID
       BOOLEAN Create // 进程是创建,通知
)
{
       PEPROCESS Process, ParentProcess;
       if (Create)
       {
              PsLookupProcessByProcessId(ParentId, &ParentProcess);
              PsLookupProcessByProcessId(ProcessId, &Process);       
              DbgPrint("有进程创建:%s, 父进程为:%s\n",  PsGetProcessImageFileName(Process), PsGetProcessImageFileName(ParentProcess));
       }
       else
       {
              PsLookupProcessByProcessId(ProcessId, &Process);
              DbgPrint("有进程推出:%s\n", PsGetProcessImageFileName(Process));
       }
}
void PcreateProcessNotifyRoutineEx(
       PEPROCESS Process,
       HANDLE ProcessId,
       PPS_CREATE_NOTIFY_INFO CreateInfo
)
{
       // Ex 版本在 XP 上是没有的, 而且 Ex 函数信息比普通的多得多
       if (CreateInfo != NULL) // 如果进程被创建，CreateInfo会被赋值
       {
              DbgPrint("创建进程ID: %d, Name = %wZ\n, 父进程ID: %d\n", ProcessId,  CreateInfo->ImageFileName, CreateInfo->ParentProcessId);
              if (_stricmp(PsGetProcessImageFileName(Process), "calc.exe") == 0)  // 执行不区分大小写的字符串比较
              {
                     CreateInfo->CreationStatus = STATUS_UNSUCCESSFUL; // 如果为目标程序返回创建不成功
              }
       }
       else
       {
              DbgPrint("推出进程ID: %d, Name = %s\n", ProcessId,  PsGetProcessImageFileName(Process));
       }
}
void PcreateThreadNotifyRoutine(
       HANDLE ProcessId,
       HANDLE ThreadId,
       BOOLEAN Create
)
{
       PEPROCESS Process;
       if (Create != FALSE) // 有线程创建的话
       {
              PsLookupProcessByProcessId(ProcessId, &Process);
              DbgPrint("进程 %s 创建线程 %d \n",  PsGetProcessImageFileName(Process), ThreadId);
       }
       else
       {
              PsLookupProcessByProcessId(ProcessId, &Process);
              DbgPrint("进程 %s 的线程 %d 退出\n",  PsGetProcessImageFileName(Process), ThreadId);
       }
}
VOID Unload(IN PDRIVER_OBJECT DriverObject)
{
       // 取消进程创建和推出的消息通知函数
       //PsSetCreateProcessNotifyRoutine(PcreateProcessNotifyRoutine/*消息通知回调函数*/, TRUE/*FALSE为注册, TRUE为取消*/);
       //PsSetCreateProcessNotifyRoutineEx(PcreateProcessNotifyRoutineEx, TRUE);
       // 取消线程创建和推出的消息通知函数
       PsRemoveCreateThreadNotifyRoutine(PcreateThreadNotifyRoutine);
       DbgPrint("卸载驱动\n");
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING   RegeditPath)
{
       DbgPrint("加载驱动\n");
       NTSTATUS status = STATUS_SUCCESS;
       DriverObject->DriverUnload = Unload;
       // 注册进程创建和推出的消息通知函数
       //PsSetCreateProcessNotifyRoutine(PcreateProcessNotifyRoutine/*消息通知回调函数*/, FALSE/*FALSE为注册, TRUE为取消*/);
       // 注册进程创建和推出的消息通知函数Ex版
       /*status = PsSetCreateProcessNotifyRoutineEx(PcreateProcessNotifyRoutineEx,  FALSE);
       if (!NT_SUCCESS(status))
       {
              DbgPrint("失败%x\n", status);
       }*/
       // 注册线程创建和推出的消息通知函数
       PsSetCreateThreadNotifyRoutine(PcreateThreadNotifyRoutine/*通知回调函数*/);
       return status;
}