作者:ZwelL
用PsSetCreateProcessNot
![](/icons/59535if.gif)
![](/icons/59535if.gif)
![](/icons/59535yi.gif)
![](/icons/59535yi.gif)
![](/icons/59535de.gif)
![](/icons/59535yi.gif)
![](/icons/59535yi.gif)
![](/icons/59535de.gif)
![](/icons/59535de.gif)
![](/icons/59535de.gif)
![](/icons/59535yinwei.gif)
![](/icons/59535hanshu.gif)
![](/icons/59535cuowu.gif)
![](/icons/59535yi.gif)
![](/icons/59535de.gif)
![](/icons/59535yi.gif)
![](/icons/59535hanshu.gif)
![](/icons/59535if.gif)
![](/icons/59535hanshu.gif)
![](/icons/59535de.gif)
![](/icons/59535if.gif)
![](/icons/59535yi.gif)
![](/icons/59535de.gif)
![](/icons/59535yi.gif)
![](/icons/59535yi.gif)
![](/icons/59535yi.gif)
![](/icons/59535yi.gif)
![](/icons/59535yi.gif)
我们来看
![](/icons/59535yi.gif)
![](/icons/59535de.gif)
![](/icons/59535de.gif)
![](/icons/59535hanshu.gif)
//////////////////////////////////////////////////////////////////////////////////////////////////////
//
// \win2k\private\ntos\ps\create.h
//
//////////////////////////////////////////////////////////////////////////////////////////////////////
NTSTATUS
PspCreateThread(
...
...
)
{
...
![](/icons/59535if.gif)
![](/icons/59535if.gif)
![](/icons/59535diaoyong.gif)
![](/icons/59535hanshu.gif)
ULONG i;
for (i=0; i<PSP_MAX_CREATE_PROCESS_NOTIFY; i
![](/icons/59535jiajia.gif)
![](/icons/59535if.gif)
![](/icons/59535if.gif)
(*PspCreateProcessNot
![](/icons/59535if.gif)
Process->UniqueProcessId,
TRUE
);
}
}
}
}
...
...
![](/icons/59535if.gif)
![](/icons/59535if.gif)
ULONG i;
for (i=0; i<PSP_MAX_CREATE_THREAD_NOTIFY; i
![](/icons/59535jiajia.gif)
![](/icons/59535diaoyong.gif)
![](/icons/59535hanshu.gif)
![](/icons/59535if.gif)
![](/icons/59535if.gif)
(*PspCreateThreadNot
![](/icons/59535if.gif)
Thread->Cid.UniqueThread,
TRUE
);
}
}
}
...
...
}
从上面可以看到,在每创建
![](/icons/59535yi.gif)
![](/icons/59535diaoyong.gif)
![](/icons/59535if.gif)
![](/icons/59535de.gif)
![](/icons/59535hanshu.gif)
![](/icons/59535if.gif)
![](/icons/59535de.gif)
![](/icons/59535if.gif)
![](/icons/59535shuzu.gif)
![](/icons/59535hanshu.gif)
![](/icons/59535de.gif)
NTSTATUS
PsSetCreateThreadNot
![](/icons/59535if.gif)
IN PCREATE_THREAD_NOTIFY_ROUTINE Not
![](/icons/59535if.gif)
)
{
ULONG i;
NTSTATUS Status;
Status = STATUS_INSUFFICIENT_RESOURCES;
for (i = 0; i < PSP_MAX_CREATE_THREAD_NOTIFY; i
![](/icons/59535jiadeng.gif)
![](/icons/59535if.gif)
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
PspCreateThreadNot
![](/icons/59535if.gif)
![](/icons/59535if.gif)
PspCreateThreadNot
![](/icons/59535if.gif)
![](/icons/59535jiadeng.gif)
Status = STATUS_SUCCESS;
![](/icons/59535break.gif)
}
}
![](/icons/59535return.gif)
}
上面
![](/icons/59535de.gif)
![](/icons/59535yi.gif)
//////////////////////////////////////////////////////////////////////////////////////////////////////
//
// \win2k\private\ntos\ps\psp.h
//
//////////////////////////////////////////////////////////////////////////////////////////////////////
#
![](/icons/59535define.gif)
ULONG PspCreateThreadNot
![](/icons/59535if.gif)
PCREATE_THREAD_NOTIFY_ROUTINE PspCreateThreadNot
![](/icons/59535if.gif)
![](/icons/59535hanshu.gif)
![](/icons/59535shuzu.gif)
而PCREATE_THREAD_NOTIFY_ROUTINE定义如下:
typedef
VOID
(*PCREATE_THREAD_NOTIFY_ROUTINE)(
IN HANDLE ProcessId,
IN HANDLE ThreadId,
IN BOOLEAN Create
);
相应
![](/icons/59535de.gif)
![](/icons/59535de.gif)
![](/icons/59535yi.gif)
![](/icons/59535de.gif)
通过上面,我们可以看到,只要我们找出该
![](/icons/59535hanshu.gif)
![](/icons/59535shuzu.gif)
![](/icons/59535de.gif)
这样
![](/icons/59535de.gif)
![](/icons/59535yi.gif)
![](/icons/59535de.gif)
![](/icons/59535diaoyong.gif)
![](/icons/59535hanshu.gif)
![](/icons/59535if.gif)
![](/icons/59535yi.gif)
NTSTATUS
PsSetCreateProcessNot
![](/icons/59535if.gif)
IN PCREATE_PROCESS_NOTIFY_ROUTINE Not
![](/icons/59535if.gif)
IN BOOLEAN Remove
)
{
ULONG i;
for (i=0; i < PSP_MAX_CREATE_PROCESS_NOTIFY; i
![](/icons/59535jiajia.gif)
![](/icons/59535if.gif)
![](/icons/59535if.gif)
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
![](/icons/59535if.gif)
![](/icons/59535de.gif)
PspCreateProcessNot
![](/icons/59535if.gif)
PspCreateProcessNot
![](/icons/59535if.gif)
![](/icons/59535yi.gif)
![](/icons/59535return.gif)
}
}
![](/icons/59535else.gif)
![](/icons/59535if.gif)
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
![](/icons/59535de.gif)
PspCreateProcessNot
![](/icons/59535if.gif)
![](/icons/59535if.gif)
PspCreateProcessNot
![](/icons/59535if.gif)
![](/icons/59535jiadeng.gif)
![](/icons/59535yi.gif)
![](/icons/59535return.gif)
}
}
}
![](/icons/59535return.gif)
}
好了,思路方法已经知道了,只要找出地址,我们就能够"全身而退"了.看
![](/icons/59535yi.gif)
![](/icons/59535de.gif)
![](/icons/59535if.gif)
lkd> u PsRemoveCreateThreadNot
![](/icons/59535if.gif)
nt!PsRemoveCreateThreadNot
![](/icons/59535if.gif)
80651d7b 53 push ebx
80651d7c 56 push esi
80651d7d 57 push edi
80651d7e 33db xor ebx,ebx
80651d80 bf400f5780 mov edi,0x80570f40 //起始地址
80651d85 57 push edi
80651d86 e8a7500100 call nt!ExWaitForRundownProtectionRelease+0x5cf (80666e32)
80651d8b 8bf0 mov esi,eax
80651d8d 85f6 test esi,esi
80651d8f 7420 jz nt!PsRemoveCreateThreadNot
![](/icons/59535if.gif)
80651d91 56 push esi
80651d92 e8ba1bffff call nt!IoReportTargetDeviceChange+0x7aa0 (80643951)
80651d97 3b442410 cmp eax,[esp+0x10]
80651d9b 750d jnz nt!PsRemoveCreateThreadNot
![](/icons/59535if.gif)
80651d9d 56 push esi
80651d9e 6a00 push 0x0
80651da0 57 push edi
80651da1 e8c54f0100 call nt!ExWaitForRundownProtectionRelease+0x508 (80666d6b)
80651da6 84c0 test al,al
80651da8 751b jnz nt!PsRemoveCreateThreadNot
![](/icons/59535if.gif)
80651daa 56 push esi
80651dab 57 push edi
80651dac e892510100 call nt!ExWaitForRundownProtectionRelease+0x6e0 (80666f43)
80651db1 43 inc ebx
80651db2 83c704 add edi,0x4
80651db5 83fb08 cmp ebx,0x8 //看是否到了最大数(8)
80651db8 72cb jb nt!PsRemoveCreateThreadNot
![](/icons/59535if.gif)
80651dba b87a0000c0 mov eax,0xc000007a
80651dbf 5f pop edi
80651dc0 5e pop esi
80651dc1 5b pop ebx
80651dc2 c20400 ret 0x4
lkd> dd 0x80570f40 //设置了监视
![](/icons/59535hanshu.gif)
80570f40 e316e557 00000000 00000000 00000000
.............................
lkd> dd 0x80570f40 //清除了监视
![](/icons/59535hanshu.gif)
80570f40 00000000 00000000 00000000 00000000
哈哈.下面是实现代码,代码中实现了进线
![](/icons/59535de.gif)
![](/icons/59535de.gif)
![](/icons/59535de.gif)
Drivers.c
/////////////////////////////////////////////////////////////////////////////////////////////////////////
//
// Made By ZwelL
#
![](/icons/59535include.gif)
#
![](/icons/59535include.gif)
#
![](/icons/59535include.gif)
![](/icons/59535define.gif)
#
![](/icons/59535define.gif)
![](/icons/59535System.gif)
#
![](/icons/59535define.gif)
const WCHAR devLink
![](/icons/59535zhk2.gif)
const WCHAR devName
![](/icons/59535zhk2.gif)
UNICODE_STRING devNameUnicd;
UNICODE_STRING devLinkUnicd;
PVOID gpEventObject = NULL; // 和应用
![](/icons/59535chengxu.gif)
![](/icons/59535de.gif)
ULONG ProcessNameOff
![](/icons/59535set.gif)
PVOID outBuf[255];
BOOL g_bMainThread;
ULONG g_dwParentId;
CHECKLIST CheckList;
ULONG BuildNumber; //系统版本号
ULONG SYSTEMID; //
![](/icons/59535System.gif)
![](/icons/59535de.gif)
PWCHAR Version[VERSIONLEN];
NTSTATUS PsLookupProcessByProcessId(IN ULONG ulProcId, OUT PEPROCESS * pEProcess);
ULONG GetProcessNameOff
![](/icons/59535set.gif)
![](/icons/59535kh.gif)
{
PEPROCESS curproc;
![](/icons/59535int.gif)
curproc = PsGetCurrentProcess
![](/icons/59535kh.gif)
for( i = 0; i < 3*PAGE_SIZE; i
![](/icons/59535jiajia.gif)
{
![](/icons/59535if.gif)
{
![](/icons/59535return.gif)
}
}
![](/icons/59535return.gif)
}
NTSTATUS GetRegValue(PCWSTR RegPath,PCWSTR ValueName,PWCHAR Value)
{
![](/icons/59535int.gif)
NTSTATUS Status;
OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE KeyHandle;
PKEY_VALUE_PARTIAL_INFORMATION valueInfoP;
ULONG valueInfoLength,
![](/icons/59535return.gif)
UNICODE_STRING UnicodeRegPath;
UNICODE_STRING UnicodeValueName;
RtlInitUnicodeString(&UnicodeRegPath, RegPath);
RtlInitUnicodeString(&UnicodeValueName, ValueName);
InitializeObjectAttributes(&ObjectAttributes,
&UnicodeRegPath,
OBJ_CASE_INSENSITIVE, // Flags
NULL, // Root directory
NULL); // Security descriptor
Status = ZwOpenKey(&KeyHandle,
KEY_ALL_ACCESS,
&ObjectAttributes);
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535return.gif)
}
valueInfoLength =
![](/icons/59535sizeof.gif)
valueInfoP = (PKEY_VALUE_PARTIAL_INFORMATION) ExAllocatePool
(NonPagedPool, valueInfoLength);
Status = ZwQueryValueKey(KeyHandle,
&UnicodeValueName,
KeyValuePartialInformation,
valueInfoP,
valueInfoLength,
&
![](/icons/59535return.gif)
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535return.gif)
}
![](/icons/59535else.gif)
{
RtlCopyMemory((PCHAR)Value, (PCHAR)valueInfoP->Data, valueInfoP->DataLength);
ReturnValue = 1;
}
![](/icons/59535if.gif)
ExFreePool(valueInfoP);
ZwClose(KeyHandle);
![](/icons/59535return.gif)
}
VOID MyRemoveCraeteThreadNot
![](/icons/59535if.gif)
IN PCREATE_THREAD_NOTIFY_ROUTINE Not
![](/icons/59535if.gif)
)
{
//PsRemoveCreateThreadNot
![](/icons/59535if.gif)
PVOID ptr=NULL;
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
//低于sp4
![](/icons/59535de.gif)
{
ptr=0x80484520;
}
![](/icons/59535else.gif)
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
{
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
ptr=0x8054efc0;
![](/icons/59535else.gif)
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
ptr=0x80561d20;
}
![](/icons/59535else.gif)
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
{
ptr=0x80570f40;
}
![](/icons/59535if.gif)
mem
![](/icons/59535set.gif)
![](/icons/59535sizeof.gif)
}
VOID ThreadCreateMon (IN HANDLE PId, IN HANDLE TId, IN BOOLEAN bCreate)
{
PEPROCESS EProcess,PEProcess;
NTSTATUS status;
HANDLE dwParentPID;
status = PsLookupProcessByProcessId( (ULONG)PId, &EProcess);
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
![](/icons/59535if.gif)
{
dwParentPID=PsGetCurrentProcessId
![](/icons/59535kh.gif)
status = PsLookupProcessByProcessId(
(ULONG)dwParentPID,
&PEProcess);
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
![](/icons/59535System.gif)
![](/icons/59535de.gif)
//在2000下是0,在XP后是4
![](/icons/59535return.gif)
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
&&(g_dwParentId != dwParentPID)
&&(dwParentPID != PId)
)
{
g_bMainThread=FALSE;
spr
![](/icons/59535int.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
"Remote Thread :"
"
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
"\nT:%18s%9d%9d%25s%9d\n"
"
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
"
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
(char *)((char *)EProcess+ProcessNameOff
![](/icons/59535set.gif)
PId, TId,
(char *)((char *)PEProcess+ProcessNameOff
![](/icons/59535set.gif)
![](/icons/59535if.gif)
KeSetEvent((PRKEVENT)gpEventObject, 0, FALSE);
}
![](/icons/59535if.gif)
![](/icons/59535return.gif)
DbgPr
![](/icons/59535int.gif)
(char *)((char *)EProcess+ProcessNameOff
![](/icons/59535set.gif)
PId, TId,
(char *)((char *)PEProcess+ProcessNameOff
![](/icons/59535set.gif)
spr
![](/icons/59535int.gif)
(char *)((char *)EProcess+ProcessNameOff
![](/icons/59535set.gif)
PId, TId,
(char *)((char *)PEProcess+ProcessNameOff
![](/icons/59535set.gif)
![](/icons/59535if.gif)
KeSetEvent((PRKEVENT)gpEventObject, 0, FALSE);
}
![](/icons/59535else.gif)
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535dd.gif)
spr
![](/icons/59535int.gif)
![](/icons/59535dd.gif)
![](/icons/59535if.gif)
KeSetEvent((PRKEVENT)gpEventObject, 0, FALSE);
}
}
VOID ProcessCreateMon ( HANDLE hParentId, HANDLE PId, BOOLEAN bCreate )
{
PEPROCESS EProcess,PProcess;
NTSTATUS status;
HANDLE TId;
g_dwParentId = hParentId;
status = PsLookupProcessByProcessId((ULONG)PId, &EProcess);
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
status = PsLookupProcessByProcessId((ULONG)hParentId, &PProcess);
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
![](/icons/59535if.gif)
{
g_bMainThread = TRUE;
DbgPr
![](/icons/59535int.gif)
(char *)((char *)EProcess+ProcessNameOff
![](/icons/59535set.gif)
PId,PsGetCurrentThreadId
![](/icons/59535kh.gif)
(char *)((char *)PProcess+ProcessNameOff
![](/icons/59535set.gif)
hParentId
);
spr
![](/icons/59535int.gif)
(char *)((char *)EProcess+ProcessNameOff
![](/icons/59535set.gif)
PId,PsGetCurrentThreadId
![](/icons/59535kh.gif)
(char *)((char *)PProcess+ProcessNameOff
![](/icons/59535set.gif)
hParentId
);
![](/icons/59535if.gif)
KeSetEvent((PRKEVENT)gpEventObject, 0, FALSE);
}
![](/icons/59535else.gif)
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535dd.gif)
spr
![](/icons/59535int.gif)
![](/icons/59535dd.gif)
![](/icons/59535if.gif)
KeSetEvent((PRKEVENT)gpEventObject, 0, FALSE);
}
}
NTSTATUS _disibledevent=> {
status=IoDeleteSymbolicLink( &devLinkUnicd );
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
IoDeleteDevice( pDriverObject->DeviceObject );
}
![](/icons/59535return.gif)
}
NTSTATUS DeviceIoControlDispatch(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP pIrp
)
{
PIO_STACK_LOCATION irpStack;
NTSTATUS status;
PVOID inputBuffer;
ULONG inputLength;
PVOID outputBuffer;
ULONG outputLength;
OBJECT_HANDLE_INFORMATION objHandleInfo;
status = STATUS_SUCCESS;
// 取出IOCTL请求代码
irpStack = IoGetCurrentIrpStackLocation(pIrp);
switch (irpStack->MajorFunction)
{
![](/icons/59535case.gif)
DbgPr
![](/icons/59535int.gif)
![](/icons/59535break.gif)
![](/icons/59535case.gif)
DbgPr
![](/icons/59535int.gif)
![](/icons/59535break.gif)
![](/icons/59535case.gif)
DbgPr
![](/icons/59535int.gif)
inputLength=irpStack->Parameters.DeviceIoControl.InputBufferLength;
outputLength=irpStack->Parameters.DeviceIoControl.OutputBufferLength;
switch (irpStack->Parameters.DeviceIoControl.IoControlCode)
{
![](/icons/59535case.gif)
inputBuffer = pIrp->AssociatedIrp.
![](/icons/59535System.gif)
DbgPr
![](/icons/59535int.gif)
status = ObReferenceObjectByHandle(*(HANDLE *)inputBuffer,
GENERIC_ALL,
NULL,
KernelMode,
&gpEventObject,
&objHandleInfo);
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535break.gif)
}
![](/icons/59535break.gif)
![](/icons/59535case.gif)
![](/icons/59535if.gif)
ObDereferenceObject(gpEventObject);
DbgPr
![](/icons/59535int.gif)
![](/icons/59535break.gif)
![](/icons/59535case.gif)
RtlCopyMemory(pIrp->UserBuffer, outBuf, outputLength);
![](/icons/59535break.gif)
![](/icons/59535case.gif)
inputBuffer = pIrp->AssociatedIrp.
![](/icons/59535System.gif)
mem
![](/icons/59535set.gif)
![](/icons/59535sizeof.gif)
RtlCopyMemory(&CheckList, inputBuffer,
![](/icons/59535sizeof.gif)
DbgPr
![](/icons/59535int.gif)
![](/icons/59535break.gif)
default:
![](/icons/59535break.gif)
}
![](/icons/59535break.gif)
default:
DbgPr
![](/icons/59535int.gif)
![](/icons/59535break.gif)
}
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = 0;
IoCompleteRequest (pIrp, IO_NO_INCREMENT);
![](/icons/59535return.gif)
}
NTSTATUS DriverEntry( IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING theRegistryPath )
{
NTSTATUS Status;
PDEVICE_OBJECT pDevice;
DbgPr
![](/icons/59535int.gif)
g_bMainThread = FALSE;
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
}
PsGetVersion(NULL, NULL, &BuildNumber, NULL);
DbgPr
![](/icons/59535int.gif)
RtlInitUnicodeString (&devNameUnicd, devName );
RtlInitUnicodeString (&devLinkUnicd, devLink );
Status = IoCreateDevice ( pDriverObject,
0,
&devNameUnicd,
FILE_DEVICE_UNKNOWN,
0,
TRUE,
&pDevice );
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535return.gif)
}
Status = IoCreateSymbolicLink (&devLinkUnicd, &devNameUnicd);
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535return.gif)
}
ProcessNameOff
![](/icons/59535set.gif)
![](/icons/59535set.gif)
![](/icons/59535kh.gif)
pDriverObject->DriverUnload = _disibledevent=> pDriverObject->MajorFunction[IRP_MJ_CLOSE] =
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DeviceIoControlDispatch;
Status = PsSetCreateProcessNot
![](/icons/59535if.gif)
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535if.gif)
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
Status = PsSetCreateThreadNot
![](/icons/59535if.gif)
![](/icons/59535if.gif)
{
DbgPr
![](/icons/59535int.gif)
![](/icons/59535if.gif)
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
![](/icons/59535return.gif)
}
////////////////////////////////////////////////////////////////////////////////////////////////////////////
![](/icons/59535main.gif)
////////////////////////////////////////////////////////////////////////////////////////////////////////////
// Made By ZwelL
#
![](/icons/59535include.gif)
#
![](/icons/59535include.gif)
#
![](/icons/59535include.gif)
![](/icons/59535define.gif)
![](/icons/59535int.gif)
![](/icons/59535main.gif)
![](/icons/59535kh.gif)
{
HANDLE hDevice;
bool status;
HANDLE m_hCommEvent;
ULONG dwReturn;
char outbuf[255];
CHECKLIST CheckList;
hDevice = NULL;
m_hCommEvent = NULL;
hDevice = CreateFile( "\\\\.\\MyEvent",
GENERIC_READ|GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL);
![](/icons/59535if.gif)
![](/icons/59535dd.gif)
{
pr
![](/icons/59535int.gif)
getchar
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
m_hCommEvent = CreateEvent(NULL,
false,
false,
NULL);
pr
![](/icons/59535int.gif)
status =DeviceIoControl(hDevice,
IOCTL_PASSEVENT,
&m_hCommEvent,
![](/icons/59535sizeof.gif)
NULL,
0,
&dwReturn,
NULL);
![](/icons/59535if.gif)
{
pr
![](/icons/59535int.gif)
![](/icons/59535kh.gif)
getchar
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
CheckList.ONLYSHOWREMOTETHREAD=TRUE;
CheckList.SHOWTHREAD=TRUE;
CheckList.SHOWTERMINATETHREAD=FALSE;
CheckList.SHOWTERMINATEPROCESS=FALSE;
status =DeviceIoControl(hDevice,
IOCTL_PASSEVSTRUCT,
&CheckList,
![](/icons/59535sizeof.gif)
NULL,
0,
&dwReturn,
NULL);
![](/icons/59535if.gif)
{
pr
![](/icons/59535int.gif)
![](/icons/59535kh.gif)
getchar
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
pr
![](/icons/59535int.gif)
while(1)
{
Re
![](/icons/59535set.gif)
WaitForSingleObject(m_hCommEvent, INFINITE);
status =DeviceIoControl(hDevice,
IOCTL_PASSBUF,
NULL,
0,
&outbuf,
![](/icons/59535sizeof.gif)
&dwReturn,
NULL);
![](/icons/59535if.gif)
{
pr
![](/icons/59535int.gif)
![](/icons/59535kh.gif)
getchar
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
pr
![](/icons/59535int.gif)
}
status =DeviceIoControl(hDevice,
IOCTL_UNPASSEVENT,
NULL,
0,
NULL,
0,
&dwReturn,
NULL);
![](/icons/59535if.gif)
{
pr
![](/icons/59535int.gif)
![](/icons/59535kh.gif)
getchar
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
status = CloseHandle( hDevice );
status = CloseHandle(m_hCommEvent);
getchar
![](/icons/59535kh.gif)
![](/icons/59535return.gif)
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////
![](/icons/59535define.gif)
/////////////////////////////////////////////////////////////////////////////////////////////////////////
#
![](/icons/59535include.gif)
#
![](/icons/59535define.gif)
// Define Interface reference/dereference routines for
// Interfaces exported by IRP_MN_QUERY_INTERFACE
#
![](/icons/59535define.gif)
CTL_CODE(FILE_DEVICE_EVENT, index, METHOD_BUFFERED, FILE_READ_DATA)
#
![](/icons/59535define.gif)
CTL_CODE(FILE_DEVICE_EVENT, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
#
![](/icons/59535define.gif)
CTL_CODE(FILE_DEVICE_EVENT, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)
#
![](/icons/59535define.gif)
CTL_CODE(FILE_DEVICE_EVENT, 0x803, METHOD_BUFFERED, FILE_ANY_ACCESS)
#
![](/icons/59535define.gif)
CTL_CODE(FILE_DEVICE_EVENT, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS)
typedef struct //这个结构主要用于调试用
{
BOOL SHOWTHREAD;
BOOL _disibledevent=> T: hh.exe 3116 3832 remote.exe 3824
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
![](/icons/59535dd.gif)
参考资料:
1. 编写进程/线程监视器 -sinister
http://www.xfocus.net/articles/200303/495.html
2. 监视远程线程
![](/icons/59535de.gif)
![](/icons/59535yi.gif)
http://www.luocong.com/bbs/dispbbs.asp?boardID=2&ID=6895&page=2
3. Windows 2000源代码
![](/icons/59535yi.gif)
![](/icons/59535hanshu.gif)
![](/icons/59535yi.gif)
![](/icons/59535de.gif)
最新评论