创建进程回调函数_阻止打开任何进程

#include <ntddk.h>VOID UnloadDriver(PDRIVER_OBJECT pDriver);VOIDCreateProcessRoutineSpy(IN HANDLE  ParentId,IN HANDLE  ProcessId,IN BOOLEAN  Create);NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING Registry){NTSTATUS status = STATUS_SUCCESS;UNREFERENCED_PARAMETER(pDriver);UNREFERENCED_PARAMETER(Registry);KdPrint(("[SysTest] DriverEntry Loading.\n"));KdPrint(("CreateProcessRoutineSpy地址%x", CreateProcessRoutineSpy));status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, FALSE);if (!NT_SUCCESS(status)){KdPrint(("[SysTest] PsSetCreateProcessNotifyRoutine failed status:(%x).\n", status));return status;}pDriver->DriverUnload = UnloadDriver;return status;}VOIDCreateProcessRoutineSpy(IN HANDLE  ParentId,IN HANDLE  ProcessId,IN BOOLEAN  Create){NTSTATUS status;HANDLE procHandle = NULL;CLIENT_ID ClientId;OBJECT_ATTRIBUTES Obja;Obja.Length = sizeof(Obja);Obja.RootDirectory = 0;Obja.ObjectName = 0;Obja.Attributes = 0;Obja.SecurityDescriptor = 0;Obja.SecurityQualityOfService = 0;ClientId.UniqueProcess = (HANDLE)ProcessId;ClientId.UniqueThread = 0;//不管创建什么程序都关闭程序if (Create)   //bCreate 为True表示创建程序{//调用函数ZwOpenProcess函数，通过进程pid号获得进程句柄status = ZwOpenProcess(&procHandle, PROCESS_ALL_ACCESS, &Obja, &ClientId);if (status == STATUS_INVALID_PARAMETER_MIX)DbgPrint("STATUS_INVALID_PARAMETER_MIX\n");else if (status == STATUS_INVALID_CID)DbgPrint("STATUS_INVALID_CID\n");else if (status == STATUS_INVALID_PARAMETER)DbgPrint("STATUS_INVALID_PARAMETER\n");else if (status == STATUS_ACCESS_DENIED)DbgPrint("STATUS_ACCESS_DENIED\n");elseDbgPrint("STATUS_SUCCESS\n");if (procHandle != NULL)status = ZwTerminateProcess(procHandle, 1);else{DbgPrint("failed to ZwOpenProcess...\n");return;}//这里是我来判断没有成功结束进程用的switch (status){case STATUS_SUCCESS:DbgPrint("process %u has beed killed ...\n", ProcessId);break;case STATUS_OBJECT_TYPE_MISMATCH:DbgPrint("failed to kill %u process,The specified handle is not a process handle. \n", ProcessId);break;case STATUS_INVALID_HANDLE:DbgPrint("failed to kill %u process,The specified handle is not valid.\n", ProcessId);break;case STATUS_ACCESS_DENIED:DbgPrint("failed to kill %u process,The driver cannot access the specified process object.\n", ProcessId);break;case STATUS_PROCESS_IS_TERMINATING:DbgPrint("failed to kill %u process,The specified process is already terminating.\n", ProcessId);break;default:break;}}if (Create){KdPrint(("进程创建[SysTest] Process Created. ParentId:(%d) ProcessId:(%d).\n", ParentId, ProcessId));}else{KdPrint(("进程销毁[SysTest] Process Terminated ProcessId:(%d).ParentId:(%d) .\n", ProcessId, ParentId));}return;}VOID UnloadDriver(PDRIVER_OBJECT pDriver){UNREFERENCED_PARAMETER(pDriver);NTSTATUS status;status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, TRUE);if (NT_SUCCESS(status)){KdPrint(("卸载完成[SysTest] UnloadDriver.\n"));}return;}