监视远程线程的创建

参考资料：
(1) sinister 编写进程/线程监视器
    http://www.xfocus.net/articles/200303/495.html
(2) DDK
(3) KmdKit
    http://www.freewebs.com/four-f/
(4) KmdTut 中文翻译
    http://asm.yeah.net

以下这篇文章作者未知

/*有时候我们希望能够动态监视系统中任意进程/线程的创建与销毁。为了达

到此目的我翻阅了 DDK 手册，发现其提供的 PsSetCreateProcessNotifyRoutine(),

PsSetCreateThreadNotifyRoutine(),等函数可以实现此功能。这两个函数可以

通过向系统注册一个 CALLBALCK 函数来监视进程/线程等操作。函数原形如下：

NTSTATUS

PsSetCreateProcessNotifyRoutine(

IN PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine,

IN BOOLEAN Remove

);

VOID

(*PCREATE_PROCESS_NOTIFY_ROUTINE) (

IN HANDLE ParentId,

IN HANDLE ProcessId,

IN BOOLEAN Create

);

NTSTATUS

PsSetCreateThreadNotifyRoutine(

IN PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine

);

VOID

(*PCREATE_THREAD_NOTIFY_ROUTINE) (

IN HANDLE ProcessId,

IN HANDLE ThreadId,

IN BOOLEAN Create

);

通过原形可以看出，其 CALLBACK 函数只提供了进程ID/线程ID。并没有提供

进程名。那么我们要进一步通过进程ID来获取进程名。这需要用到一个未公开

的函数 PsLookupProcessByProcessId()。函数原形如下：

NTSTATUS PsLookupProcessByProcessId(

IN ULONG ulProcId,

OUT PEPROCESS * pEProcess

);

函数输出的 EPROCESS 结构也是未公开的内核进程结构，很多人称其为 KPEB。

EPROCESS 结构中的偏移 0x1FC 指向当前进程名的偏移。（这个结构虽然可以在

驱动程序中直接使用。但没有公布其结构，网上有不少高手已将其结构给出。有

兴趣可以自行搜索，或去 IFS DDK 中获取，这里因为结构太长，就不贴出来了）

有了这个结构我们就可以从中得到进程名。NT系统还提供了一个函数可以动态监

视进程装载映像。此函数可以得到进程加栽时所调用的 DLL 名称与全路径，还有

一些映像信息。为我们获得更详细的进程装载信息提供了更好的帮助。

函数原形如下：

NTSTATUS

PsSetLoadImageNotifyRoutine(

IN PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine

);

VOID

(*PLOAD_IMAGE_NOTIFY_ROUTINE) (

IN PUNICODE_STRING FullImageName,

IN HANDLE ProcessId, // where image is mapped

IN PIMAGE_INFO ImageInfo

);

typedef struct _IMAGE_INFO {

union {

ULONG Properties;

struct {

ULONG ImageAddressingMode : 8; //code addressing mode

ULONG SystemModeImage   : 1; //system mode image

ULONG ImageMappedToAllPids : 1; //mapped in all processes

ULONG Reserved       : 22;

};

};

PVOID ImageBase;

ULONG ImageSelector;

ULONG ImageSize;

ULONG ImageSectionNumber;

} IMAGE_INFO, *PIMAGE_INFO;

利用以上提供的函数与结构，我们便能实现一个进程/线程监视器。下面这段

代码演示了如何实现此功能。
*/

/*****************************************************************

文件名     : WssProcMon.c

描述     : 进程/线程监视器

作者     : sinister

最后修改日期 : 2002-11-02

*****************************************************************/

#include "ntddk.h"
#include "windef.h"
#include "string.h"
#define SYSNAME "System"
//#define ProcessNameOffset 0x1fc

ULONG GetProcessNameOffset();
VOID Unload(IN PDRIVER_OBJECT DriverObject);
static NTSTATUS MydrvDispatch (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS PsLookupProcessByProcessId(IN ULONG ulProcId, OUT PEPROCESS * pEProcess);
VOID ProcessCreateMon ( IN HANDLE hParentId, IN HANDLE PId,IN BOOLEAN bCreate);
VOID ThreadCreateMon (IN HANDLE PId, IN HANDLE TId, IN BOOLEAN bCreate);
VOID ImageCreateMon (IN PUNICODE_STRING FullImageName, IN HANDLE ProcessId, IN PIMAGE_INFO ImageInfo );

// 驱动入口
ULONG ProcessNameOffset =0;
NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath )

{
UNICODE_STRING nameString, linkString;
PDEVICE_OBJECT deviceObject;
NTSTATUS     status;
int         i;
//建立设备

RtlInitUnicodeString( &nameString, L"//Device//WssProcMon" );
status = IoCreateDevice( DriverObject,
   0,
   &nameString,
   FILE_DEVICE_UNKNOWN,
   0,
   TRUE,
   &deviceObject
   );          

if (!NT_SUCCESS( status ))
   return status;

RtlInitUnicodeString( &linkString, L"//DosDevices//WssProcMon" );
status = IoCreateSymbolicLink(&linkString, &nameString);

if (!NT_SUCCESS( status ))
{
   IoDeleteDevice(DriverObject->DeviceObject);
   return status;

}  
ProcessNameOffset = GetProcessNameOffset();
/*status = PsSetLoadImageNotifyRoutine(ImageCreateMon);

if (!NT_SUCCESS( status ))
{
   DbgPrint("PsSetLoadImageNotifyRoutine()/n");
   return status;
}*/  

status = PsSetCreateThreadNotifyRoutine(ThreadCreateMon);
if (!NT_SUCCESS( status ))
{
   DbgPrint("PsSetCreateThreadNotifyRoutine()/n");
   return status;
}  

status = PsSetCreateProcessNotifyRoutine(ProcessCreateMon, FALSE);
if (!NT_SUCCESS( status ))
{
   DbgPrint("PsSetCreateProcessNotifyRoutine()/n");
   return status;
}  

for ( i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)  
{
   DriverObject->MajorFunction[i] = MydrvDispatch;
}
     DriverObject->DriverUnload = Unload;
return STATUS_SUCCESS;
}

VOID Unload(IN PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING linkString;
PsRemoveCreateThreadNotifyRoutine(ThreadCreateMon);
PsSetCreateProcessNotifyRoutine(ProcessCreateMon, TRUE);
RtlInitUnicodeString( &linkString, L"//DosDevices//WssProcMon" );
IoDeleteSymbolicLink( &linkString );
IoDeleteDevice( DriverObject->DeviceObject );
}

//处理设备对象操作

static NTSTATUS MydrvDispatch (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)

{
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0L;
IoCompleteRequest( Irp, 0 );
return Irp->IoStatus.Status;
}

HANDLE g_dwProcessId;
BOOL g_bMainThread;
VOID ProcessCreateMon ( IN HANDLE hParentId, IN HANDLE PId,IN BOOLEAN bCreate )
{
PEPROCESS EProcess;
ULONG   ulCurrentProcessId;
LPTSTR     lpCurProc;
NTSTATUS   status;
#ifdef _AMD64_
ULONG ProcessId = HandleToUlong(PId);
status = PsLookupProcessByProcessId( ProcessId, &EProcess);
#else
     HANDLE ProcessId =PId;
     status = PsLookupProcessByProcessId( (ULONG)PId, &EProcess);
#endif

if (!NT_SUCCESS( status ))
{
   DbgPrint("PsLookupProcessByProcessId()/n");
   return ;
}

if ( bCreate )
{
   //g_dwProcessId = ProcessId;
   g_bMainThread = TRUE;
   lpCurProc = (LPTSTR)EProcess;
   lpCurProc = lpCurProc + ProcessNameOffset;
   DbgPrint( "CREATE PROCESS = PROCESS NAME: %s , PROCESS PARENTID: %d, PROCESS ID: %d, PROCESS ADDRESS %x:/n",
   lpCurProc,
   hParentId,
   PId,
   EProcess );
}
else
{
   DbgPrint( "TERMINATED == PROCESS ID: %d/n", PId);
}
}

VOID ThreadCreateMon (IN HANDLE PId, IN HANDLE TId, IN BOOLEAN bCreate)

{
PEPROCESS   EProcess,ParentEProcess;
LPTSTR     lpCurProc,lpParnentProc;
NTSTATUS   status;
    
#ifdef _AMD64_
ULONG System=4;
ULONG dwParentPID=HandleToUlong(PsGetCurrentProcessId());//创建该线程的进程
ULONG ProcessId = HandleToUlong(PId);
status = PsLookupProcessByProcessId( ProcessId, &EProcess);
status = PsLookupProcessByProcessId( dwParentPID, &ParentEProcess);
#else
HANDLE System=(HANDLE)4;//under xp, in win2k is 8
HANDLE dwParentPID=PsGetCurrentProcessId();//创建该线程的进程
HANDLE ProcessId =PId;//ProcessId 是进程号，这里的进程号是指向包括该线程的进程，而不是创建该线程的进程
status = PsLookupProcessByProcessId( (ULONG)ProcessId, &EProcess);
status = PsLookupProcessByProcessId( (ULONG)dwParentPID, &ParentEProcess);
#endif

if (!NT_SUCCESS( status ))
{
   DbgPrint("PsLookupProcessByProcessId()/n");
   return ;
}  

if ( bCreate )
{
   if((g_bMainThread==TRUE)&&(ProcessId!=System)&&(ProcessId!=dwParentPID))
   {
   HANDLE dwParentTID=PsGetCurrentThreadId();
   lpCurProc   = (LPTSTR)EProcess;
   lpParnentProc= (LPTSTR)ParentEProcess;
   lpCurProc   +=   ProcessNameOffset;
   lpParnentProc +=ProcessNameOffset;
   DbgPrint("caller: Name=%s PID=%d TID=%d/t/tcalled: Name=%s PID=%d TID=%d/n", /
     lpParnentProc, dwParentPID, dwParentTID, lpCurProc, ProcessId, TId);
       g_bMainThread=FALSE;
   }
  
   lpCurProc   = (LPTSTR)EProcess;
   lpCurProc   = lpCurProc + ProcessNameOffset;
   DbgPrint( "CREATE THREAD = PROCESS NAME: %s PROCESS ID: %d, THREAD ID: %d/n", lpCurProc, PId, TId );            
}
else
{
   DbgPrint( "TERMINATED == THREAD ID: %d/n", TId);
}
}

//VOID ImageCreateMon (IN PUNICODE_STRING FullImageName, IN HANDLE ProcessId, IN PIMAGE_INFO ImageInfo )
//
//{
// DbgPrint("FullImageName: %S,Process ID: %d/n",FullImageName->Buffer,ProcessId);
// DbgPrint("ImageBase: %x,ImageSize: %d/n",ImageInfo->ImageBase,ImageInfo->ImageSize);
//}

ULONG GetProcessNameOffset()
{
PEPROCESS curproc;
int i;

curproc = PsGetCurrentProcess();

//
// Scan for 12KB, hopping the KPEB never grows that big!
//
for( i = 0; i < 3*PAGE_SIZE; i++ ) {

   if( !strncmp( SYSNAME, (PCHAR) curproc + i, strlen(SYSNAME) )) {

   return i;
   }
}

//
// Name not found - oh, well
//
return 0;
}

根据你的改为C代码,并支持WINXP -64.......