创建进程回调函数_阻止打开任何进程

#include <ntddk.h>

VOID UnloadDriver(PDRIVER_OBJECT pDriver);

VOID
CreateProcessRoutineSpy(
IN HANDLE  ParentId,
IN HANDLE  ProcessId,
IN BOOLEAN  Create
);



NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING Registry)
{
	NTSTATUS status = STATUS_SUCCESS;

	UNREFERENCED_PARAMETER(pDriver);
	UNREFERENCED_PARAMETER(Registry);
	KdPrint(("[SysTest] DriverEntry Loading.\n"));
	KdPrint(("CreateProcessRoutineSpy地址%x", CreateProcessRoutineSpy));
	status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, FALSE);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("[SysTest] PsSetCreateProcessNotifyRoutine failed status:(%x).\n", status));
		return status;
	}

	pDriver->DriverUnload = UnloadDriver;
	return status;
}

VOID
CreateProcessRoutineSpy(
IN HANDLE  ParentId,
IN HANDLE  ProcessId,
IN BOOLEAN  Create
)
{
	NTSTATUS status;
	HANDLE procHandle = NULL;
	CLIENT_ID ClientId;

	OBJECT_ATTRIBUTES Obja;
	Obja.Length = sizeof(Obja);
	Obja.RootDirectory = 0;
	Obja.ObjectName = 0;
	Obja.Attributes = 0;
	Obja.SecurityDescriptor = 0;
	Obja.SecurityQualityOfService = 0;

	ClientId.UniqueProcess = (HANDLE)ProcessId;
	ClientId.UniqueThread = 0;
	//不管创建什么程序都关闭程序
	if (Create)   //bCreate 为True表示创建程序
	{
		//调用函数ZwOpenProcess函数，通过进程pid号获得进程句柄

		status = ZwOpenProcess(&procHandle, PROCESS_ALL_ACCESS, &Obja, &ClientId);
		if (status == STATUS_INVALID_PARAMETER_MIX)
			DbgPrint("STATUS_INVALID_PARAMETER_MIX\n");
		else if (status == STATUS_INVALID_CID)
			DbgPrint("STATUS_INVALID_CID\n");
		else if (status == STATUS_INVALID_PARAMETER)
			DbgPrint("STATUS_INVALID_PARAMETER\n");
		else if (status == STATUS_ACCESS_DENIED)
			DbgPrint("STATUS_ACCESS_DENIED\n");
		else
			DbgPrint("STATUS_SUCCESS\n");

		if (procHandle != NULL)
			status = ZwTerminateProcess(procHandle, 1);
		else
		{
			DbgPrint("failed to ZwOpenProcess...\n");
			return;
		}
		//这里是我来判断没有成功结束进程用的
		switch (status)
		{
		case STATUS_SUCCESS:
			DbgPrint("process %u has beed killed ...\n", ProcessId);
			break;
		case STATUS_OBJECT_TYPE_MISMATCH:
			DbgPrint("failed to kill %u process,The specified handle is not a process handle. \n", ProcessId);
			break;
		case STATUS_INVALID_HANDLE:
			DbgPrint("failed to kill %u process,The specified handle is not valid.\n", ProcessId);
			break;
		case STATUS_ACCESS_DENIED:
			DbgPrint("failed to kill %u process,The driver cannot access the specified process object.\n", ProcessId);
			break;
		case STATUS_PROCESS_IS_TERMINATING:
			DbgPrint("failed to kill %u process,The specified process is already terminating.\n", ProcessId);
			break;
		default:
			break;
		}
	}
	if (Create)
	{
		KdPrint(("进程创建[SysTest] Process Created. ParentId:(%d) ProcessId:(%d).\n", ParentId, ProcessId));
	}
	else
	{
		KdPrint(("进程销毁[SysTest] Process Terminated ProcessId:(%d).ParentId:(%d) .\n", ProcessId, ParentId));
	}

	return;
}

VOID UnloadDriver(PDRIVER_OBJECT pDriver)
{
	UNREFERENCED_PARAMETER(pDriver);

	NTSTATUS status;
	
	status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, TRUE);
	if (NT_SUCCESS(status))
	{
		KdPrint(("卸载完成[SysTest] UnloadDriver.\n"));
	}

	return;
}