注意使用PsLookupProcessByProcessId或者PsLookupThreadByThreadId必须要调用ObDereferenceObject来释放引用
操作 | 对应函数 |
---|---|
枚举进程 | PsLookupProcessByProcessId |
获取父进程ID | PsGetProcessInheritedFromUniqueProcessId |
暂停进程 | PsSuspendProcess |
恢复进程 | PsResumeProcess |
结束进程 | ZwTerminateProcess |
枚举线程 | PsLookupThreadByThreadId |
暂停线程 | PsSuspendThread |
恢复线程 | PsResumeThread |
结束线程 | PsLookupThreadByThreadId |
枚举模块 | 枚举PEB.LDR的双向链表 |
卸载dll模块 | MmUnmapViewOfSection |
枚举进程
#include <ntifs.h>
#include <ntddk.h>
//根据进程结构获得进程名指针 需要自己申明一下。
NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);
VOID EnumProcess()
{
ULONG i = 0;
for (i; i < 20000; i += 4)
{
NTSTATUS status = STATUS_SUCCESS;
PEPROCESS Eprocess;
status = PsLookupProcessByProcessId((HANDLE)i, &Eprocess);
if (NT_SUCCESS(status))
{
PUCHAR ProcessName = PsGetProcessImageFileName(Eprocess);
KdPrint(("进程PID:%d 进程名:%s \n", i, ProcessName));
ObDereferenceObject(Eprocess);
}
}
}
暂停进程和恢复进程
#include <ntifs.h>
#include <ntddk.h>
//需要自己申明 在XP下不可以用 需要用特征码搜索函数
NTSTATUS PsSuspendProcess(PEPROCESS Eprocess);
NTSTATUS PsResumeProcess(PEPROCESS Eprocess);
VOID ResumeProcess(HANDLE ProcessId)
{
PEPROCESS Eprocess;
NTSTATUS status = PsLookupProcessByProcessId(ProcessId, &Eprocess);
if (!NT_SUCCESS(status))
{
KdPrint(("进程对象查找失败,错误码:%x\n", status));
}
PsResumeProcess(Eprocess);
ObDereferenceObject(Eprocess);
}
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
KdPrint(("驱动卸载成功\n"));
ResumeProcess((HANDLE)2480);
}
NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);
VOID SuspendProcess(HANDLE ProcessId)
{
PEPROCESS Eprocess;
NTSTATUS status = PsLookupProcessByProcessId(ProcessId,&Eprocess);
if(!NT_SUCCESS(status))
{
KdPrint(("进程对象查找失败,错误码:%x\n",status));
}
PsSuspendProcess(Eprocess);
ObDereferenceObject(Eprocess);
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
NTSTATUS status = STATUS_SUCCESS;
pDriverObject->DriverUnload = DriverUnload;
SuspendProcess((HANDLE)2480);
KdPrint(("驱动加载成功\n"));
return status;
}
获取父进程ID
//获取父进程ID 申明后就可以使用
HANDLE PsGetProcessInheritedFromUniqueProcessId(PEPROCESS Eprocess);
结束进程
//参数为进程PID
NTSTATUS MyTerminateProcess(HANDLE ProcessId)
{
NTSTATUS status;
HANDLE hProcess;
CLIENT_ID ClientId = {0};
ClientId.UniqueProcess = ProcessId;
OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
status=ZwOpenProcess(&hProcess,PROCESS_ALL_ACCESS,&oa,&ClientId);
if(!NT_SUCCESS(status))
{
KdPrint(("进程打开失败\n"));
return status;
}
ZwTerminateProcess(hProcess,0);
return status;
}
枚举线程
#include "LoadFirst.h"
//根据进程结构获得进程名指针 需要自己申明一下。
NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
KdPrint(("驱动卸载成功\n"));
}
//枚举进程的线程数量
VOID EnumProcessThread(PEPROCESS Process)
{
ULONG i = 0;
PETHREAD pEthread;
ULONG ThreadCount = 0;
while (i<100000)
{
NTSTATUS status=PsLookupThreadByThreadId((HANDLE)i, &pEthread);
if (NT_SUCCESS(status))
{
//判断线程是否属于指定的进程
if (IoThreadToProcess(pEthread)==Process)
{
ThreadCount++;
}
ObDereferenceObject(pEthread);
}
i += 4;
}
KdPrint(("进程ID:%d 进程名%s 线程总数:%d\n", PsGetProcessId(Process), PsGetProcessImageFileName(Process), ThreadCount));
}
VOID EnumProcess()
{
ULONG i = 0;
for (i; i < 20000; i += 4)
{
NTSTATUS status = STATUS_SUCCESS;
PEPROCESS Eprocess;
status = PsLookupProcessByProcessId((HANDLE)i, &Eprocess);
if (NT_SUCCESS(status))
{
EnumProcessThread(Eprocess);
ObDereferenceObject(Eprocess);
}
}
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
NTSTATUS status = STATUS_SUCCESS;
pDriverObject->DriverUnload = DriverUnload;
EnumProcess();
return status;
}
暂停和恢复线程
PsSuspendThread 在xp和win7都可以使用 未导出 需要自己搜索
PsResumeThread只能在win7使用 可以使用ZwResumeThread来代替。也可以使用特征码搜索
结束线程
ZwTerminateRthread未导出,需要自己去搜索。