驱动层进程和线程操作

注意使用PsLookupProcessByProcessId或者PsLookupThreadByThreadId必须要调用ObDereferenceObject来释放引用

操作	对应函数
枚举进程	PsLookupProcessByProcessId
获取父进程ID	PsGetProcessInheritedFromUniqueProcessId
暂停进程	PsSuspendProcess
恢复进程	PsResumeProcess
结束进程	ZwTerminateProcess
枚举线程	PsLookupThreadByThreadId
暂停线程	PsSuspendThread
恢复线程	PsResumeThread
结束线程	PsLookupThreadByThreadId
枚举模块	枚举PEB.LDR的双向链表
卸载dll模块	MmUnmapViewOfSection

枚举进程

#include <ntifs.h>
#include <ntddk.h>
//根据进程结构获得进程名指针  需要自己申明一下。

NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);

VOID EnumProcess()
{
	ULONG i = 0;
	for (i; i < 20000; i += 4)
	{
		NTSTATUS status = STATUS_SUCCESS;
		PEPROCESS Eprocess;
		status = PsLookupProcessByProcessId((HANDLE)i, &Eprocess);
		if (NT_SUCCESS(status))
		{
			PUCHAR ProcessName = PsGetProcessImageFileName(Eprocess);
			KdPrint(("进程PID：%d  进程名：%s \n", i, ProcessName));
			ObDereferenceObject(Eprocess);
		}
	}
}

暂停进程和恢复进程

#include <ntifs.h>
#include <ntddk.h>
//需要自己申明  在XP下不可以用 需要用特征码搜索函数
NTSTATUS PsSuspendProcess(PEPROCESS Eprocess);
NTSTATUS PsResumeProcess(PEPROCESS Eprocess);


VOID ResumeProcess(HANDLE ProcessId)
{
	PEPROCESS Eprocess;
	NTSTATUS status = PsLookupProcessByProcessId(ProcessId, &Eprocess);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("进程对象查找失败,错误码：%x\n", status));

	}
	PsResumeProcess(Eprocess);
	ObDereferenceObject(Eprocess);
}

VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
	KdPrint(("驱动卸载成功\n"));
	ResumeProcess((HANDLE)2480);

}

NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);


VOID SuspendProcess(HANDLE ProcessId)
{
	PEPROCESS Eprocess;
	NTSTATUS status = PsLookupProcessByProcessId(ProcessId,&Eprocess);
	if(!NT_SUCCESS(status))
	{
		KdPrint(("进程对象查找失败,错误码：%x\n",status));
	
	}
		PsSuspendProcess(Eprocess);
		ObDereferenceObject(Eprocess);
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status = STATUS_SUCCESS;
	pDriverObject->DriverUnload = DriverUnload;
	SuspendProcess((HANDLE)2480);

	KdPrint(("驱动加载成功\n"));
	return status;
}

获取父进程ID

//获取父进程ID  申明后就可以使用
HANDLE PsGetProcessInheritedFromUniqueProcessId(PEPROCESS Eprocess);

结束进程

//参数为进程PID
NTSTATUS MyTerminateProcess(HANDLE ProcessId)
{
	NTSTATUS status;
	HANDLE hProcess;
	CLIENT_ID ClientId = {0};
	ClientId.UniqueProcess = ProcessId;
	OBJECT_ATTRIBUTES oa;
	InitializeObjectAttributes(&oa, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
	status=ZwOpenProcess(&hProcess,PROCESS_ALL_ACCESS,&oa,&ClientId);
	if(!NT_SUCCESS(status))
	{
		KdPrint(("进程打开失败\n"));
		return status;
	}
	ZwTerminateProcess(hProcess,0);
	return status;
}

枚举线程

#include "LoadFirst.h"

//根据进程结构获得进程名指针  需要自己申明一下。

NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
	KdPrint(("驱动卸载成功\n"));
}




//枚举进程的线程数量

VOID EnumProcessThread(PEPROCESS Process)
{
	ULONG i = 0;
	PETHREAD pEthread;
	ULONG ThreadCount = 0;
	while (i<100000)
	{
		
		NTSTATUS status=PsLookupThreadByThreadId((HANDLE)i, &pEthread);
		if (NT_SUCCESS(status))
		{
			//判断线程是否属于指定的进程
			if (IoThreadToProcess(pEthread)==Process)
			{
				ThreadCount++;
				
			}
			ObDereferenceObject(pEthread);
		}
		i += 4;
	}
	KdPrint(("进程ID：%d  进程名%s  线程总数：%d\n", PsGetProcessId(Process), PsGetProcessImageFileName(Process), ThreadCount));
	
}

VOID EnumProcess()
{
	ULONG i = 0;
	for (i; i < 20000; i += 4)
	{
		NTSTATUS status = STATUS_SUCCESS;
		PEPROCESS Eprocess;
		status = PsLookupProcessByProcessId((HANDLE)i, &Eprocess);
		if (NT_SUCCESS(status))
		{
			EnumProcessThread(Eprocess);
			ObDereferenceObject(Eprocess);
		}
	}
}



NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status = STATUS_SUCCESS;
	pDriverObject->DriverUnload = DriverUnload;
	EnumProcess();
	return status;
}

暂停和恢复线程

PsSuspendThread 在xp和win7都可以使用 未导出 需要自己搜索
PsResumeThread只能在win7使用 可以使用ZwResumeThread来代替。也可以使用特征码搜索

结束线程

ZwTerminateRthread未导出，需要自己去搜索。