进程监控和线程监控

进程监控1

#include <ntifs.h>
#include<ntddk.h>

NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);


VOID
ProcessNotifyRoutine(
_In_ HANDLE ParentId,
_In_ HANDLE ProcessId,
_In_ BOOLEAN Create
)
{
	NTSTATUS status = 0;
	PEPROCESS process = NULL;

	if (Create == TRUE)
	{
		//创建进程回调
		status = PsLookupProcessByProcessId(ProcessId, &process);
		if (NT_SUCCESS(status))
		{
			KdPrint(("进程创建:%s\n", PsGetProcessImageFileName(process)));
		}
	}
	else
	{
		
		status=PsLookupProcessByProcessId(ProcessId, &process);
		if (NT_SUCCESS(status))
		{
			//结束进程回调
			if (_stricmp(PsGetProcessImageFileName(process), "qqq.exe") == 0)
			{
				DbgBreakPoint();
				KdPrint(("进程结束:%s\n", PsGetProcessImageFileName(process)));
			}
		}
		
	}

	if (process)
	{
		ObDereferenceObject(process);
		process = NULL;
	}
}

VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
	//移除进程回调
	//PsSetCreateProcessNotifyRoutineEx(ProcessNotifyRoutine, TRUE);
	PsSetCreateProcessNotifyRoutine(ProcessNotifyRoutine, TRUE);
	KdPrint(("驱动卸载成功\n"));
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status =STATUS_SUCCESS;
	pDriverObject->DriverUnload=DriverUnload;
	
	//添加进程回调
	PsSetCreateProcessNotifyRoutine(ProcessNotifyRoutine, FALSE);
	return status;

}

进程监控2

需要在链接器->命令行加上如下命令

/INTEGRITYCHECK 

使用软件CFF Explorer 可以看到Code Integrity Image被加上了

#include <ntifs.h>
#include<ntddk.h>

NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);

VOID
ProcessNotifyRoutineEx(
_Inout_ PEPROCESS Process,
_In_ HANDLE ProcessId,
_Inout_opt_ PPS_CREATE_NOTIFY_INFO CreateInfo
)
{
	if (CreateInfo!=NULL)
	{
		//创建进程回调
		
		KdPrint(("创建进程%wZ 父进程id%d\n",CreateInfo->ImageFileName,CreateInfo->ParentProcessId));
		if (!_stricmp(PsGetProcessImageFileName(Process),"calc.exe")==0)
		{
			CreateInfo->CreationStatus = STATUS_ACCESS_DENIED;
		}
	}
	else
	{
		//结束进程回调
		
		KdPrint(("进程结束:%s\n",PsGetProcessImageFileName(Process)));
	}
}


VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
	//移除进程回调
	//PsSetCreateProcessNotifyRoutineEx(ProcessNotifyRoutine, TRUE);
	PsSetCreateProcessNotifyRoutineEx(ProcessNotifyRoutineEx, TRUE);
	KdPrint(("驱动卸载成功\n"));
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status =STATUS_SUCCESS;
	pDriverObject->DriverUnload=DriverUnload;
	

	//xp下不能使用  需要WIN7以上
	status=PsSetCreateProcessNotifyRoutineEx(ProcessNotifyRoutineEx, FALSE);
	return status;

}

线程监控

当线程创建和销毁的时候，线程回调是运行在目标线程的线程上下文中的。

#include <ntifs.h>
#include<ntddk.h>

NTKERNELAPI
PUCHAR
PsGetProcessImageFileName(
IN PEPROCESS Process
);

VOID
CreateThreadRoutine(
_In_ HANDLE ProcessId,
_In_ HANDLE ThreadId,
_In_ BOOLEAN Create
)
{
	PEPROCESS pEprocess;
	NTSTATUS status=PsLookupProcessByProcessId(ProcessId,&pEprocess);
		if(!NT_SUCCESS(status))
		{
			KdPrint(("获取进程对象失败%x\n",status));	
			return ;
		}
	if (Create)
	{
		KdPrint(("进程：%s线程创建\n",PsGetProcessImageFileName(pEprocess)));
	} 
	else
	{
		KdPrint(("进程：%s线程销毁\n", PsGetProcessImageFileName(pEprocess)));
	}
}

VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{

	PsRemoveCreateThreadNotifyRoutine(CreateThreadRoutine);
	KdPrint(("驱动卸载成功\n"));
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status =STATUS_SUCCESS;
	pDriverObject->DriverUnload=DriverUnload;

	PsSetCreateThreadNotifyRoutine(CreateThreadRoutine);
	return status;

}