1 BOOL ProtectProcess() 2 { 3 HANDLE hDLL; 4 RtlSetProcessIsCritical fSetCritical; 5 6 hDLL = LoadLibraryA("ntdll.dll"); 7 if ( hDLL != NULL ) 8 { 9 EnablePriv(SE_DEBUG_NAME); 10 (fSetCritical) = (RtlSetProcessIsCritical) GetProcAddress( (HINSTANCE)hDLL, "RtlSetProcessIsCritical" ); 11 if(!fSetCritical) return 0; 12 fSetCritical(1,0,0); 13 return 1; 14 } else 15 return 0; 16 }
在程序中加上这两行代码,可以把当前进程设为临界进程。结束该进程则会系统蓝屏。
看一下RtlSetProcessIsCritical的实现
1 if ( ARGUMENT_PRESENT(OldValue) ) { 2 NtQueryInformationProcess(NtCurrentProcess(), 3 ProcessBreakOnTermination, 4 &Enable, 5 sizeof(Enable), 6 NULL); 7 8 *OldValue = (BOOLEAN) Enable; 9 } 10 11 Enable = NewValue; 12 13 Status = NtSetInformationProcess(NtCurrentProcess(), 14 ProcessBreakOnTermination, 15 &Enable, 16 sizeof(Enable));
调用NtSetInformationProcess对EPROCESS->Flags位设ProcessBreakOnTermination标志
那么在NtTerminateProcess函数中 会检查Process->Flags
1 if (Process->Flags & PS_PROCESS_FLAGS_BREAK_ON_TERMINATION) { 2 PspCatchCriticalBreak ("Terminating critical process 0x%p (%s)\n", 3 Process, 4 Process->ImageFileName); 5 }
PspCatchCriticalBreak 调用KeBugCheckEx触发蓝屏
1 if (!Handled) { 2 // 3 // No debugger -- bugcheck immediately 4 // 5 KeBugCheckEx(CRITICAL_OBJECT_TERMINATION, 6 (ULONG_PTR) ((DISPATCHER_HEADER *)Object)->Type, 7 (ULONG_PTR) Object, 8 (ULONG_PTR) ImageFileName, 9 (ULONG_PTR) Msg); 10 }
RtlSetThreadIsCritical 也是类似。在PspTerminateThreadByPointer函数中检查Thread->CrossThreadFlags