ring0层监视进程与线程

项目属性--->链接器---->命令行的其他选项加入     /INTEGRITYCHECK 

#include <ntifs.h>
#include <ntddk.h>

VOID CreateProcessNotifyEx(
	_Inout_  PEPROCESS              Process,
	_In_     HANDLE                 ProcessId,
	_In_opt_ PPS_CREATE_NOTIFY_INFO CreateInfo
)
{
	if (CreateInfo!=NULL)
	{
		KdPrint(("进程%s创建 PID:%d\n", PsGetProcessImageFileName(Process),ProcessId));
	}
	else
	{
		KdPrint(("进程%s退出 PID:%d\n", PsGetProcessImageFileName(Process), ProcessId));
	}
}

VOID ThreadNotifyRoutine(
	IN HANDLE  ProcessId,
	IN HANDLE  ThreadId,
	IN BOOLEAN  Create
)
{
	PEPROCESS Process;
	PsLookupProcessByProcessId(ProcessId, &Process);
	if (Create)
	{
		KdPrint(("创建线程%s:%d tid=%d\n", PsGetProcessImageFileName(Process), ProcessId, ThreadId));
	}
	else
	{
		KdPrint(("消毁线程%s:%d tid=%d\n", PsGetProcessImageFileName(Process), ProcessId, ThreadId));
	}
}

VOID Unload(IN PDRIVER_OBJECT DriverObject)
{
	//移除回调
	PsRemoveCreateThreadNotifyRoutine(ThreadNotifyRoutine);
	PsSetCreateProcessNotifyRoutineEx(CreateProcessNotifyEx, TRUE);
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status;
	//注册回调
	status = PsSetCreateProcessNotifyRoutineEx(CreateProcessNotifyEx, FALSE);
	KdPrint(("驱动加载"));
	if (NT_SUCCESS(status))
	{
		status=PsSetCreateThreadNotifyRoutine(ThreadNotifyRoutine);
		if (NT_SUCCESS(status))
		{
			KdPrint(("注册成功\n"));
		}
		else
		{
			KdPrint(("注册失败%x\n", status));
		}
	}
	else
	{
		KdPrint(("注册失败%x\n", status));
	}
	DriverObject->DriverUnload = Unload;
	return STATUS_SUCCESS;
}