关于PsCreateSystemThread函数
研究了1天这个。。。MSDN说的不是很清楚NTSTATUS PsCreateSystemThread(
_Out_ PHANDLE ThreadHandle,
_In_ ULONG DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ HANDLE ProcessHandle,
_Out_opt_PCLIENT_ID ClientId,
_In_ PKSTART_ROUTINE StartRoutine,
_In_opt_ PVOID StartContext
);
该函数用于创建系统线程，ProcessHandle参数接收NULL, NtCurrentProcess() (-1) ,或指定进程句柄 三种情况都可以用PsTerminateSystemThread结束掉
示例：
VOID MyThread(PVOID StartContext)
{
PEPROCESS pp=IoGetCurrentProcess();
NTSTATUS status=PsTerminateSystemThread(0);
//以下实际上已经不执行了
if(status == STATUS_INVALID_PARAMETER)
{
KdPrint(("not systemthread"));
}
}
HANDLE OpenProcess(HANDLEProcessid)
{
NTSTATUS status;
PEPROCESS Process = NULL;
HANDLE hProcess = NULL;
UNICODE_STRING Unicode;
status = PsLookupProcessByProcessId(Processid, &Process);
if (NT_SUCCESS(status))//判断进程号是否存在
{
RtlInitUnicodeString(&Unicode, L"PsProcessType");
//得到系统导出函数的地址和用户态的GetProcessAddress雷同
PsProcessType = (POBJECT_TYPE*)MmGetSystemRoutineAddress(&Unicode);
if (PsProcessType)
{
status = ObOpenObjectByPointer(Process,0,NULL,PROCESS_ALL_ACCESS,(POBJECT_TYPE) * PsProcessType,
KernelMode,&hProcess);
if (NT_SUCCESS(status))
{
//减少指针计数
ObfDereferenceObject(Process);
return hProcess;
}
}
ObfDereferenceObject(Process);
}
return 0;
}
HANDLE outthread1,,outthread2,outthread3,outthread4,hproc;
PsCreateSystemThread(&outthread1,THREAD_ALL_ACCESS,NULL,NULL,NULL,MyThread,NULL);
PsCreateSystemThread(&outthread2,THREAD_ALL_ACCESS,NULL,NtCurrentProcess(),NULL,MyThread,NULL);
OBJECT_ATTRIBUTES oa;
CLIENT_ID ci={(HANDLE)1472,0};//注意是进程ID！
RtlZeroMemory(&oa,sizeof(oa));
oa.Length=sizeof(oa);
ZwOpenProcess(&hproc,PROCESS_ALL_ACCESS,&oa,&ci);
PsCreateSystemThread(&outthread3,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL);
hproc=OpenProcess((HANDLE)1472);//注意是进程ID！
PsCreateSystemThread(&outthread4,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL);
该函数创建的线程，其PETHRAD属性的CrossThreadFlags有PS_CROSS_THREAD_FLAGS_SYSTEM属性，不允许以挂起模式创建线程，，其他和普通的NtCreateThread差别不大！
然而在微软官方源码中，PS_CROSS_THREAD_FLAGS_SYSTEM属性即为SystemThread，尽管其所属进程可能是explorer.exe
页:
[1]