qq空间老贴转载-32位win下进程创建的拦截

元始天尊

32位win下进程创建的拦截

1. 驱动部分：
   
2. 
   
3. 
   
4. 
   
5. #include "Driver.h"
   
6. #define
   
7. SYSNAME "System"
   
8. #define VERSIONLEN 100
   
9. 
   
10. const WCHAR devLink[]  =
    
11. L"\\??\\MyEvent";
    
12. const WCHAR devName[]  =
    
13. L"\\Device\\MyEvent";
    
14. UNICODE_STRING   
    
15. devNameUnicd;
    
16. UNICODE_STRING   
    
17. devLinkUnicd;
    
18. PVOID     gpEventObject =
    
19. NULL;            //
    
20. 与应用程序通信的 Event 对象
    
21. HANDLE     
    
22. outBuf;
    
23. BOOLEAN     BeginLog=FALSE;
    
24. [/align]
    
25. [p=30, 2, left]#pragma
    
26. code_seg("INIT")
    
27. extern "C" NTSTATUS DriverEntry(__in PDRIVER_OBJECT
    
28. pDriverObject,__in PUNICODE_STRING RegistryPath)
    
29. {
    
30. 
    
31. NTSTATUS    Status;   
    
32. 
    
33. PDEVICE_OBJECT   pDevice;
    
34. 
    
35. KdPrint(("DriverEntry
    
36. called!\n"));
    
37. UNREFERENCED_PARAMETER(RegistryPath);
    
38. RtlInitUnicodeString
    
39. (&devNameUnicd, devName );
    
40. RtlInitUnicodeString (&devLinkUnicd,
    
41. devLink );
    
42. 
    
43. Status = IoCreateDevice
    
44. (pDriverObject,0,&devNameUnicd,FILE_DEVICE_UNKNOWN,0,TRUE,&pDevice);
    
45. 
    
46. if( !NT_SUCCESS(Status))
    
47. {
    
48.   KdPrint(("Can not create
    
49. device.\n"));
    
50.   return Status;
    
51. }
    
52. 
    
53. Status =
    
54. IoCreateSymbolicLink (&devLinkUnicd, &devNameUnicd);
    
55. if(
    
56. !NT_SUCCESS(Status))
    
57. {
    
58.   KdPrint(("Cannot create
    
59. link.\n"));
    
60.   return Status;
    
61. }
    
62. 
    
63. 
    
64. pDriverObject->DriverUnload  = (PDRIVER_UNLOAD)OnUnload;
    
65. 
    
66. pDriverObject->MajorFunction[IRP_MJ_CREATE] =
    
67. 
    
68. pDriverObject->MajorFunction[IRP_MJ_CLOSE] =
    
69. 
    
70. pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] =
    
71. DeviceIoControlDispatch;
    
72. 
    
73. Status =
    
74. PsSetCreateProcessNotifyRoutine(ProcessCreateMon, FALSE);
    
75. if (!NT_SUCCESS(
    
76. Status ))
    
77. {
    
78.   
    
79. KdPrint(("PsSetCreateProcessNotifyRoutine()\n"));
    
80.   return Status;
    
81. 
    
82. }
    
83. 
    
84. if (!NT_SUCCESS( Status ))
    
85. {
    
86.   
    
87. KdPrint(("PsSetCreateThreadNotifyRoutine()\n"));
    
88.   return Status;
    
89. 
    
90. }
    
91. 
    
92. return STATUS_SUCCESS;
    
93. }
    
94. #pragma code_seg()
    
95. 
    
96. VOID
    
97. ProcessCreateMon(HANDLE hParentId,HANDLE PId,BOOLEAN bCreate)
    
98. {
    
99. 
    
100. NTSTATUS        status;
     
101. 
     
102. HANDLE            
     
103. TId;
     
104. 
     
105. PAGED_CODE();
     
106. 
     
107. UNREFERENCED_PARAMETER(hParentId);
     
108. 
     
109. if(!BeginLog)
     
110. {
     
111.   UNREFERENCED_PARAMETER(PId);
     
112.   
     
113. UNREFERENCED_PARAMETER(bCreate);
     
114.   return;
     
115. }
     
116. 
     
117. if ( bCreate
     
118. )
     
119. {
     
120.   outBuf=PId;
     
121.   if(gpEventObject!=NULL)
     
122.    
     
123. KeSetEvent((PRKEVENT)gpEventObject, 0, FALSE);
     
124. }
     
125. //  
     
126. else//进程退出事件
     
127. //  {
     
128. //
     
129. //  }
     
130. }
     
131. 
     
132. NTSTATUS OnUnload(
     
133. IN PDRIVER_OBJECT pDriverObject )
     
134. {
     
135. 
     
136. NTSTATUS            
     
137. status;
     
138. KdPrint(("OnUnload called\n"));
     
139. 
     
140. PAGED_CODE();
     
141. 
     
142. if(gpEventObject)
     
143.   ObDereferenceObject(gpEventObject);
     
144. 
     
145. PsSetCreateProcessNotifyRoutine(ProcessCreateMon, TRUE);
     
146. 
     
147. if(pDriverObject->DeviceObject != NULL)
     
148. {
     
149.   
     
150. status=IoDeleteSymbolicLink( &devLinkUnicd );
     
151.   if ( !NT_SUCCESS(
     
152. status ) )
     
153.   {
     
154.    KdPrint((  "IoDeleteSymbolicLink()
     
155. failed\n" ));
     
156.    return status;
     
157.   }
     
158.   
     
159. IoDeleteDevice( pDriverObject->DeviceObject );
     
160. }
     
161. return
     
162. STATUS_SUCCESS;
     
163. }
     
164. 
     
165. NTSTATUS DeviceIoControlDispatch(IN  
     
166. PDEVICE_OBJECT  DeviceObject,IN  PIRP pIrp)
     
167. {
     
168. PVOID
     
169. inputBuffer;
     
170. ULONG inputLength;
     
171. PVOID outputBuffer;
     
172. ULONG
     
173. outputLength;
     
174. OBJECT_HANDLE_INFORMATION objHandleInfo;
     
175. 
     
176. NTSTATUS
     
177. status=STATUS_SUCCESS;
     
178. UNREFERENCED_PARAMETER(DeviceObject);
     
179. 
     
180. 
     
181. PAGED_CODE();
     
182. KdPrint(("Enter DeviceIOControl\n"));
     
183. PIO_STACK_LOCATION
     
184. stack=IoGetCurrentIrpStackLocation(pIrp);
     
185. ULONG
     
186. cbin=stack->Parameters.DeviceIoControl.InputBufferLength;
     
187. ULONG
     
188. cbout=stack->Parameters.DeviceIoControl.OutputBufferLength;
     
189. 
     
190. 
     
191. switch(stack->MajorFunction)
     
192. {
     
193.   case IRP_MJ_CREATE
     
194. :
     
195.    KdPrint(("Call IRP_MJ_CREATE\n"));
     
196.    
     
197. BeginLog=TRUE;
     
198.    break;
     
199. 
     
200.   case
     
201. IRP_MJ_CLOSE:
     
202.    BeginLog=FALSE;
     
203.    KdPrint(("Call
     
204. IRP_MJ_CLOSE\n"));
     
205.    break;
     
206. 
     
207.   case
     
208. IRP_MJ_DEVICE_CONTROL:
     
209.    
     
210. KdPrint(("IRP_MJ_DEVICE_CONTROL\n"));
     
211.    
     
212. inputLength=stack->Parameters.DeviceIoControl.InputBufferLength;
     
213.    
     
214. outputLength=stack->Parameters.DeviceIoControl.OutputBufferLength;
     
215. 
     
216. 
     
217.    switch (stack->Parameters.DeviceIoControl.IoControlCode)
     
218. 
     
219.    {
     
220.     case IOCTL_PASSEVENT:   
     
221. //用事件做通信
     
222.      inputBuffer =
     
223. pIrp->AssociatedIrp.SystemBuffer;
     
224. 
     
225.      
     
226. KdPrint(("inputBuffer:%08x\n",
     
227. (HANDLE)inputBuffer));
     
228.      status =
     
229. ObReferenceObjectByHandle(*(HANDLE
     
230. *)inputBuffer,GENERIC_ALL,NULL,KernelMode,&gpEventObject,&objHandleInfo);//获取事件句柄对应指针
     
231. 
     
232. 
     
233.      
     
234. if(status!=STATUS_SUCCESS)
     
235.      
     
236. {
     
237.       KdPrint(("gethandle
     
238. error!"));
     
239.       break;
     
240.      
     
241. }
     
242.      break;
     
243. 
     
244.     case
     
245. IOCTL_UNPASSEVENT:
     
246.      
     
247. if(gpEventObject)
     
248.      
     
249. {
     
250.       ObDereferenceObject(gpEventObject);
     
251. 
     
252.       
     
253. gpEventObject=NULL;
     
254.      }
     
255.      
     
256. KdPrint(("unpassevent"));
     
257.      break;
     
258. 
     
259. 
     
260.     case IOCTL_PASSBUF:
     
261.      
     
262. RtlCopyMemory(pIrp->UserBuffer, &outBuf,
     
263. outputLength);
     
264.      break;
     
265. 
     
266.    
     
267. default:
     
268.      break;
     
269.    }
     
270.    
     
271. break;
     
272. 
     
273.   default:
     
274.    
     
275. KdPrint(("defaultcall"));
     
276.    
     
277. status=STATUS_INVALID_VARIANT;
     
278.    break;
     
279. }
     
280. 
     
281. pIrp->IoStatus.Status=status;
     
282. pIrp->IoStatus.Information=0;
     
283. 
     
284. IoCompleteRequest(pIrp,IO_NO_INCREMENT);
     
285. KdPrint(("Leave
     
286. DispatchRoutine\n"));
     
287. return status;
     
288. }[/p]
     
289. [p=30, 2, left]
     
290. 
     
291. 
     
292. 应用层部分：
     
293. 
     
294. 
     
295. #include <windows.h>
     
296. #include <winsvc.h>  
     
297. #include
     
298. <conio.h>  
     
299. #include <stdio.h>
     
300. #include "define.h"
     
301. 
     
302. 
     
303. //装载NT驱动程序
     
304. BOOL LoadNTDriver(char* lpszDriverName,char*
     
305. lpszDriverPath)
     
306. {
     
307. char szDriverImagePath[256];
     
308. //得到完整的驱动路径
     
309. 
     
310. GetFullPathName(lpszDriverPath, 256, szDriverImagePath, NULL);
     
311. 
     
312. BOOL
     
313. bRet = FALSE;
     
314. 
     
315. SC_HANDLE hServiceMgr=NULL;//SCM管理器的句柄
     
316. SC_HANDLE
     
317. hServiceDDK=NULL;//NT驱动程序的服务句柄
     
318. 
     
319. //打开服务控制管理器
     
320. hServiceMgr =
     
321. OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );
     
322. 
     
323. if( hServiceMgr ==
     
324. NULL )  
     
325. {
     
326.   //OpenSCManager失败
     
327.   printf(
     
328. "OpenSCManager() Faild %d ! \n", GetLastError() );
     
329.   bRet =
     
330. FALSE;
     
331.   goto BeforeLeave;
     
332. }
     
333. else
     
334. {
     
335.   
     
336. ////OpenSCManager成功
     
337.   printf( "OpenSCManager() ok ! \n" );  
     
338. 
     
339. }
     
340. 
     
341. //创建驱动所对应的服务
     
342. hServiceDDK = CreateService( hServiceMgr,
     
343.   
     
344. lpszDriverName, //驱动程序的在注册表中的名字  
     
345.   lpszDriverName, // 注册表驱动程序的
     
346. DisplayName 值  
     
347.   SERVICE_ALL_ACCESS, // 加载驱动程序的访问权限  
     
348. 
     
349.   SERVICE_KERNEL_DRIVER,// 表示加载的服务是驱动程序  
     
350.   
     
351. SERVICE_DEMAND_START, // 注册表驱动程序的 Start 值  
     
352.   SERVICE_ERROR_IGNORE,
     
353. // 注册表驱动程序的 ErrorControl 值  
     
354.   szDriverImagePath, // 注册表驱动程序的
     
355. ImagePath 值  
     
356.   NULL,  
     
357.   NULL,  
     
358.   
     
359. NULL,  
     
360.   NULL,  
     
361.   NULL);  [/p]
     
362. [p=30, 2, left] DWORD
     
363. dwRtn;
     
364. //判断服务是否失败
     
365. if( hServiceDDK == NULL )  
     
366. {  
     
367. 
     
368.   dwRtn = GetLastError();
     
369.   if( dwRtn != ERROR_IO_PENDING
     
370. && dwRtn != ERROR_SERVICE_EXISTS )  
     
371.   {  
     
372. 
     
373.    //由于其他原因创建服务失败
     
374.    printf( "CrateService() Faild %d
     
375. ! \n", dwRtn );  
     
376.    bRet = FALSE;
     
377.    goto
     
378. BeforeLeave;
     
379.   }  
     
380.   else  
     
381.   
     
382. {
     
383.    //服务创建失败，是由于服务已经创立过
     
384.    printf( "CreateService()
     
385. Faild Service is ERROR_IO_PENDING or ERROR_SERVICE_EXISTS! \n" );  
     
386. 
     
387.   }
     
388. 
     
389.   // 驱动程序已经加载，只需要打开  
     
390.   hServiceDDK =
     
391. OpenService( hServiceMgr, lpszDriverName, SERVICE_ALL_ACCESS );  
     
392.   
     
393. if( hServiceDDK == NULL )  
     
394.   {
     
395.    
     
396. //如果打开服务也失败，则意味错误
     
397.    dwRtn = GetLastError();  
     
398.    
     
399. printf( "OpenService() Faild %d ! \n", dwRtn );  
     
400.    bRet =
     
401. FALSE;
     
402.    goto BeforeLeave;
     
403.   }  
     
404.   else
     
405. 
     
406.   {
     
407.    printf( "OpenService() ok ! \n" );
     
408.   }
     
409. 
     
410. }  
     
411. else  
     
412. {
     
413.   printf( "CreateService() ok ! \n"
     
414. );
     
415. }
     
416. 
     
417. //开启此项服务
     
418. bRet= StartService( hServiceDDK, NULL, NULL
     
419. );  
     
420. if( !bRet )  
     
421. {  
     
422.   DWORD dwRtn =
     
423. GetLastError();  
     
424.   if( dwRtn != ERROR_IO_PENDING && dwRtn
     
425. != ERROR_SERVICE_ALREADY_RUNNING )  
     
426.   {  
     
427.    
     
428. printf( "StartService() Faild %d ! \n", dwRtn );  
     
429.    bRet =
     
430. FALSE;
     
431.    goto BeforeLeave;
     
432.   }  
     
433.   else  
     
434. 
     
435.   {  
     
436.    if( dwRtn == ERROR_IO_PENDING )  
     
437. 
     
438.    {  
     
439.     //设备被挂住
     
440.    
     
441. printf( "StartService() Faild ERROR_IO_PENDING ! \n");
     
442.    
     
443. bRet = FALSE;
     
444.     goto BeforeLeave;
     
445.    }  
     
446. 
     
447.    else  
     
448.    {  
     
449.    
     
450. //服务已经开启
     
451.     printf( "StartService() Faild
     
452. ERROR_SERVICE_ALREADY_RUNNING ! \n");
     
453.     bRet =
     
454. TRUE;
     
455.     goto BeforeLeave;
     
456.    }  
     
457.   
     
458. }  
     
459. }
     
460. bRet = TRUE;
     
461. //离开前关闭句柄
     
462. BeforeLeave:
     
463. 
     
464. if(hServiceDDK)
     
465. {
     
466.   CloseServiceHandle(hServiceDDK);
     
467. }
     
468. 
     
469. if(hServiceMgr)
     
470. {
     
471.   CloseServiceHandle(hServiceMgr);
     
472. }
     
473. 
     
474. return bRet;
     
475. }
     
476. 
     
477. //卸载驱动程序  
     
478. BOOL UnloadNTDriver( char *
     
479. szSvrName )  
     
480. {
     
481. BOOL bRet = FALSE;
     
482. SC_HANDLE
     
483. hServiceMgr=NULL;//SCM管理器的句柄
     
484. SC_HANDLE hServiceDDK=NULL;//NT驱动程序的服务句柄
     
485. 
     
486. SERVICE_STATUS SvrSta;
     
487. //打开SCM管理器
     
488. hServiceMgr = OpenSCManager( NULL,
     
489. NULL, SC_MANAGER_ALL_ACCESS );  
     
490. if( hServiceMgr == NULL )  
     
491. 
     
492. {
     
493.   //带开SCM管理器失败
     
494.   printf( "OpenSCManager() Faild %d ! \n",
     
495. GetLastError() );  
     
496.   bRet = FALSE;
     
497.   goto BeforeLeave;
     
498. 
     
499. }  
     
500. else  
     
501. {
     
502.   //带开SCM管理器失败成功
     
503.   printf(
     
504. "OpenSCManager() ok ! \n" );  
     
505. }
     
506. //打开驱动所对应的服务
     
507. hServiceDDK =
     
508. OpenService( hServiceMgr, szSvrName, SERVICE_ALL_ACCESS );  
     
509. 
     
510. if(
     
511. hServiceDDK == NULL )  
     
512. {
     
513.   //打开驱动所对应的服务失败
     
514.   printf(
     
515. "OpenService() Faild %d ! \n", GetLastError() );  
     
516.   bRet =
     
517. FALSE;
     
518.   goto BeforeLeave;
     
519. }  
     
520. else  
     
521. {  
     
522. 
     
523.   printf( "OpenService() ok ! \n" );  
     
524. }  
     
525. 
     
526. //停止驱动程序，如果停止失败，只有重新启动才能，再动态加载。  
     
527. if( !ControlService( hServiceDDK,
     
528. SERVICE_CONTROL_STOP , &SvrSta ) )  
     
529. {  
     
530.   printf(
     
531. "ControlService() Faild %d !\n", GetLastError() );  
     
532. }  
     
533. 
     
534. else  
     
535. {
     
536.   //打开驱动所对应的失败
     
537.   printf( "ControlService() ok
     
538. !\n" );  
     
539. }  
     
540. //动态卸载驱动程序。  
     
541. if( !DeleteService(
     
542. hServiceDDK ) )  
     
543. {
     
544.   //卸载失败
     
545.   printf( "DeleteSrevice()
     
546. Faild %d !\n", GetLastError() );  
     
547. }  
     
548. else  
     
549. {  
     
550. 
     
551.   //卸载成功
     
552.   printf( "DelServer:eleteSrevice() ok !\n" );  
     
553. 
     
554. }  
     
555. bRet = TRUE;
     
556. BeforeLeave:
     
557. //离开前关闭打开的句柄
     
558. 
     
559. if(hServiceDDK)
     
560. {
     
561.   CloseServiceHandle(hServiceDDK);
     
562. }
     
563. 
     
564. if(hServiceMgr)
     
565. {
     
566.   CloseServiceHandle(hServiceMgr);
     
567. }
     
568. 
     
569. return bRet;
     
570. } [/p]
     
571. [p=30, 2, left]int test()
     
572. {
     
573. HANDLE  
     
574. hDevice;     
     
575.     BOOL  status;
     
576. 
     
577.     HANDLE  m_hCommEvent;
     
578.    
     
579. ULONG  dwReturn;
     
580. HANDLE  PID;
     
581. 
     
582.     hDevice =
     
583. NULL;
     
584.     m_hCommEvent = NULL;
     
585.     hDevice =
     
586. CreateFile(
     
587. "\\\\.\\MyEvent",GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,
     
588. 
     
589.       
     
590. NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
     
591.     if(hDevice
     
592. == INVALID_HANDLE_VALUE)
     
593.    
     
594. {
     
595.         printf("createfile
     
596. wrong\n");
     
597.         
     
598. getchar();
     
599.         return
     
600. 0;
     
601.     }
     
602. 
     
603.     m_hCommEvent =
     
604. CreateEvent(NULL,false,false,NULL);
     
605.     printf("hEvent:%d\n",
     
606. m_hCommEvent);
     
607. 
     
608.     status
     
609. =DeviceIoControl(hDevice,IOCTL_PASSEVENT,&m_hCommEvent,sizeof(m_hCommEvent),NULL,0,&dwReturn,NULL);
     
610. 
     
611.     if( !status)
     
612.    
     
613. {
     
614.         printf("IO wrong+%d\n",
     
615. GetLastError());
     
616.         
     
617. getchar();
     
618.         return
     
619. 0;
     
620.     }
     
621.   
     
622.     printf("[Process
     
623. PID]:\n");
     
624.     while(1)
     
625.    
     
626. {
     
627.         if(getchar() == 'q')
     
628. 
     
629.    break;
     
630.         
     
631. ResetEvent(m_hCommEvent);
     
632.         
     
633. WaitForSingleObject(m_hCommEvent,INFINITE);
     
634.         
     
635. status
     
636. =DeviceIoControl(hDevice,IOCTL_PASSBUF,NULL,0,&PID,sizeof(HANDLE),&dwReturn,NULL);
     
637. 
     
638.         if(
     
639. !status)
     
640.         
     
641. {
     
642.             
     
643. printf("IO wrong+%d\n", GetLastError());
     
644. 
     
645. 
     
646.             return
     
647. 0;
     
648.         }
     
649. 
     
650. 
     
651.         printf("%d\n",PID);
     
652.   
     
653. if(!OpenProcess(PROCESS_ALL_ACCESS,FALSE,(DWORD)PID))
     
654.    
     
655. printf("OpenProcess Error\n");
     
656.     }
     
657. 
     
658. 
     
659.     status
     
660. =DeviceIoControl(hDevice,IOCTL_UNPASSEVENT,NULL,0,NULL,0,&dwReturn,NULL);
     
661. 
     
662.     if( !status)
     
663.    
     
664. {
     
665.         printf("UNPASSEVENT wrong+%d\n",
     
666. GetLastError());
     
667.         
     
668. getchar();
     
669.         return
     
670. 0;
     
671.     }
     
672. 
     
673.     status = CloseHandle(
     
674. hDevice );
     
675.     status =
     
676. CloseHandle(m_hCommEvent);
     
677.    
     
678. getchar();
     
679.     return 0;
     
680. }
     
681. 
     
682. void main()
     
683. {
     
684. 
     
685. //加载驱动
     
686. BOOL bRet = LoadNTDriver(DRIVER_NAME,DRIVER_PATH);
     
687. // if
     
688. (!bRet)
     
689. {
     
690. //  printf("LoadNTDriver error\n");
     
691. //  goto
     
692. unload;
     
693. }
     
694. //加载成功
     
695. 
     
696. printf( "press q to quit!\n" );   
     
697. 
     
698. 
     
699. test();
     
700. 
     
701. //这时候你可以通过注册表，或其他查看符号连接的软件验证。  
     
702. printf(
     
703. "press any to unload the driver!\n" );  
     
704. getch();  
     
705. 
     
706. 
     
707. unload:
     
708. //卸载驱动
     
709. UnloadNTDriver(DRIVER_NAME);
     
710. if (!bRet)
     
711. 
     
712. {
     
713.   printf("UnloadNTDriver error\n");
     
714.   return;
     
715. 
     
716. 
     
717. [/p]
     
718. [align=left]}
     
719. 
     
720. }
     
721. 
     
722. 
     

复制代码

夜雨

看不懂，收下了先~！