創建時間：2003-03-21
文章屬性：原創
文章來源：http://www.whitecell.org
文章提交：sinister (jiasys_at_21cn.com)

編寫進程/線程監視器


Author?? : sinister
Email??? : sinister@whitecell.org
HomePage: http://www.whitecell.org

（首先說明一下。有不少朋友來信問一些進程/線程監視工具是如何實現的。
我寫出來是為了讓那些朋友有進一步的了解，也省的我一封封的回MAIL。如果您
是 NT DRIVER熟手，那么此文提到的方法您可能早已掌握，完全可以略過不看。）

?? 有時候我們希望能夠動態監視系統中任意進程/線程的創建與銷毀。為了達
到此目的我翻閱了 DDK 手冊，發現其提供的 PsSetCreateProcessNotifyRoutine(),
PsSetCreateThreadNotifyRoutine(),等函數可以實現此功能。這兩個函數可以
通過向系統注冊一個 CALLBALCK 函數來監視進程/線程等操作。函數原形如下：

NTSTATUS
?? PsSetCreateProcessNotifyRoutine(
?? IN PCREATE_PROCESS_NOTIFY_ROUTINE?? NotifyRoutine,
?? IN BOOLEAN?? Remove
?? );

VOID
(*PCREATE_PROCESS_NOTIFY_ROUTINE) (
???? IN HANDLE?? ParentId,
???? IN HANDLE?? ProcessId,
???? IN BOOLEAN?? Create
???? );


NTSTATUS
?? PsSetCreateThreadNotifyRoutine(
?? IN PCREATE_THREAD_NOTIFY_ROUTINE?? NotifyRoutine
?? );

VOID
(*PCREATE_THREAD_NOTIFY_ROUTINE) (
???? IN HANDLE?? ProcessId,
???? IN HANDLE?? ThreadId,
???? IN BOOLEAN?? Create
???? );


通過原形可以看出，其 CALLBACK 函數只提供了進程ID/線程ID。并沒有提供
進程名。那么我們要進一步通過進程ID來獲取進程名。這需要用到一個未公開
的函數 PsLookupProcessByProcessId()。函數原形如下：

NTSTATUS PsLookupProcessByProcessId(
????? IN ULONG ulProcId,
????? OUT PEPROCESS * pEProcess
????? );

函數輸出的 EPROCESS 結構也是未公開的內核進程結構，很多人稱其為 KPEB。
EPROCESS 結構中的偏移 0x1FC 指向當前進程名的偏移。（這個結構雖然可以在
驅動程序中直接使用。但沒有公布其結構，網上有不少高手已將其結構給出。有
興趣可以自行搜索，或去 IFS DDK 中獲取，這里因為結構太長，就不貼出來了）
有了這個結構我們就可以從中得到進程名。NT系統還提供了一個函數可以動態監
視進程裝載映像。此函數可以得到進程加栽時所調用的 DLL 名稱與全路徑，還有
一些映像信息。為我們獲得更詳細的進程裝載信息提供了更好的幫助。

函數原形如下：

NTSTATUS
?? PsSetLoadImageNotifyRoutine(
?? IN PLOAD_IMAGE_NOTIFY_ROUTINE?? NotifyRoutine
?? );

VOID
(*PLOAD_IMAGE_NOTIFY_ROUTINE) (
???? IN PUNICODE_STRING?? FullImageName,
???? IN HANDLE?? ProcessId, // where image is mapped
???? IN PIMAGE_INFO?? ImageInfo
???? );

typedef struct?? _IMAGE_INFO {
???? union {
???????? ULONG?? Properties;
???????? struct {
???????????? ULONG ImageAddressingMode?? : 8; //code addressing mode
???????????? ULONG SystemModeImage?????? : 1; //system mode image
???????????? ULONG ImageMappedToAllPids : 1; //mapped in all processes
???????????? ULONG Reserved????????????? : 22;
???????? };
???? };
???? PVOID?? ImageBase;
???? ULONG?? ImageSelector;
???? ULONG?? ImageSize;
???? ULONG?? ImageSectionNumber;
} IMAGE_INFO, *PIMAGE_INFO;

利用以上提供的函數與結構，我們便能實現一個進程/線程監視器。下面這段
代碼演示了如何實現此功能。


/*****************************************************************
文件名???????? : WssProcMon.c
描述?????????? : 進程/線程監視器
作者?????????? : sinister
最后修改日期?? : 2002-11-02

*****************************************************************/

#include "ntddk.h"
#include "string.h"

#define ProcessNameOffset?? 0x1fc

static NTSTATUS?? MydrvDispatch (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS PsLookupProcessByProcessId(IN ULONG ulProcId, OUT PEPROCESS * pEProcess);
VOID ProcessCreateMon ( IN HANDLE?? hParentId, IN HANDLE PId,IN BOOLEAN bCreate);
VOID ThreadCreateMon (IN HANDLE?? PId, IN HANDLE TId, IN BOOLEAN?? bCreate);
VOID ImageCreateMon (IN PUNICODE_STRING?? FullImageName, IN HANDLE?? ProcessId, IN PIMAGE_INFO?? ImageInfo );


// 驅動入口
NTSTATUS?? DriverEntry( IN PDRIVER_OBJECT DriverObject,?? IN PUNICODE_STRING RegistryPath )
{
????
???? UNICODE_STRING?? nameString, linkString;
???? PDEVICE_OBJECT?? deviceObject;
???? NTSTATUS???????? status;
???? int???????????????? i;
????

???? //建立設備
???? RtlInitUnicodeString( &nameString, L"\\Device\\WssProcMon" );
????
???? status = IoCreateDevice( DriverObject,
????????????????????????????? 0,
????????????????????????????? &nameString,
????????????????????????????? FILE_DEVICE_UNKNOWN,
????????????????????????????? 0,
????????????????????????????? TRUE,
????????????????????????????? &deviceObject
??????????????????????????? );
???????????????????????????

???? if (!NT_SUCCESS( status ))
???????? return status;
????

???? RtlInitUnicodeString( &linkString, L"\\DosDevices\\WssProcMon" );

???? status = IoCreateSymbolicLink (&linkString, &nameString);

???? if (!NT_SUCCESS( status ))
???? {
???????? IoDeleteDevice (DriverObject->DeviceObject);
???????? return status;
???? }????
????
???? status = PsSetLoadImageNotifyRoutine(ImageCreateMon);
???? if (!NT_SUCCESS( status ))
???? {
???????? DbgPrint("PsSetLoadImageNotifyRoutine()\n");
???????? return status;
???? }????

???? status = PsSetCreateThreadNotifyRoutine(ThreadCreateMon);
???? if (!NT_SUCCESS( status ))
???? {
???????? DbgPrint("PsSetCreateThreadNotifyRoutine()\n");
???????? return status;
???? }????

???? status = PsSetCreateProcessNotifyRoutine(ProcessCreateMon, FALSE);
???? if (!NT_SUCCESS( status ))
???? {
???????? DbgPrint("PsSetCreateProcessNotifyRoutine()\n");
???????? return status;
???? }????
????

???? for ( i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)???? {

?????????? DriverObject->MajorFunction[i] = MydrvDispatch;
???? }
?????
?? return STATUS_SUCCESS;

}



//處理設備對象操作

static NTSTATUS MydrvDispatch (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
???? Irp->IoStatus.Status = STATUS_SUCCESS;
???? Irp->IoStatus.Information = 0L;
???? IoCompleteRequest( Irp, 0 );
???? return Irp->IoStatus.Status;
????
}


VOID ProcessCreateMon ( IN HANDLE hParentId, IN HANDLE PId,IN BOOLEAN bCreate )
{

???? PEPROCESS?? EProcess;
???? ULONG?????? ulCurrentProcessId;
???? LPTSTR??????? lpCurProc;
???? NTSTATUS??? status;

???? status = PsLookupProcessByProcessId( (ULONG)PId, &EProcess);
???? if (!NT_SUCCESS( status ))
???? {
???????? DbgPrint("PsLookupProcessByProcessId()\n");
???????? return ;
???? }
????

???? if ( bCreate )
???? {
?????????? lpCurProc = (LPTSTR)EProcess;
???????? lpCurProc = lpCurProc + ProcessNameOffset;

???????? DbgPrint( "CREATE PROCESS = PROCESS NAME: %s , PROCESS PARENTID: %d, PROCESS ID: %d, PROCESS ADDRESS %x:\n",
?????????????????????????????? lpCurProc,
?????????????????????????????? hParentId,
?????????????????????????????? PId,
?????????????????????????????? EProcess );
???? }
?????
???? else
???? {

???????? DbgPrint( "TERMINATED == PROCESS ID: %d\n", PId);

???? }

}

VOID ThreadCreateMon (IN HANDLE PId, IN HANDLE TId, IN BOOLEAN?? bCreate)
{

???? PEPROCESS??? EProcess;
???? ULONG???????? ulCurrentProcessId;
???? LPTSTR???????? lpCurProc;
???? NTSTATUS???? status;

???? status = PsLookupProcessByProcessId( (ULONG)PId, &EProcess);
???? if (!NT_SUCCESS( status ))
???? {
???????? DbgPrint("PsLookupProcessByProcessId()\n");
???????? return ;
???? }????

???? if ( bCreate )
???? {
?????????? lpCurProc???? = (LPTSTR)EProcess;
???????? lpCurProc???? = lpCurProc + ProcessNameOffset;

???????? DbgPrint( "CREATE THREAD = PROCESS NAME: %s PROCESS ID: %d, THREAD ID: %d\n", lpCurProc, PId, TId );
??????????????????????????????
???? }
?????
???? else
???? {

???????? DbgPrint( "TERMINATED == THREAD ID: %d\n", TId);

???? }

}

VOID ImageCreateMon (IN PUNICODE_STRING?? FullImageName, IN HANDLE?? ProcessId, IN PIMAGE_INFO?? ImageInfo )
{
???? DbgPrint("FullImageName: %S,Process ID: %d\n",FullImageName->Buffer,ProcessId);
???? DbgPrint("ImageBase: %x,ImageSize: %d\n",ImageInfo->ImageBase,ImageInfo->ImageSize);

}