7.1.进程回调
DriverMain.c
#include <ntifs.h>
PUCHAR PsGetProcessImageFileName(PEPROCESS Process);
//创建进程回调函数
VOID CreateProcessListen(
_In_ HANDLE ParentId,
_In_ HANDLE ProcessId,
_In_ BOOLEAN Create
)
{
PEPROCESS Process = NULL;
NTSTATUS status = PsLookupProcessByProcessId(ProcessId, &Process);
if (!NT_SUCCESS(status))
{
return;
}
//创建进程
if (Create)
{
DbgPrintEx(77,0,"[db]:%s 创建了\r\n", PsGetProcessImageFileName(Process));
}
else
{
DbgPrintEx(77, 0, "[db]:%s 退出了\r\n", PsGetProcessImageFileName(Process));
}
ObDereferenceObject(Process);
}
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
PsSetCreateProcessNotifyRoutine(CreateProcessListen, TRUE);
DbgPrint("卸载驱动\r\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg)
{
//创建进程回调
PsSetCreateProcessNotifyRoutine(CreateProcessListen,FALSE);
pDriver->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}修改PspNotifyEnableMask为00000009，创建和退出进程时就不会触发回调
kd> dd PspNotifyEnableMask
83f4c838 0000000b 00000000 8ad0e54f 00000000
83f4c848 00000000 00000000 00000000 00000000
83f4c858 00000000 00000000 00000000 00000000
83f4c868 00000000 00000000 00000000 00000000
83f4c878 00000000 00000000 00000000 00000000
83f4c888 00000000 00000000 00000000 00000000
83f4c898 00000000 00000000 00000000 00000000
83f4c8a8 00000000 00000000 00000000 00000000
kd> ed 83f4c838 00000009
kd> g
7.2.线程回调
DriverMain.c
#include <ntifs.h>
PUCHAR PsGetProcessImageFileName(PEPROCESS Process);
VOID CreateProcessListen(
_In_ HANDLE ParentId,
_In_ HANDLE ProcessId,
_In_ BOOLEAN Create
)
{
PEPROCESS Process = NULL;
NTSTATUS status = PsLookupProcessByProcessId(ProcessId, &Process);
if (!NT_SUCCESS(status))
{
return;
}
//创建进程
if (Create)
{
DbgPrintEx(77,0,"[db]:%s 创建了\r\n", PsGetProcessImageFileName(Process));
}
else
{
DbgPrintEx(77, 0, "[db]:%s 退出了\r\n", PsGetProcessImageFileName(Process));
}
ObDereferenceObject(Process);
}
VOID createThreadListen(
_In_ HANDLE ProcessId,
_In_ HANDLE ThreadId,
_In_ BOOLEAN Create
)
{
if (Create)
{
DbgPrintEx(77, 0, "[db]线程创建了\r\n");
}
else
{
DbgPrintEx(77, 0, "[db]线程结束了\r\n");
}
}
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
//PsSetCreateProcessNotifyRoutine(CreateProcessListen, TRUE);
PsRemoveCreateThreadNotifyRoutine(createThreadListen);
DbgPrint("卸载驱动\r\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg)
{
//PsSetCreateProcessNotifyRoutine(CreateProcessListen,FALSE);
PsSetCreateThreadNotifyRoutine(createThreadListen);
pDriver->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}修改PspNotifyEnableMask为00000007,创建和退出线程时就不会触发回调
7.3.模块回调
DriverMain.c
#include <ntifs.h>
PUCHAR PsGetProcessImageFileName(PEPROCESS Process);
VOID CreateProcessListen(
_In_ HANDLE ParentId,
_In_ HANDLE ProcessId,
_In_ BOOLEAN Create
)
{
PEPROCESS Process = NULL;
NTSTATUS status = PsLookupProcessByProcessId(ProcessId, &Process);
if (!NT_SUCCESS(status))
{
return;
}
//创建进程
if (Create)
{
DbgPrintEx(77,0,"[db]:%s 创建了\r\n", PsGetProcessImageFileName(Process));
}
else
{
DbgPrintEx(77, 0, "[db]:%s 退出了\r\n", PsGetProcessImageFileName(Process));
}
ObDereferenceObject(Process);
}
VOID createThreadListen(
_In_ HANDLE ProcessId,
_In_ HANDLE ThreadId,
_In_ BOOLEAN Create
)
{
if (Create)
{
DbgPrintEx(77, 0, "[db]线程创建了\r\n");
}
else
{
DbgPrintEx(77, 0, "[db]线程结束了\r\n");
}
}
VOID LoadImageListen(
_In_opt_ PUNICODE_STRING FullImageName,
_In_ HANDLE ProcessId, // pid into which image is being mapped
_In_ PIMAGE_INFO ImageInfo
)
{
if (ImageInfo->SystemModeImage)
{
DbgPrintEx(77, 0, "[db]驱动模块: %wZ\r\n", FullImageName);
}
else
{
DbgPrintEx(77, 0, "[db]普通DLL: %wZ\r\n", FullImageName);
}
}
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
//PsSetCreateProcessNotifyRoutine(CreateProcessListen, TRUE);
//PsRemoveCreateThreadNotifyRoutine(createThreadListen);
PsRemoveLoadImageNotifyRoutine(LoadImageListen);
DbgPrint("卸载驱动\r\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg)
{
//PsSetCreateProcessNotifyRoutine(CreateProcessListen,FALSE);
//PsSetCreateThreadNotifyRoutine(createThreadListen);
PsSetLoadImageNotifyRoutine(LoadImageListen);
pDriver->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}修改PspNotifyEnableMask为0000000e,就不会触发模块回调
7.4.DPC定时器
DriverMain.c
#include <ntifs.h>
#include <intrin.h>
PKDPC kdpc = NULL;
PKDPC kTimer = NULL;
HANDLE hTimer = NULL;
VOID workDpc(
_In_ struct _KDPC* Dpc,
_In_opt_ PVOID DeferredContext,
_In_opt_ PVOID SystemArgument1,
_In_opt_ PVOID SystemArgument2
)
{
static int count = 0;
DbgPrintEx(77, 0, "[xxxx] %d\r\n", ++count);
KeInitializeTimer(kTimer);
LARGE_INTEGER inTime = { 0 };
inTime.QuadPart = -10000 * 1000;
KeSetTimer(kTimer, inTime, kdpc);
//ExFreePool(Dpc);
}
VOID workDpc2(
_In_ struct _KDPC* Dpc,
_In_opt_ PVOID DeferredContext,
_In_opt_ PVOID SystemArgument1,
_In_opt_ PVOID SystemArgument2
)
{
static int count = 0;
DbgPrintEx(77, 0, "[xxxx] 2 irql = %d,count=%d ,number = %d\r\n", KeGetCurrentIrql(), ++count, KeGetCurrentProcessorNumber());
//ExFreePool(Dpc);
}
VOID apcTimer(
_In_ PVOID TimerContext,
_In_ ULONG TimerLowValue,
_In_ LONG TimerHighValue
)
{
static int count = 0;
DbgPrintEx(77, 0, "[xxxx] 3 irql = %d,count=%d \r\n", KeGetCurrentIrql(), ++count);
}
VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
/*
if (hTimer)
{
ZwCancelTimer(hTimer, NULL);
}
*/
KeCancelTimer(kTimer);
ExFreePool(kTimer);
ExFreePool(kdpc);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg)
{
LARGE_INTEGER inTime = { 0 };
inTime.QuadPart = -10000 * 10000;
//申请非分页内存
kdpc = ExAllocatePool(NonPagedPool, sizeof(KDPC));
//初始化DPC
//KeInitializeDpc(kdpc, workDpc, NULL);
KeInitializeDpc(kdpc, workDpc2, NULL);
//设置在哪个核上触发dpc
//KeSetTargetProcessorDpc(kdpc, 0);
//插入DPC到dpc队列
KeInsertQueueDpc(kdpc, NULL, NULL);
kTimer = ExAllocatePool(NonPagedPool, sizeof(KTIMER)); //申请定时器
//第一种方法
//KeInitializeTimer(kTimer); //初始化定时器
//KeSetTimer(kTimer, inTime, kdpc); //设置定时器
//第二种方法
KeInitializeTimerEx(kTimer, SynchronizationTimer);
// 第二个参数是初始时间，第三个参数是初始以后间隔时间
KeSetTimerEx(kTimer, inTime, 1000, kdpc);
//第三种方法
//NTSTATUS status = ZwCreateTimer(&hTimer, PROCESS_ALL_ACCESS, NULL, SynchronizationTimer);
//
//if (NT_SUCCESS(status))
//{
//
// ZwSetTimer(hTimer, &inTime, apcTimer, NULL, FALSE, 1000, NULL);
//}
pDriver->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
