首页
社区
课程
招聘
[求助]用PsCreateSystemThread创建的内核进程怎么让他暂停啊?
发表于: 2007-12-26 18:02 11390

[求助]用PsCreateSystemThread创建的内核进程怎么让他暂停啊?

2007-12-26 18:02
11390
用PsCreateSystemThread创建的内核进程怎么让他暂停啊?
就是类似于ring3的suspendthread啊。。
汗了。刚才头一个帖子发错了把函数。。。

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 0
支持
分享
最新回复 (4)
雪    币: 321
活跃值: (271)
能力值: ( LV13,RANK:1050 )
在线值:
发帖
回帖
粉丝
2
NtSuspendThread或者PsSuspendThread或者KeSuspendThread
2007-12-26 23:48
0
雪    币: 224
活跃值: (35)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
NtSuspendThread或者PsSuspendThread或者KeSuspendThread 不是停止ring的么 ring的suspendthread最终还是会调用的。。
2007-12-27 11:33
0
雪    币: 224
活跃值: (35)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
我试过 NtSuspendThread 了。不行的。返回的的是 拒绝访问的错误
0xC0000022 返回值。。 郁闷了。。有其他的方法么。。
2007-12-28 00:46
0
雪    币: 224
活跃值: (35)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
我的代码是这样的
#include<ntddk.h>
#include<windef.h>
#include<ntdef.h>
/////////////////////////////////////
void OnUnload(IN PDRIVER_OBJECT DriverObject);
//////////////////////////////////////
LARGE_INTEGER liTime;
HANDLE hThread;
ULONG ZwSTAddr=0x805ca69e;
ULONG IsOk;

UNICODE_STRING DerName,DerName2;
PDEVICE_OBJECT	pDevObj;

#define IOCTL_STARTTHREAD  (ULONG)CTL_CODE(FILE_DEVICE_UNKNOWN, 0x852, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA )
#define IOCTL_STOPTHREAD  (ULONG)CTL_CODE(FILE_DEVICE_UNKNOWN, 0x853, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA )

NTSTATUS DisPatchCreateClose(PDEVICE_OBJECT pDriverObj,PIRP pIrp)
{
	DbgPrint("DisPatchCreate!");
	pIrp->IoStatus.Status=STATUS_SUCCESS;
	IoCompleteRequest(pIrp,IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}
//////////////////////////////////////
void MyWorkThread(IN PVOID pContext)
{	
  liTime =RtlConvertLongToLargeInteger(-(LONG)1000* 10000);
  //Callers of KeDelayExecutionThread must be running at IRQL <= APC_LEVEL.
  while(1)
  {
  	
  KeDelayExecutionThread(KernelMode,TRUE,&liTime);
  DbgPrint("Thread Is Still Alive"); 
  
  }
}
NTSTATUS DispatchDeviceControl(IN PDEVICE_OBJECT  DeviceObject,IN PIRP  pIrp)
{
	NTSTATUS status=STATUS_INVALID_DEVICE_REQUEST;
	PIO_STACK_LOCATION pIrpStack=IoGetCurrentIrpStackLocation(pIrp);

	ULONG uIoControlCode=pIrpStack->Parameters.DeviceIoControl.IoControlCode;
	PVOID pInputBuffer= pIrpStack->Parameters.DeviceIoControl.Type3InputBuffer;
	PVOID pOutputBuffer=pIrp->UserBuffer;
	ULONG uInsize=pIrpStack->Parameters.DeviceIoControl.InputBufferLength;
	ULONG uOutsize=pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;

	//DbgPrint("DispatchDeviceControl  Code:%X",uIoControlCode);
	switch(uIoControlCode)
	{
		case IOCTL_STARTTHREAD:
		{
         IsOk=PsCreateSystemThread(&hThread,(ACCESS_MASK)0,NULL,(HANDLE)0,NULL,MyWorkThread,NULL);
         DbgPrint("Have Start MyStartThread IsOk=0x%08X hThread=0x%08X",IsOk,hThread);
         break;      
		}
		case IOCTL_STOPTHREAD:
		{
			__asm
			{
				push 0
				push hThread
				call ZwSTAddr
				mov IsOk,eax
			}
			DbgPrint("Have Stop MyStartThread IsOk=0x%08X hThread=0x%08X",IsOk,hThread);
			break;
		}
		break;
		default:
			break;
	}
	if(status==STATUS_SUCCESS)
		pIrp->IoStatus.Information=uOutsize;
	else
		pIrp->IoStatus.Information=0;
	
	pIrp->IoStatus.Status=status;
	IoCompleteRequest(pIrp,IO_NO_INCREMENT);
	return status;	
}
///////////////////////////////////////////////////
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
{
	NTSTATUS status=STATUS_SUCCESS;
	ULONG i;
	
	for(i= 0;i<IRP_MJ_MAXIMUM_FUNCTION;++i)
		DriverObject->MajorFunction[i] = DisPatchCreateClose;
  DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=DispatchDeviceControl;			
  DriverObject->DriverUnload = OnUnload;
  
  RtlInitUnicodeString(&DerName,L"\\Device\\MyStartThread");  
  status=IoCreateDevice(DriverObject,0,&DerName,FILE_DEVICE_UNKNOWN,0,FALSE,&pDevObj);  
	if(!NT_SUCCESS(status))
	{
		DbgPrint("IoCreateDevice Fail!");
		return status;
	}  
  RtlInitUnicodeString(&DerName2,L"\\??\\MyStartThreadDos");
  status=IoCreateSymbolicLink(&DerName2,&DerName);
	if(!NT_SUCCESS(status))
		DbgPrint("IoCreateSymbolicLink fail!"); 
  DbgPrint("MyStartThread Load!");		
  return status;
}
/////////////////////////////////////////////////////
VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
{
	if(IoDeleteSymbolicLink(&DerName2)!=STATUS_SUCCESS)
		DbgPrint("DeleteSymbolicLink Fail!");
	IoDeleteDevice(DriverObject->DeviceObject);	
  DbgPrint("MyStartThread Unhooker unload!");
}
2007-12-28 00:46
0
游客
登录 | 注册 方可回帖
返回
//