呵呵,小菜一只,遇到的都是些菜问题
大牛们别笑话俺~~~

刚才问过了PsCreateSystemThread的问题,现在却是PsTerminateSystemThread

大致代码如下:
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,
                     IN PUNICODE_STRING RegistryPath){

   NTSTATUS status = STATUS_SUCCESS;
    DriverObject->DriverUnload=OnUnload;
    SetHook();
    return status;
}

NTSTATUS SetHook()
{
    NTSTATUS ntStatus;
    g_bExit = FALSE;

    ntStatus = PsCreateSystemThread(&hThread, (ACCESS_MASK) THREAD_ALL_ACCESS, NULL, NULL, NULL, (PKSTART_ROUTINE)WatchKiAttachProcessThread, NULL);
    KdPrint(("创建线程结果：%X\n", ntStatus));
   return ntStatus;
}

VOID OnUnload(IN PDRIVER_OBJECT DriverObject){
    NTSTATUS ntStatus;
    PETHREAD peThread;
    g_bExit = TRUE;
    PsLookupThreadByThreadId(hThread, &peThread);
    ntStatus = KeWaitForSingleObject(peThread, Executive, KernelMode, TRUE, 0);
    KdPrint(("NTSTATUS：%X\n", ntStatus));
    ObDereferenceObject(peThread);
    UnHook();
}

void WatchKiAttachProcessThread(IN PVOID pContext)
{
    LARGE_INTEGER liInterval;
    liInterval.QuadPart = - 10 * 1000 * 1000;

    while(1)
    {
        if (g_bExit)
        {
            PsTerminateSystemThread(STATUS_SUCCESS);
        }
        KeDelayExecutionThread(KernelMode,TRUE,&liInterval);

        if(((PUCHAR)g_OirginalKiAttachProcesssAddress)[1] != g_JmpMyKiAttachProcesssBytes[1] &&
           ((PUCHAR)g_OirginalKiAttachProcesssAddress)[2] != g_JmpMyKiAttachProcesssBytes[2] &&
           ((PUCHAR)g_OirginalKiAttachProcesssAddress)[3] != g_JmpMyKiAttachProcesssBytes[3] &&
           ((PUCHAR)g_OirginalKiAttachProcesssAddress)[4] != g_JmpMyKiAttachProcesssBytes[4] )
        {
            DbgPrint("HOOK被修改");
            HookKiAttachProcesss();
        }
    }
}

当驱动卸载时,调用OnUnload过程,执行到    ntStatus = KeWaitForSingleObject(peThread, Executive, KernelMode, TRUE, 0)之后,程序会进入线程函数WatchKiAttachProcessThread中执行PsTerminateSystemThread(STATUS_SUCCESS),而执行过此指令后,驱动卸载结束,,后面的UnHook之类的全都走不到了,这是为什么?有什么办法能让驱动正常卸载 ?

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)