内核线程创建列子

最新推荐文章于 2024-07-17 08:00:00 发布

Cosmop01itan

最新推荐文章于 2024-07-17 08:00:00 发布

阅读量202

点赞数

CC 4.0 BY-SA版权

分类专栏：二进制

本文链接：https://blog.youkuaiyun.com/CosmopolitanMe/article/details/100868405

二进制专栏收录该内容

44 篇文章

订阅专栏

本文介绍在VS2013和WDK8.1环境下如何创建和管理内核模式下的线程。通过示例代码展示了内核线程的创建过程，包括初始化对象属性、调用系统服务创建线程以及线程的卸载处理。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

//vs2013+ wdk8.1下编译
#include <ntddk.h>



BOOLEAN	bStoped = FALSE;
PVOID	pThreadObj=NULL;
NTSTATUS Unload(PDRIVER_OBJECT driver)
{
	DbgPrint("unloaded!");
	bStoped = TRUE;
	KeWaitForSingleObject(pThreadObj, Executive, KernelMode, FALSE, NULL);
	ObDereferenceObject(pThreadObj);
	return STATUS_SUCCESS;
}


void MyThread(PVOID pContext)
{
	LARGE_INTEGER interval;
	interval.QuadPart = -10000000;//1s
	int i = 0;
	while (!bStoped)
	{
		DbgPrint("in loop thread %d",i);
		i++;

		/*
		something you can do
		*/
		KeDelayExecutionThread(KernelMode, FALSE, &interval);
	}
	PsTerminateSystemThread(STATUS_SUCCESS);
}

NTSTATUS CreateMyThread()
{
	OBJECT_ATTRIBUTES ObjAddr = { 0 };
	HANDLE ThreadHandle = 0;
	NTSTATUS status = STATUS_SUCCESS;
	InitializeObjectAttributes(&ObjAddr, NULL, OBJ_KERNEL_HANDLE, 0, NULL);
	status = PsCreateSystemThread(&ThreadHandle, THREAD_ALL_ACCESS, &ObjAddr, NULL, NULL, MyThread, NULL);
	if (NT_SUCCESS(status)){
		DbgPrint("Create Thread Success");
		status = ObReferenceObjectByHandle(ThreadHandle, THREAD_ALL_ACCESS, *PsThreadType, KernelMode, &pThreadObj, NULL);
		ZwClose(ThreadHandle);
		if (!NT_SUCCESS(status)){
			bStoped = TRUE;
		}
	}
	return status;
}


NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)
{


	driver->DriverUnload = Unload;
	
	CreateMyThread();
	return STATUS_SUCCESS;

}

内核输出
在这里插入图片描述