Smss.exe进程分析

传说中的会话管理服务器进程,它是windows操作系统启动时引导的最重要的系统进程,它负责启动csrss.exe和winlogon.exe进程,并对它们进行监控,如果发现其中一个挂掉,它马上叫你当机,所以要想结束csrss.exe/winlogon.exe，先结束Smss.exe，源码前一目了然(摘自windows nt 4.0代码)



 
 

  
  //1 Module Info : 变量定义,提高当前进程的优先级(11级)
 
 
 
 

  
    
  
     NTSTATUS Status;
    KPRIORITY SetBasePriority;
    UNICODE_STRING InitialCommand, DebugInitialCommand, UnicodeParameter;
    HANDLE ProcessHandles[ 2 ];
    ULONG Parameters[ 4 ];
    ULONG Response;
    PROCESS_BASIC_INFORMATION ProcessInfo;
    BOOLEAN WasEnabled;
 
 
 
 

  
      SetBasePriority = FOREGROUND_BASE_PRIORITY+2;//#define FOREGROUND_BASE_PRIORITY 9
    Status = NtSetInformationProcess( NtCurrentProcess(),
                                      ProcessBasePriority,
                                      (PVOID) &SetBasePriority,
                                       sizeof( SetBasePriority )
                                    );
    ASSERT(NT_SUCCESS(Status));
 
 
 
 

  
      if (ARGUMENT_PRESENT( DebugParameter )) {
        SmpDebug = DebugParameter;
        }
 
 
 
 

  
   
 
 
 
 

  
  //2 Module Info : 获取Csrss.exe和winlogon.exe进程的句柄,并对它们进行监控
 
 
 
 

  
  try {
        Status = SmpInit( &InitialCommand, &ProcessHandles[ 0 ] );//返回crsss.exe进程的句柄
        if (!NT_SUCCESS( Status )) {
            KdPrint(( "SMSS: SmpInit return failure - Status == %x/n" ));
            RtlInitUnicodeString( &UnicodeParameter, L"Session Manager Initialization" );
            Parameters[ 1 ] = (ULONG)Status;
            }
        else {
            SYSTEM_FLAGS_INFORMATION FlagInfo;
 
 
 
 

  
              NtQuerySystemInformation( SystemFlagsInformation,
                                      &FlagInfo,
                                      sizeof( FlagInfo ),
                                      NULL
                                    );
            if (FlagInfo.Flags & (FLG_DEBUG_INITIAL_COMMAND | FLG_DEBUG_INITIAL_COMMAND_EX) ) {
                DebugInitialCommand.MaximumLength = InitialCommand.Length + 64;
                DebugInitialCommand.Length = 0;
                DebugInitialCommand.Buffer = RtlAllocateHeap( RtlProcessHeap(),
                                                              MAKE_TAG( INIT_TAG ),
                                                              DebugInitialCommand.MaximumLength
                                                            );
                if (FlagInfo.Flags & FLG_ENABLE_CSRDEBUG) {
                    RtlAppendUnicodeToString( &DebugInitialCommand, L"ntsd -p -1 -d " );
                    }
                else {
                    RtlAppendUnicodeToString( &DebugInitialCommand, L"ntsd -d " );
                    }
 
 
 
 

  
                  if (FlagInfo.Flags & FLG_DEBUG_INITIAL_COMMAND_EX ) {
                    RtlAppendUnicodeToString( &DebugInitialCommand, L"-g -x " );
                    }
 
 
 
 

  
                  RtlAppendUnicodeStringToString( &DebugInitialCommand, &InitialCommand );
                InitialCommand = DebugInitialCommand;
                }
 
 
 
 

  
              Status = SmpExecuteInitialCommand( &InitialCommand, &ProcessHandles[ 1 ] );//返回winlogon进程句柄
            if (NT_SUCCESS( Status )) {
                Status = NtWaitForMultipleObjects( 2,
                                                   ProcessHandles,
                                                   WaitAny,
                                                   FALSE,
                                                   NULL
                                                 );
                }
 
 
 
 

  
              if (Status == STATUS_WAIT_0) {
                RtlInitUnicodeString( &UnicodeParameter, L"Windows SubSystem" );
                Status = NtQueryInformationProcess( ProcessHandles[ 0 ],
                                                    ProcessBasicInformation,
                                                    &ProcessInfo,
    
  
                                                  sizeof( ProcessInfo ),
                                                    NULL
                                                  );
 
 
 
 

  
                  KdPrint(( "SMSS: Windows subsystem terminated when it wasn't supposed to./n" ));
                }
            else {
                RtlInitUnicodeString( &UnicodeParameter, L"Windows Logon Process" );
                if (Status == STATUS_WAIT_1) {
                    Status = NtQueryInformationProcess( ProcessHandles[ 1 ],
                                                        ProcessBasicInformation,
                                                        &ProcessInfo,
                                                        sizeof( ProcessInfo ),
                                                        NULL
                                                      );
                    }
                else {
                    ProcessInfo.ExitStatus = Status;
                    Status = STATUS_SUCCESS;
                    }
 
 
 
 

  
                  KdPrint(( "SMSS: Initial command '%wZ' terminated when it wasn't supposed to./n", &InitialCommand ));
                }
 
 
 
 

  
              if (NT_SUCCESS( Status )) {
                Parameters[ 1 ] = (ULONG)ProcessInfo.ExitStatus;
                }
            else {
                Parameters[ 1 ] = (ULONG)STATUS_UNSUCCESSFUL;
                }
            }
        }
    except( SmpUnhandledExceptionFilter( GetExceptionInformation() ) ) {
        RtlInitUnicodeString( &UnicodeParameter, L"Unhandled Exception in Session Manager" );
        Parameters[ 1 ] = (ULONG)GetExceptionCode();
        }
 
 
 
 

  
   
 
 
 
 

  
   
 
 
 
 

  
  //3 Module Info : 当机代码!呵呵,其实就是通知操作系统,发生了一个硬件中断
 
 
 
 

  
   
 
 
 
 

  
    Status = RtlAdjustPrivilege( SE_SHUTDOWN_PRIVILEGE,
                                 (BOOLEAN)TRUE,
                                 TRUE,
                                 &WasEnabled
                               );//提高当前的权限,可以执行shutdown指令
 
 
 
 

  
      if (Status == STATUS_NO_TOKEN) {
 
 
 
 

  
          //
        // No thread token, use the process token
        //
 
 
 
 

  
          Status = RtlAdjustPrivilege( SE_SHUTDOWN_PRIVILEGE,
                                     (BOOLEAN)TRUE,
                                     FALSE,
                                     &WasEnabled
                                   );
        }
 
 
 
 

  
      Parameters[ 0 ] = (ULONG)&UnicodeParameter;
 
 
 
 

  
      Status = NtRaiseHardError( STATUS_SYSTEM_PROCESS_TERMINATED,
                               2,
                               1,
                               Parameters,
                               OptionShutdownSystem,
                               &Response
                             );//看看,字面意思就知道发生什么了,唤起硬件错误
 
 
 
 

  
      //
    // If this returns, giveup
    //
 
 
 
 

  
      NtTerminateProcess( NtCurrentProcess(), Status );