监控远程线程代码

最新推荐文章于 2024-04-10 15:01:48 发布

原创最新推荐文章于 2024-04-10 15:01:48 发布 · 893 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#attributes #string #null #thread #access #list

windows底层核心編程专栏收录该内容

743 篇文章

订阅专栏

本文介绍了一个针对NtCreateThreadEx函数的HOOK实现，该实现主要用于在内核模式下创建远程线程时记录目标进程的信息。文章详细展示了HOOK函数的代码实现，并解释了其工作原理。

原理参考 http://zhidao.baidu.com/question/35829777.html

NTSTATUS
HookNtCreateThread(
IN PNtCreateThread OrgFunction,
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ProcessHandle, //目标进程
OUT PCLIENT_ID ClientId,
IN PCONTEXT ThreadContext,
IN PINITIAL_TEB InitialTeb,
IN BOOLEAN CreateSuspended
)
{
NTSTATUS status;
PEPROCESS Process;
UNICODE_STRING DosPath;

if ((NT_SUCCESS(ObReferenceObjectByHandle(ProcessHandle, 0, NULL, KernelMode, &Process, NULL))))
{
if (GetProcessDosPath(Process, &DosPath))
{
if (!IsListEmpty((PLIST_ENTRY)((PBYTE)Process + KPROCESS_THREAD_LIST_OFFSET)) &&
Process != IoGetCurrentProcess())
{
UNICODE_STRING TargetPath;
if (GetProcessDosPath(IoGetCurrentProcess(), &TargetPath))
{
KdPrint(("Target:%wZ/n", &TargetPath));
RtlFreeUnicodeString(&TargetPath);
}
KdPrint(("CreateRemoteThread->%wZ/n", &DosPath));
}
RtlFreeUnicodeString(&DosPath);
}
}
status = OrgFunction(ThreadHandle, DesiredAccess, ObjectAttributes, ProcessHandle, ClientId, ThreadContext, InitialTeb, CreateSuspended);
return status;
}
2ksp4+vm6通过

HookNtCreateThreadEx