TerminateThread

最新推荐文章于 2024-09-09 11:01:39 发布

原创最新推荐文章于 2024-09-09 11:01:39 发布 · 1.6k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#thread #null #object #include #system #string

windows底层核心編程专栏收录该内容

743 篇文章

订阅专栏

本文介绍了一种在Windows内核模式下终止特定线程的方法。通过定义Apc结构并利用KeInitializeApc初始化，之后使用KeInsertQueueApc插入到线程的Apc队列中来实现。此外，还提供了获取线程标志偏移量的方法。

#include "ntddk.h"
#include "LDasm.h" //网上很多的，自己找一个好了。

typedef enum _KAPC_ENVIRONMENT {
OriginalApcEnvironment,
AttachedApcEnvironment,
CurrentApcEnvironment,
InsertApcEnvironment
} KAPC_ENVIRONMENT;

NTKERNELAPI
VOID
KeInitializeApc (
PKAPC Apc,
PETHREAD Thread,
KAPC_ENVIRONMENT Environment,
PKKERNEL_ROUTINE KernelRoutine,
PKRUNDOWN_ROUTINE RundownRoutine,
PKNORMAL_ROUTINE NormalRoutine,
KPROCESSOR_MODE ProcessorMode,
PVOID NormalContext
);

NTKERNELAPI
BOOLEAN
KeInsertQueueApc (
PKAPC Apc,
PVOID SystemArgument1,
PVOID SystemArgument2,
KPRIORITY Increment
);

#define PS_CROSS_THREAD_FLAGS_SYSTEM 0x00000010UL

ULONG GetThreadFlagsOffset()
{
UCHAR *cPtr, *pOpcode;
ULONG Length;
USHORT Offset;

for (cPtr = (PUCHAR)PsTerminateSystemThread;
cPtr < (PUCHAR)PsTerminateSystemThread + 0x100;
cPtr += Length)
{
Length = SizeOfCode(cPtr, &pOpcode);

if (!Length) break;
if (*(USHORT *)pOpcode == 0x80F6) //f6804802000010 test byte ptr [eax+248h],10h
{
Offset=*(USHORT *)((ULONG)pOpcode+2);
return Offset;
//break;
}
}
return 0;
}

VOID KernelTerminateThreadRoutine(
IN PKAPC Apc,
IN OUT PKNORMAL_ROUTINE *NormalRoutine,
IN OUT PVOID *NormalContext,
IN OUT PVOID *SystemArgument1,
IN OUT PVOID *SystemArgument2
)
{
ULONG ThreadFlagsOffset=GetThreadFlagsOffset();
PULONG ThreadFlags;
DbgPrint("[TerminateThread] KernelTerminateThreadRoutine./n");
ExFreePool(Apc);
if (ThreadFlagsOffset)
{
ThreadFlags=(ULONG *)((ULONG)(PsGetCurrentThread())+ThreadFlagsOffset);
*ThreadFlags=(*ThreadFlags)|PS_CROSS_THREAD_FLAGS_SYSTEM;
PsTerminateSystemThread(STATUS_SUCCESS); //o(∩_∩)o
}
else
{
//failed :'(
}
return; //never be here
}

BOOLEAN TerminateThread(PETHREAD Thread)
{
PKAPC Apc=NULL;
BOOLEAN blnSucceed=FALSE;
if (!MmIsAddressValid(Thread)) return FALSE; //error.
Apc=ExAllocatePool(NonPagedPool,sizeof(KAPC));
KeInitializeApc(Apc,
Thread,
OriginalApcEnvironment,
KernelTerminateThreadRoutine,
NULL,
NULL,
KernelMode,
NULL); //special apc
blnSucceed=KeInsertQueueApc(Apc,
NULL,
NULL,
0);
return blnSucceed;
}

VOID DriverUnload(PDRIVER_OBJECT pDriverObj)
{
DbgPrint("[TerminateThread] Unloaded/n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString)
{
DbgPrint("[TerminateThread] DriverEntry./n");
TerminateThread((PETHREAD)0xff6f3c70); // for test
pDriverObj->DriverUnload = DriverUnload;
return STATUS_SUCCESS; //do NOT return an unsuccessful value here, or you need to wait for apc routine return.
}