研究了1天这个。。。MSDN说的不是很清楚
NTSTATUS PsCreateSystemThread(
_Out_ PHANDLE ThreadHandle,
_In_ ULONG DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ HANDLE ProcessHandle,
_Out_opt_ PCLIENT_ID ClientId,
_In_ PKSTART_ROUTINE StartRoutine,
_In_opt_ PVOID StartContext
);
该函数用于创建系统线程，ProcessHandle参数接收NULL, NtCurrentProcess() (-1) ,或指定进程句柄 三种情况 都可以用PsTerminateSystemThread结束掉
示例：
[C++] 纯文本查看 复制代码
01 |
VOID MyThread(PVOID StartContext) |
02 |
{ |
03 |
PEPROCESS pp=IoGetCurrentProcess(); |
04 |
NTSTATUS status=PsTerminateSystemThread(0); |
05 |
//以下实际上已经不执行了 |
06 |
if(status == STATUS_INVALID_PARAMETER) |
07 |
{ |
08 |
KdPrint(("not systemthread")); |
09 |
} |
10 |
} |
11 |
12 |
HANDLE OpenProcess(HANDLE Processid) |
13 |
{ |
14 |
NTSTATUS status; |
15 |
PEPROCESS Process = NULL; |
16 |
HANDLE hProcess = NULL; |
17 |
UNICODE_STRING Unicode; |
18 |
status = PsLookupProcessByProcessId(Processid, &Process); |
19 |
if (NT_SUCCESS(status))//判断进程号是否存在 |
20 |
{ |
21 |
RtlInitUnicodeString(&Unicode, L"PsProcessType"); |
22 |
//得到系统导出函数的地址和用户态的GetProcessAddress雷同 |
23 |
PsProcessType = (POBJECT_TYPE*)MmGetSystemRoutineAddress(&Unicode); |
24 |
if (PsProcessType) |
25 |
{ |
26 |
status = ObOpenObjectByPointer(Process,0,NULL,PROCESS_ALL_ACCESS,(POBJECT_TYPE) * PsProcessType, |
27 |
KernelMode,&hProcess); |
28 |
if (NT_SUCCESS(status)) |
29 |
{ |
30 |
//减少指针计数 |
31 |
ObfDereferenceObject(Process); |
32 |
return hProcess; |
33 |
} |
34 |
} |
35 |
ObfDereferenceObject(Process); |
36 |
} |
37 |
return 0; |
38 |
} |
39 |
40 |
HANDLE outthread1,,outthread2,outthread3,outthread4,hproc; |
41 |
42 |
PsCreateSystemThread(&outthread1,THREAD_ALL_ACCESS,NULL,NULL,NULL,MyThread,NULL); |
43 |
PsCreateSystemThread(&outthread2,THREAD_ALL_ACCESS,NULL,NtCurrentProcess(),NULL,MyThread,NULL); |
44 |
45 |
OBJECT_ATTRIBUTES oa; |
46 |
CLIENT_ID ci={(HANDLE)1472,0};//注意是进程ID！ |
47 |
RtlZeroMemory(&oa,sizeof(oa)); |
48 |
oa.Length=sizeof(oa); |
49 |
ZwOpenProcess(&hproc,PROCESS_ALL_ACCESS,&oa,&ci); |
50 |
PsCreateSystemThread(&outthread3,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL); |
51 |
52 |
hproc=OpenProcess((HANDLE)1472);//注意是进程ID！ |
53 |
PsCreateSystemThread(&outthread4,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL); |
该函数创建的线程，其PETHRAD属性的CrossThreadFlags有PS_CROSS_THREAD_FLAGS_SYSTEM属性，不允许以挂起模式创建线程，，其他和普通的NtCreateThread差别不大！
然而在微软官方源码中，PS_CROSS_THREAD_FLAGS_SYSTEM属性即为SystemThread，尽管其所属进程可能是explorer.exe
https://www.0xaa55.com/forum.php?mod=viewthread&tid=1376&extra=page%3D6
时间： 2024-08-24 15:31:18