研究了1天这个。。。MSDN说的不是很清楚
NTSTATUS PsCreateSystemThread(
_Out_ PHANDLE ThreadHandle,
_In_ ULONG DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ HANDLE ProcessHandle,
_Out_opt_ PCLIENT_ID ClientId,
_In_ PKSTART_ROUTINE StartRoutine,
_In_opt_ PVOID StartContext
);
该函数用于创建系统线程,ProcessHandle参数接收NULL, NtCurrentProcess() (-1) ,或指定进程句柄 三种情况 都可以用PsTerminateSystemThread结束掉
示例:
[C++] 纯文本查看 复制代码
01 |
VOID MyThread( PVOID StartContext) |
03 |
PEPROCESS pp=IoGetCurrentProcess(); |
04 |
NTSTATUS status=PsTerminateSystemThread(0); |
06 |
if (status == STATUS_INVALID_PARAMETER) |
08 |
KdPrint(( "not systemthread" )); |
12 |
HANDLE OpenProcess( HANDLE Processid) |
15 |
PEPROCESS Process = NULL; |
16 |
HANDLE hProcess = NULL; |
17 |
UNICODE_STRING Unicode; |
18 |
status = PsLookupProcessByProcessId(Processid, &Process); |
19 |
if (NT_SUCCESS(status)) |
21 |
RtlInitUnicodeString(&Unicode, L "PsProcessType" ); |
23 |
PsProcessType = (POBJECT_TYPE*)MmGetSystemRoutineAddress(&Unicode); |
26 |
status = ObOpenObjectByPointer(Process,0,NULL,PROCESS_ALL_ACCESS,(POBJECT_TYPE) * PsProcessType, |
27 |
KernelMode,&hProcess); |
28 |
if (NT_SUCCESS(status)) |
31 |
ObfDereferenceObject(Process); |
35 |
ObfDereferenceObject(Process); |
40 |
HANDLE outthread1,,outthread2,outthread3,outthread4,hproc; |
42 |
PsCreateSystemThread(&outthread1,THREAD_ALL_ACCESS,NULL,NULL,NULL,MyThread,NULL); |
43 |
PsCreateSystemThread(&outthread2,THREAD_ALL_ACCESS,NULL,NtCurrentProcess(),NULL,MyThread,NULL); |
46 |
CLIENT_ID ci={( HANDLE )1472,0}; |
47 |
RtlZeroMemory(&oa, sizeof (oa)); |
49 |
ZwOpenProcess(&hproc,PROCESS_ALL_ACCESS,&oa,&ci); |
50 |
PsCreateSystemThread(&outthread3,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL); |
52 |
hproc=OpenProcess(( HANDLE )1472); |
53 |
PsCreateSystemThread(&outthread4,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL); |
该函数创建的线程,其PETHRAD属性的CrossThreadFlags有PS_CROSS_THREAD_FLAGS_SYSTEM属性,不允许以挂起模式创建线程,,其他和普通的NtCreateThread差别不大!
然而在微软官方源码中,PS_CROSS_THREAD_FLAGS_SYSTEM属性即为SystemThread,尽管其所属进程可能是explorer.exe
https://www.0xaa55.com/forum.php?mod=viewthread&tid=1376&extra=page%3D6
原创文章受到原创版权保护。转载请注明出处:https://www.ccppcoding.com/archives/234492
非原创文章文中已经注明原地址,如有侵权,联系删除
关注公众号【高性能架构探索】,第一时间获取最新文章
转载文章受原作者版权保护。转载请注明原作者出处!