分享进程拦截的一个标准方法

xiaoc1026 · 发表于 2013-1-7 13:18:59

方法在 WIN2003 X86 X64  WIN2008 X64 测试通过

//1，注册回调
status = PsSetLoadImageNotifyRoutine(MyProcessImageLoadFilter);

//2，
VOID MyProcessImageLoadFilter (
   IN PUNICODE_STRING  puniFullImageName,
   IN HANDLE  hProcessId,
   IN PIMAGE_INFO  pImageInfo
   )
{
PEPROCESS    pEprocess = NULL;
PVOID pPEBAddr = NULL;

         //这里的 puniFullImageName 就是镜像路径了有DLL、EXE什么的，过滤进程的话就判断EXE好了

         //如果判断是要进程拦截的进程那么就销毁它

         KillProcess(hProcessId,  pEprocess, pPEBAddr );

      //这样就达到了拦截进程的目的
}

//3，销毁进程

void KillProcess(HANDLE hProcessId, PEPROCESS pEprocess, PVOID pPEBAddr)
{
if( !NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)hProcessId,&pEprocess)) )
{
return;
}

if(VERSION_CHECK)
{
if( !MmIsAddressValid((PULONG64)((ULONG64)pfnGetProcessPeb(pEprocess) + BASEADDRESS_OFFSET)) )
{
return ;
}
pPEBAddr = (PVOID)((ULONG64)pfnGetProcessPeb(pEprocess) + BASEADDRESS_OFFSET);

*(ULONG64*)pPEBAddr += BASE_ADDRESS_DESTORY;
}
else
{
if( !MmIsAddressValid((PULONG)((ULONG)pfnGetProcessPeb(pEprocess) + BASEADDRESS_OFFSET)) )
{
return ;
}
pPEBAddr = (PVOID)((ULONG)pfnGetProcessPeb(pEprocess) + BASEADDRESS_OFFSET);

*(ULONG*)pPEBAddr += BASE_ADDRESS_DESTORY;
}

ObfDereferenceObject(pEprocess);
}