t-procmon.h

剖析Windows系统服务调用机制相关及驱动编程模式

#ifndef T_PROCMON_H
#define T_PROCMON_H

typedef struct ServiceDescriptorTableEntry
{
	UINT   *ServiceTableBase;
	UINT   *ServiceCounterTableBase;
	UINT   NumberOfService;
	PUCHAR ParameterTableBase;
}ServiceDescriptorTableEntry,*PServiceDescriptorTabelEntry;

__declspec(dllimport)  ServiceDescriptorTableEntry KeServiceDescriptorTable;

#define SYSCALL(_function) KeServiceDescriptorTable.ServiceTableBase[*(PULONG)((PUCHAR)_function+1)]
#define MUTEX_TYPE         KMUTEX
#define MUTEX_INIT(v)      KeInitializeMutex(&v,0)
#define MUTEX_P(v)         KeWaitForMutexObject(&v,Executive,KernelMode,FALSE,NULL)
#define MUTEX_V(v)         KeReleaseMutex(&v,FALSE)

typedef 
NTSTATUS 
(*ZWQUERYSYSTEMINFORMATION)(
IN     ULONG     SystemInformationClass,
IN OUT PVOID     SystemInformation,
IN     ULONG     SystemInformaitonLength,
OUT    PULONG    ReturnLength OPTIONAL);

typedef 
NTSTATUS 
(*ZWOPENPROCESS)(
OUT    PHANDLE            ProcessHandle,
IN     ACCESS_MASK        DesiredAccess,
IN     POBJECT_ATTRIBUTES ObjectAttributes,
IN     PCLIENT_ID         ClientId OPTIONAL);

typedef 
NTSTATUS 
(*ZWTERMINATEPROCESS)(
IN     HANDLE    ProcessHandle OPTIONAL,
IN     NTSTATUS  ExitStatus);

typedef
NTSTATUS 
(*ZWQUERYINFORMATIONPROCESS)(
IN     HANDLE           ProcessHandle,
IN     PROCESSINFOCLASS ProcessInformationClass,
OUT    PVOID            ProcessInformation,
IN     ULONG            ProcessInformationLength,
OUT    PULONG           ReturnLength  OPTIONAL);

typedef 
NTSTATUS 
(*ZWSETINFORMATIONPROCESS)(
IN     HANDLE           ProcessHandle,
IN     PROCESSINFOCLASS ProcessInformationClass,
IN     PVOID            ProcessInformation,
IN     ULONG            ProcessInformationLength);

ZWQUERYSYSTEMINFORMATION  OldZwQuerySystemInformation;
ZWOPENPROCESS             OldZwOpenProcess;
ZWTERMINATEPROCESS        OldZwTerminateProcess;
ZWQUERYINFORMATIONPROCESS OldZwQueryInformationProcess;
ZWSETINFORMATIONPROCESS   OldZwSetInformationProcess;

VOID 
ProcMonUnload(
IN     PDRIVER_OBJECT DriverObject);

NTSTATUS
ProcMonDispath(
IN     PDEVICE_OBJECT DeviceObject,
IN     PIRP           pIrp);

BOOLEAN  ProcmonControl(
IN     PFILE_OBJECT     FileObject,
IN     BOOLEAN          Wait,
IN     PVOID            InputBuffer,
IN     ULONG            InputBufferLength,
IN     PVOID            OutputBuffer,
IN     ULONG            OutputBufferLength,
IN     ULONG            IoControlCode,
OUT    PIO_STATUS_BLOCK IoStatus,
IN     PDEVICE_OBJECT   DeviceObject);

NTSTATUS 
HookSystemService();

NTSTATUS
UnHookSystemService();

NTSTATUS 
NewZwQuerySystemInformation(
IN     ULONG       SystemInformationClass,
IN OUT PVOID       SystemInformation,
IN     ULONG       SystemInformaitonLength,
OUT    PULONG      ReturnLength OPTIONAL);

NTSTATUS 
NewZwOpenProcess(
OUT    PHANDLE            ProcessHandle,
IN     ACCESS_MASK        DesiredAccess,
IN     POBJECT_ATTRIBUTES ObjectAttributes,
IN     PCLIENT_ID         ClientId OPTIONAL);

NTSTATUS 
NewZwTerminateProcess(
IN     HANDLE    ProcessHandle OPTIONAL,
IN     NTSTATUS  ExitStatus);

NTSTATUS 
NewZwQueryInformationProcess(
IN     HANDLE           ProcessHandle,
IN     PROCESSINFOCLASS ProcessInformationClass,
OUT    PVOID            ProcessInformation,
IN     ULONG            ProcessInformationLength,
OUT    PULONG           ReturnLength  OPTIONAL);

NTSTATUS 
NewZwSetInformationProcess(
IN     HANDLE           ProcessHandle,
IN     PROCESSINFOCLASS ProcessInformationClass,
IN     PVOID            ProcessInformation,
IN     ULONG            ProcessInformationLength);

typedef enum _THREAD_STATE
{
	StateInitialized,
	StateReady,
	StateRunning,
	StateStandby,
	StateTerminated,
	StateWait,
	StateTransition,
	StateUnknown
}THREAD_STATE;

typedef struct _SYSTEM_THREADS
{
	LARGE_INTEGER KernelTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER CreateTime;
	ULONG         WaitTime;
	PVOID         StartAddress;
	CLIENT_ID     ClientId;
	KPRIORITY     Priority;
	KPRIORITY     BasePriority;
	ULONG         ContextSwitchCount;
	THREAD_STATE  State;
	KWAIT_REASON  WaitReason;
}SYSTEM_THREADS,*PSYSTEM_THREADS;

typedef struct _SYSTEM_PROCESSES
{
	ULONG          NextEntryDelta;
	ULONG          ThreadCount;
	ULONG          Reserved1[6];
	LARGE_INTEGER  CreateTime;
	LARGE_INTEGER  UserTime;
	LARGE_INTEGER  KernelTime;
	UNICODE_STRING ProcessName;
	KPRIORITY      BasePriority;
	ULONG          ProcessId;
	ULONG          InheritedFromProcessId;
	ULONG          HandleCount;
	ULONG          Reserved2[2];
	VM_COUNTERS    VmCounters;
	IO_COUNTERS    IoCounters;
	SYSTEM_THREADS Threads[1];
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
IN     ULONG    SystemInformationClass,
IN OUT PVOID    SystemInformation,
IN     ULONG    SystemInformationLength,
OUT    PULONG   ReturnLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
ZwCreateProcess(
OUT    PHANDLE            ProcessHandle,
IN     ACCESS_MASK        DesiredAccess,
IN     POBJECT_ATTRIBUTES ObjectAttributes,
IN     HANDLE             InheritFromProcessHandle,
IN     BOOLEAN            InheritHandles,
IN     HANDLE             SectionHandle OPTIONAL,
IN     HANDLE             DebugPort     OPTIONAL,
IN     HANDLE             ExceptionPort OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
ZwOpenProcess(
OUT    PHANDLE            ProcessHandle,
IN     ACCESS_MASK        DesiredAccess,
IN     POBJECT_ATTRIBUTES ObjectAttributes,
IN     PCLIENT_ID         ClientId OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
ZwTerminateProcess(
IN     HANDLE    ProcessHandle OPTIONAL,
IN     NTSTATUS  ExitStatus
);

NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationProcess(
IN     HANDLE           ProcessHandle,
IN     PROCESSINFOCLASS ProcessInformationClass,
OUT    PVOID            ProcessInformation,
IN     ULONG            ProcessInformationLength,
OUT    PULONG           ReturnLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
ZwSetInformationProcess(
IN     HANDLE           ProcessHandle,
IN     PROCESSINFOCLASS ProcessInformationClass,
IN     PVOID            ProcessInformation,
IN     ULONG            ProcessInformationLength
);

typedef struct _messagek
{
	ULONG              Length;
	TCHAR              Message[MAX_MESSAGE];
	struct _messagek * Next;
}MESSAGEK,*PMESSAGEK;

typedef struct _procnamek
{
	UNICODE_STRING      Name;
	struct _procnamek * Next;
}PROCNAMEK,*PPROCNAMEK;

VOID
GetProcessNameOffset(VOID);

VOID
GetProcessName(
PTSTR,
PTSTR);

VOID
FreeProcessNameK(VOID);

VOID
FreeMessageK(VOID);

VOID
NewMessageK(VOID);

VOID
ResetMessageK(VOID);

VOID
UpdateMessageK(ULONG,PTSTR);

MUTEX_TYPE       MKMutex;
PMESSAGEK        pCurrentMK  = NULL;
PMESSAGEK        pFirstMK    = NULL;
PPROCNAMEK       pFirstNK    = NULL;
ULONG            Sequence    = 0;
ULONG            NumMessageK = 0;
ULONG            MaxMessageK = 16;
BOOLEAN          IsHooked    = FALSE;
ULONG            NameOffset  = 0;

#endif