关于PsCreateSystemThread函数

研究了1天这个。。。MSDN说的不是很清楚
NTSTATUS PsCreateSystemThread(
  _Out_    PHANDLE ThreadHandle,
  _In_    ULONG DesiredAccess,
  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
  _In_opt_ HANDLE ProcessHandle,
  _Out_opt_  PCLIENT_ID ClientId,
  _In_    PKSTART_ROUTINE StartRoutine,
  _In_opt_ PVOID StartContext
);

该函数用于创建系统线程，ProcessHandle参数接收NULL, NtCurrentProcess() (-1) ,或指定进程句柄三种情况都可以用PsTerminateSystemThread结束掉
示例：

[C++] 纯文本查看复制代码

`01`	`VOID` `MyThread(PVOID` `StartContext)`

02 {

`03`	`PEPROCESS pp=IoGetCurrentProcess();`

`04`	`NTSTATUS status=PsTerminateSystemThread(0);`

`05`	`//以下实际上已经不执行了`

`06`	`if(status == STATUS_INVALID_PARAMETER)`

07 {

`08`	`KdPrint(("not systemthread"));`

09 }

10 }

11

`12`	`HANDLE` `OpenProcess(HANDLE` `Processid)`

13 {

`14`	`NTSTATUS status;`

`15`	`PEPROCESS Process = NULL;`

`16`	`HANDLE` `hProcess = NULL;`

`17`	`UNICODE_STRING Unicode;`

`18`	`status = PsLookupProcessByProcessId(Processid, &Process);`

`19`	`if` `(NT_SUCCESS(status))//判断进程号是否存在`

20 {

`21`	`RtlInitUnicodeString(&Unicode, L"PsProcessType");`

`22`	`//得到系统导出函数的地址和用户态的GetProcessAddress雷同`

`23`	`PsProcessType = (POBJECT_TYPE*)MmGetSystemRoutineAddress(&Unicode);`

`24`	`if` `(PsProcessType)`

25 {

`26`	`status = ObOpenObjectByPointer(Process,0,NULL,PROCESS_ALL_ACCESS,(POBJECT_TYPE) * PsProcessType,`

`27`	`KernelMode,&hProcess);`

`28`	`if` `(NT_SUCCESS(status))`

29 {

`30`	`//减少指针计数`

`31`	`ObfDereferenceObject(Process);`

`32`	`return` `hProcess;`

33 }

34 }

`35`	`ObfDereferenceObject(Process);`

36 }

`37`	`return` `0;`

38 }

39

`40`	`HANDLE` `outthread1,,outthread2,outthread3,outthread4,hproc;`

41

`42`	`PsCreateSystemThread(&outthread1,THREAD_ALL_ACCESS,NULL,NULL,NULL,MyThread,NULL);`

`43`	`PsCreateSystemThread(&outthread2,THREAD_ALL_ACCESS,NULL,NtCurrentProcess(),NULL,MyThread,NULL);`

44

`45`	`OBJECT_ATTRIBUTES oa;`

`46`	`CLIENT_ID ci={(HANDLE)1472,0};//注意是进程ID！`

`47`	`RtlZeroMemory(&oa,sizeof(oa));`

`48`	`oa.Length=sizeof(oa);`

`49`	`ZwOpenProcess(&hproc,PROCESS_ALL_ACCESS,&oa,&ci);`

`50`	`PsCreateSystemThread(&outthread3,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL);`

51

`52`	`hproc=OpenProcess((HANDLE)1472);//注意是进程ID！`

`53`	`PsCreateSystemThread(&outthread4,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL);`

该函数创建的线程，其PETHRAD属性的CrossThreadFlags有PS_CROSS_THREAD_FLAGS_SYSTEM属性，不允许以挂起模式创建线程，，其他和普通的NtCreateThread差别不大！
然而在微软官方源码中，PS_CROSS_THREAD_FLAGS_SYSTEM属性即为SystemThread，尽管其所属进程可能是explorer.exe

https://www.0xaa55.com/forum.php?mod=viewthread&tid=1376&extra=page%3D6

巴特西

关于PsCreateSystemThread函数

最新文章

热门文章