实验环境:win7 x32
断链:
#include <ntifs.h>
NTSTATUS EnumThread(ULONG ulPid, ULONG ulTid)
{
PEPROCESS pProcessAddr = PsGetCurrentProcess();
PLIST_ENTRY pHeadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0xb8);
PLIST_ENTRY pNextlink = pHeadlink->Flink;
while (pHeadlink != pNextlink)
{
pProcessAddr = (PEPROCESS)((ULONG)pNextlink - 0xb8);
ULONG pProcessID = *(PULONG)((ULONG)pProcessAddr + 0xb4);
if (pProcessID == ulPid)
{
PLIST_ENTRY pThreadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0x188);//pThreadlink是线程链表头节点
PLIST_ENTRY pNextThreadlink = pThreadlink->Flink; //pNextThreadlink才是第一个真正的线程节点,指向ETHREAD的0x268的位置
while (pThreadlink != pNextThreadlink)
{
PETHREAD peThread = (PETHREAD)((ULONG)pNextThreadlink - 0x268);
PCLIENT_ID pCid = (PCLIENT_ID)((ULONG)peThread + 0x22c);
if (pCid->UniqueThread == ulTid)
{
RemoveEntryList(pNextThreadlink);//尽量使用MiProcessLoaderEntry进行断链
return STATUS_SUCCESS;
}
pNextThreadlink = pNextThreadlink->Flink;
}
}
pNextlink = pNextlink->Flink;
}
}
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
DbgPrint("Unload Success!\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
pDriverObject->DriverUnload = DriverUnload;
EnumThread(3148,3160);
DbgPrint("Load Success!\n");
return STATUS_SUCCESS;
}
获取信息:
#include <ntifs.h>
NTSTATUS EnumThread(ULONG ulPid)
{
PEPROCESS pProcessAddr = PsGetCurrentProcess();
PLIST_ENTRY pHeadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0xb8);
PLIST_ENTRY pNextlink = pHeadlink->Flink;
while (pHeadlink != pNextlink)
{
pProcessAddr = (PEPROCESS)((ULONG)pNextlink - 0xb8);
ULONG pProcessID = *(PULONG)((ULONG)pProcessAddr + 0xb4);
if (pProcessID == ulPid)
{
PLIST_ENTRY pThreadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0x188);
PLIST_ENTRY pNextThreadlink = pThreadlink->Flink;
while (pThreadlink != pNextThreadlink)
{
PETHREAD peThread = (PETHREAD)((ULONG)pNextThreadlink - 0x268);
PCLIENT_ID pCid = (PCLIENT_ID)((ULONG)peThread + 0x22c);
ULONG teb = *(PULONG)((ULONG)peThread + 0x88);
DbgPrint("ID:%d EThread:0x%x Tbe:0x%x\n", pCid->UniqueThread, peThread, teb);
pNextThreadlink = pNextThreadlink->Flink;
}
return STATUS_SUCCESS;
}
pNextlink = pNextlink->Flink;
}
}
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
DbgPrint("Unload Success!\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
pDriverObject->DriverUnload = DriverUnload;
EnumThread(3148);
DbgPrint("Load Success!\n");
return STATUS_SUCCESS;
}