驱动——线程断链和信息获取

实验环境：win7 x32

断链：

#include <ntifs.h>NTSTATUS EnumThread(ULONG ulPid, ULONG ulTid)
{PEPROCESS pProcessAddr = PsGetCurrentProcess();PLIST_ENTRY pHeadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0xb8);PLIST_ENTRY pNextlink = pHeadlink->Flink;while (pHeadlink != pNextlink){pProcessAddr = (PEPROCESS)((ULONG)pNextlink - 0xb8);ULONG pProcessID = *(PULONG)((ULONG)pProcessAddr + 0xb4);if (pProcessID == ulPid){PLIST_ENTRY pThreadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0x188);//pThreadlink是线程链表头节点PLIST_ENTRY pNextThreadlink = pThreadlink->Flink;					 //pNextThreadlink才是第一个真正的线程节点，指向ETHREAD的0x268的位置while (pThreadlink != pNextThreadlink){PETHREAD peThread = (PETHREAD)((ULONG)pNextThreadlink - 0x268);PCLIENT_ID pCid = (PCLIENT_ID)((ULONG)peThread + 0x22c);if (pCid->UniqueThread == ulTid){RemoveEntryList(pNextThreadlink);//尽量使用MiProcessLoaderEntry进行断链return STATUS_SUCCESS;}pNextThreadlink = pNextThreadlink->Flink;}}pNextlink = pNextlink->Flink;}
}VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{DbgPrint("Unload Success!\n");
}NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{pDriverObject->DriverUnload = DriverUnload;EnumThread(3148,3160);DbgPrint("Load Success!\n");return STATUS_SUCCESS;
}

获取信息：

#include <ntifs.h>NTSTATUS EnumThread(ULONG ulPid)
{PEPROCESS pProcessAddr = PsGetCurrentProcess();PLIST_ENTRY pHeadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0xb8);PLIST_ENTRY pNextlink = pHeadlink->Flink;while (pHeadlink != pNextlink){pProcessAddr = (PEPROCESS)((ULONG)pNextlink - 0xb8);ULONG pProcessID = *(PULONG)((ULONG)pProcessAddr + 0xb4);if (pProcessID == ulPid){PLIST_ENTRY pThreadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0x188);PLIST_ENTRY pNextThreadlink = pThreadlink->Flink;while (pThreadlink != pNextThreadlink){PETHREAD peThread = (PETHREAD)((ULONG)pNextThreadlink - 0x268);PCLIENT_ID pCid = (PCLIENT_ID)((ULONG)peThread + 0x22c);ULONG teb = *(PULONG)((ULONG)peThread + 0x88);DbgPrint("ID:%d  EThread:0x%x  Tbe:0x%x\n", pCid->UniqueThread, peThread, teb);pNextThreadlink = pNextThreadlink->Flink;}return STATUS_SUCCESS;}pNextlink = pNextlink->Flink;}
}VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{DbgPrint("Unload Success!\n");
}NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{pDriverObject->DriverUnload = DriverUnload;EnumThread(3148);DbgPrint("Load Success!\n");return STATUS_SUCCESS;
}