实验环境:win7 x32
断链:
#include <ntifs.h>NTSTATUS EnumThread(ULONG ulPid, ULONG ulTid)
{PEPROCESS pProcessAddr = PsGetCurrentProcess();PLIST_ENTRY pHeadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0xb8);PLIST_ENTRY pNextlink = pHeadlink->Flink;while (pHeadlink != pNextlink){pProcessAddr = (PEPROCESS)((ULONG)pNextlink - 0xb8);ULONG pProcessID = *(PULONG)((ULONG)pProcessAddr + 0xb4);if (pProcessID == ulPid){PLIST_ENTRY pThreadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0x188);//pThreadlink是线程链表头节点PLIST_ENTRY pNextThreadlink = pThreadlink->Flink; //pNextThreadlink才是第一个真正的线程节点,指向ETHREAD的0x268的位置while (pThreadlink != pNextThreadlink){PETHREAD peThread = (PETHREAD)((ULONG)pNextThreadlink - 0x268);PCLIENT_ID pCid = (PCLIENT_ID)((ULONG)peThread + 0x22c);if (pCid->UniqueThread == ulTid){RemoveEntryList(pNextThreadlink);//尽量使用MiProcessLoaderEntry进行断链return STATUS_SUCCESS;}pNextThreadlink = pNextThreadlink->Flink;}}pNextlink = pNextlink->Flink;}
}VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{DbgPrint("Unload Success!\n");
}NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{pDriverObject->DriverUnload = DriverUnload;EnumThread(3148,3160);DbgPrint("Load Success!\n");return STATUS_SUCCESS;
}
获取信息:
#include <ntifs.h>NTSTATUS EnumThread(ULONG ulPid)
{PEPROCESS pProcessAddr = PsGetCurrentProcess();PLIST_ENTRY pHeadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0xb8);PLIST_ENTRY pNextlink = pHeadlink->Flink;while (pHeadlink != pNextlink){pProcessAddr = (PEPROCESS)((ULONG)pNextlink - 0xb8);ULONG pProcessID = *(PULONG)((ULONG)pProcessAddr + 0xb4);if (pProcessID == ulPid){PLIST_ENTRY pThreadlink = (PLIST_ENTRY)((ULONG)pProcessAddr + 0x188);PLIST_ENTRY pNextThreadlink = pThreadlink->Flink;while (pThreadlink != pNextThreadlink){PETHREAD peThread = (PETHREAD)((ULONG)pNextThreadlink - 0x268);PCLIENT_ID pCid = (PCLIENT_ID)((ULONG)peThread + 0x22c);ULONG teb = *(PULONG)((ULONG)peThread + 0x88);DbgPrint("ID:%d EThread:0x%x Tbe:0x%x\n", pCid->UniqueThread, peThread, teb);pNextThreadlink = pNextThreadlink->Flink;}return STATUS_SUCCESS;}pNextlink = pNextlink->Flink;}
}VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{DbgPrint("Unload Success!\n");
}NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{pDriverObject->DriverUnload = DriverUnload;EnumThread(3148);DbgPrint("Load Success!\n");return STATUS_SUCCESS;
}