Windows内核事件通知机制

Windows内核事件通知机制

Windows内核中提供了一组接口，让我们可以针对某一事件注册通知例程，当这个事件发生的时候，我们注册的通知例程就会执行。

进程创建/退出通知

// 注册进程创建通知回调
NTSTATUS PsSetCreateProcessNotifyRoutine(
_In_ PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine, // 通知例程指针
_In_ BOOLEAN Remove // 为false则注册例程，为true则移除通知例程
);

// 回调函数原型
typedef VOID (*PCREATE_PROCESS_NOTIFY_ROUTINE)(
_In_ HANDLE ParentId, // 父进程ID
_In_ HANDLE ProcessId, // 被创建的进程的ID
_In_ BOOLEAN Create // 这个参数为TRUE表示当前是创建进程的通知，为FALSE表示当前是进程结束的通知
);

// 扩展版本（Windows Vista+）
NTSTATUS PsSetCreateProcessNotifyRoutineEx(
_In_ PCREATE_PROCESS_NOTIFY_ROUTINE_EX NotifyRoutine,
_In_ BOOLEAN Remove
);

通过调用PsSetCreateProcessNotifyRoutine为进程创建和退出注册NotifyRoutine回调例程。

**回调例程是在目标进程的第一个线程运行前被调用的。**根据微软文档：

“For a new process, the CreateProcessNotifyEx routine is called after the initial thread is created, but before the thread begins running.”

所以我们可以在回调中阻止进程的创建。

PsSetCreateProcessNotifyRoutineEx

该函数的第一个参数是类型为PCREATE_PROCESS_NOTIFY_ROUTINE_EX回调函数指针，定义如下：

/// PCREATE_PROCESS_NOTIFY_ROUTINE_EX
/// <summary>
/// 进程创建的通知回调
/// </summary>
/// <param name="pEprocess">进程对象指针</param>
/// <param name="hProcessId">进程ID</param>
/// <param name="pCreateInfo">进程相关信息</param>
void CreateProcessNotifyEx(PEPROCESS pEprocess, HANDLE hProcessId,
PPS_CREATE_NOTIFY_INFO pCreateInfo);

下面看看示例代码：

简单示例代码

这份代码来自谭文老师的《Windows内核编程》，回调例程中只是简单地输出进程的信息。

/*
* 进程创建或者结束
* PsSetCreateProcessNotifyRoutine:
*param1: 回调函数指针
*param2: 创建还是注销回调
*
* 回调是哪条线程执行的：
*创建：哪条线程创建的进程，就在哪条线程的上下文中执行回调
*销毁：哪条线程是进程最后一个退出的，就在哪条线程中执行回调
*/

#include <ntddk.h>
#include <windef.h>

void DriverUnload(PDRIVER_OBJECT pDriverObj);

/// <summary>
/// 进程创建的通知回调
/// </summary>
/// <param name="pEprocess">进程对象指针</param>
/// <param name="hProcessId">进程ID</param>
/// <param name="pCreateInfo">进程相关信息</param>
void CreateProcessNotifyEx(PEPROCESS pEprocess, HANDLE hProcessId,
PPS_CREATE_NOTIFY_INFO pCreateInfo);

static bool sg_bSuccReg = false;

EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegPath)
{
UNREFERENCED_PARAMETER(pRegPath);

NTSTATUS status = STATUS_SUCCESS;
do
{
pDriverObj->DriverUnload = DriverUnload;

// 创建通知回调
status = PsSetCreateProcessNotifyRoutineEx(CreateProcessNotifyEx, false);
if (!NT_SUCCESS(status))
{
sg_bSuccReg = false;
break;
}

sg_bSuccReg = true;
} while (false);

return status;
}

void DriverUnload(PDRIVER_OBJECT pDriverObj)
{
UNREFERENCED_PARAMETER(pDriverObj);

if (sg_bSuccReg)
{
// 传递true表明注销回调
PsSetCreateProcessNotifyRoutineEx(CreateProcessNotifyEx, true);
sg_bSuccReg = false;
}
}

void CreateProcessNotifyEx(PEPROCESS pEprocess, HANDLE hProcessId,
PPS_CREATE_NOTIFY_INFO pCreateInfo)
{
HANDLE hCurrentThreadID = PsGetCurrentThreadId();
if (pCreateInfo == nullptr) // 进程结束为nullptr，进程创建时为非nullptr
{
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL,
"[Destroy] ThreadID: 0x%X, ProcessID: 0x%X\\n",
(DWORD)hCurrentThreadID, (DWORD)hProcessId);
return;
}

// 进程创建
// HANDLE hParentProcessID = pCreateInfo->CreatingThreadId.UniqueProcess;
// HANDLE hParentThreadID = pCreateInfo->CreatingThreadId.UniqueThread;
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL,
"[Create] ThreadID: 0x%X, ProcessID: 0x%X, ProcessName: %wZ\\n",
(DWORD)hCurrentThreadID, (DWORD)hProcessId,
pCreateInfo->ImageFileName);

return;
}

通过回调例程阻止进程创建

要阻止进程创建，我们可以把回调例程中CreateInfo参数中的CreationStatus设置为STATUS_ACCESS_DENIED，并返回，这样就阻止进程的创建了。下面列举了可以使用的错误状态码：

• STATUS_ACCESS_DENIED- 拒绝访问
• STATUS_UNSUCCESSFUL- 操作不成功
• STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY- 策略禁用且不弹窗

#include <ntddk.h>
#include <windef.h>

// 这个函数貌似没有文档化。该函数的作用是获取EPROCESS中ImageFileName
EXTERN_C UCHAR* PsGetProcessImageFileName(PEPROCESS Process);

void DriverUnload(PDRIVER_OBJECT pDriverObj);

void CreateProcessNotifyEx(PEPROCESS pEprocess, HANDLE hProcessId,
PPS_CREATE_NOTIFY_INFO pCreateInfo);

static bool sg_bSuccReg = false;

EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegPath)
{
UNREFERENCED_PARAMETER(pRegPath);

NTSTATUS status = STATUS_SUCCESS;
do
{
pDriverObj->DriverUnload = DriverUnload;

// 创建通知回调
status = PsSetCreateProcessNotifyRoutineEx(CreateProcessNotifyEx, false);
if (!NT_SUCCESS(status))
{
sg_bSuccReg = false;
break;
}

sg_bSuccReg = true;
} while (false);

return status;
}

void DriverUnload(PDRIVER_OBJECT pDriverObj)
{
UNREFERENCED_PARAMETER(pDriverObj);

if (sg_bSuccReg)
{
// 传递true表明注销回调
PsSetCreateProcessNotifyRoutineEx(CreateProcessNotifyEx, true);
sg_bSuccReg = false;
}
}

void CreateProcessNotifyEx(PEPROCESS pEprocess, HANDLE hProcessId,
PPS_CREATE_NOTIFY_INFO pCreateInfo)
{
HANDLE hCurrentThreadID = PsGetCurrentThreadId();
if (pCreateInfo == nullptr) // 进程结束为nullptr，进程创建时为非nullptr
{
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL,
"[Destroy] ThreadID: 0x%X, ProcessID: 0x%X\\n",
(DWORD)hCurrentThreadID, (DWORD)hProcessId);
return;
}

// 进程创建，我们阻止notepad运行
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL,
"[Create] ThreadID: 0x%X, ProcessID: 0x%X, ProcessName: %wZ\\n",
(DWORD)hCurrentThreadID, (DWORD)hProcessId,
pCreateInfo->ImageFileName);

// 我们要获取的是EPROCESS中的ImageFileName
// pCreateInfo->ImageFileName是完整的路径
PUCHAR processName = PsGetProcessImageFileName(pEprocess);
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "ImageFileName: %s\\n", processName);
if (processName != nullptr && _stricmp((PCHAR)processName, "notepad.exe") == 0)
{
// 通过设置这个标志，阻止notepad.exe运行
pCreateInfo->CreationStatus = STATUS_ACCESS_DENIED;
}

return;
}

线程创建/退出通知

// 注册线程创建通知回调
NTSTATUS PsSetCreateThreadNotifyRoutine(
_In_ PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine
);

// 回调函数原型
typedef VOID (*PCREATE_THREAD_NOTIFY_ROUTINE)(
_In_ HANDLE ProcessId,
_In_ HANDLE ThreadId,
_In_ BOOLEAN Create
);

回调例程是在线程运行前被调用的。

模块加载通知

// 注册模块加载通知回调
NTSTATUS PsSetLoadImageNotifyRoutine(
_In_ PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine
);

// 回调函数原型
typedef VOID (*PLOAD_IMAGE_NOTIFY_ROUTINE)(
_In_opt_ PUNICODE_STRING FullImageName,
_In_ HANDLE ProcessId,
_In_ PIMAGE_INFO ImageInfo
);

// 注销回调
NTSTATUS PsRemoveLoadImageNotifyRoutine(
[in] PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine
);

这里的回调例程是在模块被加载完成后执行的。

示例代码

#include <ntddk.h>
#include <windef.h>

VOID DriverUnload(PDRIVER_OBJECT pDriverObj);
VOID LoadImageNotifyRoutine(PUNICODE_STRING fullImageName, HANDLE ProcessId,
PIMAGE_INFO ImageInfo);

static bool sg_bSuccReg = false;

EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegPath)
{
NTSTATUS status = STATUS_SUCCESS;
do
{
pDriverObj->DriverUnload = DriverUnload;
status = PsSetLoadImageNotifyRoutine(LoadImageNotifyRoutine);
if (!NT_SUCCESS(status))
{
break;
}

sg_bSuccReg = true;
} while (false);

return status;
}

VOID DriverUnload(PDRIVER_OBJECT pDriverObj)
{
if (sg_bSuccReg)
{
PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine);
sg_bSuccReg = false;
}

return;
}

// 这是单向通知，没有卸载事件通知回调
VOID LoadImageNotifyRoutine(PUNICODE_STRING fullImageName, HANDLE ProcessId,
PIMAGE_INFO ImageInfo)
{
if (!fullImageName || !ImageInfo)
{
return;
}

if (ImageInfo->ExtendedInfoPresent)
{
PIMAGE_INFO_EX pInfo = CONTAINING_RECORD(ImageInfo, IMAGE_INFO_EX, ImageInfo);
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL,
"ModLoad Name: %wZ, ProcessID: 0x%X, FileObj: 0x%X, ImageBase: 0x%X",
fullImageName, (DWORD)ProcessId, pInfo->FileObject,
pInfo->ImageInfo.ImageBase);
}

return;
}

注册表操作通知

// 注册注册表操作通知回调
NTSTATUS CmRegisterCallback(
_In_ PEX_CALLBACK_FUNCTION Function,
_In_opt_ PVOID Context,
_Out_ PLARGE_INTEGER Cookie
);

// 扩展版本
NTSTATUS CmRegisterCallbackEx(
_In_ PEX_CALLBACK_FUNCTION Function,
_In_ PCUNICODE_STRING Altitude,
_In_ PVOID Driver,
_In_opt_ PVOID Context,
_Out_ PLARGE_INTEGER Cookie,
_Reserved_ PVOID Reserved
);

// 回调函数原型
NTSTATUS RegistryCallback(
_In_opt_ PVOID CallbackContext,
_In_opt_ PVOID Argument1, // REG_NOTIFY_CLASS
_In_opt_ PVOID Argument2 // 操作信息结构体
);