代码案例
监控线程创建与监控进程差不多，检测线程需要调用PsSetCreateThreadNotifyRoutine 创建回调函数，之后就可监控系统所有线程的创建，具体实现代码如下。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
| #include <ntifs.h>
NTKERNELAPI PCHAR PsGetProcessImageFileName(PEPROCESS Process);
NTKERNELAPI NTSTATUS PsLookupProcessByProcessId(HANDLE ProcessId, PEPROCESS *Process);
NTKERNELAPI NTSTATUS PsLookupThreadByThreadId(HANDLE ThreadId, PETHREAD *Thread);
BOOLEAN BypassCheckSign(PDRIVER_OBJECT pDriverObject)
{
#ifdef _WIN64
typedef struct _KLDR_DATA_TABLE_ENTRY
{
LIST_ENTRY listEntry;
ULONG64 __Undefined1;
ULONG64 __Undefined2;
ULONG64 __Undefined3;
ULONG64 NonPagedDebugInfo;
ULONG64 DllBase;
ULONG64 EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING path;
UNICODE_STRING name;
ULONG Flags;
USHORT LoadCount;
USHORT __Undefined5;
ULONG64 __Undefined6;
ULONG CheckSum;
ULONG __padding1;
ULONG TimeDateStamp;
ULONG __padding2;
} KLDR_DATA_TABLE_ENTRY, *PKLDR_DATA_TABLE_ENTRY;
#else
typedef struct _KLDR_DATA_TABLE_ENTRY
{
LIST_ENTRY listEntry;
ULONG unknown1;
ULONG unknown2;
ULONG unknown3;
ULONG unknown4;
ULONG unknown5;
ULONG unknown6;
ULONG unknown7;
UNICODE_STRING path;
UNICODE_STRING name;
ULONG Flags;
} KLDR_DATA_TABLE_ENTRY, *PKLDR_DATA_TABLE_ENTRY;
#endif
PKLDR_DATA_TABLE_ENTRY pLdrData = (PKLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection;
pLdrData->Flags = pLdrData->Flags | 0x20;
return TRUE;
}
VOID MyCreateThreadNotify(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN CreateInfo)
{
PEPROCESS eprocess = NULL;
PETHREAD ethread = NULL;
UCHAR *pWin32Address = NULL;
PsLookupProcessByProcessId(ProcessId, &eprocess);
PsLookupThreadByThreadId(ThreadId, ðread);
if (CreateInfo)
{
DbgPrint("[lyshark.com] 线程TID: %1d | 所属进程名: %s | 进程PID: %1d \n", ThreadId, PsGetProcessImageFileName(eprocess), PsGetProcessId(eprocess));
}
else
{
DbgPrint("[LyShark] %s 线程已退出...", ThreadId);
}
if (eprocess)
ObDereferenceObject(eprocess);
if (ethread)
ObDereferenceObject(ethread);
}
VOID UnDriver(PDRIVER_OBJECT driver)
{
NTSTATUS status;
status = PsRemoveCreateThreadNotifyRoutine(MyCreateThreadNotify);
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
NTSTATUS status;
DbgPrint("hello lyshark.com \n");
BypassCheckSign(Driver);
status = PsSetCreateThreadNotifyRoutine(MyCreateThreadNotify);
if (!NT_SUCCESS(status))
{
DbgPrint("创建线程回调错误");
}
Driver->DriverUnload = UnDriver;
return STATUS_SUCCESS;
}
|
windbg找数据结构进行手动致盲
与进程的一模一样，按着来就行。
脚本致盲思路
跟进程一样，从函数定位然后计算偏移即可。
使用与进程回调相同的方法，我们需要找到两个靠近 PspSetCreateThreadNotifyRoutine 的函数来进行字节搜索。
1
2
| lkd> ? nt!PspSetCreateThreadNotifyRoutine - nt
Evaluate expression: 7686936 = 00000000`00754b18
|
然后使用ida进行查看这个位置的上下函数，然后搜索特征码即可