CHANGMEN's Blog | Network Security Professional

ETW-TI Kernel Bypass

最近更新：2026-05-02 | 字数总计：3.6k | 阅读估时：22分钟 | 阅读量：次

参考
流程
调用ETW-TI
代码

参考

https://github.com/V-i-x-x/kernel-callback-removal/tree/main/ETWTIBypass

流程

1 2	lkd> dqs nt!EtwThreatIntProvRegHandle L1 fffff806`904fe358 ffff950e`64cff810

lkd> dt _ETW_REG_ENTRY ffff950e`64cff810
nt!_ETW_REG_ENTRY
   +0x000 RegList          : _LIST_ENTRY [ 0xffff950e`645c6718 - 0xffff950e`645c6718 ]
   +0x010 GroupRegList     : _LIST_ENTRY [ 0xffff950e`64cff820 - 0xffff950e`64cff820 ]
   +0x020 GuidEntry        : 0xffff950e`645c66e0 _ETW_GUID_ENTRY
   +0x028 GroupEntry       : (null) 
   +0x030 ReplyQueue       : 0xfffff806`901fda7a _ETW_REPLY_QUEUE
   +0x030 ReplySlot        : [4] 0xfffff806`901fda7a _ETW_QUEUE_ENTRY
   +0x030 Caller           : 0xfffff806`901fda7a Void
   +0x038 SessionId        : 0
   +0x050 Process          : (null) 
   +0x050 CallbackContext  : (null) 
   +0x058 Callback         : (null) 
   +0x060 Index            : 0
   +0x062 Flags            : 0x41
   +0x062 DbgKernelRegistration : 0y1
   +0x062 DbgUserRegistration : 0y0
   +0x062 DbgReplyRegistration : 0y0
   +0x062 DbgClassicRegistration : 0y0
   +0x062 DbgSessionSpaceRegistration : 0y0
   +0x062 DbgModernRegistration : 0y0
   +0x062 DbgClosed        : 0y1
   +0x062 DbgInserted      : 0y0
   +0x062 DbgWow64         : 0y0
   +0x062 DbgUseDescriptorType : 0y0
   +0x062 DbgDropProviderTraits : 0y0
   +0x064 EnableMask       : 0x1 ''
   +0x065 GroupEnableMask  : 0 ''
   +0x066 HostEnableMask   : 0 ''
   +0x067 HostGroupEnableMask : 0 ''
   +0x068 Traits           : (null)

lkd> dt _ETW_GUID_ENTRY 0xffff950e`645c66e0 
nt!_ETW_GUID_ENTRY
   +0x000 GuidList         : _LIST_ENTRY [ 0xffff950e`64684828 - 0xffff950e`647faca0 ]
   +0x010 SiloGuidList     : _LIST_ENTRY [ 0xffff950e`645c66f0 - 0xffff950e`645c66f0 ]
   +0x020 RefCount         : 0n2
   +0x028 Guid             : _GUID {f4e1897c-bb5d-5668-f1d8-040f4d8dd344}
   +0x038 RegListHead      : _LIST_ENTRY [ 0xffff950e`64cff810 - 0xffff950e`64cff810 ]
   +0x048 SecurityDescriptor : 0xffffc885`0d4d59a0 Void
   +0x050 LastEnable       : _ETW_LAST_ENABLE_INFO
   +0x050 MatchId          : 0x00000114`dcfa5555
   +0x060 ProviderEnableInfo : _TRACE_ENABLE_INFO
   +0x080 EnableInfo       : [8] _TRACE_ENABLE_INFO
   +0x180 FilterData       : (null) 
   +0x188 SiloState        : 0xffff950e`64684000 _ETW_SILODRIVERSTATE
   +0x190 HostEntry        : (null) 
   +0x198 Lock             : _EX_PUSH_LOCK
   +0x1a0 LockOwner        : (null)

lkd> dx -id 0,0,ffff950e685b2080 -r1 (*((ntkrnlmp!_TRACE_ENABLE_INFO *)0xffff950e645c6740))
(*((ntkrnlmp!_TRACE_ENABLE_INFO *)0xffff950e645c6740))                 [Type: _TRACE_ENABLE_INFO]
    [+0x000] IsEnabled        : 0x1 [Type: unsigned long]
    [+0x004] Level            : 0xff [Type: unsigned char]
    [+0x005] Reserved1        : 0x0 [Type: unsigned char]
    [+0x006] LoggerId         : 0x0 [Type: unsigned short]
    [+0x008] EnableProperty   : 0x40 [Type: unsigned long]
    [+0x00c] Reserved2        : 0x0 [Type: unsigned long]
    [+0x010] MatchAnyKeyword  : 0x114dcfa5555 [Type: unsigned __int64]
    [+0x018] MatchAllKeyword  : 0x0 [Type: unsigned __int64]

IsEnabled 字段决定事件提供者是否被启用或禁用。

调用ETW-TI

这个致盲没啥难的，主要是我们自己写一个调用etw-ti的时候，是需要前提条件的，比如需要管理员运行程序，需要有签名证书，啥的，我参考https://bbs.kanxue.com/thread-283800-1.htm，进行直接windbg修改了eprocess结构

// 1. 找到你程序的 EPROCESS 地址
!process 0 0 你的程序名.exe

// 输出类似：
// PROCESS ffff8a01`23456780
//     SessionId: 1  Cid: 1234

// 2. 查看当前 Protection 字段
dt nt!_EPROCESS ffff8a0123456780 SignatureLevel SectionSignatureLevel Protection

// 3. 查找 Protection 字段的偏移
dt nt!_EPROCESS Protection

// 4. 直接修改，假设偏移是 0x878
// PPL Antimalware = Type:1, Signer:3 → 字节 = (3<<4)|1 = 0x31
eb ffff8a0123456780+0x878 0x31

// 5. 同时改 SignatureLevel 和 SectionSignatureLevel（偏移在 Protection 前两个字节）
// 假设偏移 0x876
eb ffff8a0123456780+0x876 0x3f
eb ffff8a0123456780+0x877 0x3f

代码

#include <krabs.hpp>
#include <iostream>
#include <sstream>
#include <thread>

// ============================================================
// Keywords
// ============================================================
#define KERNEL_THREATINT_KEYWORD_ALLOCVM_LOCAL                    0x1
#define KERNEL_THREATINT_KEYWORD_ALLOCVM_LOCAL_KERNEL_CALLER      0x2
#define KERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTE                   0x4
#define KERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTE_KERNEL_CALLER     0x8
#define KERNEL_THREATINT_KEYWORD_PROTECTVM_LOCAL                  0x10
#define KERNEL_THREATINT_KEYWORD_PROTECTVM_LOCAL_KERNEL_CALLER    0x20
#define KERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTE                 0x40
#define KERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTE_KERNEL_CALLER   0x80
#define KERNEL_THREATINT_KEYWORD_MAPVIEW_LOCAL                    0x100
#define KERNEL_THREATINT_KEYWORD_MAPVIEW_LOCAL_KERNEL_CALLER      0x200
#define KERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTE                   0x400
#define KERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTE_KERNEL_CALLER     0x800
#define KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE              0x1000
#define KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE_KERNEL_CALLER 0x2000
#define KERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE          0x4000
#define KERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE_KERNEL_CALLER 0x8000
#define KERNEL_THREATINT_KEYWORD_READVM_LOCAL                     0x10000
#define KERNEL_THREATINT_KEYWORD_READVM_REMOTE                    0x20000
#define KERNEL_THREATINT_KEYWORD_WRITEVM_LOCAL                    0x40000
#define KERNEL_THREATINT_KEYWORD_WRITEVM_REMOTE                   0x80000
#define KERNEL_THREATINT_KEYWORD_SUSPEND_THREAD                   0x100000
#define KERNEL_THREATINT_KEYWORD_RESUME_THREAD                    0x200000
#define KERNEL_THREATINT_KEYWORD_SUSPEND_PROCESS                  0x400000
#define KERNEL_THREATINT_KEYWORD_RESUME_PROCESS                   0x800000
#define KERNEL_THREATINT_KEYWORD_DRIVER_EVENTS                    0x40000000
#define KERNEL_THREATINT_KEYWORD_DEVICE_EVENTS                    0x80000000

krabs::user_trace g_trace(L"MyEDR-EtwTi");

// ============================================================
// ¸¨Öúº¯Êý£ºProtection ×Ö½Ú½âÎö
// ============================================================
std::string ParseProtection(UCHAR prot) {
    UCHAR type = prot & 0x7;
    UCHAR signer = (prot >> 4) & 0xF;
    std::string typeStr, signerStr;

    switch (type) {
    case 0: typeStr = "None"; break;
    case 1: typeStr = "PPL"; break;
    case 2: typeStr = "PP"; break;
    default: typeStr = "Unknown"; break;
    }
    switch (signer) {
    case 0: signerStr = "None"; break;
    case 1: signerStr = "Authenticode"; break;
    case 2: signerStr = "CodeGen"; break;
    case 3: signerStr = "Antimalware"; break;
    case 4: signerStr = "Lsa"; break;
    case 5: signerStr = "Windows"; break;
    case 6: signerStr = "WinTcb"; break;
    case 7: signerStr = "WinSystem"; break;
    case 8: signerStr = "App"; break;
    default: signerStr = "Unknown"; break;
    }
    return typeStr + "/" + signerStr;
}

std::string ProtectMaskToString(DWORD mask) {
    switch (mask & 0xFF) {
    case PAGE_NOACCESS:          return "NOACCESS";
    case PAGE_READONLY:          return "READONLY";
    case PAGE_READWRITE:         return "READWRITE";
    case PAGE_WRITECOPY:         return "WRITECOPY";
    case PAGE_EXECUTE:           return "EXECUTE";
    case PAGE_EXECUTE_READ:      return "EXECUTE_READ";
    case PAGE_EXECUTE_READWRITE: return "EXECUTE_READWRITE";
    case PAGE_EXECUTE_WRITECOPY: return "EXECUTE_WRITECOPY";
    default:                     return "UNKNOWN(0x" + std::to_string(mask) + ")";
    }
}

// ============================================================
// Event 1 : AllocVM Remote
// Template : KERNEL_THREATINT_TASK_ALLOCVMArgs_V1
// ============================================================
krabs::event_filter MakeAllocVMRemoteFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(1));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto callerTid = parser.parse<DWORD>(L"CallingThreadId");
            auto callerProt = parser.parse<UCHAR>(L"CallingProcessProtection");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");
            auto targetProt = parser.parse<UCHAR>(L"TargetProcessProtection");
            auto baseAddr = parser.parse<PVOID>(L"BaseAddress");
            auto regionSize = parser.parse<PVOID>(L"RegionSize");
            auto allocType = parser.parse<DWORD>(L"AllocationType");
            auto protectMask = parser.parse<DWORD>(L"ProtectionMask");

            std::cout << "[AllocVM Remote]\n"
                << "  Caller PID   : " << callerPid
                << " (Protection: " << ParseProtection(callerProt) << ")\n"
                << "  Caller TID   : " << callerTid << "\n"
                << "  Target PID   : " << targetPid
                << " (Protection: " << ParseProtection(targetProt) << ")\n"
                << "  BaseAddress  : 0x" << std::hex << (uintptr_t)baseAddr << "\n"
                << "  RegionSize   : 0x" << std::hex << (uintptr_t)regionSize << "\n"
                << "  AllocType    : 0x" << std::hex << allocType << "\n"
                << "  Protect      : " << ProtectMaskToString(protectMask) << "\n\n";
        });
    return filter;
}

// ============================================================
// Event 2 : ProtectVM Remote
// Template : KERNEL_THREATINT_TASK_PROTECTVMArgs_V1
// ============================================================
krabs::event_filter MakeProtectVMRemoteFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(2));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto callerTid = parser.parse<DWORD>(L"CallingThreadId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");
            auto baseAddr = parser.parse<PVOID>(L"BaseAddress");
            auto regionSize = parser.parse<PVOID>(L"RegionSize");
            auto newProtect = parser.parse<DWORD>(L"ProtectionMask");
            auto oldProtect = parser.parse<DWORD>(L"LastProtectionMask");

            std::cout << "[ProtectVM Remote]\n"
                << "  Caller PID   : " << std::dec << callerPid << "\n"
                << "  Caller TID   : " << callerTid << "\n"
                << "  Target PID   : " << targetPid << "\n"
                << "  BaseAddress  : 0x" << std::hex << (uintptr_t)baseAddr << "\n"
                << "  RegionSize   : 0x" << std::hex << (uintptr_t)regionSize << "\n"
                << "  NewProtect   : " << ProtectMaskToString(newProtect) << "\n"
                << "  OldProtect   : " << ProtectMaskToString(oldProtect) << "\n\n";
        });
    return filter;
}

// ============================================================
// Event 3 : MapView Remote
// Template : KERNEL_THREATINT_TASK_MAPVIEWArgs_V1
// ============================================================
krabs::event_filter MakeMapViewRemoteFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(3));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto callerTid = parser.parse<DWORD>(L"CallingThreadId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");
            auto baseAddr = parser.parse<PVOID>(L"BaseAddress");
            auto viewSize = parser.parse<PVOID>(L"ViewSize");
            auto allocType = parser.parse<DWORD>(L"AllocationType");
            auto protMask = parser.parse<DWORD>(L"ProtectionMask");

            std::cout << "[MapView Remote]\n"
                << "  Caller PID   : " << std::dec << callerPid << "\n"
                << "  Caller TID   : " << callerTid << "\n"
                << "  Target PID   : " << targetPid << "\n"
                << "  BaseAddress  : 0x" << std::hex << (uintptr_t)baseAddr << "\n"
                << "  ViewSize     : 0x" << std::hex << (uintptr_t)viewSize << "\n"
                << "  AllocType    : 0x" << std::hex << allocType << "\n"
                << "  Protect      : " << ProtectMaskToString(protMask) << "\n\n";
        });
    return filter;
}

// ============================================================
// Event 4 : QueueUserAPC Remote
// Template : KERNEL_THREATINT_TASK_QUEUEUSERAPCArgs_V1
// ============================================================
krabs::event_filter MakeQueueUserAPCRemoteFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(4));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto callerTid = parser.parse<DWORD>(L"CallingThreadId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");
            auto targetTid = parser.parse<DWORD>(L"TargetThreadId");
            auto alertable = parser.parse<UCHAR>(L"TargetThreadAlertable");
            auto apcRoutine = parser.parse<PVOID>(L"ApcRoutine");
            auto apcArg1 = parser.parse<PVOID>(L"ApcArgument1");
            // VAD ÐÅÏ¢£¨APC Routine ËùÔÚÄÚ´æÇøÓò£©
            auto vadMmfName = parser.parse<std::wstring>(L"ApcRoutineVadMmfName");
            auto vadAllocBase = parser.parse<PVOID>(L"ApcRoutineVadAllocationBase");
            auto vadProtect = parser.parse<DWORD>(L"ApcRoutineVadAllocationProtect");

            std::wcout << L"[QueueUserAPC Remote]\n"
                << L"  Caller PID     : " << callerPid << L"\n"
                << L"  Caller TID     : " << callerTid << L"\n"
                << L"  Target PID     : " << targetPid << L"\n"
                << L"  Target TID     : " << targetTid << L"\n"
                << L"  Alertable      : " << (alertable ? L"Yes" : L"No") << L"\n"
                << L"  ApcRoutine     : 0x" << std::hex << (uintptr_t)apcRoutine << L"\n"
                << L"  ApcArgument1   : 0x" << std::hex << (uintptr_t)apcArg1 << L"\n"
                << L"  VAD MmfName    : " << vadMmfName << L"\n"
                << L"  VAD AllocBase  : 0x" << std::hex << (uintptr_t)vadAllocBase << L"\n"
                << L"  VAD Protect    : " << ProtectMaskToString(vadProtect).c_str() << L"\n\n";
        });
    return filter;
}

// ============================================================
// Event 5 : SetThreadContext Remote
// Template : KERNEL_THREATINT_TASK_SETTHREADCONTEXTArgs_V1
// ============================================================
krabs::event_filter MakeSetThreadContextRemoteFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(5));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto callerTid = parser.parse<DWORD>(L"CallingThreadId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");
            auto targetTid = parser.parse<DWORD>(L"TargetThreadId");
            auto pc = parser.parse<PVOID>(L"Pc");
            auto sp = parser.parse<PVOID>(L"Sp");
            auto lr = parser.parse<PVOID>(L"Lr");
            auto fp = parser.parse<PVOID>(L"Fp");
            auto pcVadMmf = parser.parse<std::wstring>(L"PcVadMmfName");
            auto pcVadBase = parser.parse<PVOID>(L"PcVadAllocationBase");
            auto pcVadProt = parser.parse<DWORD>(L"PcVadAllocationProtect");

            std::wcout << L"[SetThreadContext Remote]\n"
                << L"  Caller PID   : " << callerPid << L"\n"
                << L"  Caller TID   : " << callerTid << L"\n"
                << L"  Target PID   : " << targetPid << L"\n"
                << L"  Target TID   : " << targetTid << L"\n"
                << L"  PC           : 0x" << std::hex << (uintptr_t)pc << L"\n"
                << L"  SP           : 0x" << std::hex << (uintptr_t)sp << L"\n"
                << L"  LR           : 0x" << std::hex << (uintptr_t)lr << L"\n"
                << L"  FP           : 0x" << std::hex << (uintptr_t)fp << L"\n"
                << L"  PC VAD Name  : " << pcVadMmf << L"\n"
                << L"  PC VAD Base  : 0x" << std::hex << (uintptr_t)pcVadBase << L"\n"
                << L"  PC VAD Prot  : " << ProtectMaskToString(pcVadProt).c_str() << L"\n\n";
        });
    return filter;
}

// ============================================================
// Event 13 : ReadVM Remote
// Event 14 : WriteVM Remote
// Template : KERNEL_THREATINT_TASK_READVMArgs_V1
// £¨Á½¸ö¹²ÓÃÍ¬Ò»¸ö template£¬Ö»ÊÇ Event ID ²»Í¬£©
// ============================================================
krabs::event_filter MakeReadVMRemoteFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(13));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            auto status = parser.parse<DWORD>(L"OperationStatus");
            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto callerTid = parser.parse<DWORD>(L"CallingThreadId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");
            auto baseAddr = parser.parse<PVOID>(L"BaseAddress");
            auto bytesCopied = parser.parse<PVOID>(L"BytesCopied");

            std::cout << "[ReadVM Remote]\n"
                << "  Status       : 0x" << std::hex << status << "\n"
                << "  Caller PID   : " << std::dec << callerPid << "\n"
                << "  Caller TID   : " << callerTid << "\n"
                << "  Target PID   : " << targetPid << "\n"
                << "  BaseAddress  : 0x" << std::hex << (uintptr_t)baseAddr << "\n"
                << "  BytesCopied  : " << std::dec << (uintptr_t)bytesCopied << "\n\n";
        });
    return filter;
}

krabs::event_filter MakeWriteVMRemoteFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(14));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            auto status = parser.parse<DWORD>(L"OperationStatus");
            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto callerTid = parser.parse<DWORD>(L"CallingThreadId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");
            auto baseAddr = parser.parse<PVOID>(L"BaseAddress");
            auto bytesCopied = parser.parse<PVOID>(L"BytesCopied");

            std::cout << "[WriteVM Remote]\n"
                << "  Status       : 0x" << std::hex << status << "\n"
                << "  Caller PID   : " << std::dec << callerPid << "\n"
                << "  Caller TID   : " << callerTid << "\n"
                << "  Target PID   : " << targetPid << "\n"
                << "  BaseAddress  : 0x" << std::hex << (uintptr_t)baseAddr << "\n"
                << "  BytesCopied  : " << std::dec << (uintptr_t)bytesCopied << "\n\n";
        });
    return filter;
}

// ============================================================
// Event 15/16 : Suspend/Resume Thread
// Template : KERNEL_THREATINT_TASK_SUSPENDRESUME_THREADArgs_V1
// ============================================================
krabs::event_filter MakeSuspendResumeThreadFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(15));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            bool isSuspend = (record.EventHeader.EventDescriptor.Id == 15);
            auto status = parser.parse<DWORD>(L"OperationStatus");
            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto callerTid = parser.parse<DWORD>(L"CallingThreadId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");
            auto targetTid = parser.parse<DWORD>(L"TargetThreadId");

            std::cout << (isSuspend ? "[SuspendThread]" : "[ResumeThread]") << "\n"
                << "  Status       : 0x" << std::hex << status << "\n"
                << "  Caller PID   : " << std::dec << callerPid << "\n"
                << "  Caller TID   : " << callerTid << "\n"
                << "  Target PID   : " << targetPid << "\n"
                << "  Target TID   : " << targetTid << "\n\n";
        });
    return filter;
}

krabs::event_filter MakeResumeThreadFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(16));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            bool isSuspend = (record.EventHeader.EventDescriptor.Id == 15);
            auto status = parser.parse<DWORD>(L"OperationStatus");
            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto callerTid = parser.parse<DWORD>(L"CallingThreadId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");
            auto targetTid = parser.parse<DWORD>(L"TargetThreadId");

            std::cout << (isSuspend ? "[SuspendThread]" : "[ResumeThread]") << "\n"
                << "  Status       : 0x" << std::hex << status << "\n"
                << "  Caller PID   : " << std::dec << callerPid << "\n"
                << "  Caller TID   : " << callerTid << "\n"
                << "  Target PID   : " << targetPid << "\n"
                << "  Target TID   : " << targetTid << "\n\n";
        });
    return filter;
}

// ============================================================
// Event 17/18 : Suspend/Resume Process
// Template : KERNEL_THREATINT_TASK_SUSPENDRESUME_PROCESSArgs_V1
// ============================================================
krabs::event_filter MakeSuspendResumeProcessFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(17));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            bool isSuspend = (record.EventHeader.EventDescriptor.Id == 17);
            auto status = parser.parse<DWORD>(L"OperationStatus");
            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");

            std::cout << (isSuspend ? "[SuspendProcess]" : "[ResumeProcess]") << "\n"
                << "  Status       : 0x" << std::hex << status << "\n"
                << "  Caller PID   : " << std::dec << callerPid << "\n"
                << "  Target PID   : " << targetPid << "\n\n";
        });
    return filter;
}

krabs::event_filter MakeResumeProcessFilter() {
    krabs::event_filter filter(krabs::predicates::id_is(18));
    filter.add_on_event_callback([](const EVENT_RECORD& record,
        const krabs::trace_context& ctx)
        {
            krabs::schema schema(record, ctx.schema_locator);
            krabs::parser parser(schema);

            bool isSuspend = (record.EventHeader.EventDescriptor.Id == 17);
            auto status = parser.parse<DWORD>(L"OperationStatus");
            auto callerPid = parser.parse<DWORD>(L"CallingProcessId");
            auto targetPid = parser.parse<DWORD>(L"TargetProcessId");

            std::cout << (isSuspend ? "[SuspendProcess]" : "[ResumeProcess]") << "\n"
                << "  Status       : 0x" << std::hex << status << "\n"
                << "  Caller PID   : " << std::dec << callerPid << "\n"
                << "  Target PID   : " << targetPid << "\n\n";
        });
    return filter;
}

// ============================================================
// Æô¶¯ / Í£Ö¹
// ============================================================
void StartEtwTi() {
    krabs::provider<> provider(L"Microsoft-Windows-Threat-Intelligence");

    provider.any(
        KERNEL_THREATINT_KEYWORD_ALLOCVM_REMOTE |
        KERNEL_THREATINT_KEYWORD_PROTECTVM_REMOTE |
        KERNEL_THREATINT_KEYWORD_MAPVIEW_REMOTE |
        KERNEL_THREATINT_KEYWORD_QUEUEUSERAPC_REMOTE |
        KERNEL_THREATINT_KEYWORD_SETTHREADCONTEXT_REMOTE |
        KERNEL_THREATINT_KEYWORD_READVM_REMOTE |
        KERNEL_THREATINT_KEYWORD_WRITEVM_REMOTE |
        KERNEL_THREATINT_KEYWORD_SUSPEND_THREAD |
        KERNEL_THREATINT_KEYWORD_RESUME_THREAD |
        KERNEL_THREATINT_KEYWORD_SUSPEND_PROCESS |
        KERNEL_THREATINT_KEYWORD_RESUME_PROCESS
    );

    provider.add_filter(MakeAllocVMRemoteFilter());
    provider.add_filter(MakeProtectVMRemoteFilter());
    provider.add_filter(MakeMapViewRemoteFilter());
    provider.add_filter(MakeQueueUserAPCRemoteFilter());
    provider.add_filter(MakeSetThreadContextRemoteFilter());
    provider.add_filter(MakeReadVMRemoteFilter());
    provider.add_filter(MakeWriteVMRemoteFilter());
    provider.add_filter(MakeSuspendResumeThreadFilter());
    provider.add_filter(MakeResumeThreadFilter());
    provider.add_filter(MakeSuspendResumeProcessFilter());
    provider.add_filter(MakeResumeProcessFilter());

    g_trace.enable(provider);

    std::cout << "[*] ETW-TI Monitor Started\n";
    g_trace.start(); // ×èÈû
}

void StopEtwTi() {
    g_trace.stop();
    std::cout << "[*] ETW-TI Monitor Stopped\n";
}

int main() {
    std::cout << "[*] PID: " << GetCurrentProcessId() << "\n";
    std::cout << "[*] ÇëÏÖÔÚÓÃ WinDbg ÐÞ¸Ä Protection£¬¸ÄÍêºó°´ Enter ¼ÌÐø...\n";
    std::cin.get(); // µÈÄã¸ÄÍê

    std::thread monitor([]() { StartEtwTi(); });
    std::cout << "Press Enter to stop...\n";
    std::cin.get();
    StopEtwTi();
    monitor.join();
    return 0;
}

2026-05-02 该篇文章被 CHANGMEN 打上标签: 内核