This commit is contained in:
2026-06-09 14:30:00 +08:00
parent 4d7ffb4136
commit c8aeddb902
4 changed files with 6 additions and 15 deletions
+3 -8
View File
@@ -1,13 +1,10 @@
#include "create_thread_callback.h" #include "create_thread_callback.h"
#include "protect_filter.h" #include "protect_filter.h"
namespace thread_notify_routine namespace thread_notify_routine
{ {
//保护的进程ID //保护的进程ID
auto protect_id = ULongToHandle(8976); //auto protect_id = ULongToHandle(8976);
void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create) void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
@@ -19,9 +16,6 @@ namespace thread_notify_routine
if (!NT_SUCCESS(status)) if (!NT_SUCCESS(status))
goto end; goto end;
/*PEPROCESS protect_process{ 0 }; /*PEPROCESS protect_process{ 0 };
status = PsLookupProcessByProcessId(protect_id, &protect_process); status = PsLookupProcessByProcessId(protect_id, &protect_process);
if (!NT_SUCCESS(status)) if (!NT_SUCCESS(status))
@@ -48,8 +42,9 @@ namespace thread_notify_routine
DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId); DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
} }
end: end:
ObDereferenceObject(process); ObDereferenceObject(process);
} }
} }
+3
View File
@@ -27,4 +27,7 @@ namespace kernel_api
return reinterpret_cast<UCHAR * (*)(PEPROCESS)> return reinterpret_cast<UCHAR * (*)(PEPROCESS)>
(imported.ps_getprocessimage_filname)(Process); (imported.ps_getprocessimage_filname)(Process);
} }
} }
@@ -22,13 +22,7 @@ namespace load_image_notify_routine
} }
} }
} }
-1
View File
@@ -67,7 +67,6 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
status = ObRegisterCallbacks(&obReg, &reg_ob_callback_handle); status = ObRegisterCallbacks(&obReg, &reg_ob_callback_handle);
return status; return status;
} }
auto ob_call_back::uninstall_ob_callback() -> BOOLEAN auto ob_call_back::uninstall_ob_callback() -> BOOLEAN