61 lines
1.2 KiB
C++
61 lines
1.2 KiB
C++
#include "create_thread_callback.h"
|
|
|
|
|
|
|
|
|
|
|
|
namespace thread_notify_routine
|
|
{
|
|
//保护的进程ID
|
|
auto protect_id = ULongToHandle(8976);
|
|
|
|
|
|
void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
|
|
{
|
|
if (Create)
|
|
{
|
|
PEPROCESS process{ 0 };
|
|
auto status = PsLookupProcessByProcessId(ProcessId, &process);
|
|
if (!NT_SUCCESS(status))
|
|
goto end;
|
|
|
|
PEPROCESS protect_process{ 0 };
|
|
status = PsLookupProcessByProcessId(protect_id, &protect_process);
|
|
if (!NT_SUCCESS(status))
|
|
goto end;
|
|
|
|
if (protect_process != process)
|
|
goto end;
|
|
|
|
auto cutor_process_id = PsGetCurrentProcessId();
|
|
if (HandleToLong(cutor_process_id) == 4)
|
|
goto end;
|
|
|
|
if (ProcessId != cutor_process_id)
|
|
{
|
|
DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
|
|
|
|
DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
|
|
|
|
DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
|
|
|
|
DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
|
|
}
|
|
|
|
|
|
end:
|
|
ObDereferenceObject(process);
|
|
}
|
|
}
|
|
|
|
auto create_thread_routine() -> NTSTATUS
|
|
{
|
|
return PsSetCreateThreadNotifyRoutine(thread_notify_routine);
|
|
}
|
|
|
|
auto unload_thread_routine() -> NTSTATUS
|
|
{
|
|
return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
|
|
}
|
|
|
|
} |