进程监控驱动 PsSetCreateProcessNotifyRoutine

函数原型：

NTSTATUS PsSetCreateProcessNotifyRoutine(
  _In_ PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine,
  _In_ BOOLEAN                        Remove
);
原文的解释为:The PsSetCreateProcessNotifyRoutine routine adds a driver-supplied callback routine to, or removes it from, a list of
routines to be called whenever a process is created or deleted. 
简单的翻译一下：PsSetCreateProcessNotifyRoutine 例程增加一个"驱动供应"回调例程，在进程创建或消亡的时候回调函数会被调用。
NotifyRoutine为回调指针：
定义为：
VOID
(*PCREATE_PROCESS_NOTIFY_ROUTINE) (
    IN HANDLE  ParentId,
    IN HANDLE  ProcessId,
    IN BOOLEAN  Create
    );

NotifyRoutine [in]

Specifies the entry point of a caller-supplied process-creation callback routine.

Remove [in]

Indicates whether the routine specified by NotifyRoutine should be added to or removed from the system's list of notification routines. If FALSE, the specified routine is added to the list. If TRUE, the specified routine is removed from the list.

如果为FALSE 表示在系统通知例程列表中增加此例程，如果为TRUE标志从系统通知例程列表中删除该例程，

驱动卸载时应该时此参数应该为TRUE;

废话不说了直接上代码框架：

#include <ntddk.h>

VOID UnloadDriver(PDRIVER_OBJECT pDriver);

VOID
CreateProcessRoutineSpy(
	IN HANDLE  ParentId,
	IN HANDLE  ProcessId,
	IN BOOLEAN  Create
	);

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING Registry)
{
	NTSTATUS status = STATUS_SUCCESS;

	UNREFERENCED_PARAMETER(pDriver);
	UNREFERENCED_PARAMETER(Registry);
	KdPrint(("[SysTest] DriverEntry Loading.\n"));

	status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, FALSE);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("[SysTest] PsSetCreateProcessNotifyRoutine failed status:(%x).\n", status));
		return status;
	}

	pDriver->DriverUnload = UnloadDriver;
	return status;
}

VOID
CreateProcessRoutineSpy(
	IN HANDLE  ParentId,
	IN HANDLE  ProcessId,
	IN BOOLEAN  Create
	)
{
	if (Create)
	{
		KdPrint(("[SysTest] Process Created. ParentId:(%d) ProcessId:(%d).\n", ParentId, ProcessId));
	}
	else
	{
		KdPrint(("[SysTest] Process Terminated ProcessId:(%d).ParentId:(%d) .\n", ProcessId, ParentId));
	}

	return;
}

VOID UnloadDriver(PDRIVER_OBJECT pDriver)
{
	UNREFERENCED_PARAMETER(pDriver);

	NTSTATUS status;

	status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, TRUE);
	if (NT_SUCCESS(status))
	{
		KdPrint(("[SysTest] UnloadDriver.\n"));
	}

	return;
}

Dbgview查看结果：

可以看到每当有一个进程创建的时候就会被回调函数监视到，在这里我们打印出进程的ID和父进程的ID，每当一个进程消亡时也将其ID打印出来。这个简单的进程监视框架就做好了。

扩展 CreateProcessNotifyEx
PsSetCreateProcessNotifyRoutine只能记录进程创建或消亡，不能阻止进程的创建，
PsSetCreateProcessNotifyRoutineEx可以阻止进程的创建，先看一下相关函数：

注册函数：
NTSTATUS PsSetCreateProcessNotifyRoutineEx(
  _In_ PCREATE_PROCESS_NOTIFY_ROUTINE_EX  NotifyRoutine,
  _In_ BOOLEAN  Remove
);

回调函数：
VOID
  CreateProcessNotifyEx(
    __inout PEPROCESS  Process,
    __in HANDLE  ProcessId,
    __in_opt PPS_CREATE_NOTIFY_INFO  CreateInfo
    );

可知，回调函数有所变化，在回调函数中，CreateInfo为NULL时，表示一个进程在结束，否则为进程创建，看一下CreateInfo结构：

typedef struct _PS_CREATE_NOTIFY_INFO {
    _In_ SIZE_T Size;
    union {
        _In_ ULONG Flags;
        struct {
            _In_ ULONG FileOpenNameAvailable : 1;
            _In_ ULONG Reserved : 31;
        };
    };
    _In_ HANDLE ParentProcessId;      //父进程ID
    _In_ CLIENT_ID CreatingThreadId;   //父进程信息  ，包括父进程ID，父进程的主线程ID
    _Inout_ struct _FILE_OBJECT *FileObject;    //进程有关的文件对象
    _In_ PCUNICODE_STRING ImageFileName;   //进程名
    _In_opt_ PCUNICODE_STRING CommandLine; //进程命令行参数，有时候为NULL
    _Inout_ NTSTATUS CreationStatus;//返回结果，修改这个结果可以改变进程的创建
} PS_CREATE_NOTIFY_INFO, *PPS_CREATE_NOTIFY_INFO;

现在举一例，利用此回调来阻止记事本的创建：

#include <ntddk.h>

VOID UnloadDriver(PDRIVER_OBJECT driver);

VOID
CreateProcessNotifyEx(
	__inout PEPROCESS  Process,
	__in HANDLE  ProcessId,
	__in_opt PPS_CREATE_NOTIFY_INFO  CreateInfo
	);

BOOLEAN bSuccess = FALSE;

NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING registry)
{
	NTSTATUS status = STATUS_UNSUCCESSFUL;

	UNREFERENCED_PARAMETER(registry);

	KdPrint(("[systest] Driver Loading.\n"));

	driver->DriverUnload = UnloadDriver;

	status = PsSetCreateProcessNotifyRoutineEx(CreateProcessNotifyEx, FALSE);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("[systest] PsSetCreateProcessNotifyRoutineEx error code:(%x).\n", status));
		return status;
	}

	bSuccess = TRUE;

	return status;

}

VOID
	CreateProcessNotifyEx(
	__inout PEPROCESS  Process,
	__in HANDLE  ProcessId,
	__in_opt PPS_CREATE_NOTIFY_INFO  CreateInfo
	)
{
	UNREFERENCED_PARAMETER(ProcessId);
	UNREFERENCED_PARAMETER(Process);

	PWCHAR pSub = NULL;
        //为NULL表示进程退出
	if (NULL == CreateInfo)
	{
		DbgPrint(("[systest]:process exits.\n"));
		return;
	}

	KdPrint(("[systest]process create:(%wZ).\n", CreateInfo->ImageFileName));
	pSub = wcswcs(CreateInfo->ImageFileName->Buffer, L"notepad.exe");
	if (NULL != pSub)
	{
                //修改返回结果为拒绝访问，使得创建进程失败
		CreateInfo->CreationStatus = STATUS_ACCESS_DENIED;
	}

	return;
}

VOID UnloadDriver(PDRIVER_OBJECT driver)
{
	UNREFERENCED_PARAMETER(driver);

	KdPrint(("[systest]:driver unload.\n"));

	if (bSuccess)
	{
		PsSetCreateProcessNotifyRoutineEx(CreateProcessNotifyEx, TRUE);
	}

	return;
}

需要注意的是，PsSetCreateProcessNotifyRoutineEx编译的时候可能会出现拒绝访问，解决办法是在工程属性中的连接器-->CommandLine，添加“/IntegrityCheck ”即可。