Windows内核进程管理器解析

Windows内核是如何实现线程挂起的？如何实现线程挂载到进程的？如何实现杀死进程和线程的？

从源码分析一下，这些操作具体在源码上是如何实现的。

进程创建、线程切换、线程跨越CPU权限级、进程挂靠、杀死进程、杀死线程

一.进程创建

可以分几个部分来说。首先说进程的地址空间是怎么创建起来的，进程的EPROCESS->VadRoot是用来描述进程的用户地址空间的。只有在VadRoot结构中分配了的空间才可能被使用。进程初始化空间使用了MmCreateProcessAddressSpace函数，这个函数如下.

二.线程切换

操作系统如何从一个线程切换到另一个线程？

首先，只有内核模式下有线程切换。

三.杀死进程

对应于官方接口分别是用户层的TerminateProcess()和内核层的ZwTerminateProcess()。

杀死进程与创建进程很像，都是一个由多步复合的过程。原因就是因为进程是一个包揽众多的容器。

比如进程有地址空间、有内核对象、也有所拥有的线程。倘若要创建进程势必要创建线程，倘若要杀死进程势必要杀死线程。

所以进程真正的“运行终止”，其实是取决于杀死线程。

四.创建线程

先放上KTHREAD和ETHREAD结构的情况，可见线程对象里面也是有很多东西的

 typedef struct _KTHREAD

 {

      DISPATCHER_HEADER Header;

      UINT64 CycleTime;

      ULONG HighCycleTime;

      UINT64 QuantumTarget;

      PVOID InitialStack;

      PVOID StackLimit;

      PVOID KernelStack;

      ULONG ThreadLock;

      union

      {

           KAPC_STATE ApcState;

           UCHAR ApcStateFill[];

      };

      CHAR Priority;

      WORD NextProcessor;

      WORD DeferredProcessor;

      ULONG ApcQueueLock;

      ULONG ContextSwitches;

      UCHAR State;

      UCHAR NpxState;

      UCHAR WaitIrql;

      CHAR WaitMode;

      LONG WaitStatus;

      union

      {

           PKWAIT_BLOCK WaitBlockList;

           PKGATE GateObject;

      };

      union

      {

           ULONG KernelStackResident: ;

           ULONG ReadyTransition: ;

           ULONG ProcessReadyQueue: ;

           ULONG WaitNext: ;

           ULONG SystemAffinityActive: ;

           ULONG Alertable: ;

           ULONG GdiFlushActive: ;

           ULONG Reserved: ;

           LONG MiscFlags;

      };

      UCHAR WaitReason;

      UCHAR SwapBusy;

      UCHAR Alerted[];

      union

      {

           LIST_ENTRY WaitListEntry;

           SINGLE_LIST_ENTRY SwapListEntry;

      };

      PKQUEUE Queue;

      ULONG WaitTime;

      union

      {

           struct

           {

                SHORT KernelApcDisable;

                SHORT SpecialApcDisable;

           };

           ULONG CombinedApcDisable;

      };

      PVOID Teb;

      union

      {

           KTIMER Timer;

           UCHAR TimerFill[];

      };

      union

      {

           ULONG AutoAlignment: ;

           ULONG DisableBoost: ;

           ULONG EtwStackTraceApc1Inserted: ;

           ULONG EtwStackTraceApc2Inserted: ;

           ULONG CycleChargePending: ;

           ULONG CalloutActive: ;

           ULONG ApcQueueable: ;

           ULONG EnableStackSwap: ;

           ULONG GuiThread: ;

           ULONG ReservedFlags: ;

           LONG ThreadFlags;

      };

      union

      {

           KWAIT_BLOCK WaitBlock[];

           struct

           {

                UCHAR WaitBlockFill0[];

                UCHAR IdealProcessor;

           };

           struct

           {

                UCHAR WaitBlockFill1[];

                CHAR PreviousMode;

           };

           struct

           {

                UCHAR WaitBlockFill2[];

                UCHAR ResourceIndex;

           };

           UCHAR WaitBlockFill3[];

      };

      UCHAR LargeStack;

      LIST_ENTRY QueueListEntry;

      PKTRAP_FRAME TrapFrame;

      PVOID FirstArgument;

      union

      {

           PVOID CallbackStack;

           ULONG CallbackDepth;

      };

      PVOID ServiceTable;

      UCHAR ApcStateIndex;

      CHAR BasePriority;

      CHAR PriorityDecrement;

      UCHAR Preempted;

      UCHAR AdjustReason;

      CHAR AdjustIncrement;

      UCHAR Spare01;

      CHAR Saturation;

      ULONG SystemCallNumber;

      ULONG Spare02;

      ULONG UserAffinity;

      PKPROCESS Process;

      ULONG Affinity;

      PKAPC_STATE ApcStatePointer[];

      union

      {

           KAPC_STATE SavedApcState;

           UCHAR SavedApcStateFill[];

      };

      CHAR FreezeCount;

      CHAR SuspendCount;

      UCHAR UserIdealProcessor;

      UCHAR Spare03;

      UCHAR Iopl;

      PVOID Win32Thread;

      PVOID StackBase;

      union

      {

           KAPC SuspendApc;

           struct

           {

                UCHAR SuspendApcFill0[];

                CHAR Spare04;

           };

           struct

           {

                UCHAR SuspendApcFill1[];

                UCHAR QuantumReset;

           };

           struct

           {

                UCHAR SuspendApcFill2[];

                ULONG KernelTime;

           };

           struct

           {

                UCHAR SuspendApcFill3[];

                PKPRCB WaitPrcb;

           };

           struct

           {

                UCHAR SuspendApcFill4[];

                PVOID LegoData;

           };

           UCHAR SuspendApcFill5[];

      };

      UCHAR PowerState;

      ULONG UserTime;

      union

      {

           KSEMAPHORE SuspendSemaphore;

           UCHAR SuspendSemaphorefill[];

      };

      ULONG SListFaultCount;

      LIST_ENTRY ThreadListEntry;

      LIST_ENTRY MutantListHead;

      PVOID SListFaultAddress;

      PVOID MdlForLockedTeb;

 } KTHREAD, *PKTHREAD;

KTHREAD

 typedef struct _ETHREAD

 {

      KTHREAD Tcb;

      LARGE_INTEGER CreateTime;

      union

      {

           LARGE_INTEGER ExitTime;

           LIST_ENTRY KeyedWaitChain;

      };

      union

      {

           LONG ExitStatus;

           PVOID OfsChain;

      };

      union

      {

           LIST_ENTRY PostBlockList;

           struct

           {

                PVOID ForwardLinkShadow;

                PVOID StartAddress;

           };

      };

      union

      {

           PTERMINATION_PORT TerminationPort;

           PETHREAD ReaperLink;

           PVOID KeyedWaitValue;

           PVOID Win32StartParameter;

      };

      ULONG ActiveTimerListLock;

      LIST_ENTRY ActiveTimerListHead;

      CLIENT_ID Cid;

      union

      {

           KSEMAPHORE KeyedWaitSemaphore;

           KSEMAPHORE AlpcWaitSemaphore;

      };

      PS_CLIENT_SECURITY_CONTEXT ClientSecurity;

      LIST_ENTRY IrpList;

      ULONG TopLevelIrp;

      PDEVICE_OBJECT DeviceToVerify;

      _PSP_RATE_APC * RateControlApc;

      PVOID Win32StartAddress;

      PVOID SparePtr0;

      LIST_ENTRY ThreadListEntry;

      EX_RUNDOWN_REF RundownProtect;

      EX_PUSH_LOCK ThreadLock;

      ULONG ReadClusterSize;

      LONG MmLockOrdering;

      ULONG CrossThreadFlags;

      ULONG Terminated: ;

      ULONG ThreadInserted: ;

      ULONG HideFromDebugger: ;

      ULONG ActiveImpersonationInfo: ;

      ULONG SystemThread: ;

      ULONG HardErrorsAreDisabled: ;

      ULONG BreakOnTermination: ;

      ULONG SkipCreationMsg: ;

      ULONG SkipTerminationMsg: ;

      ULONG CopyTokenOnOpen: ;

      ULONG ThreadIoPriority: ;

      ULONG ThreadPagePriority: ;

      ULONG RundownFail: ;

      ULONG SameThreadPassiveFlags;

      ULONG ActiveExWorker: ;

      ULONG ExWorkerCanWaitUser: ;

      ULONG MemoryMaker: ;

      ULONG ClonedThread: ;

      ULONG KeyedEventInUse: ;

      ULONG RateApcState: ;

      ULONG SelfTerminate: ;

      ULONG SameThreadApcFlags;

      ULONG Spare: ;

      ULONG StartAddressInvalid: ;

      ULONG EtwPageFaultCalloutActive: ;

      ULONG OwnsProcessWorkingSetExclusive: ;

      ULONG OwnsProcessWorkingSetShared: ;

      ULONG OwnsSystemWorkingSetExclusive: ;

      ULONG OwnsSystemWorkingSetShared: ;

      ULONG OwnsSessionWorkingSetExclusive: ;

      ULONG OwnsSessionWorkingSetShared: ;

      ULONG OwnsProcessAddressSpaceExclusive: ;

      ULONG OwnsProcessAddressSpaceShared: ;

      ULONG SuppressSymbolLoad: ;

      ULONG Prefetching: ;

      ULONG OwnsDynamicMemoryShared: ;

      ULONG OwnsChangeControlAreaExclusive: ;

      ULONG OwnsChangeControlAreaShared: ;

      ULONG PriorityRegionActive: ;

      UCHAR CacheManagerActive;

      UCHAR DisablePageFaultClustering;

      UCHAR ActiveFaultCount;

      ULONG AlpcMessageId;

      union

      {

           PVOID AlpcMessage;

           ULONG AlpcReceiveAttributeSet;

      };

      LIST_ENTRY AlpcWaitListEntry;

      ULONG CacheManagerCount;

 } ETHREAD, *PETHREAD;

ETHREAD

杀死线程是通过APC来实现的。首先会判断当前线程是否是最后的线程，如果是就直接调用结束当前线程。如果有别的线程就向它们插入一个APC，用于结束。