创建进程回调函数_阻止打开任何进程

#include <ntddk.h>

VOID UnloadDriver(PDRIVER_OBJECT pDriver);

VOID
CreateProcessRoutineSpy(
IN HANDLE  ParentId,
IN HANDLE  ProcessId,
IN BOOLEAN  Create
);

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING Registry)
{
NTSTATUS status = STATUS_SUCCESS;

UNREFERENCED_PARAMETER(pDriver);
UNREFERENCED_PARAMETER(Registry);
KdPrint(("[SysTest] DriverEntry Loading.\n"));
KdPrint(("CreateProcessRoutineSpy地址%x", CreateProcessRoutineSpy));
status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, FALSE);
if (!NT_SUCCESS(status))
{
KdPrint(("[SysTest] PsSetCreateProcessNotifyRoutine failed status:(%x).\n", status));
return status;
}

pDriver->DriverUnload = UnloadDriver;
return status;
}

VOID
CreateProcessRoutineSpy(
IN HANDLE  ParentId,
IN HANDLE  ProcessId,
IN BOOLEAN  Create
)
{
NTSTATUS status;
HANDLE procHandle = NULL;
CLIENT_ID ClientId;

OBJECT_ATTRIBUTES Obja;
Obja.Length = sizeof(Obja);
Obja.RootDirectory = 0;
Obja.ObjectName = 0;
Obja.Attributes = 0;
Obja.SecurityDescriptor = 0;
Obja.SecurityQualityOfService = 0;

ClientId.UniqueProcess = (HANDLE)ProcessId;
ClientId.UniqueThread = 0;
//不管创建什么程序都关闭程序
if (Create)   //bCreate 为True表示创建程序
{
//调用函数ZwOpenProcess函数，通过进程pid号获得进程句柄

status = ZwOpenProcess(&procHandle, PROCESS_ALL_ACCESS, &Obja, &ClientId);
if (status == STATUS_INVALID_PARAMETER_MIX)
DbgPrint("STATUS_INVALID_PARAMETER_MIX\n");
else if (status == STATUS_INVALID_CID)
DbgPrint("STATUS_INVALID_CID\n");
else if (status == STATUS_INVALID_PARAMETER)
DbgPrint("STATUS_INVALID_PARAMETER\n");
else if (status == STATUS_ACCESS_DENIED)
DbgPrint("STATUS_ACCESS_DENIED\n");
else
DbgPrint("STATUS_SUCCESS\n");

if (procHandle != NULL)
status = ZwTerminateProcess(procHandle, 1);
else
{
DbgPrint("failed to ZwOpenProcess...\n");
return;
}
//这里是我来判断没有成功结束进程用的
switch (status)
{
case STATUS_SUCCESS:
DbgPrint("process %u has beed killed ...\n", ProcessId);
break;
case STATUS_OBJECT_TYPE_MISMATCH:
DbgPrint("failed to kill %u process,The specified handle is not a process handle. \n", ProcessId);
break;
case STATUS_INVALID_HANDLE:
DbgPrint("failed to kill %u process,The specified handle is not valid.\n", ProcessId);
break;
case STATUS_ACCESS_DENIED:
DbgPrint("failed to kill %u process,The driver cannot access the specified process object.\n", ProcessId);
break;
case STATUS_PROCESS_IS_TERMINATING:
DbgPrint("failed to kill %u process,The specified process is already terminating.\n", ProcessId);
break;
default:
break;
}
}
if (Create)
{
KdPrint(("进程创建[SysTest] Process Created. ParentId:(%d) ProcessId:(%d).\n", ParentId, ProcessId));
}
else
{
KdPrint(("进程销毁[SysTest] Process Terminated ProcessId:(%d).ParentId:(%d) .\n", ProcessId, ParentId));
}

return;
}

VOID UnloadDriver(PDRIVER_OBJECT pDriver)
{
UNREFERENCED_PARAMETER(pDriver);

NTSTATUS status;

status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, TRUE);
if (NT_SUCCESS(status))
{
KdPrint(("卸载完成[SysTest] UnloadDriver.\n"));
}

return;
}