[英]Process monitoring CreateProcessNotifyRoutineEx
I'm developing a driver for monitoring process creation, I wrote a simple code to do it. 我正在开发一个用于监视进程创建的驱动程序,我编写了一个简单的代码来完成它。 I use the
PsSetCreateProcessNotifyRoutineEx
. 我使用
PsSetCreateProcessNotifyRoutineEx
。 But this doesn't work ! 但这不起作用! I exactly following Microsoft help on this link
我正在关注此链接上的 Microsoft帮助
#include <ntddk.h>
NTSTATUS DriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
);
VOID UnloadRoutine(
IN PDRIVER_OBJECT DriverObject
);
VOID CreateProcessNotifyEx(
__inout PEPROCESS Process,
__in HANDLE ProcessId,
__in_opt PPS_CREATE_NOTIFY_INFO CreateInfo
);
VOID CreateProcessNotifyEx(
__inout PEPROCESS Process,
__in HANDLE ProcessId,
__in_opt PPS_CREATE_NOTIFY_INFO CreateInfo
)
{
if (CreateInfo)
{
if(CreateInfo->FileOpenNameAvailable==TRUE)
{
DbgPrintEx(
DPFLTR_IHVDRIVER_ID,
DPFLTR_INFO_LEVEL,
"PID : 0x%X (%d) ImageName :%wZ CmdLine : %wZ \n",
ProcessId,ProcessId,
CreateInfo->ImageFileName,
CreateInfo->CommandLine
);
}
}
}
VOID UnloadRoutine(IN PDRIVER_OBJECT DriverObject)
{
PsSetCreateProcessNotifyRoutineEx((PCREATE_PROCESS_NOTIFY_ROUTINE_EX) CreateProcessNotifyEx, TRUE);
DbgPrintEx( DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL,"Unloaded\n");
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
NTSTATUS status = PsSetCreateProcessNotifyRoutineEx((PCREATE_PROCESS_NOTIFY_ROUTINE_EX)CreateProcessNotifyEx, FALSE);
if(!NT_SUCCESS(status))
{
DbgPrintEx( DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL,"Faild to PsSetCreateProcessNotifyRoutineEx .status : 0x%X \n",status);
}
DriverObject->DriverUnload = UnloadRoutine;
DbgPrintEx( DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL,"Load\n");
return STATUS_SUCCESS;
}
This drive load and run correctly but when run a program(new process), Doesn't happen any thing and can't register PsSetCreateProcessNotifyRoutineEx
and i got 0xC0000022
Error (Access Denied). 这个驱动器加载并正确运行但是当运行程序(新进程)时,没有发生任何事情并且无法注册
PsSetCreateProcessNotifyRoutineEx
并且我得到0xC0000022
错误(访问被拒绝)。
Any idea ? 任何的想法 ?
Always i have to find my answer ;) 总是我必须找到答案;)
For passing this problem only need to add this value LINKER_FLAGS=/integritycheck
to SOURCE file ! 要传递此问题,只需将此值
LINKER_FLAGS=/integritycheck
到SOURCE文件中!
Before : 之前:
TARGETNAME=ProcView
TARGETPATH=.
TARGETTYPE=DRIVER
SOURCES=ProcView.c
Now : 现在:
TARGETNAME=ProcView
TARGETPATH=.
TARGETTYPE=DRIVER
LINKER_FLAGS=/integritycheck
SOURCES=ProcView.c
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.