进程创建过程详解 CreateProcess
轉(zhuǎn)載請您注明出處：http://www.cnblogs.com/lsh123/p/7405796.html
0x01?CreateProcessW
CreateProcess的使用有ANSI版本的CreateProcessA和UNICODE版本的CreateProcessW:
不過查看源碼就可以發(fā)現(xiàn)其實(shí)CreateProcessA內(nèi)部調(diào)用的還是CreateProcessW：
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 | BOOL WINAPI CreateProcessA( ????LPCSTR?lpApplicationName, ????LPSTR?lpCommandLine, ????LPSECURITY_ATTRIBUTES lpProcessAttributes, ????LPSECURITY_ATTRIBUTES lpThreadAttributes, ????BOOL?bInheritHandles, ????DWORD?dwCreationFlags, ????LPVOID?lpEnvironment, ????LPCSTR?lpCurrentDirectory, ????LPSTARTUPINFOA lpStartupInfo, ????LPPROCESS_INFORMATION lpProcessInformation ????) ? /*++ ? ????ANSI thunk to CreateProcessW ? --*/ ? { ????NTSTATUS Status; ????PUNICODE_STRING CommandLine; ????UNICODE_STRING ApplicationName; ????UNICODE_STRING CurrentDirectory; ????STARTUPINFOW StartupInfo; ????ANSI_STRING AnsiString; ????UNICODE_STRING Unicode; ????UNICODE_STRING DynamicCommandLine; ????UNICODE_STRING NullUnicodeString; ????BOOL?ReturnStatus; ? ????if?(ARGUMENT_PRESENT (lpCommandLine)) { ????????if?( (strlen( lpCommandLine ) + 1) *?sizeof(?WCHAR?) < ?????????????NtCurrentTeb()->StaticUnicodeString.MaximumLength ) { ? ????????????DynamicCommandLine.Buffer = NULL; ? ????????????CommandLine = Basep8BitStringToStaticUnicodeString( lpCommandLine ); ????????????if?(CommandLine == NULL) { ????????????????return?FALSE; ????????????} ????????}?else?{ ????????????if?(!Basep8BitStringToDynamicUnicodeString( &DynamicCommandLine, ????????????????????????????????????????????????????????lpCommandLine )) { ????????????????return?FALSE; ????????????} ????????} ????}?else?{ ?????????DynamicCommandLine.Buffer = NULL; ?????????CommandLine = &NullUnicodeString; ?????????CommandLine->Buffer = NULL; ????} ? ????ApplicationName.Buffer = NULL; ????ApplicationName.Buffer = NULL; ????CurrentDirectory.Buffer = NULL; ????RtlMoveMemory(&StartupInfo,lpStartupInfo,sizeof(*lpStartupInfo)); ????ASSERT(sizeof(StartupInfo) ==?sizeof(*lpStartupInfo)); ????StartupInfo.lpReserved = NULL; ????StartupInfo.lpDesktop = NULL; ????StartupInfo.lpTitle = NULL; ? ????try?{ ????????try?{ ????????????if?(ARGUMENT_PRESENT(lpApplicationName)) { ? ????????????????if?(!Basep8BitStringToDynamicUnicodeString( &ApplicationName, ????????????????????????????????????????????????????????????lpApplicationName )) { ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????} ????????????} ? ????????????if?(ARGUMENT_PRESENT(lpCurrentDirectory)) { ????????????????if?(!Basep8BitStringToDynamicUnicodeString( &CurrentDirectory, ????????????????????????????????????????????????????????????lpCurrentDirectory )) { ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????} ????????????} ? ????????????if?(ARGUMENT_PRESENT(lpStartupInfo->lpReserved)) { ? ????????????????// ????????????????// Win95 does not touch reserved, and Intergraph Voxtel passes ????????????????// garbage for this. Handle this by probing lpReserved, and if ????????????????// the pointer is bad, ignore it ????????????????// ? ????????????????try?{ ? ????????????????????RtlInitAnsiString(&AnsiString,lpStartupInfo->lpReserved); ? ????????????????????} ????????????????except (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ????????????????????????????? EXCEPTION_EXECUTE_HANDLER ????????????????????????????: EXCEPTION_CONTINUE_SEARCH) { ????????????????????goto?bail_on_reserved; ????????????????????} ? ????????????????Unicode.MaximumLength = (USHORT)RtlAnsiStringToUnicodeSize(&AnsiString) ; ????????????????StartupInfo.lpReserved = RtlAllocateHeap( RtlProcessHeap(), ??????????????????????????????????????????????????????????MAKE_TAG( TMP_TAG ), ??????????????????????????????????????????????????????????Unicode.MaximumLength); ????????????????if?( !StartupInfo.lpReserved ) { ????????????????????BaseSetLastNTError(STATUS_NO_MEMORY); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????Unicode.Buffer = StartupInfo.lpReserved; ????????????????Status = RtlAnsiStringToUnicodeString(&Unicode,&AnsiString,FALSE); ????????????????if?( !NT_SUCCESS(Status) ) { ????????????????????BaseSetLastNTError(Status); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????} ? bail_on_reserved: ????????????if?(ARGUMENT_PRESENT(lpStartupInfo->lpDesktop)) { ????????????????RtlInitAnsiString(&AnsiString,lpStartupInfo->lpDesktop); ????????????????Unicode.MaximumLength = (USHORT)RtlAnsiStringToUnicodeSize(&AnsiString) ; ????????????????StartupInfo.lpDesktop = RtlAllocateHeap( RtlProcessHeap(), ?????????????????????????????????????????????????????????MAKE_TAG( TMP_TAG ), ?????????????????????????????????????????????????????????Unicode.MaximumLength); ????????????????if?( !StartupInfo.lpDesktop ) { ????????????????????BaseSetLastNTError(STATUS_NO_MEMORY); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????Unicode.Buffer = StartupInfo.lpDesktop; ????????????????Status = RtlAnsiStringToUnicodeString(&Unicode,&AnsiString,FALSE); ????????????????if?( !NT_SUCCESS(Status) ) { ????????????????????BaseSetLastNTError(Status); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????} ? ????????????if?(ARGUMENT_PRESENT(lpStartupInfo->lpTitle)) { ????????????????RtlInitAnsiString(&AnsiString,lpStartupInfo->lpTitle); ????????????????Unicode.MaximumLength = (USHORT)RtlAnsiStringToUnicodeSize(&AnsiString) ; ????????????????StartupInfo.lpTitle = RtlAllocateHeap( RtlProcessHeap(), ???????????????????????????????????????????????????????MAKE_TAG( TMP_TAG ), ???????????????????????????????????????????????????????Unicode.MaximumLength); ????????????????if?( !StartupInfo.lpTitle ) { ????????????????????BaseSetLastNTError(STATUS_NO_MEMORY); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????Unicode.Buffer = StartupInfo.lpTitle; ????????????????Status = RtlAnsiStringToUnicodeString(&Unicode,&AnsiString,FALSE); ????????????????if?( !NT_SUCCESS(Status) ) { ????????????????????BaseSetLastNTError(Status); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????} ????????????} ????????except (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ????????????????????? EXCEPTION_EXECUTE_HANDLER ????????????????????: EXCEPTION_CONTINUE_SEARCH) { ????????????BaseSetLastNTError(GetExceptionCode()); ????????????ReturnStatus = FALSE; ????????????goto?tryexit; ????????????} ????????ReturnStatus = CreateProcessW( ????????????????????????????ApplicationName.Buffer, ????????????????????????????DynamicCommandLine.Buffer ? DynamicCommandLine.Buffer ??????????????????????????????????????????????????????: CommandLine->Buffer, ????????????????????????????lpProcessAttributes, ????????????????????????????lpThreadAttributes, ????????????????????????????bInheritHandles, ????????????????????????????dwCreationFlags, ????????????????????????????lpEnvironment, ????????????????????????????CurrentDirectory.Buffer, ????????????????????????????&StartupInfo, ????????????????????????????lpProcessInformation ????????????????????????????); tryexit:; ????????} ????finally { ????????RtlFreeUnicodeString(&DynamicCommandLine); ????????RtlFreeUnicodeString(&ApplicationName); ????????RtlFreeUnicodeString(&CurrentDirectory); ????????RtlFreeHeap(RtlProcessHeap(), 0,StartupInfo.lpReserved); ????????RtlFreeHeap(RtlProcessHeap(), 0,StartupInfo.lpDesktop); ????????RtlFreeHeap(RtlProcessHeap(), 0,StartupInfo.lpTitle); ????????} ? ????return?ReturnStatus; ? } |
CreateProcessW的十個參數(shù)：
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | WINBASEAPI BOOL WINAPI CreateProcessW( ????LPCWSTR?lpApplicationName,????//指向一個NULL結(jié)尾的，新進(jìn)程的可執(zhí)行文件的名稱 ????LPWSTR?lpCommandLine,??????????//指向一個NULL結(jié)尾的，傳給新進(jìn)程的命令行字符串 ????LPSECURITY_ATTRIBUTES lpProcessAttributes, ????//指向一個SECURITY_ATTRIBUTES結(jié)構(gòu)體，分配給新的進(jìn)程對象 ????//SECURITY_ATTRIBUTES結(jié)構(gòu)可以決定是否返回的句柄可以被子進(jìn)程繼承（bInheritHandle ）。如果lpProcessAttributes參數(shù)為空（NULL），那么句柄不能被繼承。 ????//SECURITY_ATTRIBUTES結(jié)構(gòu)的lpSecurityDescriptor成員可以指定新進(jìn)程的安全描述符，如果參數(shù)為空，新進(jìn)程使用默認(rèn)的安全描述符。 ????LPSECURITY_ATTRIBUTES lpThreadAttributes, ????//指向一個SECURITY_ATTRIBUTES結(jié)構(gòu)體，分配給新的線程對象 ????BOOL?bInheritHandles, ????//標(biāo)識新進(jìn)程是否可以從調(diào)用進(jìn)程處繼承所有可繼承的句柄。被繼承的句柄與原進(jìn)程擁有完全相同的值和訪問權(quán)限。 ????DWORD?dwCreationFlags, ????//標(biāo)識了影響新進(jìn)程創(chuàng)建方式的標(biāo)志，多個標(biāo)志按位或進(jìn)行組合 ????LPVOID?lpEnvironment, ????//指向一塊內(nèi)存，其中包含新進(jìn)程要使用的環(huán)境字符串。如果此參數(shù)為空，新進(jìn)程繼承父進(jìn)程的一組環(huán)境字符串。 ????LPCWSTR?lpCurrentDirectory, ????//指向一個以NULL結(jié)尾的字符串，用來設(shè)置新進(jìn)程的當(dāng)前驅(qū)動器和目錄，這個字符串必須是一個包含驅(qū)動器名的絕對路徑。如果這個參數(shù)為空，新進(jìn)程將使用與父進(jìn)程相同的驅(qū)動器和目錄。 ????LPSTARTUPINFOW lpStartupInfo, ????//指向一個用于決定新進(jìn)程的主窗體如何顯示的STARTUPINFO結(jié)構(gòu)體。 ????LPPROCESS_INFORMATION lpProcessInformation ????//指向一個用來接收新進(jìn)程的識別信息的PROCESS_INFORMATION結(jié)構(gòu)體。 ????); |
（1）STARTUPINFO 和?PROCESS_INFORMATION的使用前初始化為空：
STARTUPINFO StartupInfo = { 0 };
StartupInfo.cb = sizeof(STARTUPINFO);
PROCESS_INFORMATION ProcessInfo = { 0 };
?
（2）第六參數(shù)：dwCreationFlags 的部分標(biāo)志：
?、胖?#xff1a;CREATE_DEFAULT_ERROR_MODE
含義：新的進(jìn)程不繼承調(diào)用進(jìn)程的錯誤模式。CreateProcess函數(shù)賦予新進(jìn)程當(dāng)前的默認(rèn)錯誤模式作為替代。應(yīng)用程序可以調(diào)用SetErrorMode函數(shù)設(shè)置當(dāng)前的默認(rèn)錯誤模式。
這個標(biāo)志對于那些運(yùn)行在沒有硬件錯誤環(huán)境下的多線程外殼程序是十分有用的。
對于CreateProcess函數(shù)，默認(rèn)的行為是為新進(jìn)程繼承調(diào)用者的錯誤模式。設(shè)置這個標(biāo)志以改變默認(rèn)的處理方式。
?
⑵值：CREATE_NEW_CONSOLE
含義：新的進(jìn)程將使用一個新的控制臺，而不是繼承父進(jìn)程的控制臺。這個標(biāo)志不能與DETACHED_PROCESS標(biāo)志一起使用。
?
⑶值：CREATE_NEW_PROCESS_GROUP
含義：新進(jìn)程將是一個進(jìn)程樹的根進(jìn)程。進(jìn)程樹中的全部進(jìn)程都是根進(jìn)程的子進(jìn)程。新進(jìn)程樹的用戶標(biāo)識符與這個進(jìn)程的標(biāo)識符是相同的，由lpProcessInformation參數(shù)返回。進(jìn)程樹經(jīng)常使用GenerateConsoleCtrlEvent函數(shù)允許發(fā)送CTRL+C或 CTRL+BREAK信號到一組控制臺進(jìn)程。
?
⑷值：CREATE_SEPARATE_WOW_VDM
如果被設(shè)置，新進(jìn)程將會在一個私有的虛擬DOS機(jī)（VDM）中運(yùn)行。另外，默認(rèn)情況下所有的16位Windows應(yīng)用程序都會在同一個共享的VDM中以線程的方式運(yùn)行。單獨(dú)運(yùn)行一個16位程序的優(yōu)點(diǎn)是一個應(yīng)用程序的崩潰只會結(jié)束這一個VDM的運(yùn)行；其他那些在不同VDM中運(yùn)行的程序會繼續(xù)正常的運(yùn)行。同樣的，在不同VDM中運(yùn)行的16位Windows應(yīng)用程序擁有不同的輸入隊(duì)列，這意味著如果一個程序暫時失去響應(yīng)，在獨(dú)立的VDM中的應(yīng)用程序能夠繼續(xù)獲得輸入。
?
?、芍?#xff1a;CREATE_SHARED_WOW_VDM
如果WIN.INI中的Windows段的DefaultSeparateVDM選項(xiàng)被設(shè)置為真，這個標(biāo)識使得CreateProcess函數(shù)越過這個選項(xiàng)并在共享的虛擬DOS機(jī)中運(yùn)行新進(jìn)程。
?
?、手?#xff1a;CREATE_SUSPENDED
含義：新進(jìn)程的主線程會以掛起的狀態(tài)被創(chuàng)建，直到調(diào)用ResumeThread函數(shù)被調(diào)用時才運(yùn)行。
?
?、酥?#xff1a;CREATE_UNICODE_ENVIRONMENT
含義：如果被設(shè)置，由lpEnvironment參數(shù)指定環(huán)境塊使用Unicode字符，如果為空，環(huán)境塊默認(rèn)使用ANSI字符。
?
?、讨?#xff1a;DEBUG_PROCESS
含義：如果這個標(biāo)志被設(shè)置，調(diào)用進(jìn)程將被當(dāng)做一個調(diào)試程序，并且新進(jìn)程會被當(dāng)做被調(diào)試的進(jìn)程。系統(tǒng)把被調(diào)試程序發(fā)生的所有調(diào)試事件通知給調(diào)試器。
如果你使用這個標(biāo)志創(chuàng)建進(jìn)程，只有調(diào)用進(jìn)程（調(diào)用CreateProcess函數(shù)的進(jìn)程）可以調(diào)用WaitForDebugEvent函數(shù)。
?
⑼值：DEBUG_ONLY_THIS_PROCESS
含義：如果此標(biāo)志沒有被設(shè)置且調(diào)用進(jìn)程正在被調(diào)試，新進(jìn)程將成為調(diào)試調(diào)用進(jìn)程的調(diào)試器的另一個調(diào)試對象。如果調(diào)用進(jìn)程沒有被調(diào)試，有關(guān)調(diào)試的行為就不會產(chǎn)生。
?
⑽值：DETACHED_PROCESS
含義：對于控制臺進(jìn)程，新進(jìn)程沒有訪問父進(jìn)程控制臺的權(quán)限。新進(jìn)程可以通過AllocConsole函數(shù)自己創(chuàng)建一個新的控制臺。這個標(biāo)志不可以與CREATE_NEW_CONSOLE標(biāo)志一起使用。
?
〔11〕值：CREATE_NO_WINDOW
含義：系統(tǒng)不為新進(jìn)程創(chuàng)建CUI窗口，使用該標(biāo)志可以創(chuàng)建不含窗口的CUI程序。
?
?
?
?
?
?
?
?
?
?
0x02 ?創(chuàng)建進(jìn)程詳細(xì)步驟1：打開目標(biāo)映像文件，創(chuàng)建進(jìn)程對象，線程對象
CreateProcessW源代碼（windows2000）
?
?CreateProcessW
?
暫且忽略掉之前的一些環(huán)境字符串等等相關(guān)操作，注意到第一個值得關(guān)注的函數(shù)：NtOpenFile()打開其目標(biāo)文件獲取到了文件句柄FIileHandle
?
| 1 2 3 4 5 6 7 8 9 10 11 12 | // // Open the file for execute access // ? Status = NtOpenFile( ????????????&FileHandle, ????????????SYNCHRONIZE | FILE_EXECUTE, ????????????&Obja, ????????????&IoStatusBlock, ????????????FILE_SHARE_READ | FILE_SHARE_DELETE, ????????????FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE ????????????); |
緊接其后的是NtCreateSectiont通過文件句柄創(chuàng)建一個Section文件映射區(qū)，將文件內(nèi)容映射進(jìn)來
| 1 2 3 4 5 6 7 8 9 10 11 12 13 | // // Create a section object backed by the file // ? Status = NtCreateSection( ????????????&SectionHandle, ????????????SECTION_ALL_ACCESS, ????????????NULL, ????????????NULL, ????????????PAGE_EXECUTE, ????????????SEC_IMAGE, ????????????FileHandle ????????????); |
繼續(xù)向下看關(guān)鍵函數(shù)：NtCreateProcess出現(xiàn)啦！
| 1 2 3 4 5 6 7 8 9 10 | Status = NtCreateProcess( ????????????&ProcessHandle, ????????????PROCESS_ALL_ACCESS, ????????????pObja, ????????????NtCurrentProcess(), ????????????(BOOLEAN)bInheritHandles, ????????????SectionHandle, ????????????NULL, ????????????NULL ????????????); |
在源碼中繼續(xù)延伸，發(fā)現(xiàn)調(diào)用過程是NtCreateProcess——>NtCreateProcessEx——>PspCreateProcess(Windows2000源碼中是沒有NtCreateProcessEx函數(shù)這個中間過程的，我是在另外一套源碼中找到的NtCreateProcessEx函數(shù)，但無奈另一套較新的源碼中又沒有CreateProcessW的定義，故而開始參考的是Windows2000 源碼)
?
NtCreateProcess函數(shù)和NtCreateProcessEx函數(shù)：
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 | NTSTATUS NtCreateProcess( ????__out?PHANDLE?ProcessHandle, ????__in ACCESS_MASK DesiredAccess, ????__in_opt POBJECT_ATTRIBUTES ObjectAttributes, ????__in?HANDLE?ParentProcess, ????__in?BOOLEAN?InheritObjectTable, ????__in_opt?HANDLE?SectionHandle, ????__in_opt?HANDLE?DebugPort, ????__in_opt?HANDLE?ExceptionPort ????) { ????ULONG?Flags = 0; ? ????if?((ULONG_PTR)SectionHandle & 1) { ????????Flags |= PROCESS_CREATE_FLAGS_BREAKAWAY; ????} ? ????if?((ULONG_PTR) DebugPort & 1) { ????????Flags |= PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT; ????} ? ????if?(InheritObjectTable) { ????????Flags |= PROCESS_CREATE_FLAGS_INHERIT_HANDLES; ????} ? ????return?NtCreateProcessEx (ProcessHandle, ??????????????????????????????DesiredAccess, ??????????????????????????????ObjectAttributes OPTIONAL, ??????????????????????????????ParentProcess, ??????????????????????????????Flags, ??????????????????????????????SectionHandle, ??????????????????????????????DebugPort, ??????????????????????????????ExceptionPort, ??????????????????????????????0); } ? NTSTATUS NtCreateProcessEx( ????__out?PHANDLE?ProcessHandle, ????__in ACCESS_MASK DesiredAccess, ????__in_opt POBJECT_ATTRIBUTES ObjectAttributes, ????__in?HANDLE?ParentProcess, ????__in?ULONG?Flags, ????__in_opt?HANDLE?SectionHandle, ????__in_opt?HANDLE?DebugPort, ????__in_opt?HANDLE?ExceptionPort, ????__in?ULONG?JobMemberLevel ????) ? ? ? { ????NTSTATUS Status; ? ????PAGED_CODE(); ? ????if?(KeGetPreviousMode() != KernelMode) { ? ????????// ????????// Probe all arguments ????????// ? ????????try?{ ????????????ProbeForWriteHandle (ProcessHandle); ????????} except (EXCEPTION_EXECUTE_HANDLER) { ????????????return?GetExceptionCode (); ????????} ????} ? ????if?(ARGUMENT_PRESENT (ParentProcess)) { ????????Status = PspCreateProcess (ProcessHandle, ???????????????????????????????????DesiredAccess, ???????????????????????????????????ObjectAttributes, ???????????????????????????????????ParentProcess, ???????????????????????????????????Flags, ???????????????????????????????????SectionHandle, ???????????????????????????????????DebugPort, ???????????????????????????????????ExceptionPort, ???????????????????????????????????JobMemberLevel); ????}?else?{ ????????Status = STATUS_INVALID_PARAMETER; ????} ? ????return?Status; } |
看以看到NtCreateProcess函數(shù)簡單地對處理一下參數(shù)，然后把創(chuàng)建進(jìn)程的任務(wù)交給NtCreateProcessEx函數(shù)。
NtCreateProcessEx函數(shù)的流程。它也只是簡單地檢查ProcessHandle參數(shù)代表的句柄是否可寫，ParentProcess是否不為空。真正的創(chuàng)建工作交給PspCreateProcess函數(shù)。
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 | NTSTATUS PspCreateProcess( ????OUT?PHANDLE?ProcessHandle, ????IN ACCESS_MASK DesiredAccess, ????IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, ????IN?HANDLE?ParentProcess OPTIONAL, ????IN?ULONG?Flags, ????IN?HANDLE?SectionHandle OPTIONAL, ????IN?HANDLE?DebugPort OPTIONAL, ????IN?HANDLE?ExceptionPort OPTIONAL, ????IN?ULONG?JobMemberLevel ????) /*++ ? Routine Description: ? ????This routine creates and initializes a process object.? It implements the ????foundation for NtCreateProcess and for system initialization process ????creation. ? --*/ ? { ? ????NTSTATUS Status; ????PEPROCESS Process; ????PEPROCESS CurrentProcess; ????PEPROCESS Parent; ????PETHREAD CurrentThread; ????KAFFINITY Affinity; ????KPRIORITY BasePriority; ????PVOID?SectionObject; ????PVOID?ExceptionPortObject; ????PVOID?DebugPortObject; ????ULONG?WorkingSetMinimum, WorkingSetMaximum; ????HANDLE?LocalProcessHandle; ????KPROCESSOR_MODE PreviousMode; ????INITIAL_PEB InitialPeb; ????BOOLEAN?CreatePeb; ????ULONG_PTR?DirectoryTableBase[2]; ????BOOLEAN?AccessCheck; ????BOOLEAN?MemoryAllocated; ????PSECURITY_DESCRIPTOR SecurityDescriptor; ????SECURITY_SUBJECT_CONTEXT SubjectContext; ????NTSTATUS accesst; ????NTSTATUS SavedStatus; ????ULONG?ImageFileNameSize; ????HANDLE_TABLE_ENTRY CidEntry; ????PEJOB Job; ????PPEB Peb; ????AUX_ACCESS_DATA AuxData; ????PACCESS_STATE AccessState; ????ACCESS_STATE LocalAccessState; ????BOOLEAN?UseLargePages; ????SCHAR QuantumReset; #if defined(_WIN64) ????INITIAL_PEB32 InitialPeb32; #endif ? ????PAGED_CODE(); ? ????CurrentThread = PsGetCurrentThread (); ????PreviousMode = KeGetPreviousModeByThread(&CurrentThread->Tcb); ????CurrentProcess = PsGetCurrentProcessByThread (CurrentThread); ? ????CreatePeb = FALSE; ????UseLargePages = FALSE; ????DirectoryTableBase[0] = 0; ????DirectoryTableBase[1] = 0; ????Peb = NULL; ????? ????// ????// Reject bogus create parameters for future expansion ????// ????if?(Flags&~PROCESS_CREATE_FLAGS_LEGAL_MASK) { ????????return?STATUS_INVALID_PARAMETER; ????} ? ????// ????// Parent ????// ? ????if?(ARGUMENT_PRESENT (ParentProcess)) { ????????Status = ObReferenceObjectByHandle (ParentProcess, ????????????????????????????????????????????PROCESS_CREATE_PROCESS, ????????????????????????????????????????????PsProcessType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&Parent, ????????????????????????????????????????????NULL); ????????if?(!NT_SUCCESS (Status)) { ????????????return?Status; ????????} ? ????????if?(JobMemberLevel != 0 && Parent->Job == NULL) { ????????????ObDereferenceObject (Parent); ????????????return?STATUS_INVALID_PARAMETER; ????????} ? ????????Affinity = Parent->Pcb.Affinity; ????????WorkingSetMinimum = PsMinimumWorkingSet; ????????WorkingSetMaximum = PsMaximumWorkingSet; ? ? ????}?else?{ ? ????????Parent = NULL; ????????Affinity = KeActiveProcessors; ????????WorkingSetMinimum = PsMinimumWorkingSet; ????????WorkingSetMaximum = PsMaximumWorkingSet; ????} ? ????// ????// Create the process object ????// ????Status = ObCreateObject (PreviousMode, ?????????????????????????????PsProcessType, ?????????????????????????????ObjectAttributes, ?????????????????????????????PreviousMode, ?????????????????????????????NULL, ?????????????????????????????sizeof?(EPROCESS), ?????????????????????????????0, ?????????????????????????????0, ?????????????????????????????&Process); ? ????if?(!NT_SUCCESS (Status)) { ????????goto?exit_and_deref_parent; ????} ? ????// ????// The process object is created set to NULL. Errors ????// That occur after this step cause the process delete ????// routine to be entered. ????// ????// Teardown actions that occur in the process delete routine ????// do not need to be performed inline. ????// ? ????RtlZeroMemory (Process,?sizeof(EPROCESS)); ????ExInitializeRundownProtection (&Process->RundownProtect); ????PspInitializeProcessLock (Process); ????InitializeListHead (&Process->ThreadListHead); ? #if defined(_WIN64) ? ????if?(Flags & PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE) { ????????PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_OVERRIDE_ADDRESS_SPACE); ????} ? #endif ? ????PspInheritQuota (Process, Parent); ????ObInheritDeviceMap (Process, Parent); ????if?(Parent != NULL) { ????????Process->DefaultHardErrorProcessing = Parent->DefaultHardErrorProcessing; ????????Process->InheritedFromUniqueProcessId = Parent->UniqueProcessId; ? ????}?else?{ ????????Process->DefaultHardErrorProcessing = PROCESS_HARDERROR_DEFAULT; ????????Process->InheritedFromUniqueProcessId = NULL; ????} ? ????// ????// Section ????// ? ????if?(ARGUMENT_PRESENT (SectionHandle)) { ????????Status = ObReferenceObjectByHandle (SectionHandle, ????????????????????????????????????????????SECTION_MAP_EXECUTE, ????????????????????????????????????????????MmSectionObjectType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&SectionObject, ????????????????????????????????????????????NULL); ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????}?else?{ ????????SectionObject = NULL; ????????if?(Parent != PsInitialSystemProcess) { ? ????????????// ????????????// Fetch the section pointer from the parent process ????????????// as we will be cloning. Since the section pointer ????????????// is removed at last thread exit we need to protect against ????????????// process exit here to be safe. ????????????// ? ????????????if?(ExAcquireRundownProtection (&Parent->RundownProtect)) { ????????????????SectionObject = Parent->SectionObject; ????????????????if?(SectionObject != NULL) { ????????????????????ObReferenceObject (SectionObject); ????????????????} ? ????????????????ExReleaseRundownProtection (&Parent->RundownProtect); ????????????} ? ????????????if?(SectionObject == NULL) { ????????????????Status = STATUS_PROCESS_IS_TERMINATING; ????????????????goto?exit_and_deref; ????????????} ????????} ????} ? ????Process->SectionObject = SectionObject; ? ????// ????// DebugPort ????// ? ????if?(ARGUMENT_PRESENT (DebugPort)) { ????????Status = ObReferenceObjectByHandle (DebugPort, ????????????????????????????????????????????DEBUG_PROCESS_ASSIGN, ????????????????????????????????????????????DbgkDebugObjectType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&DebugPortObject, ????????????????????????????????????????????NULL); ? ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????????Process->DebugPort = DebugPortObject; ????????if?(Flags&PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT) { ????????????PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_NO_DEBUG_INHERIT); ????????} ? ????}?else?{ ????????if?(Parent != NULL) { ????????????DbgkCopyProcessDebugPort (Process, Parent); ????????} ????} ? ????// ????// ExceptionPort ????// ? ????if?(ARGUMENT_PRESENT (ExceptionPort)) { ????????Status = ObReferenceObjectByHandle (ExceptionPort, ????????????????????????????????????????????0, ????????????????????????????????????????????LpcPortObjectType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&ExceptionPortObject, ????????????????????????????????????????????NULL); ? ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????????Process->ExceptionPort = ExceptionPortObject; ????} ? ????Process->ExitStatus = STATUS_PENDING; ? ????// ????// Clone parent's object table. ????// If no parent (booting) then use the current object table created in ????// ObInitSystem. ????// ? ????if?(Parent != NULL) { ? ????????// ????????// Calculate address space ????????// ????????//????? If Parent == PspInitialSystem ????????// ? ????????if?(!MmCreateProcessAddressSpace (WorkingSetMinimum, ??????????????????????????????????????????Process, ??????????????????????????????????????????&DirectoryTableBase[0])) { ? ????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????goto?exit_and_deref; ????????} ? ????}?else?{ ????????Process->ObjectTable = CurrentProcess->ObjectTable; ? ????????// ????????// Initialize the Working Set Mutex and address creation mutex ????????// for this "hand built" process. ????????// Normally, the call to MmInitializeAddressSpace initializes the ????????// working set mutex, however, in this case, we have already initialized ????????// the address space and we are now creating a second process using ????????// the address space of the idle thread. ????????// ? ????????Status = MmInitializeHandBuiltProcess (Process, &DirectoryTableBase[0]); ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ????} ? ????PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_HAS_ADDRESS_SPACE); ????Process->Vm.MaximumWorkingSetSize = WorkingSetMaximum; ????KeInitializeProcess (&Process->Pcb, ?????????????????????????NORMAL_BASE_PRIORITY, ?????????????????????????Affinity, ?????????????????????????&DirectoryTableBase[0], ?????????????????????????(BOOLEAN)(Process->DefaultHardErrorProcessing & PROCESS_HARDERROR_ALIGNMENT_BIT)); ? ????// ????//? Initialize the security fields of the process ????//? The parent may be null exactly once (during system init). ????//? Thereafter, a parent is always required so that we have a ????//? security context to duplicate for the new process. ????// ? ????Status = PspInitializeProcessSecurity (Parent, Process); ????if?(!NT_SUCCESS (Status)) { ????????goto?exit_and_deref; ????} ? ????Process->PriorityClass = PROCESS_PRIORITY_CLASS_NORMAL; ????if?(Parent != NULL) { ????????if?(Parent->PriorityClass == PROCESS_PRIORITY_CLASS_IDLE || ????????????Parent->PriorityClass == PROCESS_PRIORITY_CLASS_BELOW_NORMAL) { ????????????Process->PriorityClass = Parent->PriorityClass; ????????} ? ????????// ????????// if address space creation worked, then when going through ????????// delete, we will attach. Of course, attaching means that the kprocess ????????// must be initialized, so we delay the object stuff till here. ????????// ? ????????Status = ObInitProcess ((Flags&PROCESS_CREATE_FLAGS_INHERIT_HANDLES) ? Parent : NULL, ????????????????????????????????Process); ? ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????}?else?{ ????????Status = MmInitializeHandBuiltProcess2 (Process); ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ????} ? ????Status = STATUS_SUCCESS; ????SavedStatus = STATUS_SUCCESS; ? ????// ????// Initialize the process address space ????// The address space has four possibilities ????// ????//????? 1 - Boot Process. Address space is initialized during ????//????????? MmInit. Parent is not specified. ????// ????//????? 2 - System Process. Address space is a virgin address ????//????????? space that only maps system space. Process is same ????//????????? as PspInitialSystemProcess. ????// ????//????? 3 - User Process (Cloned Address Space). Address space ????//????????? is cloned from the specified process. ????// ????//????? 4 - User Process (New Image Address Space). Address space ????//????????? is initialized so that it maps the specified section. ????// ? ????if?(SectionHandle != NULL) { ? ????????// ????????// User Process (New Image Address Space). Don't specify Process to ????????// clone, just SectionObject. ????????// ????????// Passing in the 4th parameter as below lets the EPROCESS struct contain its image file name, provided that ????????// appropriate audit settings are enabled.? Memory is allocated inside of MmInitializeProcessAddressSpace ????????// and pointed to by ImageFileName, so that must be freed in the process deletion routine (PspDeleteProcess()) ????????// ? ????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????SectionObject, ??????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????&(Process->SeAuditProcessCreationInfo.ImageFileName)); ? ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????????// ????????// In order to support relocating executables, the proper status ????????// (STATUS_IMAGE_NOT_AT_BASE) must be returned, so save it here. ????????// ? ????????SavedStatus = Status; ????????CreatePeb = TRUE; ????????UseLargePages = ((Flags & PROCESS_CREATE_FLAGS_LARGE_PAGES) != 0 ? TRUE : FALSE); ? ????}?else?if?(Parent != NULL) { ????????if?(Parent != PsInitialSystemProcess) { ????????????Process->SectionBaseAddress = Parent->SectionBaseAddress; ? ????????????// ????????????// User Process ( Cloned Address Space ).? Don't specify section to ????????????// map, just Process to clone. ????????????// ? ????????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????????Parent, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????????NULL); ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ? ????????????CreatePeb = TRUE; ????????????UseLargePages = ((Flags & PROCESS_CREATE_FLAGS_LARGE_PAGES) != 0 ? TRUE : FALSE); ????????????? ????????????// ????????????// A cloned process isn't started from an image file, so we give it the name ????????????// of the process of which it is a clone, provided the original has a name. ????????????// ? ????????????if?(Parent->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????ImageFileNameSize =?sizeof(OBJECT_NAME_INFORMATION) + ????????????????????????????????????Parent->SeAuditProcessCreationInfo.ImageFileName->Name.MaximumLength; ? ????????????????Process->SeAuditProcessCreationInfo.ImageFileName = ????????????????????ExAllocatePoolWithTag (PagedPool, ???????????????????????????????????????????ImageFileNameSize, ???????????????????????????????????????????'aPeS'); ? ????????????????if?(Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????????RtlCopyMemory (Process->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????????Parent->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????????ImageFileNameSize); ? ????????????????????// ????????????????????// The UNICODE_STRING in the process is self contained, so calculate the ????????????????????// offset for the buffer. ????????????????????// ? ????????????????????Process->SeAuditProcessCreationInfo.ImageFileName->Name.Buffer = ????????????????????????(PUSHORT)(((PUCHAR) Process->SeAuditProcessCreationInfo.ImageFileName) + ????????????????????????sizeof(UNICODE_STRING)); ? ????????????????}?else?{ ????????????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????????????goto?exit_and_deref; ????????????????} ????????????} ? ????????}?else?{ ? ????????????// ????????????// System Process.? Don't specify Process to clone or section to map ????????????// ? ????????????Flags &= ~PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS; ????????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????????NULL); ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ? ????????????// ????????????// In case the image file name of this system process is ever queried, we give ????????????// a zero length UNICODE_STRING. ????????????// ? ????????????Process->SeAuditProcessCreationInfo.ImageFileName = ????????????????ExAllocatePoolWithTag (PagedPool, ???????????????????????????????????????sizeof(OBJECT_NAME_INFORMATION), ???????????????????????????????????????'aPeS'); ? ????????????if?(Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????RtlZeroMemory (Process->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????sizeof(OBJECT_NAME_INFORMATION)); ????????????}?else?{ ????????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????????goto?exit_and_deref; ????????????} ????????} ????} ? ????// ????// Create the process ID ????// ? ????CidEntry.Object = Process; ????CidEntry.GrantedAccess = 0; ????Process->UniqueProcessId = ExCreateHandle (PspCidTable, &CidEntry); ????if?(Process->UniqueProcessId == NULL) { ????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????goto?exit_and_deref; ????} ? ????ExSetHandleTableOwner (Process->ObjectTable, Process->UniqueProcessId); ? ????// ????// Audit the process creation. ????// ? ????if?(SeDetailedAuditingWithToken (NULL)) { ????????SeAuditProcessCreation (Process); ????} ? ????// ????// See if the parent has a job. If so reference the job ????// and add the process in. ????// ? ????if?(Parent) { ????????Job = Parent->Job; ????????if?(Job != NULL && !(Job->LimitFlags & JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK)) { ????????????if?(Flags&PROCESS_CREATE_FLAGS_BREAKAWAY) { ????????????????if?(!(Job->LimitFlags & JOB_OBJECT_LIMIT_BREAKAWAY_OK)) { ????????????????????Status = STATUS_ACCESS_DENIED; ? ????????????????}?else?{ ????????????????????Status = STATUS_SUCCESS; ????????????????} ? ????????????}?else?{ ????????????????Status = PspGetJobFromSet (Job, JobMemberLevel, &Process->Job); ????????????????if?(NT_SUCCESS (Status)) { ????????????????????PACCESS_TOKEN Token, NewToken; ????????????????????Job = Process->Job; ????????????????????Status = PspAddProcessToJob (Job, Process); ? ????????????????????// ????????????????????// Duplicate a new process token if one is specified for the job ????????????????????// ? ????????????????????Token = Job->Token; ????????????????????if?(Token != NULL) { ????????????????????????Status = SeSubProcessToken (Token, ????????????????????????????????????????????????????&NewToken, ????????????????????????????????????????????????????FALSE, ????????????????????????????????????????????????????Job->SessionId); ? ????????????????????????if?(!NT_SUCCESS (Status)) { ????????????????????????????goto?exit_and_deref; ????????????????????????} ? ????????????????????????SeAssignPrimaryToken (Process, NewToken);??? ????????????????????????ObDereferenceObject (NewToken);??????????????????? ????????????????????} ????????????????} ????????????} ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ????????} ????} ? ????if?(Parent && CreatePeb) { ? ????????// ????????// For processes created w/ a section, ????????// a new "virgin" PEB is created. Otherwise, ????????// for forked processes, uses inherited PEB ????????// with an updated mutant. ????????// ? ????????RtlZeroMemory (&InitialPeb, FIELD_OFFSET(INITIAL_PEB, Mutant)); ? ????????InitialPeb.Mutant = (HANDLE)(-1); ????????InitialPeb.ImageUsesLargePages = (BOOLEAN) UseLargePages; ????????????? ????????if?(SectionHandle != NULL) { ????????????Status = MmCreatePeb (Process, &InitialPeb, &Process->Peb); ????????????if?(!NT_SUCCESS (Status)) { ????????????????Process->Peb = NULL; ????????????????goto?exit_and_deref; ????????????} ? ????????????Peb =? Process->Peb; ? ????????}?else?{ ????????????SIZE_T?BytesCopied; ? ????????????InitialPeb.InheritedAddressSpace = TRUE; ????????????Process->Peb = Parent->Peb; ????????????MmCopyVirtualMemory (CurrentProcess, ?????????????????????????????????&InitialPeb, ?????????????????????????????????Process, ?????????????????????????????????Process->Peb, ?????????????????????????????????sizeof?(INITIAL_PEB), ?????????????????????????????????KernelMode, ?????????????????????????????????&BytesCopied); ? #if defined(_WIN64) ????????????if?(Process->Wow64Process != NULL) { ????????????????? ????????????????RtlZeroMemory (&InitialPeb32, FIELD_OFFSET(INITIAL_PEB32, Mutant)); ????????????????InitialPeb32.Mutant = -1; ????????????????InitialPeb32.InheritedAddressSpace = TRUE; ????????????????InitialPeb32.ImageUsesLargePages = (BOOLEAN) UseLargePages; ? ????????????????MmCopyVirtualMemory (CurrentProcess, ?????????????????????????????????????&InitialPeb32, ?????????????????????????????????????Process, ?????????????????????????????????????Process->Wow64Process->Wow64, ?????????????????????????????????????sizeof?(INITIAL_PEB32), ?????????????????????????????????????KernelMode, ?????????????????????????????????????&BytesCopied); ????????????} #endif ? ????????} ????} ? ????Peb = Process->Peb; ? ????// ????// Add the process to the global list of processes. ????// ? ????PspLockProcessList (CurrentThread); ????InsertTailList (&PsActiveProcessHead, &Process->ActiveProcessLinks); ????PspUnlockProcessList (CurrentThread); ????AccessState = NULL; ????if?(!PsUseImpersonationToken) { ????????AccessState = &LocalAccessState; ????????Status = SeCreateAccessStateEx (NULL, ????????????????????????????????????????(Parent == NULL || Parent != PsInitialSystemProcess)? ???????????????????????????????????????????PsGetCurrentProcessByThread (CurrentThread) : ???????????????????????????????????????????PsInitialSystemProcess, ????????????????????????????????????????AccessState, ????????????????????????????????????????&AuxData, ????????????????????????????????????????DesiredAccess, ????????????????????????????????????????&PsProcessType->TypeInfo.GenericMapping); ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ????} ? ????// ????// Insert the object. Once we do this is reachable from the outside world via ????// open by name. Open by ID is still disabled. Since its reachable ????// somebody might create a thread in the process and cause ????// rundown. ????// ? ????Status = ObInsertObject (Process, ?????????????????????????????AccessState, ?????????????????????????????DesiredAccess, ?????????????????????????????1,?????// bias the refcnt by one for future process manipulations ?????????????????????????????NULL, ?????????????????????????????&LocalProcessHandle); ? ????if?(AccessState != NULL) { ????????SeDeleteAccessState (AccessState); ????} ? ????if?(!NT_SUCCESS (Status)) { ????????goto?exit_and_deref_parent; ????} ? ????// ????// Compute the base priority and quantum reset values for the process and ????// set the memory priority. ????// ? ????ASSERT(IsListEmpty(&Process->ThreadListHead) == TRUE); ? ????BasePriority = PspComputeQuantumAndPriority(Process, ????????????????????????????????????????????????PsProcessPriorityBackground, ????????????????????????????????????????????????&QuantumReset); ? ????Process->Pcb.BasePriority = (SCHAR)BasePriority; ????Process->Pcb.QuantumReset = QuantumReset; ? ????// ????// As soon as a handle to the process is accessible, allow the process to ????// be deleted. ????// ? ????Process->GrantedAccess = PROCESS_TERMINATE; ????if?(Parent && Parent != PsInitialSystemProcess) { ????????Status = ObGetObjectSecurity (Process, ??????????????????????????????????????&SecurityDescriptor, ??????????????????????????????????????&MemoryAllocated); ? ????????if?(!NT_SUCCESS (Status)) { ????????????ObCloseHandle (LocalProcessHandle, PreviousMode); ????????????goto?exit_and_deref; ????????} ? ????????// ????????// Compute the subject security context ????????// ? ????????SubjectContext.ProcessAuditId = Process; ????????SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process); ????????SubjectContext.ClientToken = NULL; ????????AccessCheck = SeAccessCheck (SecurityDescriptor, ?????????????????????????????????????&SubjectContext, ?????????????????????????????????????FALSE, ?????????????????????????????????????MAXIMUM_ALLOWED, ?????????????????????????????????????0, ?????????????????????????????????????NULL, ?????????????????????????????????????&PsProcessType->TypeInfo.GenericMapping, ?????????????????????????????????????PreviousMode, ?????????????????????????????????????&Process->GrantedAccess, ?????????????????????????????????????&accesst); ? ????????PsDereferencePrimaryTokenEx (Process, SubjectContext.PrimaryToken); ????????ObReleaseObjectSecurity (SecurityDescriptor, ?????????????????????????????????MemoryAllocated); ? ????????if?(!AccessCheck) { ????????????Process->GrantedAccess = 0; ????????} ? ????????// ????????// It does not make any sense to create a process that can not ????????// do anything to itself. ????????// Note: Changes to this set of bits should be reflected in psquery.c ????????// code, in PspSetPrimaryToken. ????????// ? ????????Process->GrantedAccess |= (PROCESS_VM_OPERATION | ???????????????????????????????????PROCESS_VM_READ | ???????????????????????????????????PROCESS_VM_WRITE | ???????????????????????????????????PROCESS_QUERY_INFORMATION | ???????????????????????????????????PROCESS_TERMINATE | ???????????????????????????????????PROCESS_CREATE_THREAD | ???????????????????????????????????PROCESS_DUP_HANDLE | ???????????????????????????????????PROCESS_CREATE_PROCESS | ???????????????????????????????????PROCESS_SET_INFORMATION | ???????????????????????????????????STANDARD_RIGHTS_ALL | ???????????????????????????????????PROCESS_SET_QUOTA); ? ????}?else?{ ????????Process->GrantedAccess = PROCESS_ALL_ACCESS; ????} ? ????KeQuerySystemTime (&Process->CreateTime); ????try?{ ????????if?(Peb != NULL && CurrentThread->Tcb.Teb != NULL) { ????????????((PTEB)(CurrentThread->Tcb.Teb))->NtTib.ArbitraryUserPointer = Peb; ????????} ? ????????*ProcessHandle = LocalProcessHandle; ? ????} except (EXCEPTION_EXECUTE_HANDLER) { ????????NOTHING; ????} ? ????if?(SavedStatus != STATUS_SUCCESS) { ????????Status = SavedStatus; ????} ? exit_and_deref: ????ObDereferenceObject (Process); ? exit_and_deref_parent: ????if?(Parent != NULL) { ????????ObDereferenceObject (Parent); ????} ? ????return?Status; } |
?
?
來具體分析一下PspCreateProcess所做的關(guān)鍵工作：
（1）調(diào)用ObCreateObject 創(chuàng)建一個類型為PsProcessType的內(nèi)核對象，置于局部變量Process中，對象體為EPROCESS，即創(chuàng)建EPROCESS
| 1 2 3 4 5 6 7 8 9 | Status = ObCreateObject (PreviousMode, ?????????????????????????PsProcessType, ?????????????????????????ObjectAttributes, ?????????????????????????PreviousMode, ?????????????????????????NULL, ?????????????????????????sizeof?(EPROCESS), ?????????????????????????0, ?????????????????????????0, ?????????????????????????&Process); |
（2）MmCreateProcessAddressSpace創(chuàng)建新的地址空間
| 1 2 3 4 5 6 7 8 9 | if?(Parent != NULL) { ????//創(chuàng)建新的地址空間 ????if?(!MmCreateProcessAddressSpace (WorkingSetMinimum, ??????????????????????????????????????Process, ??????????????????????????????????????&DirectoryTableBase[0])) { ? ????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????goto?exit_and_deref; ????} |
（3）MmInitializeProcessAddressSpace?初始化新進(jìn)程的地址空間
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 | if?(Parent != PsInitialSystemProcess) {<br> //根據(jù)父進(jìn)程來初始化進(jìn)程地址空間，并把父進(jìn)程的映像名稱拷貝到新進(jìn)程對象的數(shù)據(jù)結(jié)構(gòu)中。 ????????????Process->SectionBaseAddress = Parent->SectionBaseAddress; ? ????????????// ????????????// User Process ( Cloned Address Space ).? Don't specify section to ????????????// map, just Process to clone. ????????????// ? ????????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????????Parent, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????????NULL); ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ? ????????????CreatePeb = TRUE; ????????????UseLargePages = ((Flags & PROCESS_CREATE_FLAGS_LARGE_PAGES) != 0 ? TRUE : FALSE); ????????????? ????????????// ????????????// A cloned process isn't started from an image file, so we give it the name ????????????// of the process of which it is a clone, provided the original has a name. ????????????// ? ????????????if?(Parent->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????ImageFileNameSize =?sizeof(OBJECT_NAME_INFORMATION) + ????????????????????????????????????Parent->SeAuditProcessCreationInfo.ImageFileName->Name.MaximumLength; ? ????????????????Process->SeAuditProcessCreationInfo.ImageFileName = ????????????????????ExAllocatePoolWithTag (PagedPool, ???????????????????????????????????????????ImageFileNameSize, ???????????????????????????????????????????'aPeS'); ? ????????????????if?(Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????????RtlCopyMemory (Process->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????????Parent->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????????ImageFileNameSize); ? ????????????????????// ????????????????????// The UNICODE_STRING in the process is self contained, so calculate the ????????????????????// offset for the buffer. ????????????????????// ? ????????????????????Process->SeAuditProcessCreationInfo.ImageFileName->Name.Buffer = ????????????????????????(PUSHORT)(((PUCHAR) Process->SeAuditProcessCreationInfo.ImageFileName) + ????????????????????????sizeof(UNICODE_STRING)); ? ????????????????}?else?{ ????????????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????????????goto?exit_and_deref; ????????????????} ????????????} ? ????????}?else?{ ? ????????????// ????????????// System Process.? Don't specify Process to clone or section to map ????????????// ? ????????????Flags &= ~PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS; ????????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????????NULL); ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ? ????????????// ????????????// In case the image file name of this system process is ever queried, we give ????????????// a zero length UNICODE_STRING. ????????????// ? ????????????Process->SeAuditProcessCreationInfo.ImageFileName = ????????????????ExAllocatePoolWithTag (PagedPool, ???????????????????????????????????????sizeof(OBJECT_NAME_INFORMATION), ???????????????????????????????????????'aPeS'); ? ????????????if?(Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????RtlZeroMemory (Process->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????sizeof(OBJECT_NAME_INFORMATION)); ????????????}?else?{ ????????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????????goto?exit_and_deref; ????????????} ????????} ????} |
（4）ExCreateHandle函數(shù)在CID句柄表中創(chuàng)建一個進(jìn)程ID項(xiàng)。
| 1 2 3 4 5 6 7 8 9 | CidEntry.Object = Process; CidEntry.GrantedAccess = 0; Process->UniqueProcessId = ExCreateHandle (PspCidTable, &CidEntry); if?(Process->UniqueProcessId == NULL) { ????Status = STATUS_INSUFFICIENT_RESOURCES; ????goto?exit_and_deref; } ? ExSetHandleTableOwner (Process->ObjectTable, Process->UniqueProcessId); |
（5）MmCreatePeb?創(chuàng)建一個PEB，如果進(jìn)程通過映像內(nèi)存區(qū)來創(chuàng)建，創(chuàng)建一個PEB，如果是進(jìn)程拷貝，則使用繼承的PEB。
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | RtlZeroMemory (&InitialPeb, FIELD_OFFSET(INITIAL_PEB, Mutant)); ? ???????InitialPeb.Mutant = (HANDLE)(-1); ???????InitialPeb.ImageUsesLargePages = (BOOLEAN) UseLargePages; ???????????? ???????if?(SectionHandle != NULL) { ???????????Status = MmCreatePeb (Process, &InitialPeb, &Process->Peb); ???????????if?(!NT_SUCCESS (Status)) { ???????????????Process->Peb = NULL; ???????????????goto?exit_and_deref; ???????????} ? ???????????Peb =? Process->Peb; ? ???????}?else?{ ???????????SIZE_T?BytesCopied; ? ???????????InitialPeb.InheritedAddressSpace = TRUE; ???????????Process->Peb = Parent->Peb; ???????????MmCopyVirtualMemory (CurrentProcess, ????????????????????????????????&InitialPeb, ????????????????????????????????Process, ????????????????????????????????Process->Peb, ????????????????????????????????sizeof?(INITIAL_PEB), ????????????????????????????????KernelMode, ????????????????????????????????&BytesCopied); |
（6）InsertTailList 函數(shù)把新進(jìn)程加入全局的LIST_ENTRY進(jìn)程鏈表中（位置：PsActiveProcessHead）
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | PspLockProcessList (CurrentThread); InsertTailList (&PsActiveProcessHead, &Process->ActiveProcessLinks); PspUnlockProcessList (CurrentThread); AccessState = NULL; if?(!PsUseImpersonationToken) { ????AccessState = &LocalAccessState; ????Status = SeCreateAccessStateEx (NULL, ????????????????????????????????????(Parent == NULL || Parent != PsInitialSystemProcess)? ???????????????????????????????????????PsGetCurrentProcessByThread (CurrentThread) : ???????????????????????????????????????PsInitialSystemProcess, ????????????????????????????????????AccessState, ????????????????????????????????????&AuxData, ????????????????????????????????????DesiredAccess, ????????????????????????????????????&PsProcessType->TypeInfo.GenericMapping); ????if?(!NT_SUCCESS (Status)) { ????????goto?exit_and_deref; ????} } |
（7）ObInsertObject?將新進(jìn)程對象記錄到當(dāng)前進(jìn)程的句柄表中。
| 1 2 3 4 5 6 | Status = ObInsertObject (Process, ?????????????????????????????AccessState, ?????????????????????????????DesiredAccess, ?????????????????????????????1,?????// bias the refcnt by one for future process manipulations ?????????????????????????????NULL, ?????????????????????????????&LocalProcessHandle); |
NtCreateProcess結(jié)束后，就創(chuàng)建好了進(jìn)程，然而進(jìn)程只不過是一個容器，接下來的代碼就可以看到NtCreateThread函數(shù)的線程創(chuàng)建了：
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 | NTSTATUS NtCreateThread( ????__out?PHANDLE?ThreadHandle, ????__in ACCESS_MASK DesiredAccess, ????__in_opt POBJECT_ATTRIBUTES ObjectAttributes, ????__in?HANDLE?ProcessHandle, ????__out PCLIENT_ID ClientId, ????__in PCONTEXT ThreadContext, ????__in PINITIAL_TEB InitialTeb, ????__in?BOOLEAN?CreateSuspended ????) /*++ ? Routine Description: ? ????This system service API creates and initializes a thread object. ? --*/ ? { ????NTSTATUS Status; ????INITIAL_TEB CapturedInitialTeb; ? ????PAGED_CODE(); ? ? ????// ????// Probe all arguments ????// ? ????try?{ ????????if?(KeGetPreviousMode () != KernelMode) { ????????????ProbeForWriteHandle (ThreadHandle); ? ????????????if?(ARGUMENT_PRESENT (ClientId)) { ????????????????ProbeForWriteSmallStructure (ClientId,?sizeof?(CLIENT_ID),?sizeof?(ULONG)); ????????????} ? ????????????if?(ARGUMENT_PRESENT (ThreadContext) ) { ????????????????ProbeForReadSmallStructure (ThreadContext,?sizeof?(CONTEXT), CONTEXT_ALIGN); ????????????}?else?{ ????????????????return?STATUS_INVALID_PARAMETER; ????????????} ????????????ProbeForReadSmallStructure (InitialTeb,?sizeof?(InitialTeb->OldInitialTeb),?sizeof?(ULONG)); ????????} ? ????????CapturedInitialTeb.OldInitialTeb = InitialTeb->OldInitialTeb; ????????if?(CapturedInitialTeb.OldInitialTeb.OldStackBase == NULL && ????????????CapturedInitialTeb.OldInitialTeb.OldStackLimit == NULL) { ????????????// ????????????// Since the structure size here is less than 64k we don't need to reprobe ????????????// ????????????CapturedInitialTeb = *InitialTeb; ????????} ????} except (ExSystemExceptionFilter ()) { ????????return?GetExceptionCode (); ????} ? ????Status = PspCreateThread (ThreadHandle, ??????????????????????????????DesiredAccess, ??????????????????????????????ObjectAttributes, ??????????????????????????????ProcessHandle, ??????????????????????????????NULL, ??????????????????????????????ClientId, ??????????????????????????????ThreadContext, ??????????????????????????????&CapturedInitialTeb, ??????????????????????????????CreateSuspended, ??????????????????????????????NULL, ??????????????????????????????NULL); ? ????return?Status; } |
?
?
?
看到這里NtCreateThread函數(shù)還是調(diào)用了PspCreateThread函數(shù)來完成實(shí)際的工作。NtCreateThread——>PspCreateThread
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 | NTSTATUS PspCreateThread( ????OUT?PHANDLE?ThreadHandle, ????IN ACCESS_MASK DesiredAccess, ????IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, ????IN?HANDLE?ProcessHandle, ????IN PEPROCESS ProcessPointer, ????OUT PCLIENT_ID ClientId OPTIONAL, ????IN PCONTEXT ThreadContext OPTIONAL, ????IN PINITIAL_TEB InitialTeb OPTIONAL, ????IN?BOOLEAN?CreateSuspended, ????IN PKSTART_ROUTINE StartRoutine OPTIONAL, ????IN?PVOID?StartContext ????) /*++ Routine Description: ????This routine creates and initializes a thread object. It implements the ????foundation for NtCreateThread and for PsCreateSystemThread. --*/ ? { ? ????HANDLE_TABLE_ENTRY CidEntry; ????NTSTATUS Status; ????PETHREAD Thread; ????PETHREAD CurrentThread; ????PEPROCESS Process; ????PTEB Teb; ????KPROCESSOR_MODE PreviousMode; ????HANDLE?LocalThreadHandle; ????BOOLEAN?AccessCheck; ????BOOLEAN?MemoryAllocated; ????PSECURITY_DESCRIPTOR SecurityDescriptor; ????SECURITY_SUBJECT_CONTEXT SubjectContext; ????NTSTATUS accesst; ????LARGE_INTEGER CreateTime; ????ULONG?OldActiveThreads; ????PEJOB Job; ????AUX_ACCESS_DATA AuxData; ????PACCESS_STATE AccessState; ????ACCESS_STATE LocalAccessState; ? ????PAGED_CODE(); ? ? ????CurrentThread = PsGetCurrentThread (); ? ????if?(StartRoutine != NULL) { ????????PreviousMode = KernelMode; ????}?else?{ ????????PreviousMode = KeGetPreviousModeByThread (&CurrentThread->Tcb); ????} ? ????Teb = NULL; ? ????Thread = NULL; ????Process = NULL; ? ????if?(ProcessHandle != NULL) { ????????// ????????// Process object reference count is biased by one for each thread. ????????// This accounts for the pointer given to the kernel that remains ????????// in effect until the thread terminates (and becomes signaled) ????????// ? ????????Status = ObReferenceObjectByHandle (ProcessHandle, ????????????????????????????????????????????PROCESS_CREATE_THREAD, ????????????????????????????????????????????PsProcessType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&Process, ????????????????????????????????????????????NULL); ????}?else?{ ????????if?(StartRoutine != NULL) { ????????????ObReferenceObject (ProcessPointer); ????????????Process = ProcessPointer; ????????????Status = STATUS_SUCCESS; ????????}?else?{ ????????????Status = STATUS_INVALID_HANDLE; ????????} ????} ? ????if?(!NT_SUCCESS (Status)) { ????????return?Status; ????} ? ????// ????// If the previous mode is user and the target process is the system ????// process, then the operation cannot be performed. ????// ? ????if?((PreviousMode != KernelMode) && (Process == PsInitialSystemProcess)) { ????????ObDereferenceObject (Process); ????????return?STATUS_INVALID_HANDLE; ????} ? ????Status = ObCreateObject (PreviousMode, ?????????????????????????????PsThreadType, ?????????????????????????????ObjectAttributes, ?????????????????????????????PreviousMode, ?????????????????????????????NULL, ?????????????????????????????sizeof(ETHREAD), ?????????????????????????????0, ?????????????????????????????0, ?????????????????????????????&Thread); ? ????if?(!NT_SUCCESS (Status)) { ????????ObDereferenceObject (Process); ????????return?Status; ????} ? ????RtlZeroMemory (Thread,?sizeof?(ETHREAD)); ? ????// ????// Initialize rundown protection for cross thread TEB refs etc. ????// ????ExInitializeRundownProtection (&Thread->RundownProtect); ? ????// ????// Assign this thread to the process so that from now on ????// we don't have to dereference in error paths. ????// ????Thread->ThreadsProcess = Process; ? ????Thread->Cid.UniqueProcess = Process->UniqueProcessId; ? ????CidEntry.Object = Thread; ????CidEntry.GrantedAccess = 0; ????Thread->Cid.UniqueThread = ExCreateHandle (PspCidTable, &CidEntry); ? ????if?(Thread->Cid.UniqueThread == NULL) { ????????ObDereferenceObject (Thread); ????????return?(STATUS_INSUFFICIENT_RESOURCES); ????} ? ????// ????// Initialize Mm ????// ? ????Thread->ReadClusterSize = MmReadClusterSize; ? ????// ????// Initialize LPC ????// ? ????KeInitializeSemaphore (&Thread->LpcReplySemaphore, 0L, 1L); ????InitializeListHead (&Thread->LpcReplyChain); ? ????// ????// Initialize Io ????// ? ????InitializeListHead (&Thread->IrpList); ? ????// ????// Initialize Registry ????// ? ????InitializeListHead (&Thread->PostBlockList); ? ????// ????// Initialize the thread lock ????// ? ????PspInitializeThreadLock (Thread); ? ????KeInitializeSpinLock (&Thread->ActiveTimerListLock); ????InitializeListHead (&Thread->ActiveTimerListHead); ? ? ????if?(!ExAcquireRundownProtection (&Process->RundownProtect)) { ????????ObDereferenceObject (Thread); ????????return?STATUS_PROCESS_IS_TERMINATING; ????} ? ????if?(ARGUMENT_PRESENT (ThreadContext)) { ? ????????// ????????// User-mode thread. Create TEB etc ????????// ? ????????Status = MmCreateTeb (Process, InitialTeb, &Thread->Cid, &Teb); ????????if?(!NT_SUCCESS (Status)) { ????????????ExReleaseRundownProtection (&Process->RundownProtect); ????????????ObDereferenceObject (Thread); ????????????return?Status; ????????} ? ? ????????try?{ ????????????// ????????????// Initialize kernel thread object for user mode thread. ????????????// ? ????????????Thread->StartAddress = (PVOID)CONTEXT_TO_PROGRAM_COUNTER(ThreadContext); ? #if defined(_AMD64_) ? ????????????Thread->Win32StartAddress = (PVOID)ThreadContext->Rdx; ? #elif defined(_X86_) ? ????????????Thread->Win32StartAddress = (PVOID)ThreadContext->Eax; ? #else ? #error "no target architecture" ? #endif ? ????????} except (EXCEPTION_EXECUTE_HANDLER) { ? ????????????Status = GetExceptionCode(); ????????} ? ????????if?(NT_SUCCESS (Status)) { ????????????Status = KeInitThread (&Thread->Tcb, ???????????????????????????????????NULL, ???????????????????????????????????PspUserThreadStartup, ???????????????????????????????????(PKSTART_ROUTINE)NULL, ???????????????????????????????????Thread->StartAddress, ???????????????????????????????????ThreadContext, ???????????????????????????????????Teb, ???????????????????????????????????&Process->Pcb); ???????} ? ? ????}?else?{ ? ????????Teb = NULL; ????????// ????????// Set the system thread bit thats kept for all time ????????// ????????PS_SET_BITS (&Thread->CrossThreadFlags, PS_CROSS_THREAD_FLAGS_SYSTEM); ? ????????// ????????// Initialize kernel thread object for kernel mode thread. ????????// ? ????????Thread->StartAddress = (PKSTART_ROUTINE) StartRoutine; ????????Status = KeInitThread (&Thread->Tcb, ???????????????????????????????NULL, ???????????????????????????????PspSystemThreadStartup, ???????????????????????????????StartRoutine, ???????????????????????????????StartContext, ???????????????????????????????NULL, ???????????????????????????????NULL, ???????????????????????????????&Process->Pcb); ????} ? ? ????if?(!NT_SUCCESS (Status)) { ????????if?(Teb != NULL) { ????????????MmDeleteTeb(Process, Teb); ????????} ????????ExReleaseRundownProtection (&Process->RundownProtect); ????????ObDereferenceObject (Thread); ????????return?Status; ????} ? ????PspLockProcessExclusive (Process, CurrentThread); ????// ????// Process is exiting or has had delete process called ????// We check the calling threads termination status so we ????// abort any thread creates while ExitProcess is being called -- ????// but the call is blocked only if the new thread would be created ????// in the terminating thread's process. ????// ????if?((Process->Flags&PS_PROCESS_FLAGS_PROCESS_DELETE) != 0 || ????????(((CurrentThread->CrossThreadFlags&PS_CROSS_THREAD_FLAGS_TERMINATED) != 0) && ????????(ThreadContext != NULL) && ????????(THREAD_TO_PROCESS(CurrentThread) == Process))) { ? ????????PspUnlockProcessExclusive (Process, CurrentThread); ? ????????KeUninitThread (&Thread->Tcb); ? ????????if?(Teb != NULL) { ????????????MmDeleteTeb(Process, Teb); ????????} ????????ExReleaseRundownProtection (&Process->RundownProtect); ????????ObDereferenceObject(Thread); ? ????????return?STATUS_PROCESS_IS_TERMINATING; ????} ? ? ????OldActiveThreads = Process->ActiveThreads++; ????InsertTailList (&Process->ThreadListHead, &Thread->ThreadListEntry); ? ????KeStartThread (&Thread->Tcb); ? ????PspUnlockProcessExclusive (Process, CurrentThread); ? ????ExReleaseRundownProtection (&Process->RundownProtect); ? ????// ????// Failures that occur after this point cause the thread to ????// go through PspExitThread ????// ? ? ????if?(OldActiveThreads == 0) { ????????PERFINFO_PROCESS_CREATE (Process); ? ????????if?(PspCreateProcessNotifyRoutineCount != 0) { ????????????ULONG?i; ????????????PEX_CALLBACK_ROUTINE_BLOCK CallBack; ????????????PCREATE_PROCESS_NOTIFY_ROUTINE Rtn; ? ????????????for?(i=0; i<PSP_MAX_CREATE_PROCESS_NOTIFY; i++) { ????????????????CallBack = ExReferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i]); ????????????????if?(CallBack != NULL) { ????????????????????Rtn = (PCREATE_PROCESS_NOTIFY_ROUTINE) ExGetCallBackBlockRoutine (CallBack); ????????????????????Rtn (Process->InheritedFromUniqueProcessId, ?????????????????????????Process->UniqueProcessId, ?????????????????????????TRUE); ????????????????????ExDereferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i], ????????????????????????????????????????????????CallBack); ????????????????} ????????????} ????????} ????} ? ????// ????// If the process has a job with a completion port, ????// AND if the process is really considered to be in the Job, AND ????// the process has not reported, report in ????// ????// This should really be done in add process to job, but can't ????// in this path because the process's ID isn't assigned until this point ????// in time ????// ????Job = Process->Job; ????if?(Job != NULL && Job->CompletionPort && ????????!(Process->JobStatus & (PS_JOB_STATUS_NOT_REALLY_ACTIVE|PS_JOB_STATUS_NEW_PROCESS_REPORTED))) { ? ????????PS_SET_BITS (&Process->JobStatus, PS_JOB_STATUS_NEW_PROCESS_REPORTED); ? ????????KeEnterCriticalRegionThread (&CurrentThread->Tcb); ????????ExAcquireResourceSharedLite (&Job->JobLock, TRUE); ????????if?(Job->CompletionPort != NULL) { ????????????IoSetIoCompletion (Job->CompletionPort, ???????????????????????????????Job->CompletionKey, ???????????????????????????????(PVOID)Process->UniqueProcessId, ???????????????????????????????STATUS_SUCCESS, ???????????????????????????????JOB_OBJECT_MSG_NEW_PROCESS, ???????????????????????????????FALSE); ????????} ????????ExReleaseResourceLite (&Job->JobLock); ????????KeLeaveCriticalRegionThread (&CurrentThread->Tcb); ????} ? ????PERFINFO_THREAD_CREATE(Thread, InitialTeb); ? ????// ????// Notify registered callout routines of thread creation. ????// ? ????if?(PspCreateThreadNotifyRoutineCount != 0) { ????????ULONG?i; ????????PEX_CALLBACK_ROUTINE_BLOCK CallBack; ????????PCREATE_THREAD_NOTIFY_ROUTINE Rtn; ? ????????for?(i = 0; i < PSP_MAX_CREATE_THREAD_NOTIFY; i++) { ????????????CallBack = ExReferenceCallBackBlock (&PspCreateThreadNotifyRoutine[i]); ????????????if?(CallBack != NULL) { ????????????????Rtn = (PCREATE_THREAD_NOTIFY_ROUTINE) ExGetCallBackBlockRoutine (CallBack); ????????????????Rtn (Thread->Cid.UniqueProcess, ?????????????????????Thread->Cid.UniqueThread, ?????????????????????TRUE); ????????????????ExDereferenceCallBackBlock (&PspCreateThreadNotifyRoutine[i], ????????????????????????????????????????????CallBack); ????????????} ????????} ????} ? ? ????// ????// Reference count of thread is biased once for itself and once for the handle if we create it. ????// ? ????ObReferenceObjectEx (Thread, 2); ? ????if?(CreateSuspended) { ????????try?{ ????????????KeSuspendThread (&Thread->Tcb); ????????} except ((GetExceptionCode () == STATUS_SUSPEND_COUNT_EXCEEDED)? ?????????????????????EXCEPTION_EXECUTE_HANDLER : ?????????????????????EXCEPTION_CONTINUE_SEARCH) { ????????} ????????// ????????// If deletion was started after we suspended then wake up the thread ????????// ????????if?(Thread->CrossThreadFlags&PS_CROSS_THREAD_FLAGS_TERMINATED) { ????????????KeForceResumeThread (&Thread->Tcb); ????????} ????} ? ????AccessState = NULL; ????if?(!PsUseImpersonationToken) { ????????AccessState = &LocalAccessState; ????????Status = SeCreateAccessStateEx (NULL, ????????????????????????????????????????ARGUMENT_PRESENT (ThreadContext)?PsGetCurrentProcessByThread (CurrentThread) : Process, ????????????????????????????????????????AccessState, ????????????????????????????????????????&AuxData, ????????????????????????????????????????DesiredAccess, ????????????????????????????????????????&PsThreadType->TypeInfo.GenericMapping); ? ????????if?(!NT_SUCCESS (Status)) { ????????????PS_SET_BITS (&Thread->CrossThreadFlags, ?????????????????????????PS_CROSS_THREAD_FLAGS_DEADTHREAD); ? ????????????if?(CreateSuspended) { ????????????????(VOID) KeResumeThread (&Thread->Tcb); ????????????} ????????????KeReadyThread (&Thread->Tcb); ????????????ObDereferenceObjectEx (Thread, 2); ? ????????????return?Status; ????????} ????} ? ????Status = ObInsertObject (Thread, ?????????????????????????????AccessState, ?????????????????????????????DesiredAccess, ?????????????????????????????0, ?????????????????????????????NULL, ?????????????????????????????&LocalThreadHandle); ? ????if?(AccessState != NULL) { ????????SeDeleteAccessState (AccessState); ????} ? ????if?(!NT_SUCCESS (Status)) { ? ????????// ????????// The insert failed. Terminate the thread. ????????// ? ????????// ????????// This trick is used so that Dbgk doesn't report ????????// events for dead threads ????????// ? ????????PS_SET_BITS (&Thread->CrossThreadFlags, ?????????????????????PS_CROSS_THREAD_FLAGS_DEADTHREAD); ? ????????if?(CreateSuspended) { ????????????KeResumeThread (&Thread->Tcb); ????????} ? ????}?else?{ ? ????????try?{ ? ????????????*ThreadHandle = LocalThreadHandle; ????????????if?(ARGUMENT_PRESENT (ClientId)) { ????????????????*ClientId = Thread->Cid; ????????????} ????????} except(EXCEPTION_EXECUTE_HANDLER) { ? ????????????PS_SET_BITS (&Thread->CrossThreadFlags, ?????????????????????????PS_CROSS_THREAD_FLAGS_DEADTHREAD); ? ????????????if?(CreateSuspended) { ????????????????(VOID) KeResumeThread (&Thread->Tcb); ????????????} ????????????KeReadyThread (&Thread->Tcb); ????????????ObDereferenceObject (Thread); ????????????ObCloseHandle (LocalThreadHandle, PreviousMode); ????????????return?GetExceptionCode(); ????????} ????} ? ????KeQuerySystemTime(&CreateTime); ????ASSERT ((CreateTime.HighPart & 0xf0000000) == 0); ????PS_SET_THREAD_CREATE_TIME(Thread, CreateTime); ? ? ????if?((Thread->CrossThreadFlags&PS_CROSS_THREAD_FLAGS_DEADTHREAD) == 0) { ????????Status = ObGetObjectSecurity (Thread, ??????????????????????????????????????&SecurityDescriptor, ??????????????????????????????????????&MemoryAllocated); ????????if?(!NT_SUCCESS (Status)) { ????????????// ????????????// This trick us used so that Dbgk doesn't report ????????????// events for dead threads ????????????// ????????????PS_SET_BITS (&Thread->CrossThreadFlags, ?????????????????????????PS_CROSS_THREAD_FLAGS_DEADTHREAD); ? ????????????if?(CreateSuspended) { ????????????????KeResumeThread(&Thread->Tcb); ????????????} ????????????KeReadyThread (&Thread->Tcb); ????????????ObDereferenceObject (Thread); ????????????ObCloseHandle (LocalThreadHandle, PreviousMode); ????????????return?Status; ????????} ? ????????// ????????// Compute the subject security context ????????// ? ????????SubjectContext.ProcessAuditId = Process; ????????SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process); ????????SubjectContext.ClientToken = NULL; ? ????????AccessCheck = SeAccessCheck (SecurityDescriptor, ?????????????????????????????????????&SubjectContext, ?????????????????????????????????????FALSE, ?????????????????????????????????????MAXIMUM_ALLOWED, ?????????????????????????????????????0, ?????????????????????????????????????NULL, ?????????????????????????????????????&PsThreadType->TypeInfo.GenericMapping, ?????????????????????????????????????PreviousMode, ?????????????????????????????????????&Thread->GrantedAccess, ?????????????????????????????????????&accesst); ? ????????PsDereferencePrimaryTokenEx (Process, SubjectContext.PrimaryToken); ? ????????ObReleaseObjectSecurity (SecurityDescriptor, ?????????????????????????????????MemoryAllocated); ? ????????if?(!AccessCheck) { ????????????Thread->GrantedAccess = 0; ????????} ? ????????Thread->GrantedAccess |= (THREAD_TERMINATE | THREAD_SET_INFORMATION | THREAD_QUERY_INFORMATION); ? ????}?else?{ ????????Thread->GrantedAccess = THREAD_ALL_ACCESS; ????} ? ????KeReadyThread (&Thread->Tcb); ????ObDereferenceObject (Thread); ? ????return?Status; } |
繼續(xù)分析PspCreateThread函數(shù)實(shí)現(xiàn)的關(guān)鍵步驟：
?
（1）ObCreateObject創(chuàng)建一個線程對象ETHREAD，并初始化為零。
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | Status = ObCreateObject (PreviousMode, ?????????????????????????PsThreadType, ?????????????????????????ObjectAttributes, ?????????????????????????PreviousMode, ?????????????????????????NULL, ?????????????????????????sizeof(ETHREAD), ?????????????????????????0, ?????????????????????????0, ?????????????????????????&Thread); ? if?(!NT_SUCCESS (Status)) { ????ObDereferenceObject (Process); ????return?Status; } ? RtlZeroMemory (Thread,?sizeof?(ETHREAD)); |
（2）ExCreateHandle函數(shù)創(chuàng)建線程ID
| 1 2 3 4 5 6 7 8 9 10 11 12 | Thread->ThreadsProcess = Process; ? ????Thread->Cid.UniqueProcess = Process->UniqueProcessId; ? ????CidEntry.Object = Thread; ????CidEntry.GrantedAccess = 0; ????Thread->Cid.UniqueThread = ExCreateHandle (PspCidTable, &CidEntry); ? ????if?(Thread->Cid.UniqueThread == NULL) { ????????ObDereferenceObject (Thread); ????????return?(STATUS_INSUFFICIENT_RESOURCES); ????} |
(3)MmCreateTeb函數(shù)創(chuàng)建TEB
| 1 2 3 4 5 6 | Status = MmCreateTeb (Process, InitialTeb, &Thread->Cid, &Teb); ????????if?(!NT_SUCCESS (Status)) { ????????????ExReleaseRundownProtection (&Process->RundownProtect); ????????????ObDereferenceObject (Thread); ????????????return?Status; ????????} |
（4）利用ThreadContext中的程序指針（Eip寄存器）來設(shè)置線程的啟動地址
| 1 | Thread->StartAddress = (PKSTART_ROUTINE) StartRoutine; |
（5）InsertTailList 函數(shù)將線程插入線程LIST_ENTRY鏈表
?
| 1 2 | OldActiveThreads = Process->ActiveThreads++; ????InsertTailList (&Process->ThreadListHead, &Thread->ThreadListEntry); |
?
（6）判斷如果這個線程是進(jìn)程中的第一個進(jìn)程，回調(diào)函數(shù)則觸發(fā)進(jìn)程的創(chuàng)建通知
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | if?(OldActiveThreads == 0) { ????????PERFINFO_PROCESS_CREATE (Process); ? ????????if?(PspCreateProcessNotifyRoutineCount != 0) { ????????????ULONG?i; ????????????PEX_CALLBACK_ROUTINE_BLOCK CallBack; ????????????PCREATE_PROCESS_NOTIFY_ROUTINE Rtn; ? ????????????for?(i=0; i<PSP_MAX_CREATE_PROCESS_NOTIFY; i++) { ????????????????CallBack = ExReferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i]); ????????????????if?(CallBack != NULL) { ????????????????????Rtn = (PCREATE_PROCESS_NOTIFY_ROUTINE) ExGetCallBackBlockRoutine (CallBack); ????????????????????Rtn (Process->InheritedFromUniqueProcessId, ?????????????????????????Process->UniqueProcessId, ?????????????????????????TRUE); ????????????????????ExDereferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i], ????????????????????????????????????????????????CallBack); ????????????????} ????????????} ????????} ????} |
（7）ObInsertObject函數(shù)將線程對象插入到當(dāng)前進(jìn)程的句柄表中
| 1 2 3 4 5 6 | Status = ObInsertObject (Thread, ?????????????????????????AccessState, ?????????????????????????DesiredAccess, ?????????????????????????0, ?????????????????????????NULL, ?????????????????????????&LocalThreadHandle); |
（8）KeReadyThread函數(shù)使線程進(jìn)入“就緒”狀態(tài)，準(zhǔn)備馬上執(zhí)行
| 1 2 | KeReadyThread (&Thread->Tcb); ObDereferenceObject (Thread); |
到目前為止進(jìn)程對象和線程對象的創(chuàng)建工作就完成了。
?
?
?
?
?
?
?
0x03 ?創(chuàng)建進(jìn)程詳細(xì)步驟2：?通知windows子系統(tǒng)有新進(jìn)程創(chuàng)建，啟動初始線程，用戶空間的初始化和Dll連接
?
四：通知windows子系統(tǒng)
?
每個進(jìn)程在創(chuàng)建/退出的時候都要向windows子系統(tǒng)進(jìn)程csrss.exe進(jìn)程發(fā)出通知，因?yàn)樗鼡?dān)負(fù)著對windows所有進(jìn)程的管理的責(zé)任，
注意，這里發(fā)出通知的是CreateProcess的調(diào)用者，不是新建出來的進(jìn)程，因?yàn)樗€沒有開始運(yùn)行。
?
至此，CreateProcess的操作已經(jīng)完成，但子進(jìn)程中的線程卻尚未開始運(yùn)行，它的運(yùn)行還要經(jīng)歷下面的第五和第六階段。
?
五：啟動初始線程
?
在內(nèi)核中，新線程的啟動例程是KiThreadStartup函數(shù)，這是當(dāng)PspCreateThread 調(diào)用KeInitThread 函數(shù)時，KeInitThread 函數(shù)調(diào)用KiInitializeContextThread（參見base\ntos\ke\i386\thredini.c 文件）來設(shè)置的。
KiThreadStartup 函數(shù)首先將IRQL 降低到APC_LEVEL，然后調(diào)用系統(tǒng)初始的線程函數(shù)PspUserThreadStartup。這里的PspUserThreadStartup 函數(shù)是PspCreateThread 函數(shù)在調(diào)用KeInitThread 時指定的，。注意，PspCreateThread函數(shù)在創(chuàng)建系統(tǒng)線程時指定的初始線程函數(shù)為PspSystemThreadStartup ?。線程啟動函數(shù)被作為一個參數(shù)傳遞給PspUserThreadStartup，在這里，它應(yīng)該是kernel32.dll 中的BaseProcessStart。
PspUserThreadStartup 函數(shù)被調(diào)用。邏輯并不復(fù)雜，但是涉及異步函數(shù)調(diào)用（APC）機(jī)制。
?
新創(chuàng)建的線程未必是可以被立即調(diào)度運(yùn)行的，因?yàn)橛脩艨赡茉趧?chuàng)建時把標(biāo)志位CREATE_ SUSPENDED設(shè)成了1；
如果那樣的話，就需要等待別的進(jìn)程通過系統(tǒng)調(diào)用恢復(fù)其運(yùn)行資格以后才可以被調(diào)度運(yùn)行。否則現(xiàn)在已經(jīng)可以被調(diào)度運(yùn)行了。至于什么時候才會被調(diào)度運(yùn)行，則就要看優(yōu)先級等等條件了。
?
?
六：用戶空間的初始化和Dll連接
?
PspUserThreadStartup 函數(shù)返回以后，KiThreadStartup 函數(shù)返回到用戶模式，此時，PspUserThreadStartup 插入的APC 被交付，于是LdrInitializeThunk 函數(shù)被調(diào)用，這是映像加載器（image loader）的初始化函數(shù)。LdrInitializeThunk 函數(shù)完成加載器、堆管理器等初始化工作，然后加載任何必要的DLL，并且調(diào)用這些DLL 的入口函數(shù)。最后，當(dāng)LdrInitializeThunk 返回到用戶模式APC 分發(fā)器時，該線程開始在用戶模式下執(zhí)行，調(diào)用應(yīng)用程序指定的線程啟動函數(shù)，此啟動函數(shù)的地址已經(jīng)在APC 交付時被壓到用戶棧中。
DLL連接由ntdll.dll中的LdrInitializeThunk()在用戶空間完成。在此之前ntdll.dll與應(yīng)用軟件尚未連接，但是已經(jīng)被映射到了用戶空間
函數(shù)LdrInitializeThunk()在映像中的位置是系統(tǒng)初始化時就預(yù)先確定并記錄在案的，所以在進(jìn)入這個函數(shù)之前也不需要連接。
?
?
0x04 最后總結(jié)一下整個流程
1.打開目標(biāo)映像文件（NtOpenFile()獲取句柄， NtCreateSectiont通過文件句柄創(chuàng)建一個Section文件映射區(qū)，將文件內(nèi)容映射進(jìn)來）
2.創(chuàng)建進(jìn)程對象
??NtCreateProcess——>NtCreateProcessEx——>PspCreateProcess——>
ObCreateObject函數(shù)創(chuàng)建EPROCESS
MmCreateProcessAddressSpace創(chuàng)建新的地址空間，MmInitializeProcessAddressSpace 初始化新進(jìn)程的地址空間
ExCreateHandle函數(shù)在CID句柄表中創(chuàng)建一個進(jìn)程ID項(xiàng)。
? ?MmCreatePeb 創(chuàng)建一個PEB，如果進(jìn)程通過映像內(nèi)存區(qū)來創(chuàng)建，創(chuàng)建一個PEB，如果是進(jìn)程拷貝，則使用繼承的PEB。
InsertTailList 函數(shù)把新進(jìn)程加入全局的LIST_ENTRY進(jìn)程鏈表中（位置：PsActiveProcessHead）
ObInsertObject 將新進(jìn)程對象記錄到當(dāng)前進(jìn)程的句柄表中。
? ? ?3.創(chuàng)建線程對象
?NtCreateThread——>PspCreateThread——>
ObCreateObject創(chuàng)建一個線程對象ETHREAD，并初始化為零。
ExCreateHandle函數(shù)創(chuàng)建線程ID
MmCreateTeb函數(shù)創(chuàng)建TEB
利用ThreadContext中的程序指針（Eip寄存器）來設(shè)置線程的啟動地址Thread->StartAddress = (PKSTART_ROUTINE) StartRoutine;
? ?InsertTailList 函數(shù)將線程插入線程LIST_ENTRY鏈表
判斷如果這個線程是進(jìn)程中的第一個進(jìn)程，回調(diào)函數(shù)則觸發(fā)進(jìn)程的創(chuàng)建通知PCREATE_PROCESS_NOTIFY_ROUTINE Rtn;
? ?ObInsertObject函數(shù)將線程對象插入到當(dāng)前進(jìn)程的句柄表中
? ?KeReadyThread函數(shù)使線程進(jìn)入“就緒”狀態(tài)，準(zhǔn)備馬上執(zhí)行
4.通知windows子系統(tǒng)
CreateProcess的調(diào)用者向windows子系統(tǒng)進(jìn)程csrss.exe進(jìn)程發(fā)出進(jìn)程創(chuàng)建通知
5.啟動初始線程
??在內(nèi)核中，新線程的啟動例程是KiThreadStartup函數(shù)，這是當(dāng)PspCreateThread 調(diào)用KeInitThread 函數(shù)時，KeInitThread 函數(shù)調(diào)用KiInitializeContextThread（參見base\ntos\ke\i386\thredini.c 文件）來設(shè)置的。
6.用戶空間的初始化和Dll連接
DLL連接由ntdll.dll中的LdrInitializeThunk()在用戶空間完成
?
?
?
?
總結(jié)
以上是生活随笔為你收集整理的进程创建过程详解 CreateProcess的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： Syclover战队专访 | 年度终局之
- 下一篇： 战队第二次考核wp