进程创建过程详解 CreateProcess
轉載請您注明出處：http://www.cnblogs.com/lsh123/p/7405796.html
0x01?CreateProcessW
CreateProcess的使用有ANSI版本的CreateProcessA和UNICODE版本的CreateProcessW:
不過查看源碼就可以發(fā)現其實CreateProcessA內部調用的還是CreateProcessW：
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 | BOOL WINAPI CreateProcessA( ????LPCSTR?lpApplicationName, ????LPSTR?lpCommandLine, ????LPSECURITY_ATTRIBUTES lpProcessAttributes, ????LPSECURITY_ATTRIBUTES lpThreadAttributes, ????BOOL?bInheritHandles, ????DWORD?dwCreationFlags, ????LPVOID?lpEnvironment, ????LPCSTR?lpCurrentDirectory, ????LPSTARTUPINFOA lpStartupInfo, ????LPPROCESS_INFORMATION lpProcessInformation ????) ? /*++ ? ????ANSI thunk to CreateProcessW ? --*/ ? { ????NTSTATUS Status; ????PUNICODE_STRING CommandLine; ????UNICODE_STRING ApplicationName; ????UNICODE_STRING CurrentDirectory; ????STARTUPINFOW StartupInfo; ????ANSI_STRING AnsiString; ????UNICODE_STRING Unicode; ????UNICODE_STRING DynamicCommandLine; ????UNICODE_STRING NullUnicodeString; ????BOOL?ReturnStatus; ? ????if?(ARGUMENT_PRESENT (lpCommandLine)) { ????????if?( (strlen( lpCommandLine ) + 1) *?sizeof(?WCHAR?) < ?????????????NtCurrentTeb()->StaticUnicodeString.MaximumLength ) { ? ????????????DynamicCommandLine.Buffer = NULL; ? ????????????CommandLine = Basep8BitStringToStaticUnicodeString( lpCommandLine ); ????????????if?(CommandLine == NULL) { ????????????????return?FALSE; ????????????} ????????}?else?{ ????????????if?(!Basep8BitStringToDynamicUnicodeString( &DynamicCommandLine, ????????????????????????????????????????????????????????lpCommandLine )) { ????????????????return?FALSE; ????????????} ????????} ????}?else?{ ?????????DynamicCommandLine.Buffer = NULL; ?????????CommandLine = &NullUnicodeString; ?????????CommandLine->Buffer = NULL; ????} ? ????ApplicationName.Buffer = NULL; ????ApplicationName.Buffer = NULL; ????CurrentDirectory.Buffer = NULL; ????RtlMoveMemory(&StartupInfo,lpStartupInfo,sizeof(*lpStartupInfo)); ????ASSERT(sizeof(StartupInfo) ==?sizeof(*lpStartupInfo)); ????StartupInfo.lpReserved = NULL; ????StartupInfo.lpDesktop = NULL; ????StartupInfo.lpTitle = NULL; ? ????try?{ ????????try?{ ????????????if?(ARGUMENT_PRESENT(lpApplicationName)) { ? ????????????????if?(!Basep8BitStringToDynamicUnicodeString( &ApplicationName, ????????????????????????????????????????????????????????????lpApplicationName )) { ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????} ????????????} ? ????????????if?(ARGUMENT_PRESENT(lpCurrentDirectory)) { ????????????????if?(!Basep8BitStringToDynamicUnicodeString( &CurrentDirectory, ????????????????????????????????????????????????????????????lpCurrentDirectory )) { ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????} ????????????} ? ????????????if?(ARGUMENT_PRESENT(lpStartupInfo->lpReserved)) { ? ????????????????// ????????????????// Win95 does not touch reserved, and Intergraph Voxtel passes ????????????????// garbage for this. Handle this by probing lpReserved, and if ????????????????// the pointer is bad, ignore it ????????????????// ? ????????????????try?{ ? ????????????????????RtlInitAnsiString(&AnsiString,lpStartupInfo->lpReserved); ? ????????????????????} ????????????????except (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ????????????????????????????? EXCEPTION_EXECUTE_HANDLER ????????????????????????????: EXCEPTION_CONTINUE_SEARCH) { ????????????????????goto?bail_on_reserved; ????????????????????} ? ????????????????Unicode.MaximumLength = (USHORT)RtlAnsiStringToUnicodeSize(&AnsiString) ; ????????????????StartupInfo.lpReserved = RtlAllocateHeap( RtlProcessHeap(), ??????????????????????????????????????????????????????????MAKE_TAG( TMP_TAG ), ??????????????????????????????????????????????????????????Unicode.MaximumLength); ????????????????if?( !StartupInfo.lpReserved ) { ????????????????????BaseSetLastNTError(STATUS_NO_MEMORY); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????Unicode.Buffer = StartupInfo.lpReserved; ????????????????Status = RtlAnsiStringToUnicodeString(&Unicode,&AnsiString,FALSE); ????????????????if?( !NT_SUCCESS(Status) ) { ????????????????????BaseSetLastNTError(Status); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????} ? bail_on_reserved: ????????????if?(ARGUMENT_PRESENT(lpStartupInfo->lpDesktop)) { ????????????????RtlInitAnsiString(&AnsiString,lpStartupInfo->lpDesktop); ????????????????Unicode.MaximumLength = (USHORT)RtlAnsiStringToUnicodeSize(&AnsiString) ; ????????????????StartupInfo.lpDesktop = RtlAllocateHeap( RtlProcessHeap(), ?????????????????????????????????????????????????????????MAKE_TAG( TMP_TAG ), ?????????????????????????????????????????????????????????Unicode.MaximumLength); ????????????????if?( !StartupInfo.lpDesktop ) { ????????????????????BaseSetLastNTError(STATUS_NO_MEMORY); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????Unicode.Buffer = StartupInfo.lpDesktop; ????????????????Status = RtlAnsiStringToUnicodeString(&Unicode,&AnsiString,FALSE); ????????????????if?( !NT_SUCCESS(Status) ) { ????????????????????BaseSetLastNTError(Status); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????} ? ????????????if?(ARGUMENT_PRESENT(lpStartupInfo->lpTitle)) { ????????????????RtlInitAnsiString(&AnsiString,lpStartupInfo->lpTitle); ????????????????Unicode.MaximumLength = (USHORT)RtlAnsiStringToUnicodeSize(&AnsiString) ; ????????????????StartupInfo.lpTitle = RtlAllocateHeap( RtlProcessHeap(), ???????????????????????????????????????????????????????MAKE_TAG( TMP_TAG ), ???????????????????????????????????????????????????????Unicode.MaximumLength); ????????????????if?( !StartupInfo.lpTitle ) { ????????????????????BaseSetLastNTError(STATUS_NO_MEMORY); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????Unicode.Buffer = StartupInfo.lpTitle; ????????????????Status = RtlAnsiStringToUnicodeString(&Unicode,&AnsiString,FALSE); ????????????????if?( !NT_SUCCESS(Status) ) { ????????????????????BaseSetLastNTError(Status); ????????????????????ReturnStatus = FALSE; ????????????????????goto?tryexit; ????????????????????} ????????????????} ????????????} ????????except (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ????????????????????? EXCEPTION_EXECUTE_HANDLER ????????????????????: EXCEPTION_CONTINUE_SEARCH) { ????????????BaseSetLastNTError(GetExceptionCode()); ????????????ReturnStatus = FALSE; ????????????goto?tryexit; ????????????} ????????ReturnStatus = CreateProcessW( ????????????????????????????ApplicationName.Buffer, ????????????????????????????DynamicCommandLine.Buffer ? DynamicCommandLine.Buffer ??????????????????????????????????????????????????????: CommandLine->Buffer, ????????????????????????????lpProcessAttributes, ????????????????????????????lpThreadAttributes, ????????????????????????????bInheritHandles, ????????????????????????????dwCreationFlags, ????????????????????????????lpEnvironment, ????????????????????????????CurrentDirectory.Buffer, ????????????????????????????&StartupInfo, ????????????????????????????lpProcessInformation ????????????????????????????); tryexit:; ????????} ????finally { ????????RtlFreeUnicodeString(&DynamicCommandLine); ????????RtlFreeUnicodeString(&ApplicationName); ????????RtlFreeUnicodeString(&CurrentDirectory); ????????RtlFreeHeap(RtlProcessHeap(), 0,StartupInfo.lpReserved); ????????RtlFreeHeap(RtlProcessHeap(), 0,StartupInfo.lpDesktop); ????????RtlFreeHeap(RtlProcessHeap(), 0,StartupInfo.lpTitle); ????????} ? ????return?ReturnStatus; ? } |
CreateProcessW的十個參數：
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | WINBASEAPI BOOL WINAPI CreateProcessW( ????LPCWSTR?lpApplicationName,????//指向一個NULL結尾的，新進程的可執(zhí)行文件的名稱 ????LPWSTR?lpCommandLine,??????????//指向一個NULL結尾的，傳給新進程的命令行字符串 ????LPSECURITY_ATTRIBUTES lpProcessAttributes, ????//指向一個SECURITY_ATTRIBUTES結構體，分配給新的進程對象 ????//SECURITY_ATTRIBUTES結構可以決定是否返回的句柄可以被子進程繼承（bInheritHandle ）。如果lpProcessAttributes參數為空（NULL），那么句柄不能被繼承。 ????//SECURITY_ATTRIBUTES結構的lpSecurityDescriptor成員可以指定新進程的安全描述符，如果參數為空，新進程使用默認的安全描述符。 ????LPSECURITY_ATTRIBUTES lpThreadAttributes, ????//指向一個SECURITY_ATTRIBUTES結構體，分配給新的線程對象 ????BOOL?bInheritHandles, ????//標識新進程是否可以從調用進程處繼承所有可繼承的句柄。被繼承的句柄與原進程擁有完全相同的值和訪問權限。 ????DWORD?dwCreationFlags, ????//標識了影響新進程創(chuàng)建方式的標志，多個標志按位或進行組合 ????LPVOID?lpEnvironment, ????//指向一塊內存，其中包含新進程要使用的環(huán)境字符串。如果此參數為空，新進程繼承父進程的一組環(huán)境字符串。 ????LPCWSTR?lpCurrentDirectory, ????//指向一個以NULL結尾的字符串，用來設置新進程的當前驅動器和目錄，這個字符串必須是一個包含驅動器名的絕對路徑。如果這個參數為空，新進程將使用與父進程相同的驅動器和目錄。 ????LPSTARTUPINFOW lpStartupInfo, ????//指向一個用于決定新進程的主窗體如何顯示的STARTUPINFO結構體。 ????LPPROCESS_INFORMATION lpProcessInformation ????//指向一個用來接收新進程的識別信息的PROCESS_INFORMATION結構體。 ????); |
（1）STARTUPINFO 和?PROCESS_INFORMATION的使用前初始化為空：
STARTUPINFO StartupInfo = { 0 };
StartupInfo.cb = sizeof(STARTUPINFO);
PROCESS_INFORMATION ProcessInfo = { 0 };
?
（2）第六參數：dwCreationFlags 的部分標志：
⑴值：CREATE_DEFAULT_ERROR_MODE
含義：新的進程不繼承調用進程的錯誤模式。CreateProcess函數賦予新進程當前的默認錯誤模式作為替代。應用程序可以調用SetErrorMode函數設置當前的默認錯誤模式。
這個標志對于那些運行在沒有硬件錯誤環(huán)境下的多線程外殼程序是十分有用的。
對于CreateProcess函數，默認的行為是為新進程繼承調用者的錯誤模式。設置這個標志以改變默認的處理方式。
?
⑵值：CREATE_NEW_CONSOLE
含義：新的進程將使用一個新的控制臺，而不是繼承父進程的控制臺。這個標志不能與DETACHED_PROCESS標志一起使用。
?
⑶值：CREATE_NEW_PROCESS_GROUP
含義：新進程將是一個進程樹的根進程。進程樹中的全部進程都是根進程的子進程。新進程樹的用戶標識符與這個進程的標識符是相同的，由lpProcessInformation參數返回。進程樹經常使用GenerateConsoleCtrlEvent函數允許發(fā)送CTRL+C或 CTRL+BREAK信號到一組控制臺進程。
?
⑷值：CREATE_SEPARATE_WOW_VDM
如果被設置，新進程將會在一個私有的虛擬DOS機（VDM）中運行。另外，默認情況下所有的16位Windows應用程序都會在同一個共享的VDM中以線程的方式運行。單獨運行一個16位程序的優(yōu)點是一個應用程序的崩潰只會結束這一個VDM的運行；其他那些在不同VDM中運行的程序會繼續(xù)正常的運行。同樣的，在不同VDM中運行的16位Windows應用程序擁有不同的輸入隊列，這意味著如果一個程序暫時失去響應，在獨立的VDM中的應用程序能夠繼續(xù)獲得輸入。
?
⑸值：CREATE_SHARED_WOW_VDM
如果WIN.INI中的Windows段的DefaultSeparateVDM選項被設置為真，這個標識使得CreateProcess函數越過這個選項并在共享的虛擬DOS機中運行新進程。
?
⑹值：CREATE_SUSPENDED
含義：新進程的主線程會以掛起的狀態(tài)被創(chuàng)建，直到調用ResumeThread函數被調用時才運行。
?
⑺值：CREATE_UNICODE_ENVIRONMENT
含義：如果被設置，由lpEnvironment參數指定環(huán)境塊使用Unicode字符，如果為空，環(huán)境塊默認使用ANSI字符。
?
⑻值：DEBUG_PROCESS
含義：如果這個標志被設置，調用進程將被當做一個調試程序，并且新進程會被當做被調試的進程。系統(tǒng)把被調試程序發(fā)生的所有調試事件通知給調試器。
如果你使用這個標志創(chuàng)建進程，只有調用進程（調用CreateProcess函數的進程）可以調用WaitForDebugEvent函數。
?
⑼值：DEBUG_ONLY_THIS_PROCESS
含義：如果此標志沒有被設置且調用進程正在被調試，新進程將成為調試調用進程的調試器的另一個調試對象。如果調用進程沒有被調試，有關調試的行為就不會產生。
?
⑽值：DETACHED_PROCESS
含義：對于控制臺進程，新進程沒有訪問父進程控制臺的權限。新進程可以通過AllocConsole函數自己創(chuàng)建一個新的控制臺。這個標志不可以與CREATE_NEW_CONSOLE標志一起使用。
?
〔11〕值：CREATE_NO_WINDOW
含義：系統(tǒng)不為新進程創(chuàng)建CUI窗口，使用該標志可以創(chuàng)建不含窗口的CUI程序。
?
?
?
?
?
?
?
?
?
?
0x02 ?創(chuàng)建進程詳細步驟1：打開目標映像文件，創(chuàng)建進程對象，線程對象
CreateProcessW源代碼（windows2000）
?
?CreateProcessW
?
暫且忽略掉之前的一些環(huán)境字符串等等相關操作，注意到第一個值得關注的函數：NtOpenFile()打開其目標文件獲取到了文件句柄FIileHandle
?
| 1 2 3 4 5 6 7 8 9 10 11 12 | // // Open the file for execute access // ? Status = NtOpenFile( ????????????&FileHandle, ????????????SYNCHRONIZE | FILE_EXECUTE, ????????????&Obja, ????????????&IoStatusBlock, ????????????FILE_SHARE_READ | FILE_SHARE_DELETE, ????????????FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE ????????????); |
緊接其后的是NtCreateSectiont通過文件句柄創(chuàng)建一個Section文件映射區(qū)，將文件內容映射進來
| 1 2 3 4 5 6 7 8 9 10 11 12 13 | // // Create a section object backed by the file // ? Status = NtCreateSection( ????????????&SectionHandle, ????????????SECTION_ALL_ACCESS, ????????????NULL, ????????????NULL, ????????????PAGE_EXECUTE, ????????????SEC_IMAGE, ????????????FileHandle ????????????); |
繼續(xù)向下看關鍵函數：NtCreateProcess出現啦！
| 1 2 3 4 5 6 7 8 9 10 | Status = NtCreateProcess( ????????????&ProcessHandle, ????????????PROCESS_ALL_ACCESS, ????????????pObja, ????????????NtCurrentProcess(), ????????????(BOOLEAN)bInheritHandles, ????????????SectionHandle, ????????????NULL, ????????????NULL ????????????); |
在源碼中繼續(xù)延伸，發(fā)現調用過程是NtCreateProcess——>NtCreateProcessEx——>PspCreateProcess(Windows2000源碼中是沒有NtCreateProcessEx函數這個中間過程的，我是在另外一套源碼中找到的NtCreateProcessEx函數，但無奈另一套較新的源碼中又沒有CreateProcessW的定義，故而開始參考的是Windows2000 源碼)
?
NtCreateProcess函數和NtCreateProcessEx函數：
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 | NTSTATUS NtCreateProcess( ????__out?PHANDLE?ProcessHandle, ????__in ACCESS_MASK DesiredAccess, ????__in_opt POBJECT_ATTRIBUTES ObjectAttributes, ????__in?HANDLE?ParentProcess, ????__in?BOOLEAN?InheritObjectTable, ????__in_opt?HANDLE?SectionHandle, ????__in_opt?HANDLE?DebugPort, ????__in_opt?HANDLE?ExceptionPort ????) { ????ULONG?Flags = 0; ? ????if?((ULONG_PTR)SectionHandle & 1) { ????????Flags |= PROCESS_CREATE_FLAGS_BREAKAWAY; ????} ? ????if?((ULONG_PTR) DebugPort & 1) { ????????Flags |= PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT; ????} ? ????if?(InheritObjectTable) { ????????Flags |= PROCESS_CREATE_FLAGS_INHERIT_HANDLES; ????} ? ????return?NtCreateProcessEx (ProcessHandle, ??????????????????????????????DesiredAccess, ??????????????????????????????ObjectAttributes OPTIONAL, ??????????????????????????????ParentProcess, ??????????????????????????????Flags, ??????????????????????????????SectionHandle, ??????????????????????????????DebugPort, ??????????????????????????????ExceptionPort, ??????????????????????????????0); } ? NTSTATUS NtCreateProcessEx( ????__out?PHANDLE?ProcessHandle, ????__in ACCESS_MASK DesiredAccess, ????__in_opt POBJECT_ATTRIBUTES ObjectAttributes, ????__in?HANDLE?ParentProcess, ????__in?ULONG?Flags, ????__in_opt?HANDLE?SectionHandle, ????__in_opt?HANDLE?DebugPort, ????__in_opt?HANDLE?ExceptionPort, ????__in?ULONG?JobMemberLevel ????) ? ? ? { ????NTSTATUS Status; ? ????PAGED_CODE(); ? ????if?(KeGetPreviousMode() != KernelMode) { ? ????????// ????????// Probe all arguments ????????// ? ????????try?{ ????????????ProbeForWriteHandle (ProcessHandle); ????????} except (EXCEPTION_EXECUTE_HANDLER) { ????????????return?GetExceptionCode (); ????????} ????} ? ????if?(ARGUMENT_PRESENT (ParentProcess)) { ????????Status = PspCreateProcess (ProcessHandle, ???????????????????????????????????DesiredAccess, ???????????????????????????????????ObjectAttributes, ???????????????????????????????????ParentProcess, ???????????????????????????????????Flags, ???????????????????????????????????SectionHandle, ???????????????????????????????????DebugPort, ???????????????????????????????????ExceptionPort, ???????????????????????????????????JobMemberLevel); ????}?else?{ ????????Status = STATUS_INVALID_PARAMETER; ????} ? ????return?Status; } |
看以看到NtCreateProcess函數簡單地對處理一下參數，然后把創(chuàng)建進程的任務交給NtCreateProcessEx函數。
NtCreateProcessEx函數的流程。它也只是簡單地檢查ProcessHandle參數代表的句柄是否可寫，ParentProcess是否不為空。真正的創(chuàng)建工作交給PspCreateProcess函數。
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 | NTSTATUS PspCreateProcess( ????OUT?PHANDLE?ProcessHandle, ????IN ACCESS_MASK DesiredAccess, ????IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, ????IN?HANDLE?ParentProcess OPTIONAL, ????IN?ULONG?Flags, ????IN?HANDLE?SectionHandle OPTIONAL, ????IN?HANDLE?DebugPort OPTIONAL, ????IN?HANDLE?ExceptionPort OPTIONAL, ????IN?ULONG?JobMemberLevel ????) /*++ ? Routine Description: ? ????This routine creates and initializes a process object.? It implements the ????foundation for NtCreateProcess and for system initialization process ????creation. ? --*/ ? { ? ????NTSTATUS Status; ????PEPROCESS Process; ????PEPROCESS CurrentProcess; ????PEPROCESS Parent; ????PETHREAD CurrentThread; ????KAFFINITY Affinity; ????KPRIORITY BasePriority; ????PVOID?SectionObject; ????PVOID?ExceptionPortObject; ????PVOID?DebugPortObject; ????ULONG?WorkingSetMinimum, WorkingSetMaximum; ????HANDLE?LocalProcessHandle; ????KPROCESSOR_MODE PreviousMode; ????INITIAL_PEB InitialPeb; ????BOOLEAN?CreatePeb; ????ULONG_PTR?DirectoryTableBase[2]; ????BOOLEAN?AccessCheck; ????BOOLEAN?MemoryAllocated; ????PSECURITY_DESCRIPTOR SecurityDescriptor; ????SECURITY_SUBJECT_CONTEXT SubjectContext; ????NTSTATUS accesst; ????NTSTATUS SavedStatus; ????ULONG?ImageFileNameSize; ????HANDLE_TABLE_ENTRY CidEntry; ????PEJOB Job; ????PPEB Peb; ????AUX_ACCESS_DATA AuxData; ????PACCESS_STATE AccessState; ????ACCESS_STATE LocalAccessState; ????BOOLEAN?UseLargePages; ????SCHAR QuantumReset; #if defined(_WIN64) ????INITIAL_PEB32 InitialPeb32; #endif ? ????PAGED_CODE(); ? ????CurrentThread = PsGetCurrentThread (); ????PreviousMode = KeGetPreviousModeByThread(&CurrentThread->Tcb); ????CurrentProcess = PsGetCurrentProcessByThread (CurrentThread); ? ????CreatePeb = FALSE; ????UseLargePages = FALSE; ????DirectoryTableBase[0] = 0; ????DirectoryTableBase[1] = 0; ????Peb = NULL; ????? ????// ????// Reject bogus create parameters for future expansion ????// ????if?(Flags&~PROCESS_CREATE_FLAGS_LEGAL_MASK) { ????????return?STATUS_INVALID_PARAMETER; ????} ? ????// ????// Parent ????// ? ????if?(ARGUMENT_PRESENT (ParentProcess)) { ????????Status = ObReferenceObjectByHandle (ParentProcess, ????????????????????????????????????????????PROCESS_CREATE_PROCESS, ????????????????????????????????????????????PsProcessType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&Parent, ????????????????????????????????????????????NULL); ????????if?(!NT_SUCCESS (Status)) { ????????????return?Status; ????????} ? ????????if?(JobMemberLevel != 0 && Parent->Job == NULL) { ????????????ObDereferenceObject (Parent); ????????????return?STATUS_INVALID_PARAMETER; ????????} ? ????????Affinity = Parent->Pcb.Affinity; ????????WorkingSetMinimum = PsMinimumWorkingSet; ????????WorkingSetMaximum = PsMaximumWorkingSet; ? ? ????}?else?{ ? ????????Parent = NULL; ????????Affinity = KeActiveProcessors; ????????WorkingSetMinimum = PsMinimumWorkingSet; ????????WorkingSetMaximum = PsMaximumWorkingSet; ????} ? ????// ????// Create the process object ????// ????Status = ObCreateObject (PreviousMode, ?????????????????????????????PsProcessType, ?????????????????????????????ObjectAttributes, ?????????????????????????????PreviousMode, ?????????????????????????????NULL, ?????????????????????????????sizeof?(EPROCESS), ?????????????????????????????0, ?????????????????????????????0, ?????????????????????????????&Process); ? ????if?(!NT_SUCCESS (Status)) { ????????goto?exit_and_deref_parent; ????} ? ????// ????// The process object is created set to NULL. Errors ????// That occur after this step cause the process delete ????// routine to be entered. ????// ????// Teardown actions that occur in the process delete routine ????// do not need to be performed inline. ????// ? ????RtlZeroMemory (Process,?sizeof(EPROCESS)); ????ExInitializeRundownProtection (&Process->RundownProtect); ????PspInitializeProcessLock (Process); ????InitializeListHead (&Process->ThreadListHead); ? #if defined(_WIN64) ? ????if?(Flags & PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE) { ????????PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_OVERRIDE_ADDRESS_SPACE); ????} ? #endif ? ????PspInheritQuota (Process, Parent); ????ObInheritDeviceMap (Process, Parent); ????if?(Parent != NULL) { ????????Process->DefaultHardErrorProcessing = Parent->DefaultHardErrorProcessing; ????????Process->InheritedFromUniqueProcessId = Parent->UniqueProcessId; ? ????}?else?{ ????????Process->DefaultHardErrorProcessing = PROCESS_HARDERROR_DEFAULT; ????????Process->InheritedFromUniqueProcessId = NULL; ????} ? ????// ????// Section ????// ? ????if?(ARGUMENT_PRESENT (SectionHandle)) { ????????Status = ObReferenceObjectByHandle (SectionHandle, ????????????????????????????????????????????SECTION_MAP_EXECUTE, ????????????????????????????????????????????MmSectionObjectType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&SectionObject, ????????????????????????????????????????????NULL); ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????}?else?{ ????????SectionObject = NULL; ????????if?(Parent != PsInitialSystemProcess) { ? ????????????// ????????????// Fetch the section pointer from the parent process ????????????// as we will be cloning. Since the section pointer ????????????// is removed at last thread exit we need to protect against ????????????// process exit here to be safe. ????????????// ? ????????????if?(ExAcquireRundownProtection (&Parent->RundownProtect)) { ????????????????SectionObject = Parent->SectionObject; ????????????????if?(SectionObject != NULL) { ????????????????????ObReferenceObject (SectionObject); ????????????????} ? ????????????????ExReleaseRundownProtection (&Parent->RundownProtect); ????????????} ? ????????????if?(SectionObject == NULL) { ????????????????Status = STATUS_PROCESS_IS_TERMINATING; ????????????????goto?exit_and_deref; ????????????} ????????} ????} ? ????Process->SectionObject = SectionObject; ? ????// ????// DebugPort ????// ? ????if?(ARGUMENT_PRESENT (DebugPort)) { ????????Status = ObReferenceObjectByHandle (DebugPort, ????????????????????????????????????????????DEBUG_PROCESS_ASSIGN, ????????????????????????????????????????????DbgkDebugObjectType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&DebugPortObject, ????????????????????????????????????????????NULL); ? ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????????Process->DebugPort = DebugPortObject; ????????if?(Flags&PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT) { ????????????PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_NO_DEBUG_INHERIT); ????????} ? ????}?else?{ ????????if?(Parent != NULL) { ????????????DbgkCopyProcessDebugPort (Process, Parent); ????????} ????} ? ????// ????// ExceptionPort ????// ? ????if?(ARGUMENT_PRESENT (ExceptionPort)) { ????????Status = ObReferenceObjectByHandle (ExceptionPort, ????????????????????????????????????????????0, ????????????????????????????????????????????LpcPortObjectType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&ExceptionPortObject, ????????????????????????????????????????????NULL); ? ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????????Process->ExceptionPort = ExceptionPortObject; ????} ? ????Process->ExitStatus = STATUS_PENDING; ? ????// ????// Clone parent's object table. ????// If no parent (booting) then use the current object table created in ????// ObInitSystem. ????// ? ????if?(Parent != NULL) { ? ????????// ????????// Calculate address space ????????// ????????//????? If Parent == PspInitialSystem ????????// ? ????????if?(!MmCreateProcessAddressSpace (WorkingSetMinimum, ??????????????????????????????????????????Process, ??????????????????????????????????????????&DirectoryTableBase[0])) { ? ????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????goto?exit_and_deref; ????????} ? ????}?else?{ ????????Process->ObjectTable = CurrentProcess->ObjectTable; ? ????????// ????????// Initialize the Working Set Mutex and address creation mutex ????????// for this "hand built" process. ????????// Normally, the call to MmInitializeAddressSpace initializes the ????????// working set mutex, however, in this case, we have already initialized ????????// the address space and we are now creating a second process using ????????// the address space of the idle thread. ????????// ? ????????Status = MmInitializeHandBuiltProcess (Process, &DirectoryTableBase[0]); ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ????} ? ????PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_HAS_ADDRESS_SPACE); ????Process->Vm.MaximumWorkingSetSize = WorkingSetMaximum; ????KeInitializeProcess (&Process->Pcb, ?????????????????????????NORMAL_BASE_PRIORITY, ?????????????????????????Affinity, ?????????????????????????&DirectoryTableBase[0], ?????????????????????????(BOOLEAN)(Process->DefaultHardErrorProcessing & PROCESS_HARDERROR_ALIGNMENT_BIT)); ? ????// ????//? Initialize the security fields of the process ????//? The parent may be null exactly once (during system init). ????//? Thereafter, a parent is always required so that we have a ????//? security context to duplicate for the new process. ????// ? ????Status = PspInitializeProcessSecurity (Parent, Process); ????if?(!NT_SUCCESS (Status)) { ????????goto?exit_and_deref; ????} ? ????Process->PriorityClass = PROCESS_PRIORITY_CLASS_NORMAL; ????if?(Parent != NULL) { ????????if?(Parent->PriorityClass == PROCESS_PRIORITY_CLASS_IDLE || ????????????Parent->PriorityClass == PROCESS_PRIORITY_CLASS_BELOW_NORMAL) { ????????????Process->PriorityClass = Parent->PriorityClass; ????????} ? ????????// ????????// if address space creation worked, then when going through ????????// delete, we will attach. Of course, attaching means that the kprocess ????????// must be initialized, so we delay the object stuff till here. ????????// ? ????????Status = ObInitProcess ((Flags&PROCESS_CREATE_FLAGS_INHERIT_HANDLES) ? Parent : NULL, ????????????????????????????????Process); ? ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????}?else?{ ????????Status = MmInitializeHandBuiltProcess2 (Process); ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ????} ? ????Status = STATUS_SUCCESS; ????SavedStatus = STATUS_SUCCESS; ? ????// ????// Initialize the process address space ????// The address space has four possibilities ????// ????//????? 1 - Boot Process. Address space is initialized during ????//????????? MmInit. Parent is not specified. ????// ????//????? 2 - System Process. Address space is a virgin address ????//????????? space that only maps system space. Process is same ????//????????? as PspInitialSystemProcess. ????// ????//????? 3 - User Process (Cloned Address Space). Address space ????//????????? is cloned from the specified process. ????// ????//????? 4 - User Process (New Image Address Space). Address space ????//????????? is initialized so that it maps the specified section. ????// ? ????if?(SectionHandle != NULL) { ? ????????// ????????// User Process (New Image Address Space). Don't specify Process to ????????// clone, just SectionObject. ????????// ????????// Passing in the 4th parameter as below lets the EPROCESS struct contain its image file name, provided that ????????// appropriate audit settings are enabled.? Memory is allocated inside of MmInitializeProcessAddressSpace ????????// and pointed to by ImageFileName, so that must be freed in the process deletion routine (PspDeleteProcess()) ????????// ? ????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????SectionObject, ??????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????&(Process->SeAuditProcessCreationInfo.ImageFileName)); ? ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ? ????????// ????????// In order to support relocating executables, the proper status ????????// (STATUS_IMAGE_NOT_AT_BASE) must be returned, so save it here. ????????// ? ????????SavedStatus = Status; ????????CreatePeb = TRUE; ????????UseLargePages = ((Flags & PROCESS_CREATE_FLAGS_LARGE_PAGES) != 0 ? TRUE : FALSE); ? ????}?else?if?(Parent != NULL) { ????????if?(Parent != PsInitialSystemProcess) { ????????????Process->SectionBaseAddress = Parent->SectionBaseAddress; ? ????????????// ????????????// User Process ( Cloned Address Space ).? Don't specify section to ????????????// map, just Process to clone. ????????????// ? ????????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????????Parent, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????????NULL); ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ? ????????????CreatePeb = TRUE; ????????????UseLargePages = ((Flags & PROCESS_CREATE_FLAGS_LARGE_PAGES) != 0 ? TRUE : FALSE); ????????????? ????????????// ????????????// A cloned process isn't started from an image file, so we give it the name ????????????// of the process of which it is a clone, provided the original has a name. ????????????// ? ????????????if?(Parent->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????ImageFileNameSize =?sizeof(OBJECT_NAME_INFORMATION) + ????????????????????????????????????Parent->SeAuditProcessCreationInfo.ImageFileName->Name.MaximumLength; ? ????????????????Process->SeAuditProcessCreationInfo.ImageFileName = ????????????????????ExAllocatePoolWithTag (PagedPool, ???????????????????????????????????????????ImageFileNameSize, ???????????????????????????????????????????'aPeS'); ? ????????????????if?(Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????????RtlCopyMemory (Process->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????????Parent->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????????ImageFileNameSize); ? ????????????????????// ????????????????????// The UNICODE_STRING in the process is self contained, so calculate the ????????????????????// offset for the buffer. ????????????????????// ? ????????????????????Process->SeAuditProcessCreationInfo.ImageFileName->Name.Buffer = ????????????????????????(PUSHORT)(((PUCHAR) Process->SeAuditProcessCreationInfo.ImageFileName) + ????????????????????????sizeof(UNICODE_STRING)); ? ????????????????}?else?{ ????????????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????????????goto?exit_and_deref; ????????????????} ????????????} ? ????????}?else?{ ? ????????????// ????????????// System Process.? Don't specify Process to clone or section to map ????????????// ? ????????????Flags &= ~PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS; ????????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????????NULL); ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ? ????????????// ????????????// In case the image file name of this system process is ever queried, we give ????????????// a zero length UNICODE_STRING. ????????????// ? ????????????Process->SeAuditProcessCreationInfo.ImageFileName = ????????????????ExAllocatePoolWithTag (PagedPool, ???????????????????????????????????????sizeof(OBJECT_NAME_INFORMATION), ???????????????????????????????????????'aPeS'); ? ????????????if?(Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????RtlZeroMemory (Process->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????sizeof(OBJECT_NAME_INFORMATION)); ????????????}?else?{ ????????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????????goto?exit_and_deref; ????????????} ????????} ????} ? ????// ????// Create the process ID ????// ? ????CidEntry.Object = Process; ????CidEntry.GrantedAccess = 0; ????Process->UniqueProcessId = ExCreateHandle (PspCidTable, &CidEntry); ????if?(Process->UniqueProcessId == NULL) { ????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????goto?exit_and_deref; ????} ? ????ExSetHandleTableOwner (Process->ObjectTable, Process->UniqueProcessId); ? ????// ????// Audit the process creation. ????// ? ????if?(SeDetailedAuditingWithToken (NULL)) { ????????SeAuditProcessCreation (Process); ????} ? ????// ????// See if the parent has a job. If so reference the job ????// and add the process in. ????// ? ????if?(Parent) { ????????Job = Parent->Job; ????????if?(Job != NULL && !(Job->LimitFlags & JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK)) { ????????????if?(Flags&PROCESS_CREATE_FLAGS_BREAKAWAY) { ????????????????if?(!(Job->LimitFlags & JOB_OBJECT_LIMIT_BREAKAWAY_OK)) { ????????????????????Status = STATUS_ACCESS_DENIED; ? ????????????????}?else?{ ????????????????????Status = STATUS_SUCCESS; ????????????????} ? ????????????}?else?{ ????????????????Status = PspGetJobFromSet (Job, JobMemberLevel, &Process->Job); ????????????????if?(NT_SUCCESS (Status)) { ????????????????????PACCESS_TOKEN Token, NewToken; ????????????????????Job = Process->Job; ????????????????????Status = PspAddProcessToJob (Job, Process); ? ????????????????????// ????????????????????// Duplicate a new process token if one is specified for the job ????????????????????// ? ????????????????????Token = Job->Token; ????????????????????if?(Token != NULL) { ????????????????????????Status = SeSubProcessToken (Token, ????????????????????????????????????????????????????&NewToken, ????????????????????????????????????????????????????FALSE, ????????????????????????????????????????????????????Job->SessionId); ? ????????????????????????if?(!NT_SUCCESS (Status)) { ????????????????????????????goto?exit_and_deref; ????????????????????????} ? ????????????????????????SeAssignPrimaryToken (Process, NewToken);??? ????????????????????????ObDereferenceObject (NewToken);??????????????????? ????????????????????} ????????????????} ????????????} ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ????????} ????} ? ????if?(Parent && CreatePeb) { ? ????????// ????????// For processes created w/ a section, ????????// a new "virgin" PEB is created. Otherwise, ????????// for forked processes, uses inherited PEB ????????// with an updated mutant. ????????// ? ????????RtlZeroMemory (&InitialPeb, FIELD_OFFSET(INITIAL_PEB, Mutant)); ? ????????InitialPeb.Mutant = (HANDLE)(-1); ????????InitialPeb.ImageUsesLargePages = (BOOLEAN) UseLargePages; ????????????? ????????if?(SectionHandle != NULL) { ????????????Status = MmCreatePeb (Process, &InitialPeb, &Process->Peb); ????????????if?(!NT_SUCCESS (Status)) { ????????????????Process->Peb = NULL; ????????????????goto?exit_and_deref; ????????????} ? ????????????Peb =? Process->Peb; ? ????????}?else?{ ????????????SIZE_T?BytesCopied; ? ????????????InitialPeb.InheritedAddressSpace = TRUE; ????????????Process->Peb = Parent->Peb; ????????????MmCopyVirtualMemory (CurrentProcess, ?????????????????????????????????&InitialPeb, ?????????????????????????????????Process, ?????????????????????????????????Process->Peb, ?????????????????????????????????sizeof?(INITIAL_PEB), ?????????????????????????????????KernelMode, ?????????????????????????????????&BytesCopied); ? #if defined(_WIN64) ????????????if?(Process->Wow64Process != NULL) { ????????????????? ????????????????RtlZeroMemory (&InitialPeb32, FIELD_OFFSET(INITIAL_PEB32, Mutant)); ????????????????InitialPeb32.Mutant = -1; ????????????????InitialPeb32.InheritedAddressSpace = TRUE; ????????????????InitialPeb32.ImageUsesLargePages = (BOOLEAN) UseLargePages; ? ????????????????MmCopyVirtualMemory (CurrentProcess, ?????????????????????????????????????&InitialPeb32, ?????????????????????????????????????Process, ?????????????????????????????????????Process->Wow64Process->Wow64, ?????????????????????????????????????sizeof?(INITIAL_PEB32), ?????????????????????????????????????KernelMode, ?????????????????????????????????????&BytesCopied); ????????????} #endif ? ????????} ????} ? ????Peb = Process->Peb; ? ????// ????// Add the process to the global list of processes. ????// ? ????PspLockProcessList (CurrentThread); ????InsertTailList (&PsActiveProcessHead, &Process->ActiveProcessLinks); ????PspUnlockProcessList (CurrentThread); ????AccessState = NULL; ????if?(!PsUseImpersonationToken) { ????????AccessState = &LocalAccessState; ????????Status = SeCreateAccessStateEx (NULL, ????????????????????????????????????????(Parent == NULL || Parent != PsInitialSystemProcess)? ???????????????????????????????????????????PsGetCurrentProcessByThread (CurrentThread) : ???????????????????????????????????????????PsInitialSystemProcess, ????????????????????????????????????????AccessState, ????????????????????????????????????????&AuxData, ????????????????????????????????????????DesiredAccess, ????????????????????????????????????????&PsProcessType->TypeInfo.GenericMapping); ????????if?(!NT_SUCCESS (Status)) { ????????????goto?exit_and_deref; ????????} ????} ? ????// ????// Insert the object. Once we do this is reachable from the outside world via ????// open by name. Open by ID is still disabled. Since its reachable ????// somebody might create a thread in the process and cause ????// rundown. ????// ? ????Status = ObInsertObject (Process, ?????????????????????????????AccessState, ?????????????????????????????DesiredAccess, ?????????????????????????????1,?????// bias the refcnt by one for future process manipulations ?????????????????????????????NULL, ?????????????????????????????&LocalProcessHandle); ? ????if?(AccessState != NULL) { ????????SeDeleteAccessState (AccessState); ????} ? ????if?(!NT_SUCCESS (Status)) { ????????goto?exit_and_deref_parent; ????} ? ????// ????// Compute the base priority and quantum reset values for the process and ????// set the memory priority. ????// ? ????ASSERT(IsListEmpty(&Process->ThreadListHead) == TRUE); ? ????BasePriority = PspComputeQuantumAndPriority(Process, ????????????????????????????????????????????????PsProcessPriorityBackground, ????????????????????????????????????????????????&QuantumReset); ? ????Process->Pcb.BasePriority = (SCHAR)BasePriority; ????Process->Pcb.QuantumReset = QuantumReset; ? ????// ????// As soon as a handle to the process is accessible, allow the process to ????// be deleted. ????// ? ????Process->GrantedAccess = PROCESS_TERMINATE; ????if?(Parent && Parent != PsInitialSystemProcess) { ????????Status = ObGetObjectSecurity (Process, ??????????????????????????????????????&SecurityDescriptor, ??????????????????????????????????????&MemoryAllocated); ? ????????if?(!NT_SUCCESS (Status)) { ????????????ObCloseHandle (LocalProcessHandle, PreviousMode); ????????????goto?exit_and_deref; ????????} ? ????????// ????????// Compute the subject security context ????????// ? ????????SubjectContext.ProcessAuditId = Process; ????????SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process); ????????SubjectContext.ClientToken = NULL; ????????AccessCheck = SeAccessCheck (SecurityDescriptor, ?????????????????????????????????????&SubjectContext, ?????????????????????????????????????FALSE, ?????????????????????????????????????MAXIMUM_ALLOWED, ?????????????????????????????????????0, ?????????????????????????????????????NULL, ?????????????????????????????????????&PsProcessType->TypeInfo.GenericMapping, ?????????????????????????????????????PreviousMode, ?????????????????????????????????????&Process->GrantedAccess, ?????????????????????????????????????&accesst); ? ????????PsDereferencePrimaryTokenEx (Process, SubjectContext.PrimaryToken); ????????ObReleaseObjectSecurity (SecurityDescriptor, ?????????????????????????????????MemoryAllocated); ? ????????if?(!AccessCheck) { ????????????Process->GrantedAccess = 0; ????????} ? ????????// ????????// It does not make any sense to create a process that can not ????????// do anything to itself. ????????// Note: Changes to this set of bits should be reflected in psquery.c ????????// code, in PspSetPrimaryToken. ????????// ? ????????Process->GrantedAccess |= (PROCESS_VM_OPERATION | ???????????????????????????????????PROCESS_VM_READ | ???????????????????????????????????PROCESS_VM_WRITE | ???????????????????????????????????PROCESS_QUERY_INFORMATION | ???????????????????????????????????PROCESS_TERMINATE | ???????????????????????????????????PROCESS_CREATE_THREAD | ???????????????????????????????????PROCESS_DUP_HANDLE | ???????????????????????????????????PROCESS_CREATE_PROCESS | ???????????????????????????????????PROCESS_SET_INFORMATION | ???????????????????????????????????STANDARD_RIGHTS_ALL | ???????????????????????????????????PROCESS_SET_QUOTA); ? ????}?else?{ ????????Process->GrantedAccess = PROCESS_ALL_ACCESS; ????} ? ????KeQuerySystemTime (&Process->CreateTime); ????try?{ ????????if?(Peb != NULL && CurrentThread->Tcb.Teb != NULL) { ????????????((PTEB)(CurrentThread->Tcb.Teb))->NtTib.ArbitraryUserPointer = Peb; ????????} ? ????????*ProcessHandle = LocalProcessHandle; ? ????} except (EXCEPTION_EXECUTE_HANDLER) { ????????NOTHING; ????} ? ????if?(SavedStatus != STATUS_SUCCESS) { ????????Status = SavedStatus; ????} ? exit_and_deref: ????ObDereferenceObject (Process); ? exit_and_deref_parent: ????if?(Parent != NULL) { ????????ObDereferenceObject (Parent); ????} ? ????return?Status; } |
?
?
來具體分析一下PspCreateProcess所做的關鍵工作：
（1）調用ObCreateObject 創(chuàng)建一個類型為PsProcessType的內核對象，置于局部變量Process中，對象體為EPROCESS，即創(chuàng)建EPROCESS
| 1 2 3 4 5 6 7 8 9 | Status = ObCreateObject (PreviousMode, ?????????????????????????PsProcessType, ?????????????????????????ObjectAttributes, ?????????????????????????PreviousMode, ?????????????????????????NULL, ?????????????????????????sizeof?(EPROCESS), ?????????????????????????0, ?????????????????????????0, ?????????????????????????&Process); |
（2）MmCreateProcessAddressSpace創(chuàng)建新的地址空間
| 1 2 3 4 5 6 7 8 9 | if?(Parent != NULL) { ????//創(chuàng)建新的地址空間 ????if?(!MmCreateProcessAddressSpace (WorkingSetMinimum, ??????????????????????????????????????Process, ??????????????????????????????????????&DirectoryTableBase[0])) { ? ????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????goto?exit_and_deref; ????} |
（3）MmInitializeProcessAddressSpace?初始化新進程的地址空間
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 | if?(Parent != PsInitialSystemProcess) {<br> //根據父進程來初始化進程地址空間，并把父進程的映像名稱拷貝到新進程對象的數據結構中。 ????????????Process->SectionBaseAddress = Parent->SectionBaseAddress; ? ????????????// ????????????// User Process ( Cloned Address Space ).? Don't specify section to ????????????// map, just Process to clone. ????????????// ? ????????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????????Parent, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????????NULL); ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ? ????????????CreatePeb = TRUE; ????????????UseLargePages = ((Flags & PROCESS_CREATE_FLAGS_LARGE_PAGES) != 0 ? TRUE : FALSE); ????????????? ????????????// ????????????// A cloned process isn't started from an image file, so we give it the name ????????????// of the process of which it is a clone, provided the original has a name. ????????????// ? ????????????if?(Parent->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????ImageFileNameSize =?sizeof(OBJECT_NAME_INFORMATION) + ????????????????????????????????????Parent->SeAuditProcessCreationInfo.ImageFileName->Name.MaximumLength; ? ????????????????Process->SeAuditProcessCreationInfo.ImageFileName = ????????????????????ExAllocatePoolWithTag (PagedPool, ???????????????????????????????????????????ImageFileNameSize, ???????????????????????????????????????????'aPeS'); ? ????????????????if?(Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????????RtlCopyMemory (Process->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????????Parent->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????????ImageFileNameSize); ? ????????????????????// ????????????????????// The UNICODE_STRING in the process is self contained, so calculate the ????????????????????// offset for the buffer. ????????????????????// ? ????????????????????Process->SeAuditProcessCreationInfo.ImageFileName->Name.Buffer = ????????????????????????(PUSHORT)(((PUCHAR) Process->SeAuditProcessCreationInfo.ImageFileName) + ????????????????????????sizeof(UNICODE_STRING)); ? ????????????????}?else?{ ????????????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????????????goto?exit_and_deref; ????????????????} ????????????} ? ????????}?else?{ ? ????????????// ????????????// System Process.? Don't specify Process to clone or section to map ????????????// ? ????????????Flags &= ~PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS; ????????????Status = MmInitializeProcessAddressSpace (Process, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????NULL, ??????????????????????????????????????????????????????&Flags, ??????????????????????????????????????????????????????NULL); ? ????????????if?(!NT_SUCCESS (Status)) { ????????????????goto?exit_and_deref; ????????????} ? ????????????// ????????????// In case the image file name of this system process is ever queried, we give ????????????// a zero length UNICODE_STRING. ????????????// ? ????????????Process->SeAuditProcessCreationInfo.ImageFileName = ????????????????ExAllocatePoolWithTag (PagedPool, ???????????????????????????????????????sizeof(OBJECT_NAME_INFORMATION), ???????????????????????????????????????'aPeS'); ? ????????????if?(Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { ????????????????RtlZeroMemory (Process->SeAuditProcessCreationInfo.ImageFileName, ???????????????????????????????sizeof(OBJECT_NAME_INFORMATION)); ????????????}?else?{ ????????????????Status = STATUS_INSUFFICIENT_RESOURCES; ????????????????goto?exit_and_deref; ????????????} ????????} ????} |
（4）ExCreateHandle函數在CID句柄表中創(chuàng)建一個進程ID項。
| 1 2 3 4 5 6 7 8 9 | CidEntry.Object = Process; CidEntry.GrantedAccess = 0; Process->UniqueProcessId = ExCreateHandle (PspCidTable, &CidEntry); if?(Process->UniqueProcessId == NULL) { ????Status = STATUS_INSUFFICIENT_RESOURCES; ????goto?exit_and_deref; } ? ExSetHandleTableOwner (Process->ObjectTable, Process->UniqueProcessId); |
（5）MmCreatePeb?創(chuàng)建一個PEB，如果進程通過映像內存區(qū)來創(chuàng)建，創(chuàng)建一個PEB，如果是進程拷貝，則使用繼承的PEB。
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | RtlZeroMemory (&InitialPeb, FIELD_OFFSET(INITIAL_PEB, Mutant)); ? ???????InitialPeb.Mutant = (HANDLE)(-1); ???????InitialPeb.ImageUsesLargePages = (BOOLEAN) UseLargePages; ???????????? ???????if?(SectionHandle != NULL) { ???????????Status = MmCreatePeb (Process, &InitialPeb, &Process->Peb); ???????????if?(!NT_SUCCESS (Status)) { ???????????????Process->Peb = NULL; ???????????????goto?exit_and_deref; ???????????} ? ???????????Peb =? Process->Peb; ? ???????}?else?{ ???????????SIZE_T?BytesCopied; ? ???????????InitialPeb.InheritedAddressSpace = TRUE; ???????????Process->Peb = Parent->Peb; ???????????MmCopyVirtualMemory (CurrentProcess, ????????????????????????????????&InitialPeb, ????????????????????????????????Process, ????????????????????????????????Process->Peb, ????????????????????????????????sizeof?(INITIAL_PEB), ????????????????????????????????KernelMode, ????????????????????????????????&BytesCopied); |
（6）InsertTailList 函數把新進程加入全局的LIST_ENTRY進程鏈表中（位置：PsActiveProcessHead）
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | PspLockProcessList (CurrentThread); InsertTailList (&PsActiveProcessHead, &Process->ActiveProcessLinks); PspUnlockProcessList (CurrentThread); AccessState = NULL; if?(!PsUseImpersonationToken) { ????AccessState = &LocalAccessState; ????Status = SeCreateAccessStateEx (NULL, ????????????????????????????????????(Parent == NULL || Parent != PsInitialSystemProcess)? ???????????????????????????????????????PsGetCurrentProcessByThread (CurrentThread) : ???????????????????????????????????????PsInitialSystemProcess, ????????????????????????????????????AccessState, ????????????????????????????????????&AuxData, ????????????????????????????????????DesiredAccess, ????????????????????????????????????&PsProcessType->TypeInfo.GenericMapping); ????if?(!NT_SUCCESS (Status)) { ????????goto?exit_and_deref; ????} } |
（7）ObInsertObject?將新進程對象記錄到當前進程的句柄表中。
| 1 2 3 4 5 6 | Status = ObInsertObject (Process, ?????????????????????????????AccessState, ?????????????????????????????DesiredAccess, ?????????????????????????????1,?????// bias the refcnt by one for future process manipulations ?????????????????????????????NULL, ?????????????????????????????&LocalProcessHandle); |
NtCreateProcess結束后，就創(chuàng)建好了進程，然而進程只不過是一個容器，接下來的代碼就可以看到NtCreateThread函數的線程創(chuàng)建了：
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 | NTSTATUS NtCreateThread( ????__out?PHANDLE?ThreadHandle, ????__in ACCESS_MASK DesiredAccess, ????__in_opt POBJECT_ATTRIBUTES ObjectAttributes, ????__in?HANDLE?ProcessHandle, ????__out PCLIENT_ID ClientId, ????__in PCONTEXT ThreadContext, ????__in PINITIAL_TEB InitialTeb, ????__in?BOOLEAN?CreateSuspended ????) /*++ ? Routine Description: ? ????This system service API creates and initializes a thread object. ? --*/ ? { ????NTSTATUS Status; ????INITIAL_TEB CapturedInitialTeb; ? ????PAGED_CODE(); ? ? ????// ????// Probe all arguments ????// ? ????try?{ ????????if?(KeGetPreviousMode () != KernelMode) { ????????????ProbeForWriteHandle (ThreadHandle); ? ????????????if?(ARGUMENT_PRESENT (ClientId)) { ????????????????ProbeForWriteSmallStructure (ClientId,?sizeof?(CLIENT_ID),?sizeof?(ULONG)); ????????????} ? ????????????if?(ARGUMENT_PRESENT (ThreadContext) ) { ????????????????ProbeForReadSmallStructure (ThreadContext,?sizeof?(CONTEXT), CONTEXT_ALIGN); ????????????}?else?{ ????????????????return?STATUS_INVALID_PARAMETER; ????????????} ????????????ProbeForReadSmallStructure (InitialTeb,?sizeof?(InitialTeb->OldInitialTeb),?sizeof?(ULONG)); ????????} ? ????????CapturedInitialTeb.OldInitialTeb = InitialTeb->OldInitialTeb; ????????if?(CapturedInitialTeb.OldInitialTeb.OldStackBase == NULL && ????????????CapturedInitialTeb.OldInitialTeb.OldStackLimit == NULL) { ????????????// ????????????// Since the structure size here is less than 64k we don't need to reprobe ????????????// ????????????CapturedInitialTeb = *InitialTeb; ????????} ????} except (ExSystemExceptionFilter ()) { ????????return?GetExceptionCode (); ????} ? ????Status = PspCreateThread (ThreadHandle, ??????????????????????????????DesiredAccess, ??????????????????????????????ObjectAttributes, ??????????????????????????????ProcessHandle, ??????????????????????????????NULL, ??????????????????????????????ClientId, ??????????????????????????????ThreadContext, ??????????????????????????????&CapturedInitialTeb, ??????????????????????????????CreateSuspended, ??????????????????????????????NULL, ??????????????????????????????NULL); ? ????return?Status; } |
?
?
?
看到這里NtCreateThread函數還是調用了PspCreateThread函數來完成實際的工作。NtCreateThread——>PspCreateThread
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 | NTSTATUS PspCreateThread( ????OUT?PHANDLE?ThreadHandle, ????IN ACCESS_MASK DesiredAccess, ????IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, ????IN?HANDLE?ProcessHandle, ????IN PEPROCESS ProcessPointer, ????OUT PCLIENT_ID ClientId OPTIONAL, ????IN PCONTEXT ThreadContext OPTIONAL, ????IN PINITIAL_TEB InitialTeb OPTIONAL, ????IN?BOOLEAN?CreateSuspended, ????IN PKSTART_ROUTINE StartRoutine OPTIONAL, ????IN?PVOID?StartContext ????) /*++ Routine Description: ????This routine creates and initializes a thread object. It implements the ????foundation for NtCreateThread and for PsCreateSystemThread. --*/ ? { ? ????HANDLE_TABLE_ENTRY CidEntry; ????NTSTATUS Status; ????PETHREAD Thread; ????PETHREAD CurrentThread; ????PEPROCESS Process; ????PTEB Teb; ????KPROCESSOR_MODE PreviousMode; ????HANDLE?LocalThreadHandle; ????BOOLEAN?AccessCheck; ????BOOLEAN?MemoryAllocated; ????PSECURITY_DESCRIPTOR SecurityDescriptor; ????SECURITY_SUBJECT_CONTEXT SubjectContext; ????NTSTATUS accesst; ????LARGE_INTEGER CreateTime; ????ULONG?OldActiveThreads; ????PEJOB Job; ????AUX_ACCESS_DATA AuxData; ????PACCESS_STATE AccessState; ????ACCESS_STATE LocalAccessState; ? ????PAGED_CODE(); ? ? ????CurrentThread = PsGetCurrentThread (); ? ????if?(StartRoutine != NULL) { ????????PreviousMode = KernelMode; ????}?else?{ ????????PreviousMode = KeGetPreviousModeByThread (&CurrentThread->Tcb); ????} ? ????Teb = NULL; ? ????Thread = NULL; ????Process = NULL; ? ????if?(ProcessHandle != NULL) { ????????// ????????// Process object reference count is biased by one for each thread. ????????// This accounts for the pointer given to the kernel that remains ????????// in effect until the thread terminates (and becomes signaled) ????????// ? ????????Status = ObReferenceObjectByHandle (ProcessHandle, ????????????????????????????????????????????PROCESS_CREATE_THREAD, ????????????????????????????????????????????PsProcessType, ????????????????????????????????????????????PreviousMode, ????????????????????????????????????????????&Process, ????????????????????????????????????????????NULL); ????}?else?{ ????????if?(StartRoutine != NULL) { ????????????ObReferenceObject (ProcessPointer); ????????????Process = ProcessPointer; ????????????Status = STATUS_SUCCESS; ????????}?else?{ ????????????Status = STATUS_INVALID_HANDLE; ????????} ????} ? ????if?(!NT_SUCCESS (Status)) { ????????return?Status; ????} ? ????// ????// If the previous mode is user and the target process is the system ????// process, then the operation cannot be performed. ????// ? ????if?((PreviousMode != KernelMode) && (Process == PsInitialSystemProcess)) { ????????ObDereferenceObject (Process); ????????return?STATUS_INVALID_HANDLE; ????} ? ????Status = ObCreateObject (PreviousMode, ?????????????????????????????PsThreadType, ?????????????????????????????ObjectAttributes, ?????????????????????????????PreviousMode, ?????????????????????????????NULL, ?????????????????????????????sizeof(ETHREAD), ?????????????????????????????0, ?????????????????????????????0, ?????????????????????????????&Thread); ? ????if?(!NT_SUCCESS (Status)) { ????????ObDereferenceObject (Process); ????????return?Status; ????} ? ????RtlZeroMemory (Thread,?sizeof?(ETHREAD)); ? ????// ????// Initialize rundown protection for cross thread TEB refs etc. ????// ????ExInitializeRundownProtection (&Thread->RundownProtect); ? ????// ????// Assign this thread to the process so that from now on ????// we don't have to dereference in error paths. ????// ????Thread->ThreadsProcess = Process; ? ????Thread->Cid.UniqueProcess = Process->UniqueProcessId; ? ????CidEntry.Object = Thread; ????CidEntry.GrantedAccess = 0; ????Thread->Cid.UniqueThread = ExCreateHandle (PspCidTable, &CidEntry); ? ????if?(Thread->Cid.UniqueThread == NULL) { ????????ObDereferenceObject (Thread); ????????return?(STATUS_INSUFFICIENT_RESOURCES); ????} ? ????// ????// Initialize Mm ????// ? ????Thread->ReadClusterSize = MmReadClusterSize; ? ????// ????// Initialize LPC ????// ? ????KeInitializeSemaphore (&Thread->LpcReplySemaphore, 0L, 1L); ????InitializeListHead (&Thread->LpcReplyChain); ? ????// ????// Initialize Io ????// ? ????InitializeListHead (&Thread->IrpList); ? ????// ????// Initialize Registry ????// ? ????InitializeListHead (&Thread->PostBlockList); ? ????// ????// Initialize the thread lock ????// ? ????PspInitializeThreadLock (Thread); ? ????KeInitializeSpinLock (&Thread->ActiveTimerListLock); ????InitializeListHead (&Thread->ActiveTimerListHead); ? ? ????if?(!ExAcquireRundownProtection (&Process->RundownProtect)) { ????????ObDereferenceObject (Thread); ????????return?STATUS_PROCESS_IS_TERMINATING; ????} ? ????if?(ARGUMENT_PRESENT (ThreadContext)) { ? ????????// ????????// User-mode thread. Create TEB etc ????????// ? ????????Status = MmCreateTeb (Process, InitialTeb, &Thread->Cid, &Teb); ????????if?(!NT_SUCCESS (Status)) { ????????????ExReleaseRundownProtection (&Process->RundownProtect); ????????????ObDereferenceObject (Thread); ????????????return?Status; ????????} ? ? ????????try?{ ????????????// ????????????// Initialize kernel thread object for user mode thread. ????????????// ? ????????????Thread->StartAddress = (PVOID)CONTEXT_TO_PROGRAM_COUNTER(ThreadContext); ? #if defined(_AMD64_) ? ????????????Thread->Win32StartAddress = (PVOID)ThreadContext->Rdx; ? #elif defined(_X86_) ? ????????????Thread->Win32StartAddress = (PVOID)ThreadContext->Eax; ? #else ? #error "no target architecture" ? #endif ? ????????} except (EXCEPTION_EXECUTE_HANDLER) { ? ????????????Status = GetExceptionCode(); ????????} ? ????????if?(NT_SUCCESS (Status)) { ????????????Status = KeInitThread (&Thread->Tcb, ???????????????????????????????????NULL, ???????????????????????????????????PspUserThreadStartup, ???????????????????????????????????(PKSTART_ROUTINE)NULL, ???????????????????????????????????Thread->StartAddress, ???????????????????????????????????ThreadContext, ???????????????????????????????????Teb, ???????????????????????????????????&Process->Pcb); ???????} ? ? ????}?else?{ ? ????????Teb = NULL; ????????// ????????// Set the system thread bit thats kept for all time ????????// ????????PS_SET_BITS (&Thread->CrossThreadFlags, PS_CROSS_THREAD_FLAGS_SYSTEM); ? ????????// ????????// Initialize kernel thread object for kernel mode thread. ????????// ? ????????Thread->StartAddress = (PKSTART_ROUTINE) StartRoutine; ????????Status = KeInitThread (&Thread->Tcb, ???????????????????????????????NULL, ???????????????????????????????PspSystemThreadStartup, ???????????????????????????????StartRoutine, ???????????????????????????????StartContext, ???????????????????????????????NULL, ???????????????????????????????NULL, ???????????????????????????????&Process->Pcb); ????} ? ? ????if?(!NT_SUCCESS (Status)) { ????????if?(Teb != NULL) { ????????????MmDeleteTeb(Process, Teb); ????????} ????????ExReleaseRundownProtection (&Process->RundownProtect); ????????ObDereferenceObject (Thread); ????????return?Status; ????} ? ????PspLockProcessExclusive (Process, CurrentThread); ????// ????// Process is exiting or has had delete process called ????// We check the calling threads termination status so we ????// abort any thread creates while ExitProcess is being called -- ????// but the call is blocked only if the new thread would be created ????// in the terminating thread's process. ????// ????if?((Process->Flags&PS_PROCESS_FLAGS_PROCESS_DELETE) != 0 || ????????(((CurrentThread->CrossThreadFlags&PS_CROSS_THREAD_FLAGS_TERMINATED) != 0) && ????????(ThreadContext != NULL) && ????????(THREAD_TO_PROCESS(CurrentThread) == Process))) { ? ????????PspUnlockProcessExclusive (Process, CurrentThread); ? ????????KeUninitThread (&Thread->Tcb); ? ????????if?(Teb != NULL) { ????????????MmDeleteTeb(Process, Teb); ????????} ????????ExReleaseRundownProtection (&Process->RundownProtect); ????????ObDereferenceObject(Thread); ? ????????return?STATUS_PROCESS_IS_TERMINATING; ????} ? ? ????OldActiveThreads = Process->ActiveThreads++; ????InsertTailList (&Process->ThreadListHead, &Thread->ThreadListEntry); ? ????KeStartThread (&Thread->Tcb); ? ????PspUnlockProcessExclusive (Process, CurrentThread); ? ????ExReleaseRundownProtection (&Process->RundownProtect); ? ????// ????// Failures that occur after this point cause the thread to ????// go through PspExitThread ????// ? ? ????if?(OldActiveThreads == 0) { ????????PERFINFO_PROCESS_CREATE (Process); ? ????????if?(PspCreateProcessNotifyRoutineCount != 0) { ????????????ULONG?i; ????????????PEX_CALLBACK_ROUTINE_BLOCK CallBack; ????????????PCREATE_PROCESS_NOTIFY_ROUTINE Rtn; ? ????????????for?(i=0; i<PSP_MAX_CREATE_PROCESS_NOTIFY; i++) { ????????????????CallBack = ExReferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i]); ????????????????if?(CallBack != NULL) { ????????????????????Rtn = (PCREATE_PROCESS_NOTIFY_ROUTINE) ExGetCallBackBlockRoutine (CallBack); ????????????????????Rtn (Process->InheritedFromUniqueProcessId, ?????????????????????????Process->UniqueProcessId, ?????????????????????????TRUE); ????????????????????ExDereferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i], ????????????????????????????????????????????????CallBack); ????????????????} ????????????} ????????} ????} ? ????// ????// If the process has a job with a completion port, ????// AND if the process is really considered to be in the Job, AND ????// the process has not reported, report in ????// ????// This should really be done in add process to job, but can't ????// in this path because the process's ID isn't assigned until this point ????// in time ????// ????Job = Process->Job; ????if?(Job != NULL && Job->CompletionPort && ????????!(Process->JobStatus & (PS_JOB_STATUS_NOT_REALLY_ACTIVE|PS_JOB_STATUS_NEW_PROCESS_REPORTED))) { ? ????????PS_SET_BITS (&Process->JobStatus, PS_JOB_STATUS_NEW_PROCESS_REPORTED); ? ????????KeEnterCriticalRegionThread (&CurrentThread->Tcb); ????????ExAcquireResourceSharedLite (&Job->JobLock, TRUE); ????????if?(Job->CompletionPort != NULL) { ????????????IoSetIoCompletion (Job->CompletionPort, ???????????????????????????????Job->CompletionKey, ???????????????????????????????(PVOID)Process->UniqueProcessId, ???????????????????????????????STATUS_SUCCESS, ???????????????????????????????JOB_OBJECT_MSG_NEW_PROCESS, ???????????????????????????????FALSE); ????????} ????????ExReleaseResourceLite (&Job->JobLock); ????????KeLeaveCriticalRegionThread (&CurrentThread->Tcb); ????} ? ????PERFINFO_THREAD_CREATE(Thread, InitialTeb); ? ????// ????// Notify registered callout routines of thread creation. ????// ? ????if?(PspCreateThreadNotifyRoutineCount != 0) { ????????ULONG?i; ????????PEX_CALLBACK_ROUTINE_BLOCK CallBack; ????????PCREATE_THREAD_NOTIFY_ROUTINE Rtn; ? ????????for?(i = 0; i < PSP_MAX_CREATE_THREAD_NOTIFY; i++) { ????????????CallBack = ExReferenceCallBackBlock (&PspCreateThreadNotifyRoutine[i]); ????????????if?(CallBack != NULL) { ????????????????Rtn = (PCREATE_THREAD_NOTIFY_ROUTINE) ExGetCallBackBlockRoutine (CallBack); ????????????????Rtn (Thread->Cid.UniqueProcess, ?????????????????????Thread->Cid.UniqueThread, ?????????????????????TRUE); ????????????????ExDereferenceCallBackBlock (&PspCreateThreadNotifyRoutine[i], ????????????????????????????????????????????CallBack); ????????????} ????????} ????} ? ? ????// ????// Reference count of thread is biased once for itself and once for the handle if we create it. ????// ? ????ObReferenceObjectEx (Thread, 2); ? ????if?(CreateSuspended) { ????????try?{ ????????????KeSuspendThread (&Thread->Tcb); ????????} except ((GetExceptionCode () == STATUS_SUSPEND_COUNT_EXCEEDED)? ?????????????????????EXCEPTION_EXECUTE_HANDLER : ?????????????????????EXCEPTION_CONTINUE_SEARCH) { ????????} ????????// ????????// If deletion was started after we suspended then wake up the thread ????????// ????????if?(Thread->CrossThreadFlags&PS_CROSS_THREAD_FLAGS_TERMINATED) { ????????????KeForceResumeThread (&Thread->Tcb); ????????} ????} ? ????AccessState = NULL; ????if?(!PsUseImpersonationToken) { ????????AccessState = &LocalAccessState; ????????Status = SeCreateAccessStateEx (NULL, ????????????????????????????????????????ARGUMENT_PRESENT (ThreadContext)?PsGetCurrentProcessByThread (CurrentThread) : Process, ????????????????????????????????????????AccessState, ????????????????????????????????????????&AuxData, ????????????????????????????????????????DesiredAccess, ????????????????????????????????????????&PsThreadType->TypeInfo.GenericMapping); ? ????????if?(!NT_SUCCESS (Status)) { ????????????PS_SET_BITS (&Thread->CrossThreadFlags, ?????????????????????????PS_CROSS_THREAD_FLAGS_DEADTHREAD); ? ????????????if?(CreateSuspended) { ????????????????(VOID) KeResumeThread (&Thread->Tcb); ????????????} ????????????KeReadyThread (&Thread->Tcb); ????????????ObDereferenceObjectEx (Thread, 2); ? ????????????return?Status; ????????} ????} ? ????Status = ObInsertObject (Thread, ?????????????????????????????AccessState, ?????????????????????????????DesiredAccess, ?????????????????????????????0, ?????????????????????????????NULL, ?????????????????????????????&LocalThreadHandle); ? ????if?(AccessState != NULL) { ????????SeDeleteAccessState (AccessState); ????} ? ????if?(!NT_SUCCESS (Status)) { ? ????????// ????????// The insert failed. Terminate the thread. ????????// ? ????????// ????????// This trick is used so that Dbgk doesn't report ????????// events for dead threads ????????// ? ????????PS_SET_BITS (&Thread->CrossThreadFlags, ?????????????????????PS_CROSS_THREAD_FLAGS_DEADTHREAD); ? ????????if?(CreateSuspended) { ????????????KeResumeThread (&Thread->Tcb); ????????} ? ????}?else?{ ? ????????try?{ ? ????????????*ThreadHandle = LocalThreadHandle; ????????????if?(ARGUMENT_PRESENT (ClientId)) { ????????????????*ClientId = Thread->Cid; ????????????} ????????} except(EXCEPTION_EXECUTE_HANDLER) { ? ????????????PS_SET_BITS (&Thread->CrossThreadFlags, ?????????????????????????PS_CROSS_THREAD_FLAGS_DEADTHREAD); ? ????????????if?(CreateSuspended) { ????????????????(VOID) KeResumeThread (&Thread->Tcb); ????????????} ????????????KeReadyThread (&Thread->Tcb); ????????????ObDereferenceObject (Thread); ????????????ObCloseHandle (LocalThreadHandle, PreviousMode); ????????????return?GetExceptionCode(); ????????} ????} ? ????KeQuerySystemTime(&CreateTime); ????ASSERT ((CreateTime.HighPart & 0xf0000000) == 0); ????PS_SET_THREAD_CREATE_TIME(Thread, CreateTime); ? ? ????if?((Thread->CrossThreadFlags&PS_CROSS_THREAD_FLAGS_DEADTHREAD) == 0) { ????????Status = ObGetObjectSecurity (Thread, ??????????????????????????????????????&SecurityDescriptor, ??????????????????????????????????????&MemoryAllocated); ????????if?(!NT_SUCCESS (Status)) { ????????????// ????????????// This trick us used so that Dbgk doesn't report ????????????// events for dead threads ????????????// ????????????PS_SET_BITS (&Thread->CrossThreadFlags, ?????????????????????????PS_CROSS_THREAD_FLAGS_DEADTHREAD); ? ????????????if?(CreateSuspended) { ????????????????KeResumeThread(&Thread->Tcb); ????????????} ????????????KeReadyThread (&Thread->Tcb); ????????????ObDereferenceObject (Thread); ????????????ObCloseHandle (LocalThreadHandle, PreviousMode); ????????????return?Status; ????????} ? ????????// ????????// Compute the subject security context ????????// ? ????????SubjectContext.ProcessAuditId = Process; ????????SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process); ????????SubjectContext.ClientToken = NULL; ? ????????AccessCheck = SeAccessCheck (SecurityDescriptor, ?????????????????????????????????????&SubjectContext, ?????????????????????????????????????FALSE, ?????????????????????????????????????MAXIMUM_ALLOWED, ?????????????????????????????????????0, ?????????????????????????????????????NULL, ?????????????????????????????????????&PsThreadType->TypeInfo.GenericMapping, ?????????????????????????????????????PreviousMode, ?????????????????????????????????????&Thread->GrantedAccess, ?????????????????????????????????????&accesst); ? ????????PsDereferencePrimaryTokenEx (Process, SubjectContext.PrimaryToken); ? ????????ObReleaseObjectSecurity (SecurityDescriptor, ?????????????????????????????????MemoryAllocated); ? ????????if?(!AccessCheck) { ????????????Thread->GrantedAccess = 0; ????????} ? ????????Thread->GrantedAccess |= (THREAD_TERMINATE | THREAD_SET_INFORMATION | THREAD_QUERY_INFORMATION); ? ????}?else?{ ????????Thread->GrantedAccess = THREAD_ALL_ACCESS; ????} ? ????KeReadyThread (&Thread->Tcb); ????ObDereferenceObject (Thread); ? ????return?Status; } |
繼續(xù)分析PspCreateThread函數實現的關鍵步驟：
?
（1）ObCreateObject創(chuàng)建一個線程對象ETHREAD，并初始化為零。
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | Status = ObCreateObject (PreviousMode, ?????????????????????????PsThreadType, ?????????????????????????ObjectAttributes, ?????????????????????????PreviousMode, ?????????????????????????NULL, ?????????????????????????sizeof(ETHREAD), ?????????????????????????0, ?????????????????????????0, ?????????????????????????&Thread); ? if?(!NT_SUCCESS (Status)) { ????ObDereferenceObject (Process); ????return?Status; } ? RtlZeroMemory (Thread,?sizeof?(ETHREAD)); |
（2）ExCreateHandle函數創(chuàng)建線程ID
| 1 2 3 4 5 6 7 8 9 10 11 12 | Thread->ThreadsProcess = Process; ? ????Thread->Cid.UniqueProcess = Process->UniqueProcessId; ? ????CidEntry.Object = Thread; ????CidEntry.GrantedAccess = 0; ????Thread->Cid.UniqueThread = ExCreateHandle (PspCidTable, &CidEntry); ? ????if?(Thread->Cid.UniqueThread == NULL) { ????????ObDereferenceObject (Thread); ????????return?(STATUS_INSUFFICIENT_RESOURCES); ????} |
(3)MmCreateTeb函數創(chuàng)建TEB
| 1 2 3 4 5 6 | Status = MmCreateTeb (Process, InitialTeb, &Thread->Cid, &Teb); ????????if?(!NT_SUCCESS (Status)) { ????????????ExReleaseRundownProtection (&Process->RundownProtect); ????????????ObDereferenceObject (Thread); ????????????return?Status; ????????} |
（4）利用ThreadContext中的程序指針（Eip寄存器）來設置線程的啟動地址
| 1 | Thread->StartAddress = (PKSTART_ROUTINE) StartRoutine; |
（5）InsertTailList 函數將線程插入線程LIST_ENTRY鏈表
?
| 1 2 | OldActiveThreads = Process->ActiveThreads++; ????InsertTailList (&Process->ThreadListHead, &Thread->ThreadListEntry); |
?
（6）判斷如果這個線程是進程中的第一個進程，回調函數則觸發(fā)進程的創(chuàng)建通知
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | if?(OldActiveThreads == 0) { ????????PERFINFO_PROCESS_CREATE (Process); ? ????????if?(PspCreateProcessNotifyRoutineCount != 0) { ????????????ULONG?i; ????????????PEX_CALLBACK_ROUTINE_BLOCK CallBack; ????????????PCREATE_PROCESS_NOTIFY_ROUTINE Rtn; ? ????????????for?(i=0; i<PSP_MAX_CREATE_PROCESS_NOTIFY; i++) { ????????????????CallBack = ExReferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i]); ????????????????if?(CallBack != NULL) { ????????????????????Rtn = (PCREATE_PROCESS_NOTIFY_ROUTINE) ExGetCallBackBlockRoutine (CallBack); ????????????????????Rtn (Process->InheritedFromUniqueProcessId, ?????????????????????????Process->UniqueProcessId, ?????????????????????????TRUE); ????????????????????ExDereferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i], ????????????????????????????????????????????????CallBack); ????????????????} ????????????} ????????} ????} |
（7）ObInsertObject函數將線程對象插入到當前進程的句柄表中
| 1 2 3 4 5 6 | Status = ObInsertObject (Thread, ?????????????????????????AccessState, ?????????????????????????DesiredAccess, ?????????????????????????0, ?????????????????????????NULL, ?????????????????????????&LocalThreadHandle); |
（8）KeReadyThread函數使線程進入“就緒”狀態(tài)，準備馬上執(zhí)行
| 1 2 | KeReadyThread (&Thread->Tcb); ObDereferenceObject (Thread); |
到目前為止進程對象和線程對象的創(chuàng)建工作就完成了。
?
?
?
?
?
?
?
0x03 ?創(chuàng)建進程詳細步驟2：?通知windows子系統(tǒng)有新進程創(chuàng)建，啟動初始線程，用戶空間的初始化和Dll連接
?
四：通知windows子系統(tǒng)
?
每個進程在創(chuàng)建/退出的時候都要向windows子系統(tǒng)進程csrss.exe進程發(fā)出通知，因為它擔負著對windows所有進程的管理的責任，
注意，這里發(fā)出通知的是CreateProcess的調用者，不是新建出來的進程，因為它還沒有開始運行。
?
至此，CreateProcess的操作已經完成，但子進程中的線程卻尚未開始運行，它的運行還要經歷下面的第五和第六階段。
?
五：啟動初始線程
?
在內核中，新線程的啟動例程是KiThreadStartup函數，這是當PspCreateThread 調用KeInitThread 函數時，KeInitThread 函數調用KiInitializeContextThread（參見base\ntos\ke\i386\thredini.c 文件）來設置的。
KiThreadStartup 函數首先將IRQL 降低到APC_LEVEL，然后調用系統(tǒng)初始的線程函數PspUserThreadStartup。這里的PspUserThreadStartup 函數是PspCreateThread 函數在調用KeInitThread 時指定的，。注意，PspCreateThread函數在創(chuàng)建系統(tǒng)線程時指定的初始線程函數為PspSystemThreadStartup ?。線程啟動函數被作為一個參數傳遞給PspUserThreadStartup，在這里，它應該是kernel32.dll 中的BaseProcessStart。
PspUserThreadStartup 函數被調用。邏輯并不復雜，但是涉及異步函數調用（APC）機制。
?
新創(chuàng)建的線程未必是可以被立即調度運行的，因為用戶可能在創(chuàng)建時把標志位CREATE_ SUSPENDED設成了1；
如果那樣的話，就需要等待別的進程通過系統(tǒng)調用恢復其運行資格以后才可以被調度運行。否則現在已經可以被調度運行了。至于什么時候才會被調度運行，則就要看優(yōu)先級等等條件了。
?
?
六：用戶空間的初始化和Dll連接
?
PspUserThreadStartup 函數返回以后，KiThreadStartup 函數返回到用戶模式，此時，PspUserThreadStartup 插入的APC 被交付，于是LdrInitializeThunk 函數被調用，這是映像加載器（image loader）的初始化函數。LdrInitializeThunk 函數完成加載器、堆管理器等初始化工作，然后加載任何必要的DLL，并且調用這些DLL 的入口函數。最后，當LdrInitializeThunk 返回到用戶模式APC 分發(fā)器時，該線程開始在用戶模式下執(zhí)行，調用應用程序指定的線程啟動函數，此啟動函數的地址已經在APC 交付時被壓到用戶棧中。
DLL連接由ntdll.dll中的LdrInitializeThunk()在用戶空間完成。在此之前ntdll.dll與應用軟件尚未連接，但是已經被映射到了用戶空間
函數LdrInitializeThunk()在映像中的位置是系統(tǒng)初始化時就預先確定并記錄在案的，所以在進入這個函數之前也不需要連接。
?
?
0x04 最后總結一下整個流程
1.打開目標映像文件（NtOpenFile()獲取句柄， NtCreateSectiont通過文件句柄創(chuàng)建一個Section文件映射區(qū)，將文件內容映射進來）
2.創(chuàng)建進程對象
??NtCreateProcess——>NtCreateProcessEx——>PspCreateProcess——>
ObCreateObject函數創(chuàng)建EPROCESS
MmCreateProcessAddressSpace創(chuàng)建新的地址空間，MmInitializeProcessAddressSpace 初始化新進程的地址空間
ExCreateHandle函數在CID句柄表中創(chuàng)建一個進程ID項。
? ?MmCreatePeb 創(chuàng)建一個PEB，如果進程通過映像內存區(qū)來創(chuàng)建，創(chuàng)建一個PEB，如果是進程拷貝，則使用繼承的PEB。
InsertTailList 函數把新進程加入全局的LIST_ENTRY進程鏈表中（位置：PsActiveProcessHead）
ObInsertObject 將新進程對象記錄到當前進程的句柄表中。
? ? ?3.創(chuàng)建線程對象
?NtCreateThread——>PspCreateThread——>
ObCreateObject創(chuàng)建一個線程對象ETHREAD，并初始化為零。
ExCreateHandle函數創(chuàng)建線程ID
MmCreateTeb函數創(chuàng)建TEB
利用ThreadContext中的程序指針（Eip寄存器）來設置線程的啟動地址Thread->StartAddress = (PKSTART_ROUTINE) StartRoutine;
? ?InsertTailList 函數將線程插入線程LIST_ENTRY鏈表
判斷如果這個線程是進程中的第一個進程，回調函數則觸發(fā)進程的創(chuàng)建通知PCREATE_PROCESS_NOTIFY_ROUTINE Rtn;
? ?ObInsertObject函數將線程對象插入到當前進程的句柄表中
? ?KeReadyThread函數使線程進入“就緒”狀態(tài)，準備馬上執(zhí)行
4.通知windows子系統(tǒng)
CreateProcess的調用者向windows子系統(tǒng)進程csrss.exe進程發(fā)出進程創(chuàng)建通知
5.啟動初始線程
??在內核中，新線程的啟動例程是KiThreadStartup函數，這是當PspCreateThread 調用KeInitThread 函數時，KeInitThread 函數調用KiInitializeContextThread（參見base\ntos\ke\i386\thredini.c 文件）來設置的。
6.用戶空間的初始化和Dll連接
DLL連接由ntdll.dll中的LdrInitializeThunk()在用戶空間完成
?
?
?
?
總結
以上是生活随笔為你收集整理的进程创建过程详解 CreateProcess的全部內容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： Syclover战队专访 | 年度终局之
- 下一篇： 战队第二次考核wp