如何在进程创建的hook时结束被创建的进程

2025-04-27 04:34:44
推荐回答(1个)
回答1:

在ZwCreateProcess的Hook处理过程中
返回STATUS_ACCESS_DENIED等错误代码该进程就创建不起来
参考如下的代码片断:
NTSTATUS
HookCreateProcessEx(
OUT PHANDLE phProcess,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN HANDLE hParentProcess,
IN BOOLEAN bInheritParentHandles,
IN HANDLE hSection OPTIONAL,
IN HANDLE hDebugPort OPTIONAL,
IN HANDLE hExceptionPort OPTIONAL,
IN ULONG unKnownParam OPTIONAL
)
{
NTSTATUS ns;
if(hSection)
{
ns=GetProcName(hSection,fullname);
if(!FilterProcHandle(fullname)) return STATUS_ACCESS_DENIED;
}
ns=(RealCreateProcessEx(phProcess,DesiredAccess,ObjectAttributes,hParentProcess,bInheritParentHandles,hSection,hDebugPort,hExceptionPort,unKnownParam);
return ns;
}