关于PsCreateSystemThread函数

研究了1天这个。。。MSDN说的不是很清楚
NTSTATUS PsCreateSystemThread(
  _Out_    PHANDLE ThreadHandle,
  _In_    ULONG DesiredAccess,
  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
  _In_opt_ HANDLE ProcessHandle,
  _Out_opt_  PCLIENT_ID ClientId,
  _In_    PKSTART_ROUTINE StartRoutine,
  _In_opt_ PVOID StartContext
);

该函数用于创建系统线程，ProcessHandle参数接收NULL,    NtCurrentProcess() (-1) ,或指定进程句柄三种情况  都可以用PsTerminateSystemThread结束掉
示例：

[C++] 纯文本查看复制代码

01

VOID MyThread(PVOID StartContext)

02
{

03

    PEPROCESS pp=IoGetCurrentProcess();

04

    NTSTATUS status=PsTerminateSystemThread(0);

05
//以下实际上已经不执行了

06

    if(status == STATUS_INVALID_PARAMETER)

07

    {

08

        KdPrint(("not systemthread"));

09

    }

10
}

11
 
12

HANDLE OpenProcess(HANDLE  Processid)

13
{

14

    NTSTATUS status;

15

    PEPROCESS Process = NULL;

16

    HANDLE hProcess = NULL;

17

    UNICODE_STRING Unicode;

18

    status = PsLookupProcessByProcessId(Processid, &Process);

19

    if (NT_SUCCESS(status))//判断进程号是否存在

20

    {

21

        RtlInitUnicodeString(&Unicode, L"PsProcessType");

22

        //得到系统导出函数的地址和用户态的GetProcessAddress雷同

23

        PsProcessType = (POBJECT_TYPE*)MmGetSystemRoutineAddress(&Unicode);

24

        if (PsProcessType)

25

        {

26

            status = ObOpenObjectByPointer(Process,0,NULL,PROCESS_ALL_ACCESS,(POBJECT_TYPE) * PsProcessType,

27

                KernelMode,&hProcess);

28

            if (NT_SUCCESS(status))

29

            {

30

                //减少指针计数

31

                ObfDereferenceObject(Process);

32

                return hProcess;

33

            }

34

        }

35

        ObfDereferenceObject(Process);

36

    }

37

    return 0;

38
}

39
 
40

HANDLE outthread1,,outthread2,outthread3,outthread4,hproc;

41
 
42
PsCreateSystemThread(&outthread1,THREAD_ALL_ACCESS,NULL,NULL,NULL,MyThread,NULL);

43
PsCreateSystemThread(&outthread2,THREAD_ALL_ACCESS,NULL,NtCurrentProcess(),NULL,MyThread,NULL);

44
 
45
OBJECT_ATTRIBUTES oa;

46

CLIENT_ID ci={(HANDLE)1472,0};//注意是进程ID！

47

RtlZeroMemory(&oa,sizeof(oa));

48

oa.Length=sizeof(oa);

49
ZwOpenProcess(&hproc,PROCESS_ALL_ACCESS,&oa,&ci);

50
PsCreateSystemThread(&outthread3,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL);

51
 
52

hproc=OpenProcess((HANDLE)1472);//注意是进程ID！

53
PsCreateSystemThread(&outthread4,THREAD_ALL_ACCESS,NULL,hproc,NULL,MyThread,NULL);

该函数创建的线程，其PETHRAD属性的CrossThreadFlags有PS_CROSS_THREAD_FLAGS_SYSTEM属性，不允许以挂起模式创建线程，，其他和普通的NtCreateThread差别不大！
然而在微软官方源码中，PS_CROSS_THREAD_FLAGS_SYSTEM属性即为SystemThread，尽管其所属进程可能是explorer.exe

https://www.0xaa55.com/forum.php?mod=viewthread&tid=1376&extra=page%3D6