ReadProcess/Thread.cpp at master · 393686984/ReadProcess · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
#include "Thread.h"

NTSTATUS ApcpQuerySystemProcessInformation(PSYSTEM_PROCESS_INFO * SystemInfo)
{
	PSYSTEM_PROCESS_INFO pBuffer = NULL;
	ULONG BufferSize = 0;
	ULONG RequiredSize = 0;

	NTSTATUS status = STATUS_SUCCESS;
	while ((status = ZwQuerySystemInformation(
		SystemProcessInformation,
		pBuffer,
		BufferSize,
		&RequiredSize//retn Length
	)) == STATUS_INFO_LENGTH_MISMATCH)
	{
		BufferSize = RequiredSize;
		pBuffer = (PSYSTEM_PROCESS_INFO)ExAllocatePool(PagedPool, BufferSize);
	}

	if (!NT_SUCCESS(status))
	{
		if (pBuffer != NULL)
		{
			ExFreePool(pBuffer);
		}

		return status;
	}
	//retn pSystemProcessInfo
	*SystemInfo = pBuffer;
	return status;
}
BOOLEAN Thread::ICanbeInsertedAPC_W7(My_PETHREADW7 THOBJECT)
{
	BOOLEAN nRet = FALSE;
	if (MmIsAddressValid(THOBJECT) == FALSE) {
		return nRet;
	}
	if (THOBJECT->Tcb.Alertable == 1) {
		nRet = TRUE;
		return nRet;
	}
	return nRet;
}

NTSTATUS Thread::InsertApc(PEPROCESS PEOBJCT, PVOID SystemArgument2, PVOID Parameter)
{
	NTSTATUS Status;
	PKAPC ExitApc = NULL;

	if (!SystemProcessInfo) {
		PSYSTEM_PROCESS_INFO OriginalSystemProcessInfo = NULL;


		Status = ApcpQuerySystemProcessInformation(&OriginalSystemProcessInfo);
		if (!NT_SUCCESS(Status)) {
			return Status;
		}

		SystemProcessInfo = OriginalSystemProcessInfo;
		Status = STATUS_NOT_FOUND;
		do
		{
			if (SystemProcessInfo->UniqueProcessId == PsGetProcessId(PEOBJCT))
			{
				Status = STATUS_SUCCESS;
				break;
			}

			SystemProcessInfo = (PSYSTEM_PROCESS_INFO)((PUCHAR)SystemProcessInfo + SystemProcessInfo->NextEntryOffset);
		} while (SystemProcessInfo->NextEntryOffset != 0);

		if (!NT_SUCCESS(Status))
		{
			ExFreePool(OriginalSystemProcessInfo);
			return Status;
		}
	}
STATRT:
	if (MmIsAddressValid(SystemProcessInfo)) {
		if (pEThread == NULL || MmIsAddressValid(pEThread) == FALSE) {
			for (ULONG Index = 0; Index < SystemProcessInfo->NumberOfThreads; ++Index)
			{

				HANDLE UniqueThreadId = SystemProcessInfo->Threads[Index].ClientId.UniqueThread;
				Status = PsLookupThreadByThreadId(UniqueThreadId, &pEThread);
				if (NT_SUCCESS(Status) && pEThread != NULL) {
					ExitApc = (PKAPC)ExAllocatePool(NonPagedPool, sizeof(KAPC));
					KeInitializeApc(ExitApc,
						(PKTHREAD)pEThread,
						OriginalApcEnvironment,
						(PKKERNEL_ROUTINE)SystemArgument2,
						NULL,
						NULL,
						KernelMode,
						NULL);
					ExitApc->NormalContext = Parameter;
					if (KeInsertQueueApc(ExitApc, ExitApc, NULL, 2)) {
						//ObDereferenceObject(pEThread);
						break;
					}
					ObDereferenceObject(pEThread);
					Status = STATUS_UNSUCCESSFUL;
				}
			}
		}
		else {
			ExitApc = (PKAPC)ExAllocatePool(NonPagedPool, sizeof(KAPC));
			KeInitializeApc(ExitApc,
				(PKTHREAD)pEThread,
				OriginalApcEnvironment,
				(PKKERNEL_ROUTINE)SystemArgument2,
				NULL,
				NULL,
				KernelMode,
				NULL);
			ExitApc->NormalContext = Parameter;
			if (KeInsertQueueApc(ExitApc, ExitApc, NULL, 2)) {
				Status = STATUS_SUCCESS;
				return Status;
			}
			goto STATRT;
		}
	}
	return Status;
}