第8章 进程和线程通知

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING)
{
    UNICODE_STRING devName = RTL_CONSTANT_STRING(L"\\Device\\Notify");
    PDEVICE_OBJECT dev;
    NTSTATUS st = IoCreateDevice(DriverObject, sizeof(CTX),
        &devName, FILE_DEVICE_UNKNOWN, 0, FALSE, &dev);
    if (!NT_SUCCESS(st)) return st;
 
    InitQueue(&((CTX*)dev->DeviceExtension)->queue);
 
    // 注册三个通知回调（逆序回滚）
    st = PsSetCreateProcessNotifyRoutineEx(OnProcessNotify, FALSE);
    if (!NT_SUCCESS(st)) { IoDeleteDevice(dev); return st; }
 
    st = PsSetCreateThreadNotifyRoutine(OnThreadNotify);
    if (!NT_SUCCESS(st)) {
        PsRemoveCreateProcessNotifyRoutine(OnProcessNotify);
        IoDeleteDevice(dev); return st;
    }
 
    st = PsSetLoadImageNotifyRoutine(OnImageNotify);
    if (!NT_SUCCESS(st)) { /* 同样逆序回滚 */ }
 
    DriverObject->DriverUnload = OnUnload;
    return STATUS_SUCCESS;
}

DriverEntry
  │
  ├─→ IoCreateDevice（用户模式的取数门）
  ├─→ InitQueue：队列 + 自旋锁 + 序号
  ├─→ PsSetCreateProcessNotifyRoutineEx(OnProcessNotify)
  ├─→ PsSetCreateThreadNotifyRoutine(OnThreadNotify)
  ├─→ PsSetLoadImageNotifyRoutine(OnImageNotify)
  │     注册失败 → 逆序回滚已注册的回调
  └─→ DriverUnload = OnUnload

VOID OnProcessNotify(PEPROCESS Process, HANDLE Pid,
    PPS_CREATE_NOTIFY_INFO CreateInfo)
{
    UNREFERENCED_PARAMETER(Process);
    CTX* ctx = GetCtx();               // 全局上下文
    EVENT_REC rec = { 0 };
 
    rec.kind = CreateInfo ? EV_PROC_CREATE : EV_PROC_EXIT;
    rec.pid = (ULONG)(ULONG_PTR)Pid;
    if (CreateInfo) {
        rec.ppid = (ULONG)(ULONG_PTR)CreateInfo->ParentProcessId;
        // 创建标志：CreateInfo->CreationStatus 非 0 表示创建失败
    }
 
    // 入队：满则丢弃并递增丢弃计数（生产者的唯一动作）
    QueuePush(&ctx->queue, &rec);
}

任何进程创建/退出
  │
  ▼
OnProcessNotify（APC_LEVEL）
  │
  ├─→ 组装 EVENT_REC（kind/pid/ppid）
  ├─→ QueuePush（自旋锁保护）
  │     ├─→ 队列有空位 → 写入，序号 +1
  │     └─→ 队列已满   → 丢弃，丢弃计数 +1
  │
  └─→ 返回（全程无等待、无分页访问）

VOID OnThreadNotify(HANDLE Pid, HANDLE Tid, BOOLEAN Create)
{
    CTX* ctx = GetCtx();
    EVENT_REC rec = { 0 };
    rec.kind = Create ? EV_THREAD_CREATE : EV_THREAD_EXIT;
    rec.pid = (ULONG)(ULONG_PTR)Pid;
    rec.tid = (ULONG)(ULONG_PTR)Tid;
    QueuePush(&ctx->queue, &rec);
}
 
VOID OnImageNotify(PUNICODE_STRING FullImageName,
    HANDLE Pid, PIMAGE_INFO ImageInfo)
{
    UNREFERENCED_PARAMETER(ImageInfo);
    CTX* ctx = GetCtx();
    EVENT_REC rec = { 0 };
    rec.kind = EV_IMAGE_LOAD;
    rec.pid = (ULONG)(ULONG_PTR)Pid;
 
    if (FullImageName && FullImageName->Length < MAX_PATH * 2) {
        // 路径复制到非分页记录缓冲（回调里不能访问分页内存）
        RtlCopyMemory(rec.imagePath,
            FullImageName->Buffer, FullImageName->Length);
        rec.imageLen = FullImageName->Length;
    }
    QueuePush(&ctx->queue, &rec);
}

线程创建/退出（高频！）
  │ → OnThreadNotify：pid/tid 一条，入队
  │
进程加载 EXE/DLL
  │ → OnImageNotify：路径 + 基址 + pid
  │     · 路径复制进非分页记录缓冲
  │     · 入队（满则丢弃计数）
  │
共同点：回调极短，全部动作 = 组装 + 入队

NTSTATUS GetEvents(PIRP Irp, PIO_STACK_LOCATION stack)
{
    CTX* ctx = GetCtx();
    ULONG outLen = stack->Parameters.DeviceIoControl.OutputBufferLength;
    auto* out = (GET_EVENTS_OUT*)Irp->SystemBuffer;
    if (outLen < sizeof(GET_EVENTS_OUT)) {
        Irp->IoStatus.Status = STATUS_BUFFER_TOO_SMALL;
        Irp->IoStatus.Information = 0;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return STATUS_BUFFER_TOO_SMALL;
    }
 
    ULONG n = QueueDrain(&ctx->queue, out->records,
        (outLen - sizeof(ULONG)) / sizeof(EVENT_REC));
    out->dropped = ctx->queue.dropped;  // 丢弃计数随响应返回
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information =
        sizeof(ULONG) + n * sizeof(EVENT_REC);
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

VOID OnUnload(PDRIVER_OBJECT DriverObject)
{
    // 1. 先注销：内核保证不再调用回调
    PsRemoveCreateProcessNotifyRoutine(OnProcessNotify);
    PsRemoveCreateThreadNotifyRoutine(OnThreadNotify);
    PsRemoveLoadImageNotifyRoutine(OnImageNotify);
 
    // 2. 再排空队列、释放资源、删设备
    QueueFree(&GetCtx()->queue);
    IoDeleteDevice(DriverObject->DeviceObject);
}

// 轮询取事件（或等"有新事件"信号再取）
for (;;) {
    GET_EVENTS_OUT out = { 0 };
    DWORD returned = 0;
    DeviceIoControl(h, IOCTL_GET_EVENTS,
        nullptr, 0, &out, sizeof(out), &returned, nullptr);
 
    if (out.dropped > lastDropped) {
        // 丢弃计数变了 → 中间丢了 (out.dropped - lastDropped) 条
        printf("丢失 %u 条事件\n", out.dropped - lastDropped);
    }
    lastDropped = out.dropped;
    for (ULONG i = 0; i < returned / sizeof(EVENT_REC); i++) {
        // 处理 out.records[i]（kind/pid/tid/路径）
    }
    Sleep(100);
}