进程创建过程分析NtCreateProcess-NtCreateProcessEx-PspCreateProcess

「爱情、让人受尽委屈。」 2022-05-14 12:43 305阅读 0赞

转载自：[http://www.blogfshare.com/createprocess-analyse.html][http_www.blogfshare.com_createprocess-analyse.html]

在内核中，windows创建一个进程的过程是从NtCreateProcess函数开始的。找到这个函数，发现它只是简单地对参数稍作处理，然后把创建进程的任务交给NtCreateProcessEx函数。

NTSTATUS  
NtCreateProcess(  
    \_\_out PHANDLE ProcessHandle,  
    \_\_in ACCESS\_MASK DesiredAccess,  
    \_\_in\_opt POBJECT\_ATTRIBUTES ObjectAttributes,  
    \_\_in HANDLE ParentProcess,  
    \_\_in BOOLEAN InheritObjectTable,  
    \_\_in\_opt HANDLE SectionHandle,  
    \_\_in\_opt HANDLE DebugPort,  
    \_\_in\_opt HANDLE ExceptionPort  
    )  
\{  
    ULONG Flags = 0;

if ((ULONG\_PTR)SectionHandle & 1) \{  
        Flags |= PROCESS\_CREATE\_FLAGS\_BREAKAWAY;  
    \}

if ((ULONG\_PTR) DebugPort & 1) \{  
        Flags |= PROCESS\_CREATE\_FLAGS\_NO\_DEBUG\_INHERIT;  
    \}

if (InheritObjectTable) \{  
        Flags |= PROCESS\_CREATE\_FLAGS\_INHERIT\_HANDLES;  
    \}

return NtCreateProcessEx (ProcessHandle,  
                              DesiredAccess,  
                              ObjectAttributes OPTIONAL,  
                              ParentProcess,  
                              Flags,  
                              SectionHandle,  
                              DebugPort,  
                              ExceptionPort,  
                              0);  
\}

所以我们来看NtCreateProcessEx函数的流程。它也只是简单地检查ProcessHandle参数代表的句柄是否可写，ParentProcess是否不为空，这是个必需的参数，不能为NULL，并且调用者必须对该进程具有PROCESS\_CREATE\_PROCESS访问权限。真正的创建工作交给PspCreateProcess函数。

NtCreateProcessEx(  
    \_\_out PHANDLE ProcessHandle,  
    \_\_in ACCESS\_MASK DesiredAccess,  
    \_\_in\_opt POBJECT\_ATTRIBUTES ObjectAttributes,  
    \_\_in HANDLE ParentProcess,  
    \_\_in ULONG Flags,  
    \_\_in\_opt HANDLE SectionHandle,  
    \_\_in\_opt HANDLE DebugPort,  
    \_\_in\_opt HANDLE ExceptionPort,  
    \_\_in ULONG JobMemberLevel  
    )

\{  
    NTSTATUS Status;

PAGED\_CODE();

if (KeGetPreviousMode() != KernelMode) \{

try \{  
            ProbeForWriteHandle (ProcessHandle);  
        \} except (EXCEPTION\_EXECUTE\_HANDLER) \{  
            return GetExceptionCode ();  
        \}  
    \}

if (ARGUMENT\_PRESENT (ParentProcess)) \{  
        Status = PspCreateProcess (ProcessHandle,  
                                   DesiredAccess,  
                                   ObjectAttributes,  
                                   ParentProcess,  
                                   Flags,  
                                   SectionHandle,  
                                   DebugPort,  
                                   ExceptionPort,  
                                   JobMemberLevel);  
    \} else \{  
        Status = STATUS\_INVALID\_PARAMETER;  
    \}

return Status;  
\}

下面来看看PspCreateProcess 的执行流程。

**1.**   if (ARGUMENT\_PRESENT (ParentProcess)) \{

//如果ParentProcess不为空，则通过ObReferenceObjectByHandle 获得父进程对象的EPROCESS指针，放在局部变量Parent。  
       Status = ObReferenceObjectByHandle (ParentProcess,  
                                           PROCESS\_CREATE\_PROCESS,  
                                           PsProcessType,  
                                           PreviousMode,  
                                           &Parent,  
                                           NULL);  
       if (!NT\_SUCCESS (Status)) \{  
           return Status;  
       \}

if (JobMemberLevel != 0 && Parent->Job == NULL) \{  
           ObDereferenceObject (Parent);  
           return STATUS\_INVALID\_PARAMETER;  
       \}

//获得父进程Affinity设置。

Affinity = Parent->Pcb.Affinity;

新进程的工作集最大/最小值被初始化为全局变量。  
       WorkingSetMinimum = PsMinimumWorkingSet;  
       WorkingSetMaximum = PsMaximumWorkingSet;

\} else \{

Parent = NULL;

//Affinity设置为全局变量KeActiveProcessors，系统中当前的可用处理器。  
       Affinity = KeActiveProcessors;  
       WorkingSetMinimum = PsMinimumWorkingSet;  
       WorkingSetMaximum = PsMaximumWorkingSet;  
   \}

**2.调用ObCreateObject 创建一个类型为PsProcessType的内核对象，置于局部变量Process中，对象体为EPROCESS**

Status = ObCreateObject (PreviousMode,  
                            PsProcessType,  
                            ObjectAttributes,  
                            PreviousMode,  
                            NULL,  
                            sizeof (EPROCESS),  
                            0,  
                            0,  
                            &Process);

if (!NT\_SUCCESS (Status)) \{  
       goto exit\_and\_deref\_parent;  
   \}

**3.把Process置0，并初始化部分成员。**

RtlZeroMemory (Process, sizeof(EPROCESS));

//初始化进程的引用计数  
    ExInitializeRundownProtection (&Process->RundownProtect);

//初始化进程锁  
    PspInitializeProcessLock (Process);

//初始化进程的线程链表  
    InitializeListHead (&Process->ThreadListHead);

\#if defined(\_WIN64)

if (Flags & PROCESS\_CREATE\_FLAGS\_OVERRIDE\_ADDRESS\_SPACE) \{  
        PS\_SET\_BITS (&Process->Flags, PS\_PROCESS\_FLAGS\_OVERRIDE\_ADDRESS\_SPACE);  
    \}

\#endif

//继承资源配额

PspInheritQuota (Process, Parent);

//继承父进程的设备位图  
    ObInheritDeviceMap (Process, Parent);  
    if (Parent != NULL) \{

//继承父进程  
        Process->DefaultHardErrorProcessing = Parent->DefaultHardErrorProcessing;

//保存父进程PID  
        Process->InheritedFromUniqueProcessId = Parent->UniqueProcessId;

\} else \{  
        Process->DefaultHardErrorProcessing = PROCESS\_HARDERROR\_DEFAULT;  
        Process->InheritedFromUniqueProcessId = NULL;  
    \}

**4.判断SectionHandle是否为空**

if (ARGUMENT\_PRESENT (SectionHandle)) \{

//不为空，ObReferenceObjectByHandle 获取内存区对象的指针  
    Status = ObReferenceObjectByHandle (SectionHandle,  
                                        SECTION\_MAP\_EXECUTE,  
                                        MmSectionObjectType,  
                                        PreviousMode,  
                                        &SectionObject,  
                                        NULL);  
    if (!NT\_SUCCESS (Status)) \{  
        goto exit\_and\_deref;  
    \}

\} else \{  
    SectionObject = NULL;

//父进程不为系统进程  
    if (Parent != PsInitialSystemProcess) \{

//acquire run-down protection on a shared object so the caller can safely access the object

if (ExAcquireRundownProtection (&Parent->RundownProtect)) \{

//继承自父进程  
            SectionObject = Parent->SectionObject;  
            if (SectionObject != NULL) \{  
                ObReferenceObject (SectionObject);  
            \}

//减少引用计数

ExReleaseRundownProtection (&Parent->RundownProtect);  
        \}

if (SectionObject == NULL) \{  
            Status = STATUS\_PROCESS\_IS\_TERMINATING;  
            goto exit\_and\_deref;  
        \}  
    \}  
\}

Process->SectionObject = SectionObject;

新进程对象的内存区对象已经完成初始化。

**5.初始化DebugPort参数。**

if (ARGUMENT\_PRESENT (DebugPort)) \{  
        Status = ObReferenceObjectByHandle (DebugPort,  
                                            DEBUG\_PROCESS\_ASSIGN,  
                                            DbgkDebugObjectType,  
                                            PreviousMode,  
                                            &DebugPortObject,  
                                            NULL);

if (!NT\_SUCCESS (Status)) \{  
            goto exit\_and\_deref;  
        \}

Process->DebugPort = DebugPortObject;  
        if (Flags&PROCESS\_CREATE\_FLAGS\_NO\_DEBUG\_INHERIT) \{  
            PS\_SET\_BITS (&Process->Flags, PS\_PROCESS\_FLAGS\_NO\_DEBUG\_INHERIT);  
        \}

\} else \{  
        if (Parent != NULL) \{  
            DbgkCopyProcessDebugPort (Process, Parent);  
        \}  
    \}

**6.初始化ExceptionPort参数。**

if (ARGUMENT\_PRESENT (ExceptionPort)) \{  
        Status = ObReferenceObjectByHandle (ExceptionPort,  
                                            0,  
                                            LpcPortObjectType,  
                                            PreviousMode,  
                                            &ExceptionPortObject,  
                                            NULL);

if (!NT\_SUCCESS (Status)) \{  
            goto exit\_and\_deref;  
        \}

Process->ExceptionPort = ExceptionPortObject;  
    \}

Process->ExitStatus = STATUS\_PENDING;

**7.创建地址空间。**

if (Parent != NULL) \{  
    //创建一个全新的地址空间

if (!MmCreateProcessAddressSpace (WorkingSetMinimum,  
                                      Process,  
                                      &DirectoryTableBase\[0\])) \{

Status = STATUS\_INSUFFICIENT\_RESOURCES;  
        goto exit\_and\_deref;  
    \}

\} else \{

//否则新进程句柄表指向当前进程句柄表  
    Process->ObjectTable = CurrentProcess->ObjectTable;  
    //利用空闲线程的地址空间来初始化新进程的地址空间

Status = MmInitializeHandBuiltProcess (Process, &DirectoryTableBase\[0\]);  
    if (!NT\_SUCCESS (Status)) \{  
        goto exit\_and\_deref;  
    \}  
\}

PS\_SET\_BITS (&Process->Flags, PS\_PROCESS\_FLAGS\_HAS\_ADDRESS\_SPACE);  
Process->Vm.MaximumWorkingSetSize = WorkingSetMaximum;

**8.初始化新进程对象的基本优先级、Affinity、进程页表目录和超空间的页帧号。**

KeInitializeProcess (&Process->Pcb,  
                        NORMAL\_BASE\_PRIORITY,  
                        Affinity,  
                        &DirectoryTableBase\[0\],  
                        (BOOLEAN)(Process->DefaultHardErrorProcessing & PROCESS\_HARDERROR\_ALIGNMENT\_BIT));

**9.初始化新进程的安全属性。**

Status = PspInitializeProcessSecurity (Parent, Process);  
   if (!NT\_SUCCESS (Status)) \{  
       goto exit\_and\_deref;  
   \}

**10.设置新进程优先级。**

Process->PriorityClass = PROCESS\_PRIORITY\_CLASS\_NORMAL;  
   if (Parent != NULL) \{  
       if (Parent->PriorityClass == PROCESS\_PRIORITY\_CLASS\_IDLE ||  
           Parent->PriorityClass == PROCESS\_PRIORITY\_CLASS\_BELOW\_NORMAL) \{

//拷贝父进程的优先级  
           Process->PriorityClass = Parent->PriorityClass;  
       \}  
       //如果参数中包含了句柄继承标志，则把父进程句柄表中凡是具有继承属性的对象拷贝到新进程句柄表中。

Status = ObInitProcess ((Flags&PROCESS\_CREATE\_FLAGS\_INHERIT\_HANDLES) ? Parent : NULL,  
                               Process);

if (!NT\_SUCCESS (Status)) \{  
           goto exit\_and\_deref;  
       \}

\} else \{  
       Status = MmInitializeHandBuiltProcess2 (Process);  
       if (!NT\_SUCCESS (Status)) \{  
           goto exit\_and\_deref;  
       \}  
   \}

Status = STATUS\_SUCCESS;  
   SavedStatus = STATUS\_SUCCESS;

**11.初始化新进程的地址空间**

if (SectionHandle != NULL) \{

//新进程有新的可执行映像内存区对象，根据指定的内存区对象来初始化进程地址空间。

Status = MmInitializeProcessAddressSpace (Process,  
                                                 NULL,  
                                                 SectionObject,  
                                                 &Flags,  
                                                 &(Process->SeAuditProcessCreationInfo.ImageFileName));

if (!NT\_SUCCESS (Status)) \{  
           goto exit\_and\_deref;  
       \}

SavedStatus = Status;  
       CreatePeb = TRUE;  
       UseLargePages = ((Flags & PROCESS\_CREATE\_FLAGS\_LARGE\_PAGES) != 0 ? TRUE : FALSE);

\} else if (Parent != NULL) \{  
       if (Parent != PsInitialSystemProcess) \{

//根据父进程来初始化进程地址空间，并把父进程的映像名称拷贝到新进程对象的数据结构中。  
           Process->SectionBaseAddress = Parent->SectionBaseAddress;

Status = MmInitializeProcessAddressSpace (Process,  
                                                     Parent,  
                                                     NULL,  
                                                     &Flags,  
                                                     NULL);

if (!NT\_SUCCESS (Status)) \{  
               goto exit\_and\_deref;  
           \}

CreatePeb = TRUE;  
           UseLargePages = ((Flags & PROCESS\_CREATE\_FLAGS\_LARGE\_PAGES) != 0 ? TRUE : FALSE);

if (Parent->SeAuditProcessCreationInfo.ImageFileName != NULL) \{  
               ImageFileNameSize = sizeof(OBJECT\_NAME\_INFORMATION) +  
                                   Parent->SeAuditProcessCreationInfo.ImageFileName->Name.MaximumLength;

Process->SeAuditProcessCreationInfo.ImageFileName =  
                   ExAllocatePoolWithTag (PagedPool,  
                                          ImageFileNameSize,  
                                          ‘aPeS’);

if (Process->SeAuditProcessCreationInfo.ImageFileName != NULL) \{  
                   RtlCopyMemory (Process->SeAuditProcessCreationInfo.ImageFileName,  
                                  Parent->SeAuditProcessCreationInfo.ImageFileName,  
                                  ImageFileNameSize);

Process->SeAuditProcessCreationInfo.ImageFileName->Name.Buffer =  
                       (PUSHORT)(((PUCHAR) Process->SeAuditProcessCreationInfo.ImageFileName) +  
                       sizeof(UNICODE\_STRING));

\} else \{  
                   Status = STATUS\_INSUFFICIENT\_RESOURCES;  
                   goto exit\_and\_deref;  
               \}  
           \}

\} else \{

//系统进程，不指定内存区和父进程，直接初始化，同样拷贝父进程的映像名称到新进程对象的数据结构中。

Flags &= ~PROCESS\_CREATE\_FLAGS\_ALL\_LARGE\_PAGE\_FLAGS;  
           Status = MmInitializeProcessAddressSpace (Process,  
                                                     NULL,  
                                                     NULL,  
                                                     &Flags,  
                                                     NULL);

if (!NT\_SUCCESS (Status)) \{  
               goto exit\_and\_deref;  
           \}

Process->SeAuditProcessCreationInfo.ImageFileName =  
               ExAllocatePoolWithTag (PagedPool,  
                                      sizeof(OBJECT\_NAME\_INFORMATION),  
                                      ‘aPeS’);

if (Process->SeAuditProcessCreationInfo.ImageFileName != NULL) \{  
               RtlZeroMemory (Process->SeAuditProcessCreationInfo.ImageFileName,  
                              sizeof(OBJECT\_NAME\_INFORMATION));  
           \} else \{  
               Status = STATUS\_INSUFFICIENT\_RESOURCES;  
               goto exit\_and\_deref;  
           \}  
       \}  
   \}

还有第四种可能性，即没有指定映像内存区对象，也没有指定父进程。这对应于系统的引导进程（后蜕化成空闲进程），它的地址空间是在MmInitSystem执行过程中初始化的，由MiInitMachineDependent函数调用MmInitializeProcessAddressSpace来完成。

**12.创建进程ID。利用ExCreateHandle函数在CID句柄表中创建一个进程ID项。**

CidEntry.Object = Process;  
   CidEntry.GrantedAccess = 0;  
   Process->UniqueProcessId = ExCreateHandle (PspCidTable, &CidEntry);  
   if (Process->UniqueProcessId == NULL) \{  
       Status = STATUS\_INSUFFICIENT\_RESOURCES;  
       goto exit\_and\_deref;  
   \}

ExSetHandleTableOwner (Process->ObjectTable, Process->UniqueProcessId);

**13.审计创建行为**

if (SeDetailedAuditingWithToken (NULL)) \{  
       SeAuditProcessCreation (Process);  
   \}

**14.如果父进程属于一个作业对象，则也加入到父进程所在的作业中。**

if (Parent) \{  
        Job = Parent->Job;  
        if (Job != NULL && !(Job->LimitFlags & JOB\_OBJECT\_LIMIT\_SILENT\_BREAKAWAY\_OK)) \{  
            if (Flags&PROCESS\_CREATE\_FLAGS\_BREAKAWAY) \{  
                if (!(Job->LimitFlags & JOB\_OBJECT\_LIMIT\_BREAKAWAY\_OK)) \{  
                    Status = STATUS\_ACCESS\_DENIED;

\} else \{  
                    Status = STATUS\_SUCCESS;  
                \}

\} else \{  
                Status = PspGetJobFromSet (Job, JobMemberLevel, &Process->Job);  
                if (NT\_SUCCESS (Status)) \{  
                    PACCESS\_TOKEN Token, NewToken;  
                    Job = Process->Job;  
                    Status = PspAddProcessToJob (Job, Process);

Token = Job->Token;  
                    if (Token != NULL) \{  
                        Status = SeSubProcessToken (Token,  
                                                    &NewToken,  
                                                    FALSE,  
                                                    Job->SessionId);

if (!NT\_SUCCESS (Status)) \{  
                            goto exit\_and\_deref;  
                        \}

SeAssignPrimaryToken (Process, NewToken);      
                        ObDereferenceObject (NewToken);                      
                    \}  
                \}  
            \}

if (!NT\_SUCCESS (Status)) \{  
                goto exit\_and\_deref;  
            \}  
        \}  
    \}

**15.对于通过映像内存区来创建进程的情形，创建一个PEB，对于进程拷贝的情况，则使用继承的PEB。**

if (Parent && CreatePeb) \{

RtlZeroMemory (&InitialPeb, FIELD\_OFFSET(INITIAL\_PEB, Mutant));

InitialPeb.Mutant = (HANDLE)(-1);  
        InitialPeb.ImageUsesLargePages = (BOOLEAN) UseLargePages;  
              
        if (SectionHandle != NULL) \{  
            Status = MmCreatePeb (Process, &InitialPeb, &Process->Peb);  
            if (!NT\_SUCCESS (Status)) \{  
                Process->Peb = NULL;  
                goto exit\_and\_deref;  
            \}

Peb =  Process->Peb;

\} else \{  
            SIZE\_T BytesCopied;

InitialPeb.InheritedAddressSpace = TRUE;  
            Process->Peb = Parent->Peb;  
            MmCopyVirtualMemory (CurrentProcess,  
                                 &InitialPeb,  
                                 Process,  
                                 Process->Peb,  
                                 sizeof (INITIAL\_PEB),  
                                 KernelMode,  
                                 &BytesCopied);

\#if defined(\_WIN64)  
            if (Process->Wow64Process != NULL) \{  
                  
                RtlZeroMemory (&InitialPeb32, FIELD\_OFFSET(INITIAL\_PEB32, Mutant));  
                InitialPeb32.Mutant = -1;  
                InitialPeb32.InheritedAddressSpace = TRUE;  
                InitialPeb32.ImageUsesLargePages = (BOOLEAN) UseLargePages;

MmCopyVirtualMemory (CurrentProcess,  
                                     &InitialPeb32,  
                                     Process,  
                                     Process->Wow64Process->Wow64,  
                                     sizeof (INITIAL\_PEB32),  
                                     KernelMode,  
                                     &BytesCopied);  
            \}  
\#endif

\}  
    \}

Peb = Process->Peb;

**16.把新进程加入全局的进程链表中。PsActiveProcessHead**

PspLockProcessList (CurrentThread);  
   InsertTailList (&PsActiveProcessHead, &Process->ActiveProcessLinks);  
   PspUnlockProcessList (CurrentThread);  
   AccessState = NULL;  
   if (!PsUseImpersonationToken) \{  
       AccessState = &LocalAccessState;  
       Status = SeCreateAccessStateEx (NULL,  
                                       (Parent == NULL || Parent != PsInitialSystemProcess)?  
                                          PsGetCurrentProcessByThread (CurrentThread) :  
                                          PsInitialSystemProcess,  
                                       AccessState,  
                                       &AuxData,  
                                       DesiredAccess,  
                                       &PsProcessType->TypeInfo.GenericMapping);  
       if (!NT\_SUCCESS (Status)) \{  
           goto exit\_and\_deref;  
       \}  
   \}

**17.把新进程对象插入到当前进程的句柄表中。**

Status = ObInsertObject (Process,  
                             AccessState,  
                             DesiredAccess,  
                             1,     // bias the refcnt by one for future process manipulations  
                             NULL,  
                             &LocalProcessHandle);

if (AccessState != NULL) \{  
        SeDeleteAccessState (AccessState);  
    \}

if (!NT\_SUCCESS (Status)) \{  
        goto exit\_and\_deref\_parent;  
    \}

**18.计算新进程的优先级和时限重置值，设置内存优先级。**

ASSERT(IsListEmpty(&Process->ThreadListHead) == TRUE);

BasePriority = PspComputeQuantumAndPriority(Process,  
                                               PsProcessPriorityBackground,  
                                               &QuantumReset);

Process->Pcb.BasePriority = (SCHAR)BasePriority;  
   Process->Pcb.QuantumReset = QuantumReset;

**19。设置进程的访问权限，GrantedAccess。由于新进程已经被加入到句柄表中，所以它现在能够被终止了（PROCESS\_TERMINATE）。有父进程，但不是PsInitialialSystemProcess，首先执行访问检查，然后计算进程的访问权限。如果是PsInitialialSystemProcess的子进程，则授予所有的访问权限。**

Process->GrantedAccess = PROCESS\_TERMINATE;  
   if (Parent && Parent != PsInitialSystemProcess) \{  
       Status = ObGetObjectSecurity (Process,  
                                     &SecurityDescriptor,  
                                     &MemoryAllocated);

if (!NT\_SUCCESS (Status)) \{  
           ObCloseHandle (LocalProcessHandle, PreviousMode);  
           goto exit\_and\_deref;

SubjectContext.ProcessAuditId = Process;  
       SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process);  
       SubjectContext.ClientToken = NULL;  
       AccessCheck = SeAccessCheck (SecurityDescriptor,  
                                    &SubjectContext,  
                                    FALSE,  
                                    MAXIMUM\_ALLOWED,  
                                    0,  
                                    NULL,  
                                    &PsProcessType->TypeInfo.GenericMapping,  
                                    PreviousMode,  
                                    &Process->GrantedAccess,  
                                    &accesst);

PsDereferencePrimaryTokenEx (Process, SubjectContext.PrimaryToken);  
       ObReleaseObjectSecurity (SecurityDescriptor,  
                                MemoryAllocated);

if (!AccessCheck) \{  
           Process->GrantedAccess = 0;  
       \}

\} else \{  
       Process->GrantedAccess = PROCESS\_ALL\_ACCESS;  
   \}

20.设置进程的创建时间，把新进程的句柄赋到ProcessHandle中。

KeQuerySystemTime (&Process->CreateTime);  
    try \{  
        if (Peb != NULL && CurrentThread->Tcb.Teb != NULL) \{  
            ((PTEB)(CurrentThread->Tcb.Teb))->NtTib.ArbitraryUserPointer = Peb;  
        \}

\*ProcessHandle = LocalProcessHandle;

\} except (EXCEPTION\_EXECUTE\_HANDLER) \{  
        NOTHING;  
    \}

if (SavedStatus != STATUS\_SUCCESS) \{  
        Status = SavedStatus;  
    \}

exit\_and\_deref:  
    ObDereferenceObject (Process);

exit\_and\_deref\_parent:  
    if (Parent != NULL) \{  
        ObDereferenceObject (Parent);  
    \}

return Status;

新建的进程中，没有任何线程对象，所有还是一个死的进程空间，其中的代码没有真正的运行起来。直到第一个线程被创建！

[http_www.blogfshare.com_createprocess-analyse.html]: http://www.blogfshare.com/createprocess-analyse.html