{"id":454,"date":"2010-05-17T01:46:52","date_gmt":"2010-05-17T01:46:52","guid":{"rendered":"https:\/\/driverentry.com.br\/en\/2010\/05\/17\/preventing-process-execution\/"},"modified":"2026-07-31T04:50:40","modified_gmt":"2026-07-31T04:50:40","slug":"preventing-process-execution","status":"publish","type":"post","link":"https:\/\/driverentry.com.br\/en\/2010\/05\/17\/preventing-process-execution\/","title":{"rendered":"Preventing Process Execution"},"content":{"rendered":"
\"\"<\/a><\/div>\n

\"\"During that long period when I was away from new posts on the blog, some things happened that deserved a little place here on my list of posts to write. One of them<\/a> was the long discussion that took place on the C\/C++ group<\/a> list. It was about the steps to follow to write a driver that would do a bit of everything regarding security services. One of the items especially discussed was the idea of writing a driver that could prevent a certain process from being executed. Let me say right away that I am not going to get into whether this solves a security problem or not. I am not here to discuss that and, to be quite honest, I do not even want to. In this post I will demonstrate, in a very simple way, how we can prevent the execution of a process.<\/p>\n

Tracking the lifetime of Processes<\/h3>\n

Before going around putting both feet on a process’s chest to make it fall, let’s first just see how to monitor its lifetime. This is easily done by calling the PsSetCreateProcessNotifyRoutine()<\/a> routine, which has been available since back when the rainbow was black and white. Although the documentation says it has been available since Windows 2000, I already know this routine from other carnivals and I know it has been around at least since the late Windows NT 3.51. Wow, I am getting old. But back to the subject, this routine registers a callback function that notifies our driver about the start and the end of processes in the system. This is especially useful if a certain driver wants to keep information related to processes; thus, knowing when a process has ended is essential to free the resources used by such information.<\/p>\n

\n
NTSTATUS PsSetCreateProcessNotifyRoutine(<\/pre>\n
  __in  PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine,<\/pre>\n
  __in  BOOLEAN Remove<\/pre>\n
);<\/pre>\n<\/div>\n
The callback function registered by this routine has the signature shown below:<\/p>\n
\n
VOID<\/pre>\n
(*PCREATE_PROCESS_NOTIFY_ROUTINE) (<\/pre>\n
    IN HANDLE  ParentId,<\/pre>\n
    IN HANDLE  ProcessId,<\/pre>\n
    IN BOOLEAN  Create<\/pre>\n
    );<\/pre>\n<\/div>\n
Pretty simple, isn’t it? The first parameter is the ProcessId<\/em> of the parent process in this creation. This means that, for example, if you start Notepad from “Run…”<\/em> in the Windows Start menu, we will have Explorer.exe<\/em> as the parent process of the new Notepad.exe<\/em> process. The second parameter is the ProcessId<\/em> of the process being started or ended at the time of the call. Last but not least, we have the flag that will indicate whether this is a start or an end notification for a process.<\/p>\n
One important thing to note here is about the parent process’s ProcessId<\/em>. This parameter is reliable in process-start notifications, but not so much when it comes to termination. This happens because when a process is being started, its parent process is still there, safe and sound, but when a process ends, even though the ParentId<\/em> carries the same value as the process-start notification, that data is no longer valid. Let me give an example to make it easier.<\/p>\n
    \n
  1. Process1(32) creates Process2(57), we receive the call: CreateProcessNotifyRoutine(32, 57, TRUE);<\/li>\n
  2. Process1(32) ends.<\/li>\n
  3. Process3(32) is created and gets an Id equal to 32.<\/li>\n
  4. Process2(57) ends and we receive the call: CreateProcessNotifyRoutine(32, 57, FALSE);<\/li>\n<\/ol>\n
    In the termination notification for Process2 that occurred in step 4, the process whose Id is 32 is now Process3, which, by the way, is not really the parent process of Process2. So when you gather information about a process, do it during its initialization, keep this data in a list and then remove it when the process ends.<\/p>\n
    Registering the callback function is very simple, but what really matters is removing this registration when the driver is unloaded. Can you imagine what would happen if one of these notifications were delivered to a driver that is no longer in memory? Well, I can.<\/p>\n
    Getting the path of a process image<\/h3>\n
    It is likely that you want to obtain more information about the processes involved in these notifications; one such piece of information is the path of the file being executed. You can obtain this information using the Id of the processes we receive in the new-process notification. To do this, we will have to use the almost-documented ZwQueryInformationProcess()<\/a> routine. This is a native API that has existed forever but was never officially documented. To use it, just declare its signature as shown below.<\/p>\n
    \n
    NTSTATUS<\/pre>\n
    ZwQueryInformationProcess(IN HANDLE ProcessHandle,<\/pre>\n
                              IN PROCESSINFOCLASS ProcessInformationClass,<\/pre>\n
                              OUT PVOID ProcessInformation,<\/pre>\n
                              IN ULONG ProcessInformationLength,<\/pre>\n
                              OUT PULONG ReturnLength OPTIONAL);<\/pre>\n<\/div>\n
    If you want to know more about undocumented native APIs, this link<\/a> is a huge help, but nothing beats this book<\/a>.<\/p>\n
    The code below uses this API to obtain a process’s image from its Pid. Notice that ZwQueryInformationProcess()<\/em> asks for a handle to the process you want to obtain information about. To obtain that handle we will first need to obtain the EPROCESS<\/strong> structure that represents a process in Kernel-Mode. We will do this using the PsLookupProcessByProcessId()<\/a> function, which will return a pointer to that structure.<\/p>\n
    \n
    NTSTATUS PsLookupProcessByProcessId(<\/pre>\n
      __in   HANDLE ProcessId,<\/pre>\n
      __out  PEPROCESS *Process<\/pre>\n
    );<\/pre>\n<\/div>\n
    Although opaque, this structure will allow us to obtain the handle to the process it represents, now using the ObOpenObjectByPointer()<\/a> function of the Object Manager<\/strong>.<\/p>\n
    \n
    NTSTATUS ObOpenObjectByPointer(<\/pre>\n
      __in      PVOID Object,<\/pre>\n
      __in      ULONG HandleAttributes,<\/pre>\n
      __in_opt  PACCESS_STATE PassedAccessState,<\/pre>\n
      __in      ACCESS_MASK DesiredAccess,<\/pre>\n
      __in_opt  POBJECT_TYPE ObjectType,<\/pre>\n
      __in      KPROCESSOR_MODE AccessMode,<\/pre>\n
      __out     PHANDLE Handle<\/pre>\n
    );<\/pre>\n<\/div>\n
    I think everything will be easier to understand with the source below. After all, a line of code is worth more than a thousand words. The following function obtains the EPROCESS structure of a process, then obtains the handle to it, and with that handle obtains the information we want from the process. OK, OK, OK… Here is the source, but don’t forget to read the comments.<\/p>\n
    \n
    \/****<\/span><\/pre>\n
    ***     GetProcessImageName<\/span><\/pre>\n
    **<\/span><\/pre>\n
    **      Returns a PUNICODE_STRING containing the path<\/span><\/pre>\n
    **      of the image used by the process whose Pid was<\/span><\/pre>\n
    **      provided as a parameter.<\/span><\/pre>\n
    *\/<\/span><\/pre>\n
    NTSTATUS<\/pre>\n
    GetProcessImageName(HANDLE           hProcessId,<\/pre>\n
                        PUNICODE_STRING* ppusImageName)<\/pre>\n
    {<\/pre>\n
        NTSTATUS        nts;<\/pre>\n
        PUNICODE_STRING pusImageName = NULL;<\/pre>\n
        ULONG           ulSize;<\/pre>\n
        HANDLE          hProcess;<\/pre>\n
        PEPROCESS       pEProcess;<\/pre>\n
     <\/pre>\n
        \/\/-f--> First of all, zero out the output variable.<\/span><\/pre>\n
        *ppusImageName = NULL;<\/pre>\n
     <\/pre>\n
        \/\/-f--> Here we obtain the structure that represents a process<\/span><\/pre>\n
        \/\/     (EPROCESS) from its Pid;<\/span><\/pre>\n
        nts = PsLookupProcessByProcessId(hProcessId,<\/pre>\n
                                         &pEProcess);<\/pre>\n
        if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
            return<\/span> nts;<\/pre>\n
     <\/pre>\n
        \/\/-f--> Now we obtain a handle to this object.<\/span><\/pre>\n
        nts = ObOpenObjectByPointer(pEProcess,<\/pre>\n
                                    OBJ_KERNEL_HANDLE,<\/pre>\n
                                    NULL,<\/pre>\n
                                    0<\/span>,<\/pre>\n
                                    *PsProcessType,<\/pre>\n
                                    KernelMode,<\/pre>\n
                                    &hProcess);<\/pre>\n
     <\/pre>\n
        \/\/-f--> Whether or not the handle was obtained,<\/span><\/pre>\n
        \/\/      we will have to release the reference we obtained<\/span><\/pre>\n
        \/\/      to the EPROCESS.<\/span><\/pre>\n
        ObDereferenceObject(pEProcess);<\/pre>\n
        if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
            return<\/span> nts;<\/pre>\n
     <\/pre>\n
        \/\/-f--> Now that we have the handle to the process, we can<\/span><\/pre>\n
        \/\/      obtain information about it; in this case,<\/span><\/pre>\n
        \/\/      we will obtain the path of the process image.<\/span><\/pre>\n
        nts = ZwQueryInformationProcess(hProcess,<\/pre>\n
                                        ProcessImageFileName,<\/pre>\n
                                        NULL,<\/pre>\n
                                        0<\/span>,<\/pre>\n
                                        &ulSize);<\/pre>\n
     <\/pre>\n
        \/\/-f--> To get the right size, we pass zero on the first<\/span><\/pre>\n
        \/\/      attempt; this will return an error and the number<\/span><\/pre>\n
        \/\/      of bytes needed to obtain this information.<\/span><\/pre>\n
        if<\/span> (nts != STATUS_INFO_LENGTH_MISMATCH)<\/pre>\n
            return<\/span> nts;<\/pre>\n
     <\/pre>\n
        \/\/-f--> The returned size includes the size of the UNICODE_STRING structure,<\/span><\/pre>\n
        \/\/      so everything is allocated at once.<\/span><\/pre>\n
        pusImageName = (PUNICODE_STRING) ExAllocatePoolWithTag(PagedPool,<\/pre>\n
                                                               ulSize,<\/pre>\n
                                                               TRACER_TAG);<\/pre>\n
        \/\/-f--> Oops! Close Photoshop and try again.<\/span><\/pre>\n
        if<\/span> (!pusImageName)<\/pre>\n
            return<\/span> STATUS_INSUFFICIENT_RESOURCES;<\/pre>\n
     <\/pre>\n
        \/\/-f--> Now we offer the buffer allocated with the right size.<\/span><\/pre>\n
        \/\/      What could go wrong? (EVERYTHING!)<\/span><\/pre>\n
        nts = ZwQueryInformationProcess(hProcess,<\/pre>\n
                                        ProcessImageFileName,<\/pre>\n
                                        pusImageName,<\/pre>\n
                                        ulSize,<\/pre>\n
                                        &ulSize);<\/pre>\n
        if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
        {<\/pre>\n
            \/\/-f--> Oops! Something went wrong.<\/span><\/pre>\n
            ExFreePoolWithTag(pusImageName,<\/pre>\n
                              TRACER_TAG);<\/pre>\n
        }<\/pre>\n
        else<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> All good so far. The caller is in charge<\/span><\/pre>\n
            \/\/      of freeing the memory allocated here.<\/span><\/pre>\n
            *ppusImageName = pusImageName;<\/pre>\n
        }<\/pre>\n
     <\/pre>\n
        return<\/span> nts;<\/pre>\n
    }<\/pre>\n
     <\/pre>\n<\/div>\n
    With this routine it becomes easy to write the following callback function that will show us basic information about the processes started and ended.<\/p>\n
    \n
    \/****<\/span><\/pre>\n
    ***     OnCreateProcess<\/span><\/pre>\n
    **<\/span><\/pre>\n
    **      Callback function that will be registered if this<\/span><\/pre>\n
    **      driver is running on Windows Vista or earlier.<\/span><\/pre>\n
    *\/<\/span><\/pre>\n
    VOID<\/pre>\n
    OnCreateProcess(HANDLE  hParentId,<\/pre>\n
                    HANDLE  hProcessId,<\/pre>\n
                    BOOLEAN bCreate)<\/pre>\n
    {<\/pre>\n
        \/\/-f--> Here we check whether the event is about a creation<\/span><\/pre>\n
        \/\/      or termination of a process.<\/span><\/pre>\n
        if<\/span> (bCreate)<\/pre>\n
        {<\/pre>\n
            NTSTATUS        nts;<\/pre>\n
            PUNICODE_STRING pusImageName = NULL;<\/pre>\n
     <\/pre>\n
            \/\/-f--> Gets the path of the image that was used by<\/span><\/pre>\n
            \/\/      this process.<\/span><\/pre>\n
            nts = GetProcessImageName(hProcessId,<\/pre>\n
                                      &pusImageName);<\/pre>\n
     <\/pre>\n
            if<\/span> (NT_SUCCESS(nts))<\/pre>\n
            {<\/pre>\n
                \/\/-f--> If the path was obtained successfully,<\/span><\/pre>\n
                \/\/      it registers the process-start notification.<\/span><\/pre>\n
                DbgPrint(\"[Process Tracer] Action = Starting\\n\"<\/span><\/pre>\n
                         \"                 Process Id = 0x%x\\n\"<\/span><\/pre>\n
                         \"                 Parent Id = 0x%x\\n\"<\/span><\/pre>\n
                         \"                 Image name = %wZ\\n\\n\"<\/span>,<\/pre>\n
                         hProcessId,<\/pre>\n
                         hParentId,<\/pre>\n
                         pusImageName);<\/pre>\n
     <\/pre>\n
                \/\/-f--> Releases the allocated resources.<\/span><\/pre>\n
                ExFreePool(pusImageName);<\/pre>\n
            }<\/pre>\n
        }<\/pre>\n
        else<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> Registers the process-termination event.<\/span><\/pre>\n
            DbgPrint(\"[Process Tracer] Action = Finishing\\n\"<\/span><\/pre>\n
                     \"                 Process Id = 0x%x\\n\"<\/span><\/pre>\n
                     \"                 Parent Id = 0x%x\\n\\n\"<\/span>,<\/pre>\n
                     hProcessId,<\/pre>\n
                     hParentId);<\/pre>\n
        }<\/pre>\n
    }<\/pre>\n
     <\/pre>\n<\/div>\n
    With these functions working on a Windows XP, we will have the following output in the debugger.<\/p>\n
    \n
    [Process Tracer] Action = Starting<\/pre>\n
                     Process Id = 0x35c<\/span><\/pre>\n
                     Parent Id = 0x694<\/span><\/pre>\n
                     Image name = \\Device\\HarddiskVolume1\\WINDOWS\\system32\\notepad.exe<\/pre>\n
     <\/pre>\n
    kd> !process 0x35c<\/span> 0<\/pre>\n
    Searching for Process with Cid == 35c<\/pre>\n
    Cid handle table at e1003000 with 380 entries in use<\/pre>\n
     <\/pre>\n
    PROCESS 82100020  SessionId: 0  Cid: 035c    Peb: 7ffd7000  ParentCid: 0694<\/pre>\n
        DirBase: 08840400  ObjectTable: e10d2400  HandleCount:  41.<\/pre>\n
        Image: notepad.exe<\/span><\/pre>\n
     <\/pre>\n
    kd> !process 0x694<\/span> 0<\/pre>\n
    Searching for Process with Cid == 694<\/pre>\n
    Cid handle table at e1003000 with 380 entries in use<\/pre>\n
     <\/pre>\n
    PROCESS 821cc228  SessionId: 0  Cid: 0694    Peb: 7ffd6000  ParentCid: 0640<\/pre>\n
        DirBase: 08840200  ObjectTable: e18df2a0  HandleCount: 365.<\/pre>\n
        Image: explorer.exe<\/span><\/pre>\n
     <\/pre>\n
    kd> g<\/pre>\n
    [Process Tracer] Action = Finishing<\/pre>\n
                     Process Id = 0x35c<\/span><\/pre>\n
                     Parent Id = 0x694<\/span><\/pre>\n
     <\/pre>\n<\/div>\n
    Right at the beginning I start the Notepad process from the “Run…”<\/em> menu as I mentioned at the very beginning. After that I use WinDbg’s !process<\/strong> extension to obtain minimal information about the processes involved in this notification. Then I close Notepad, giving rise to the last message shown above.<\/p>\n
    A new API in Windows Vista SP1<\/h3>\n
    All right, this is very cool, but we are here to talk about how to prevent a certain process from being executed. Preventing process execution in Windows Vista became child’s play with the new PsSetCreateProcessNotifyRoutineEx()<\/a> routine, whose signature is listed right below:<\/p>\n
    \n
    NTSTATUS PsSetCreateProcessNotifyRoutineEx(<\/pre>\n
      __in  PCREATE_PROCESS_NOTIFY_ROUTINE_EX NotifyRoutine,<\/pre>\n
      __in  BOOLEAN Remove<\/pre>\n
    );<\/pre>\n<\/div>\n
    This routine registers a callback function that also notifies your driver about the start and end of processes in the system. The first parameter indicates the callback routine to be registered, while the second parameter indicates whether the routine should be registered or removed. Very similar to its older sister PsSetCreateProcessNotifyRoutine().<\/em> The callback routine must have the following signature:<\/p>\n
    \n
    VOID CreateProcessNotifyEx(<\/pre>\n
      __inout   PEPROCESS Process,<\/pre>\n
      __in      HANDLE ProcessId,<\/pre>\n
      __in_opt  PPS_CREATE_NOTIFY_INFO CreateInfo<\/pre>\n
    );<\/pre>\n<\/div>\n
    It is easy to see that the parameters of this callback function have changed quite a bit. To know whether the event is about the creation or the termination of a process, just check the CreateInfo<\/em> parameter. If it is non-null, then it is about a new process being executed; otherwise, about its termination. Let’s take a look at this structure:<\/p>\n
    \n
    typedef<\/span> struct<\/span> _PS_CREATE_NOTIFY_INFO {<\/pre>\n
      SIZE_T              Size;<\/pre>\n
      union<\/span> {<\/pre>\n
        ULONG  Flags;<\/pre>\n
        struct<\/span> {<\/pre>\n
          ULONG FileOpenNameAvailable  :1<\/span>;<\/pre>\n
          ULONG Reserved  :31<\/span>;<\/pre>\n
        } ;<\/pre>\n
      } ;<\/pre>\n
      HANDLE              ParentProcessId;<\/pre>\n
      CLIENT_ID           CreatingThreadId;<\/pre>\n
      struct<\/span> _FILE_OBJECT *FileObject;<\/pre>\n
      PCUNICODE_STRING    ImageFileName;<\/pre>\n
      PCUNICODE_STRING    CommandLine;<\/pre>\n
      NTSTATUS            CreationStatus;<\/pre>\n
    } PS_CREATE_NOTIFY_INFO, *PPS_CREATE_NOTIFY_INFO;<\/pre>\n<\/div>\n
    Yeah, it seems that life became much easier for those who want to seek greater detail about the processes involved in the notification. The great appeal of this new version is that we can prevent the creation of a process just by modifying the CreationStatus<\/em> field. Just to exemplify this ease, I wrote the callback function below. Always read the comments.<\/p>\n
    \n
    \/****<\/span><\/pre>\n
    ***     OnCreateProcessEx<\/span><\/pre>\n
    **<\/span><\/pre>\n
    **      Callback function that will be registered if this<\/span><\/pre>\n
    **      driver is running on Windows Vista SP1 or later.<\/span><\/pre>\n
    *\/<\/span><\/pre>\n
    VOID<\/pre>\n
    OnCreateProcessEx(PEPROCESS                 pEProcess,<\/pre>\n
                      HANDLE                    hProcessId,<\/pre>\n
                      PPS_CREATE_NOTIFY_INFO    pCreateInfo)<\/pre>\n
    {<\/pre>\n
        \/\/-f--> Here we check whether the event is about a creation<\/span><\/pre>\n
        \/\/      or termination of a process.<\/span><\/pre>\n
        if<\/span> (pCreateInfo)<\/pre>\n
        {<\/pre>\n
            UNICODE_STRING  usBlockingApp;<\/pre>\n
     <\/pre>\n
            \/\/-f--> Since this is just an example, I am putting the file<\/span><\/pre>\n
            \/\/      path hard coded here, but remember that references to<\/span><\/pre>\n
            \/\/      file images may use HarddiskVolume1 or other<\/span><\/pre>\n
            \/\/      variations that change depending on many things.<\/span><\/pre>\n
            RtlInitUnicodeString(&usBlockingApp,<\/pre>\n
                                 L\"\\\\??\\\\C:\\\\Windows\\\\System32\\\\Notepad.exe\"<\/span>);<\/pre>\n
     <\/pre>\n
            \/\/-f--> Comparing the image of the process that was just created<\/span><\/pre>\n
            \/\/      with the path I used above.<\/span><\/pre>\n
            if<\/span> (RtlEqualUnicodeString(&usBlockingApp,<\/pre>\n
                                      pCreateInfo->ImageFileName,<\/pre>\n
                                      TRUE))<\/pre>\n
            {<\/pre>\n
                \/\/-f--> All right, now it is time to grab the guy and show up terrifying:<\/span><\/pre>\n
                \/\/      \"Hand it over, playboy!\"<\/span><\/pre>\n
                DbgPrint(\"[Process Tracer] Action = Blocking\\n\"<\/span><\/pre>\n
                         \"                 Process Id = 0x%x\\n\"<\/span><\/pre>\n
                         \"                 Parent Id = 0x%x\\n\"<\/span><\/pre>\n
                         \"                 Image name = %wZ\\n\\n\"<\/span>,<\/pre>\n
                         hProcessId,<\/pre>\n
                         pCreateInfo->ParentProcessId,<\/pre>\n
                         pCreateInfo->ImageFileName);<\/pre>\n
     <\/pre>\n
                \/\/-f--> Changes the process-creation status so that<\/span><\/pre>\n
                \/\/      it does not proceed.<\/span><\/pre>\n
                pCreateInfo->CreationStatus = STATUS_ACCESS_DENIED;<\/pre>\n
            }<\/pre>\n
            else<\/span><\/pre>\n
            {<\/pre>\n
                \/\/-f--> It is not our \"man\"; let the process start normally.<\/span><\/pre>\n
                DbgPrint(\"[Process Tracer] Action = Starting\\n\"<\/span><\/pre>\n
                         \"                 Process Id = 0x%x\\n\"<\/span><\/pre>\n
                         \"                 Parent Id = 0x%x\\n\"<\/span><\/pre>\n
                         \"                 Image name = %wZ\\n\\n\"<\/span>,<\/pre>\n
                         hProcessId,<\/pre>\n
                         pCreateInfo->ParentProcessId,<\/pre>\n
                         pCreateInfo->ImageFileName);<\/pre>\n
            }<\/pre>\n
        }<\/pre>\n
        else<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> Here we just register the notification of the termination of<\/span><\/pre>\n
            \/\/      a process.<\/span><\/pre>\n
            DbgPrint(\"[Process Tracer] Action = Finishing\\n\"<\/span><\/pre>\n
                     \"                 Process Id = 0x%x\\n\\n\"<\/span>,<\/pre>\n
                     hProcessId);<\/pre>\n
        }<\/pre>\n
    }<\/pre>\n
     <\/pre>\n<\/div>\n
    Notice that the path to the file whose creation I am blocking is hard-coded<\/em> in the example source. This path may have a different syntax for the same file depending on how the process is created or on which version of Windows we are running. For this reason, if you want to run this test at home, check that the syntax is as I used here; otherwise adjust it and recompile the example.<\/p>\n
    One driver, two options<\/h3>\n
    This new API is available only for Windows Vista SP1 and later, but it is likely that you want a driver that is still able to run on earlier versions of Windows even if the system does not support this routine. As you must already know, simply calling the PsSetCreateProcessNotifyRoutineEx()<\/em> routine in your driver will create a static dependency and your driver will not be able to be loaded on older versions of Windows.<\/p>\n
    \"\"<\/p>\n
    To prevent this static dependency while having a single binary that can be loaded on both older and newer versions, using the newer version of this routine, we will use the MmGetSystemRoutineAddress()<\/a> function, which is the Kernel-Mode sister of the well-known GetProcAddress()<\/a> in User-Mode. The example driver available for download at the end of this post has these characteristics precisely to demonstrate how this can be done. Obviously, running the driver on Windows XP we will not have operating-system support to interrupt a process, and we will have to resort to alternative techniques to obtain the same result.<\/p>\n
    The DriverEntry<\/em> function for this driver looks like this:<\/p>\n
    \n
    \/****<\/span><\/pre>\n
    ***     DriverEntry<\/span><\/pre>\n
    **<\/span><\/pre>\n
    **      Entry point of the driver. If you are still thinking<\/span><\/pre>\n
    **      it is easy, do not worry, you will end up changing your mind.<\/span><\/pre>\n
    *\/<\/span><\/pre>\n
    NTSTATUS<\/pre>\n
    DriverEntry(PDRIVER_OBJECT     pDriverObj,<\/pre>\n
                PUNICODE_STRING    pusRegistryPath)<\/pre>\n
    {<\/pre>\n
        UNICODE_STRING  usSystemRoutine;<\/pre>\n
        NTSTATUS        nts;<\/pre>\n
     <\/pre>\n
        \/\/-f--> Registers our cleanup function so that<\/span><\/pre>\n
        \/\/      our driver can be unloaded.<\/span><\/pre>\n
        pDriverObj->DriverUnload = OnDriverUnload;<\/pre>\n
     <\/pre>\n
        \/\/-f--> Initializes the name of the routine we will try to look up dynamically.<\/span><\/pre>\n
        RtlInitUnicodeString(&usSystemRoutine,<\/pre>\n
                             L\"PsSetCreateProcessNotifyRoutineEx\"<\/span>);<\/pre>\n
     <\/pre>\n
        \/\/-f--> Here we check whether the system already supports PsSetCreateProcessNotifyRoutineEx<\/span><\/pre>\n
        \/\/      Exactly as the teacher taught GetProcessAddress() back in kindergarten.<\/span><\/pre>\n
        *(PVOID*)&pfPsSetCreateProcessNotifyRoutineEx = MmGetSystemRoutineAddress(&usSystemRoutine);<\/pre>\n
     <\/pre>\n
        if<\/span> (pfPsSetCreateProcessNotifyRoutineEx)<\/pre>\n
        {<\/pre>\n
            \/\/-f--> If we are on Windows Vista SP1 or later, we will have the address<\/span><\/pre>\n
            \/\/      of this routine, and therefore we will register with it.<\/span><\/pre>\n
            nts = pfPsSetCreateProcessNotifyRoutineEx(OnCreateProcessEx,<\/pre>\n
                                                      FALSE);<\/pre>\n
        }<\/pre>\n
        else<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> Whoa! We are running on some 386. Let us register with<\/span><\/pre>\n
            \/\/      that routine from the 90s.<\/span><\/pre>\n
            nts = PsSetCreateProcessNotifyRoutine(OnCreateProcess,<\/pre>\n
                                                  FALSE);<\/pre>\n
        }<\/pre>\n
     <\/pre>\n
        ASSERT(NT_SUCCESS(nts));<\/pre>\n
        return<\/span> nts;<\/pre>\n
    }<\/pre>\n<\/div>\n
    Testing PsSetCreateProcessNotifyRoutineEx()<\/h3>\n
    By now you must be jumping for joy imagining that your world-domination driver will finally work with great ease using this new API, but the thing is that this routine is not for just anyone. That is because only digitally signed drivers can call this new routine without receiving the STATUS_ACCESS_DENIED return.<\/p>\n
    \n
    But Fernando, how am I going to be able to test your example driver? I don’t have a certificate or anything!<\/p>\n<\/blockquote>\n
    This routine initially checks whether the module where your driver is defined has the integrity-check bit set. To set this bit just for fun, add the \/INTEGRITYCHECK option to your project’s linker options. The sources file of the example project looks like this:<\/p>\n
    \n
    TARGETNAME=ProcessTracer<\/pre>\n
    TARGETTYPE=DRIVER<\/pre>\n
     <\/pre>\n
    SOURCES=ProcessTracer.cpp<\/pre>\n
     <\/pre>\n
    LINKER_FLAGS=\/INTEGRITYCHECK<\/pre>\n
     <\/pre>\n<\/div>\n
    This will make the system check your driver’s signature, but since your driver is not signed, you will still receive the same error. To finally see this work without even having a certificate, you will have to disable code-integrity checking for drivers in Windows Vista.<\/p>\n
    All right, no panic. Start Windows Vista and press F8 as soon as Boot begins, then select the option below in the menu that appears as shown below:<\/p>\n
    \"\"<\/p>\n
    With these two modifications it is possible to test the example driver and get an output in the debugger like the one illustrated below:<\/p>\n
    \n
    [Process Tracer] Action = Blocking<\/span><\/pre>\n
                     Process Id = 0x3a4<\/pre>\n
                     Parent Id = 0xd98<\/pre>\n
                     Image name = \\??\\C:\\Windows\\system32\\notepad.exe<\/pre>\n<\/div>\n
    In this case, once again, I tried to start Notepad through the “Run…”<\/em> menu, but this time the output I got was the one shown below:<\/p>\n
    \"\"<\/p>\n
    Phew! Another giant post for the collection. I hope I helped, and see you next time!<\/p>\n
    ProcessTracer.zip<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
    During that long period when I was away from new posts on the blog, some things happened that deserved a little place here on my list of posts to write. One of them was the long discussion that took place on the C\/C++ group list. It was about the steps to follow to write a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-454","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/comments?post=454"}],"version-history":[{"count":1,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/454\/revisions"}],"predecessor-version":[{"id":455,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/454\/revisions\/455"}],"wp:attachment":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/media?parent=454"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/categories?post=454"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/tags?post=454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}