PspCidTable概述

1. PspCidTable = ExCreateHandleTable (NULL);  //创建!
2.     if (PspCidTable == NULL) {
3.         return FALSE;
4.      }
5.     //
6.     // Set PID and TID reuse to strict FIFO. This isn't absolutely needed but
7.     // it makes tracking audits easier.
8.     //
9.      ExSetHandleTableStrictFIFO (PspCidTable);
10.      ExRemoveHandleTable (PspCidTable);  //使得PspCidTable独立于其它句柄表 独立很重要
    

2.进程创建时,PspCreateProcess()在PspCidTable中以进程对象创建句柄,是为PID
//

    // Create the process ID

1.     //
2.      CidEntry.Object = Process;
3.      CidEntry.GrantedAccess = 0;
4.      Process->UniqueProcessId = ExCreateHandle (PspCidTable, &CidEntry);  //进程的PID是这么来的
5.     if (Process->UniqueProcessId == NULL) {
6.          Status = STATUS_INSUFFICIENT_RESOURCES;
7.         goto exit_and_deref;
8.      }

3.线程创建时,PspCreateThread()在PspCidTable中以线程对象创建句柄,是为TID

1.      Thread->ThreadsProcess = Process;
2.      Thread->Cid.UniqueProcess = Process->UniqueProcessId;
3.      CidEntry.Object = Thread;
4.      CidEntry.GrantedAccess = 0;
5.      Thread->Cid.UniqueThread = ExCreateHandle (PspCidTable, &CidEntry); //线程的TID
6.     if (Thread->Cid.UniqueThread == NULL) {
7.          ObDereferenceObject (Thread);
8.         return (STATUS_INSUFFICIENT_RESOURCES);
9.      }

这儿可以清楚地知道:PID和TID分别是EPROCESS和ETHREAD对象在PspCidTable这个句柄表中的索引

4.进程和线程的查询,主要是以下三个函数,按照给定的PID或TID从PspCidTable从查找相应的进线程对象

PsLookupProcessThreadByCid()
PsLookupProcessByProcessId()
PsLookupThreadByThreadId()
其中有如下调用:
CidEntry = ExMapHandleToPointer(PspCidTable, ProcessId);
CidEntry = ExMapHandleToPointer(PspCidTable, ThreadId);

1. if (Thread->Cid.UniqueThread != NULL) {
2.         if (!ExDestroyHandle (PspCidTable, Thread->Cid.UniqueThread, NULL)) {
3.              KeBugCheck(CID_HANDLE_DELETION);
4.          }
5.      }

6.进程退出时,PspProcessDelete()在PspCidTable中销毁句柄

1. if (Process->UniqueProcessId) {
2.         if (!(ExDestroyHandle (PspCidTable, Process->UniqueProcessId, NULL))) {
3.              KeBugCheck (CID_HANDLE_DELETION);
4.          }
5.      }

这里要注意,如果进线程退出时,销毁句柄却发现句柄不存在造成ExDestroyHandle返回失败,可是要蓝屏滴~
所以抹了PspCidTable来隐藏的进程,在退出时必须把进线程对象再放回去,欲知后事如何,请看下回分解~~

最后

以上就是爱笑电灯胆为你收集整理的PspCidTable概述的全部内容，希望文章能够帮你解决PspCidTable概述所遇到的程序开发问题。

如果觉得靠谱客网站的内容还不错，欢迎将靠谱客网站推荐给程序员好友。