Description: Under the control of the creation of a process, the key function of the relationship between the Executive has the following: XP sp3 under: 1.NtCreateProcessEx 2.NtCreateThread 3.CreateProcessNotify, call the callback function to create the process, in PspCreateThread call 4.CreateThreadNotify, create a thread callback call function call in PspCreateThread Vista, Win7 under: 1.NtCreateUserProcess-> PspInsertThread 2.CreateProcessNotify, call the callback function to create the process, in PspInsertThread call, which is NtCreateUserProcess deep 3.CreateThreadNotify, call the callback function to create the process, in PspInsertThread call, that is, the deep NtCreateUserProcess
File list (Check if you may need any files):
利用CreateProcessNotify监控下一个进程的创建过程\bin\Example.dll
...............................................\...\Loader.exe
...............................................\dll\Example.cpp
...............................................\...\Example.def
...............................................\...\Example.dsp
...............................................\...\Example.dsw
...............................................\...\Example.plg
...............................................\...\ReadMe.txt
...............................................\...\..lease\Example.exp
...............................................\...\.......\Example.lib
...............................................\...\StdAfx.cpp
...............................................\...\StdAfx.h
...............................................\down.dsw
...............................................\exe\Loader.cpp
...............................................\...\Loader.dsp
...............................................\...\Loader.dsw
...............................................\...\Loader.plg
...............................................\removejunk.bat
...............................................\dll\Release
...............................................\exe\Release
...............................................\bin
...............................................\dll
...............................................\exe
利用CreateProcessNotify监控下一个进程的创建过程
Download