Windows核心程式管理器解析

Ox9A82發表於2016-04-22
Windows

Windows核心是如何實現執行緒掛起的？如何實現執行緒掛載到程式的？如何實現殺死程式和執行緒的？

從原始碼分析一下，這些操作具體在原始碼上是如何實現的。

程式建立、執行緒切換、執行緒跨越CPU許可權級、程式掛靠、殺死程式、殺死執行緒

一.程式建立

可以分幾個部分來說。首先說程式的地址空間是怎麼建立起來的，程式的EPROCESS->VadRoot是用來描述程式的使用者地址空間的。只有在VadRoot結構中分配了的空間才可能被使用。程式初始化空間使用了MmCreateProcessAddressSpace函式，這個函式如下.

 

二.執行緒切換

作業系統如何從一個執行緒切換到另一個執行緒？

首先，只有核心模式下有執行緒切換。

 

三.殺死程式

對應於官方介面分別是使用者層的TerminateProcess()和核心層的ZwTerminateProcess()。

殺死程式與建立程式很像，都是一個由多步複合的過程。原因就是因為程式是一個包攬眾多的容器。

比如程式有地址空間、有核心物件、也有所擁有的執行緒。倘若要建立程式勢必要建立執行緒，倘若要殺死程式勢必要殺死執行緒。

所以程式真正的“執行終止”，其實是取決於殺死執行緒。

 

四.建立執行緒

先放上KTHREAD和ETHREAD結構的情況，可見執行緒物件裡面也是有很多東西的

  1 typedef struct _KTHREAD
  2 {
  3      DISPATCHER_HEADER Header;
  4      UINT64 CycleTime;
  5      ULONG HighCycleTime;
  6      UINT64 QuantumTarget;
  7      PVOID InitialStack;
  8      PVOID StackLimit;
  9      PVOID KernelStack;
 10      ULONG ThreadLock;
 11      union
 12      {
 13           KAPC_STATE ApcState;
 14           UCHAR ApcStateFill[23];
 15      };
 16      CHAR Priority;
 17      WORD NextProcessor;
 18      WORD DeferredProcessor;
 19      ULONG ApcQueueLock;
 20      ULONG ContextSwitches;
 21      UCHAR State;
 22      UCHAR NpxState;
 23      UCHAR WaitIrql;
 24      CHAR WaitMode;
 25      LONG WaitStatus;
 26      union
 27      {
 28           PKWAIT_BLOCK WaitBlockList;
 29           PKGATE GateObject;
 30      };
 31      union
 32      {
 33           ULONG KernelStackResident: 1;
 34           ULONG ReadyTransition: 1;
 35           ULONG ProcessReadyQueue: 1;
 36           ULONG WaitNext: 1;
 37           ULONG SystemAffinityActive: 1;
 38           ULONG Alertable: 1;
 39           ULONG GdiFlushActive: 1;
 40           ULONG Reserved: 25;
 41           LONG MiscFlags;
 42      };
 43      UCHAR WaitReason;
 44      UCHAR SwapBusy;
 45      UCHAR Alerted[2];
 46      union
 47      {
 48           LIST_ENTRY WaitListEntry;
 49           SINGLE_LIST_ENTRY SwapListEntry;
 50      };
 51      PKQUEUE Queue;
 52      ULONG WaitTime;
 53      union
 54      {
 55           struct
 56           {
 57                SHORT KernelApcDisable;
 58                SHORT SpecialApcDisable;
 59           };
 60           ULONG CombinedApcDisable;
 61      };
 62      PVOID Teb;
 63      union
 64      {
 65           KTIMER Timer;
 66           UCHAR TimerFill[40];
 67      };
 68      union
 69      {
 70           ULONG AutoAlignment: 1;
 71           ULONG DisableBoost: 1;
 72           ULONG EtwStackTraceApc1Inserted: 1;
 73           ULONG EtwStackTraceApc2Inserted: 1;
 74           ULONG CycleChargePending: 1;
 75           ULONG CalloutActive: 1;
 76           ULONG ApcQueueable: 1;
 77           ULONG EnableStackSwap: 1;
 78           ULONG GuiThread: 1;
 79           ULONG ReservedFlags: 23;
 80           LONG ThreadFlags;
 81      };
 82      union
 83      {
 84           KWAIT_BLOCK WaitBlock[4];
 85           struct
 86           {
 87                UCHAR WaitBlockFill0[23];
 88                UCHAR IdealProcessor;
 89           };
 90           struct
 91           {
 92                UCHAR WaitBlockFill1[47];
 93                CHAR PreviousMode;
 94           };
 95           struct
 96           {
 97                UCHAR WaitBlockFill2[71];
 98                UCHAR ResourceIndex;
 99           };
100           UCHAR WaitBlockFill3[95];
101      };
102      UCHAR LargeStack;
103      LIST_ENTRY QueueListEntry;
104      PKTRAP_FRAME TrapFrame;
105      PVOID FirstArgument;
106      union
107      {
108           PVOID CallbackStack;
109           ULONG CallbackDepth;
110      };
111      PVOID ServiceTable;
112      UCHAR ApcStateIndex;
113      CHAR BasePriority;
114      CHAR PriorityDecrement;
115      UCHAR Preempted;
116      UCHAR AdjustReason;
117      CHAR AdjustIncrement;
118      UCHAR Spare01;
119      CHAR Saturation;
120      ULONG SystemCallNumber;
121      ULONG Spare02;
122      ULONG UserAffinity;
123      PKPROCESS Process;
124      ULONG Affinity;
125      PKAPC_STATE ApcStatePointer[2];
126      union
127      {
128           KAPC_STATE SavedApcState;
129           UCHAR SavedApcStateFill[23];
130      };
131      CHAR FreezeCount;
132      CHAR SuspendCount;
133      UCHAR UserIdealProcessor;
134      UCHAR Spare03;
135      UCHAR Iopl;
136      PVOID Win32Thread;
137      PVOID StackBase;
138      union
139      {
140           KAPC SuspendApc;
141           struct
142           {
143                UCHAR SuspendApcFill0[1];
144                CHAR Spare04;
145           };
146           struct
147           {
148                UCHAR SuspendApcFill1[3];
149                UCHAR QuantumReset;
150           };
151           struct
152           {
153                UCHAR SuspendApcFill2[4];
154                ULONG KernelTime;
155           };
156           struct
157           {
158                UCHAR SuspendApcFill3[36];
159                PKPRCB WaitPrcb;
160           };
161           struct
162           {
163                UCHAR SuspendApcFill4[40];
164                PVOID LegoData;
165           };
166           UCHAR SuspendApcFill5[47];
167      };
168      UCHAR PowerState;
169      ULONG UserTime;
170      union
171      {
172           KSEMAPHORE SuspendSemaphore;
173           UCHAR SuspendSemaphorefill[20];
174      };
175      ULONG SListFaultCount;
176      LIST_ENTRY ThreadListEntry;
177      LIST_ENTRY MutantListHead;
178      PVOID SListFaultAddress;
179      PVOID MdlForLockedTeb;
180 } KTHREAD, *PKTHREAD;
KTHREAD
  1 typedef struct _ETHREAD
  2 {
  3      KTHREAD Tcb;
  4      LARGE_INTEGER CreateTime;
  5      union
  6      {
  7           LARGE_INTEGER ExitTime;
  8           LIST_ENTRY KeyedWaitChain;
  9      };
 10      union
 11      {
 12           LONG ExitStatus;
 13           PVOID OfsChain;
 14      };
 15      union
 16      {
 17           LIST_ENTRY PostBlockList;
 18           struct
 19           {
 20                PVOID ForwardLinkShadow;
 21                PVOID StartAddress;
 22           };
 23      };
 24      union
 25      {
 26           PTERMINATION_PORT TerminationPort;
 27           PETHREAD ReaperLink;
 28           PVOID KeyedWaitValue;
 29           PVOID Win32StartParameter;
 30      };
 31      ULONG ActiveTimerListLock;
 32      LIST_ENTRY ActiveTimerListHead;
 33      CLIENT_ID Cid;
 34      union
 35      {
 36           KSEMAPHORE KeyedWaitSemaphore;
 37           KSEMAPHORE AlpcWaitSemaphore;
 38      };
 39      PS_CLIENT_SECURITY_CONTEXT ClientSecurity;
 40      LIST_ENTRY IrpList;
 41      ULONG TopLevelIrp;
 42      PDEVICE_OBJECT DeviceToVerify;
 43      _PSP_RATE_APC * RateControlApc;
 44      PVOID Win32StartAddress;
 45      PVOID SparePtr0;
 46      LIST_ENTRY ThreadListEntry;
 47      EX_RUNDOWN_REF RundownProtect;
 48      EX_PUSH_LOCK ThreadLock;
 49      ULONG ReadClusterSize;
 50      LONG MmLockOrdering;
 51      ULONG CrossThreadFlags;
 52      ULONG Terminated: 1;
 53      ULONG ThreadInserted: 1;
 54      ULONG HideFromDebugger: 1;
 55      ULONG ActiveImpersonationInfo: 1;
 56      ULONG SystemThread: 1;
 57      ULONG HardErrorsAreDisabled: 1;
 58      ULONG BreakOnTermination: 1;
 59      ULONG SkipCreationMsg: 1;
 60      ULONG SkipTerminationMsg: 1;
 61      ULONG CopyTokenOnOpen: 1;
 62      ULONG ThreadIoPriority: 3;
 63      ULONG ThreadPagePriority: 3;
 64      ULONG RundownFail: 1;
 65      ULONG SameThreadPassiveFlags;
 66      ULONG ActiveExWorker: 1;
 67      ULONG ExWorkerCanWaitUser: 1;
 68      ULONG MemoryMaker: 1;
 69      ULONG ClonedThread: 1;
 70      ULONG KeyedEventInUse: 1;
 71      ULONG RateApcState: 2;
 72      ULONG SelfTerminate: 1;
 73      ULONG SameThreadApcFlags;
 74      ULONG Spare: 1;
 75      ULONG StartAddressInvalid: 1;
 76      ULONG EtwPageFaultCalloutActive: 1;
 77      ULONG OwnsProcessWorkingSetExclusive: 1;
 78      ULONG OwnsProcessWorkingSetShared: 1;
 79      ULONG OwnsSystemWorkingSetExclusive: 1;
 80      ULONG OwnsSystemWorkingSetShared: 1;
 81      ULONG OwnsSessionWorkingSetExclusive: 1;
 82      ULONG OwnsSessionWorkingSetShared: 1;
 83      ULONG OwnsProcessAddressSpaceExclusive: 1;
 84      ULONG OwnsProcessAddressSpaceShared: 1;
 85      ULONG SuppressSymbolLoad: 1;
 86      ULONG Prefetching: 1;
 87      ULONG OwnsDynamicMemoryShared: 1;
 88      ULONG OwnsChangeControlAreaExclusive: 1;
 89      ULONG OwnsChangeControlAreaShared: 1;
 90      ULONG PriorityRegionActive: 4;
 91      UCHAR CacheManagerActive;
 92      UCHAR DisablePageFaultClustering;
 93      UCHAR ActiveFaultCount;
 94      ULONG AlpcMessageId;
 95      union
 96      {
 97           PVOID AlpcMessage;
 98           ULONG AlpcReceiveAttributeSet;
 99      };
100      LIST_ENTRY AlpcWaitListEntry;
101      ULONG CacheManagerCount;
102 } ETHREAD, *PETHREAD;
ETHREAD

 

殺死執行緒是通過APC來實現的。首先會判斷當前執行緒是否是最後的執行緒，如果是就直接呼叫     結束當前執行緒。如果有別的執行緒就向它們插入一個APC，用於結束。

相關文章