挂钩 TerminateProcess &从 Handle It Supplies 获取信息
如果要阻止进程终止，一种方法是挂钩 TerminateProcess（或 NtTerminateProcess）。如果进程自行终止（例如，因为您关闭了其窗口），则提供给这些函数的句柄为 NULL，因此您可以使用 GetCurrentProcess() & 找出正在终止的可执行文件。 GetModuleFileNameEx()。由于 GetCurrentProcess() 返回一个伪句柄，因此您可以毫无问题地访问它。
但是，如果一个进程正在终止另一个进程，则提供的句柄不为 NULL。它代表正在终止的进程。问题是，您无法获取有关该过程的信息。您可以简单地返回一个表示“访问被拒绝”的代码，而不是调用原始的 [Nt]TerminateProcess()，但是该毯子会阻止所有进程终止其他进程 - 这是一个坏主意。
句柄必须代表有效的东西，否则 TerminateProcess 将无法用它做任何有用的事情 - 但我什至无法对其调用 GetProcessId()，我得到 ERROR_INVALID_HANDLE （或 ERROR_ACCESS_DENIED）。我尝试了从帮助和在线收集的各种方法，包括获得调试权限（成功）和DuplicateHandle（）（相同的错误）和ZwQueryInformationProcess（）来获取ID（STATUS_ACCESS_DENIED）。我什至无法枚举进程，因为它们返回 ID，而我无法获取 ID，并且 OpenProcess() 总是返回一个新句柄，因此我无法比较句柄。
我只能假设句柄具有 PROCESS_TERMINATE 权限，除此之外别无其他。我知道 Vista 及更高版本由于数字版权管理而保护进程，但我使用 ProcessExplorer 作为我的小白鼠，所以它绝对不是媒体应用程序！
有谁知道我还能如何获得有关从此句柄终止的进程的任何类型的信息？
If you want to stop a process from being terminated, one way is to hook into TerminateProcess (or NtTerminateProcess). If the process is terminating itself (because you closed its window, for example), the handle supplied to those functions is NULL, so you can find out what executable is being terminated using GetCurrentProcess() & GetModuleFileNameEx(). As GetCurrentProcess() returns a pseudo-handle, you can access it with no problems.
If one process is terminating another, though, the handle supplied is not NULL. It represents the process being terminated. The problem is, you can't get information about that process. You can simply return a code saying "access denied" instead of calling the original [Nt]TerminateProcess(), but that blanket stops all processes from terminating others - which is a bad idea.
The handle must represent something valid otherwise TerminateProcess wouldn't be able to do anything useful with it - but I can't even call GetProcessId() on it, I get ERROR_INVALID_HANDLE (or ERROR_ACCESS_DENIED). I've tried various methods I've collected from the help and from online, including gaining the debug privilege (success) and DuplicateHandle() (same error) and ZwQueryInformationProcess() to get the ID (STATUS_ACCESS_DENIED). I can't even enumerate processes because they return IDs, and I can't get the ID, and OpenProcess() always returns a fresh handle, so I can't compare handles.
I can only assume the handle has PROCESS_TERMINATE right and nothing else. I know that Vista and higher have protected processes due to Digital Rights Management, but I'm using ProcessExplorer as my guinea pig so it's definitely not a media application!
Does anyone know how else I might be able to get any kind of information about the process being terminated from this handle?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这只是一个普通的进程句柄。问题是，你的钩子函数是在哪个进程中执行的？如果是调用进程，则句柄可以按原样用于 GetProcessId 或 NtQueryInformationProcess。如果没有，您需要调用 DuplicateHandle 将句柄复制到您的进程中。
如果您收到访问被拒绝错误，可能是因为进程句柄仅具有 PROCESS_TERMINATE 访问权限。在这种情况下，请使用 DuplicateHandle 通过 PROCESS_QUERY_(LIMITED_)INFORMATION 访问“重新打开”进程。
It's just an ordinary process handle. The question is, in which process is your hook function executing? If it's the calling process, the handle can be used as-is for GetProcessId or NtQueryInformationProcess. If not, you need to call DuplicateHandle to duplicate the handle into your process.
If you're getting access denied errors, it may be because the process handle only has PROCESS_TERMINATE access. In that case, use DuplicateHandle to "re-open" the process with PROCESS_QUERY_(LIMITED_)INFORMATION access.