Smss.exe进程分析

传说中的会话管理服务器进程,它是windows操作系统启动时引导的最重要的系统进程,它负责启动csrss.exe和winlogon.exe进程,并对它们进行监控,如果发现其中一个挂掉,它马上叫你当机,所以要想结束csrss.exe/winlogon.exe，先结束Smss.exe，源码前一目了然(摘自windows nt 4.0代码)

//1 Module Info : 变量定义,提高当前进程的优先级(11级)

NTSTATUS Status; KPRIORITY SetBasePriority; UNICODE_STRING InitialCommand, DebugInitialCommand, UnicodeParameter; HANDLE ProcessHandles[ 2 ]; ULONG Parameters[ 4 ]; ULONG Response; PROCESS_BASIC_INFORMATION ProcessInfo; BOOLEAN WasEnabled;

SetBasePriority = FOREGROUND_BASE_PRIORITY+2;//#define FOREGROUND_BASE_PRIORITY 9 Status = NtSetInformationProcess( NtCurrentProcess(), ProcessBasePriority, (PVOID) &SetBasePriority, sizeof( SetBasePriority ) ); ASSERT(NT_SUCCESS(Status));

if (ARGUMENT_PRESENT( DebugParameter )) { SmpDebug = DebugParameter; }

//2 Module Info : 获取Csrss.exe和winlogon.exe进程的句柄,并对它们进行监控

try { Status = SmpInit( &InitialCommand, &ProcessHandles[ 0 ] );//返回crsss.exe进程的句柄 if (!NT_SUCCESS( Status )) { KdPrint(( "SMSS: SmpInit return failure - Status == %x/n" )); RtlInitUnicodeString( &UnicodeParameter, L"Session Manager Initialization" ); Parameters[ 1 ] = (ULONG)Status; } else { SYSTEM_FLAGS_INFORMATION FlagInfo;

NtQuerySystemInformation( SystemFlagsInformation, &FlagInfo, sizeof( FlagInfo ), NULL ); if (FlagInfo.Flags & (FLG_DEBUG_INITIAL_COMMAND | FLG_DEBUG_INITIAL_COMMAND_EX) ) { DebugInitialCommand.MaximumLength = InitialCommand.Length + 64; DebugInitialCommand.Length = 0; DebugInitialCommand.Buffer = RtlAllocateHeap( RtlProcessHeap(), MAKE_TAG( INIT_TAG ), DebugInitialCommand.MaximumLength ); if (FlagInfo.Flags & FLG_ENABLE_CSRDEBUG) { RtlAppendUnicodeToString( &DebugInitialCommand, L"ntsd -p -1 -d " ); } else { RtlAppendUnicodeToString( &DebugInitialCommand, L"ntsd -d " ); }

if (FlagInfo.Flags & FLG_DEBUG_INITIAL_COMMAND_EX ) { RtlAppendUnicodeToString( &DebugInitialCommand, L"-g -x " ); }

RtlAppendUnicodeStringToString( &DebugInitialCommand, &InitialCommand ); InitialCommand = DebugInitialCommand; }

Status = SmpExecuteInitialCommand( &InitialCommand, &ProcessHandles[ 1 ] );//返回winlogon进程句柄 if (NT_SUCCESS( Status )) { Status = NtWaitForMultipleObjects( 2, ProcessHandles, WaitAny, FALSE, NULL ); }

if (Status == STATUS_WAIT_0) { RtlInitUnicodeString( &UnicodeParameter, L"Windows SubSystem" ); Status = NtQueryInformationProcess( ProcessHandles[ 0 ], ProcessBasicInformation, &ProcessInfo, sizeof( ProcessInfo ), NULL );

KdPrint(( "SMSS: Windows subsystem terminated when it wasn't supposed to./n" )); } else { RtlInitUnicodeString( &UnicodeParameter, L"Windows Logon Process" ); if (Status == STATUS_WAIT_1) { Status = NtQueryInformationProcess( ProcessHandles[ 1 ], ProcessBasicInformation, &ProcessInfo, sizeof( ProcessInfo ), NULL ); } else { ProcessInfo.ExitStatus = Status; Status = STATUS_SUCCESS; }

KdPrint(( "SMSS: Initial command '%wZ' terminated when it wasn't supposed to./n", &InitialCommand )); }

if (NT_SUCCESS( Status )) { Parameters[ 1 ] = (ULONG)ProcessInfo.ExitStatus; } else { Parameters[ 1 ] = (ULONG)STATUS_UNSUCCESSFUL; } } } except( SmpUnhandledExceptionFilter( GetExceptionInformation() ) ) { RtlInitUnicodeString( &UnicodeParameter, L"Unhandled Exception in Session Manager" ); Parameters[ 1 ] = (ULONG)GetExceptionCode(); }

//3 Module Info : 当机代码!呵呵,其实就是通知操作系统,发生了一个硬件中断

Status = RtlAdjustPrivilege( SE_SHUTDOWN_PRIVILEGE, (BOOLEAN)TRUE, TRUE, &WasEnabled );//提高当前的权限,可以执行shutdown指令

if (Status == STATUS_NO_TOKEN) {

// // No thread token, use the process token //

Status = RtlAdjustPrivilege( SE_SHUTDOWN_PRIVILEGE, (BOOLEAN)TRUE, FALSE, &WasEnabled ); }

Parameters[ 0 ] = (ULONG)&UnicodeParameter;

Status = NtRaiseHardError( STATUS_SYSTEM_PROCESS_TERMINATED, 2, 1, Parameters, OptionShutdownSystem, &Response );//看看,字面意思就知道发生什么了,唤起硬件错误

// // If this returns, giveup //

NtTerminateProcess( NtCurrentProcess(), Status );

Smss.exe进程分析相关推荐

Smss.exe 进程分析--NT 源码--当机方法
来源:http://blog.vckbase.com/windowssky/archive/2007/04/17/25544.html 传说中的会话管理服务器进程,它是windows操作系统启动时引导 ...
smss.exe是什么进程?详解Windows会话管理器中的smss.exe
smss.exe是什么进程?详解Windows会话管理器中的smss.exe 进程综述 smss.exe是什么进程?详解Windows会话管理器中的smss.exe-冯金伟博客园smss.exe是什么 ...
WindowsXP 进程分析
[system process] - [system Idle process] - 进程信息进程文件: [system process] or [system process] 进程名称: Win ...
彻底清除SMSS.EXE病毒
概述: SMSS.EXE(Session Manager Subsystem),该进程为会话管理子系统用以初始化系统变量,MS-DOS驱动名称类似LPT1以及COM,调用Win32壳子系统和运行在 ...
SMSS.EXE病毒处理
SMSS.EXE(Session Manager Subsystem),该进程为会话管理子系统用以初始化系统变量,MS-DOS驱动名称类似LPT1以及COM,调用Win32壳子系统和运行在Window ...
最新征途木马专杀工具-------------------------SMSS.exe
SMSS病毒介绍:这是一种Windows下的PE病毒,它采用VB6编写 ,是一个能够破坏IE和EXPLORER的征途木马病毒变种.该病毒会在注册表中多处添加自己的启动项,还会修改系统文件,并在[WIN ...
磁碟机变种简单分析（lsass.exe、smss.exe、dnsq.dll、NetApi000.sys）
from: http://bbs.xcdx169.net/redirect.php?tid=56034&goto=lastpost&sid=NrNn1c 磁碟机变种简单分析(lsass ...
svchost.exe进程的分析
你是否经常在你电脑看到很多svchost.exe进程呢?有的人电脑有6个svchost.exe进程.有的人电脑更多的svchost.exe进程.例如我的电脑就有5个svchost.exe程序.一般来说 ...
smss.exe之wom毒
文章类别文章来源文章标题提交者发布日期点击数原创天空 yude smss.exe之wom毒 yude 2006-5-22 3159 这是一个WOW木马,最近好像中招的人多起来了,这个小 ...

Smss.exe进程分析

Smss.exe进程分析相关推荐

最新文章

热门文章