如何让driver知道一个特定的app运行结束了(正常退出或这崩掉了)

有简单的方法吗?

PsSetCreateThreadNotifyRoutine()
PsLookupProcessByProcessId()

所有用户进程退出时都调用exitprocess，Hook它，然后检查返回的EAX值，便知道是正常还是异常退出，当然这个hook在用户层中作，在核心作原理是一样的。

PsSetCreateThreadNotifyRoutine()
PsLookupProcessByProcessId()

1.在驱动中用IoCreateNotificationEvent生成一个Event，
2.在PsSetCreateThreadNotifyRoutine()的回调例程里来使用该事件：
KeSetEvent(extension->ProcessEvent, 0, FALSE);
KeClearEvent(extension->ProcessEvent);
3.在App开启监控线程监听内核通知事件。

PsSetCreateProcessNotifyRoutine

谢谢大家帮忙，分数发放了：）

哪位可以给我一个小例子看看吗？

再问一下，在app里可以拿到当前的processid吗？用什么方法？

GetCurrentProcessId();

还有个问题，我怎么知道是我要监视的那个app退出了，而不是其他的app呢？

我想能不能先在app里拿到它的processID，然后传到driver里面，当有process退出的时候让notifyroutine去看是不是我关心的那个id，如果不是就pass，否则进行一些处理。
还有，notifyroutine只传入三个参数，可是我想一旦我的app退出要干便deviceextension的某个field的值可怎么半呀？
继续高分求教。

不明白你最终的需求是什么，如果是监控进程停止，其实可以用一个简单的办法，那就是Hook ZwTermintateProcess API，感觉更好一些，PsSetCreateProcessNotifyRoutine可能对监控进程开启更适合一些。

不明白你最终的需求是什么，如果是监控进程停止，其实可以用一个简单的办法，那就是Hook ZwTermintateProcess API，感觉更好一些，PsSetCreateProcessNotifyRoutine可能对监控进程开启更适合一些。

我的需求就是在一个特定的app开启和退出时让driver做一点工作。
比如在deviceextension里有一个flag，当这个app启动时driver将它设成true，当app退出时driver将其设为FALSE

如果设备和APP都是你做的话，你可以在APP得到设备句柄，通过自定义DEVICEIOCONTROL，告诉驱动你的打开和关闭呢。

如果设备和APP都是你做的话，你可以在APP得到设备句柄，通过自定义DEVICEIOCONTROL，告诉驱动你的打开和关闭呢。

如果程序意外退出了，在哪里做deviceiocontrol啊？

PsSetCreateProcessNotifyRoutine
PsSetCreateProcessNotifyRoutine adds a driver-supplied callback routine to, or removes it from, a list of routines to be called whenever a process is created or deleted.

NTSTATUS
  PsSetCreateProcessNotifyRoutine(
    IN PCREATE_PROCESS_NOTIFY_ROUTINE  NotifyRoutine,
    IN BOOLEAN  Remove
    );
Parameters
NotifyRoutine
Specifies the entry point of a caller-supplied process-creation callback routine.
Remove
Indicates whether the routine specified by NotifyRoutine should be added to or removed from the system's list of notification routines. If FALSE, the specified routine is added to the list. If TRUE, the specified routine is removed from the list.
Include
ntddk.h

Return Value
PsSetCreateProcessNotifyRoutine can return one of the following:

STATUS_SUCCESS
The given NotifyRoutine is now registered with the system.
STATUS_INVALID_PARAMETER
The given NotifyRoutine has already been registered so this is a redundant call, or the system has reached its limit for registering process-creation callbacks.
Comments
Highest-level drivers can call PsSetCreateProcessNotifyRoutine to set up their process-creation notify routines, declared as follows:

VOID
(*PCREATE_PROCESS_NOTIFY_ROUTINE) (
    IN HANDLE  ParentId,
    IN HANDLE  ProcessId,
    IN BOOLEAN  Create
    );
The ParentId and ProcessId parameters identify the process, and the Create parameter indicates whether the process was created (TRUE) or deleted (FALSE).

An IFS or highest-level system-profiling driver might register a process-creation callback to track the system-wide creation and deletion of processes against the driver's internal state. The system can register up to eight process-creation callbacks. Any driver that successfully registers a callback must remain loaded until the system itself is shut down.

After a driver-supplied routine is registered, it is called with Create set to TRUE just after the initial thread is created within the newly created process designated by the input ProcessId handle. The input ParentId handle identifies the parent process of the newly created process if it inherits open handles from its parent.

A driver's process-notify routine is also called with Create set to FALSE, usually when the last thread within a process has terminated and the process address space is about to be deleted. In very rare circumstances, for processes in which no thread was ever created, a driver's process-notify routine is called only at the destruction of the process.

The driver's process-creation notify routine runs at IRQL PASSIVE_LEVEL, either in the context of the initial thread within a newly created process or in the context of a system thread.

Callers of PsSetCreateProcessNotifyRoutine must be running at IRQL PASSIVE_LEVEL

据我所知在用户端调用GetCurrentProcessId()只返回0xffffffff，根本不是内核中对应的ProcessId，因为在用户端只能看到一个进程。PsSetCreateProcessNotifyRoutine中的输入参数ProcessId的给定是个问题。

据我所知在用户端调用GetCurrentProcessId()只返回0xffffffff，根本不是内核中对应的ProcessId，因为在用户端只能看到一个进程。PsSetCreateProcessNotifyRoutine中的输入参数ProcessId的给定是个问题。

有这样的事？！

建议还是先动手做，不论什么方法，得自试了以后才知道适不适合。

我的需求就是在一个特定的app开启和退出时让driver做一点工作。
比如在deviceextension里有一个flag，当这个app启动时driver将它设成true，当app退出时driver将其设为FALSE

我重申一下我的需求，上面老兄贴的msdn我看过，我想要的是一个例子。
我不知道在notifyroutine里怎么判别是不是我关心的app开始或结束了，还有怎么操作在定义在deviceExtension里的一个field的值。
分数已经加了，有人能回答吗？

你的信箱多少，我可以给发一个驱动的例子。

据我所知在用户端调用GetCurrentProcessId()只返回0xffffffff，根本不是内核中对应的ProcessId，因为在用户端只能看到一个进程。PsSetCreateProcessNotifyRoutine中的输入参数ProcessId的给定是个问题。

的确有问题,在PsSetCreateProcessNotifyRoutine中的输入参数ProcessId中有时候系统给你的ProcessId是错误的,在WIN2K下由为严重,不过XP下好象基本没有问题的......