Windows内核进程管理器解析

Windows内核是如何实现线程挂起的？如何实现线程挂载到进程的？如何实现杀死进程和线程的？

从源码分析一下，这些操作具体在源码上是如何实现的。

进程创建、线程切换、线程跨越CPU权限级、进程挂靠、杀死进程、杀死线程

一.进程创建

可以分几个部分来说。首先说进程的地址空间是怎么创建起来的，进程的EPROCESS->VadRoot是用来描述进程的用户地址空间的。只有在VadRoot结构中分配了的空间才可能被使用。进程初始化空间使用了MmCreateProcessAddressSpace函数，这个函数如下.

二.线程切换

操作系统如何从一个线程切换到另一个线程？

首先，只有内核模式下有线程切换。

三.杀死进程

对应于官方接口分别是用户层的TerminateProcess()和内核层的ZwTerminateProcess()。

杀死进程与创建进程很像，都是一个由多步复合的过程。原因就是因为进程是一个包揽众多的容器。

比如进程有地址空间、有内核对象、也有所拥有的线程。倘若要创建进程势必要创建线程，倘若要杀死进程势必要杀死线程。

所以进程真正的“运行终止”，其实是取决于杀死线程。

四.创建线程

先放上KTHREAD和ETHREAD结构的情况，可见线程对象里面也是有很多东西的

 typedef struct _KTHREAD
 {
      DISPATCHER_HEADER Header;
      UINT64 CycleTime;
      ULONG HighCycleTime;
      UINT64 QuantumTarget;
      PVOID InitialStack;
      PVOID StackLimit;
      PVOID KernelStack;
      ULONG ThreadLock;
      union
      {
           KAPC_STATE ApcState;
           UCHAR ApcStateFill[];
      };
      CHAR Priority;
      WORD NextProcessor;
      WORD DeferredProcessor;
      ULONG ApcQueueLock;
      ULONG ContextSwitches;
      UCHAR State;
      UCHAR NpxState;
      UCHAR WaitIrql;
      CHAR WaitMode;
      LONG WaitStatus;
      union
      {
           PKWAIT_BLOCK WaitBlockList;
           PKGATE GateObject;
      };
      union
      {
           ULONG KernelStackResident: ;
           ULONG ReadyTransition: ;
           ULONG ProcessReadyQueue: ;
           ULONG WaitNext: ;
           ULONG SystemAffinityActive: ;
           ULONG Alertable: ;
           ULONG GdiFlushActive: ;
           ULONG Reserved: ;
           LONG MiscFlags;
      };
      UCHAR WaitReason;
      UCHAR SwapBusy;
      UCHAR Alerted[];
      union
      {
           LIST_ENTRY WaitListEntry;
           SINGLE_LIST_ENTRY SwapListEntry;
      };
      PKQUEUE Queue;
      ULONG WaitTime;
      union
      {
           struct
           {
                SHORT KernelApcDisable;
                SHORT SpecialApcDisable;
           };
           ULONG CombinedApcDisable;
      };
      PVOID Teb;
      union
      {
           KTIMER Timer;
           UCHAR TimerFill[];
      };
      union
      {
           ULONG AutoAlignment: ;
           ULONG DisableBoost: ;
           ULONG EtwStackTraceApc1Inserted: ;
           ULONG EtwStackTraceApc2Inserted: ;
           ULONG CycleChargePending: ;
           ULONG CalloutActive: ;
           ULONG ApcQueueable: ;
           ULONG EnableStackSwap: ;
           ULONG GuiThread: ;
           ULONG ReservedFlags: ;
           LONG ThreadFlags;
      };
      union
      {
           KWAIT_BLOCK WaitBlock[];
           struct
           {
                UCHAR WaitBlockFill0[];
                UCHAR IdealProcessor;
           };
           struct
           {
                UCHAR WaitBlockFill1[];
                CHAR PreviousMode;
           };
           struct
           {
                UCHAR WaitBlockFill2[];
                UCHAR ResourceIndex;
           };
           UCHAR WaitBlockFill3[];
      };
      UCHAR LargeStack;
      LIST_ENTRY QueueListEntry;
      PKTRAP_FRAME TrapFrame;
      PVOID FirstArgument;
      union
      {
           PVOID CallbackStack;
           ULONG CallbackDepth;
      };
      PVOID ServiceTable;
      UCHAR ApcStateIndex;
      CHAR BasePriority;
      CHAR PriorityDecrement;
      UCHAR Preempted;
      UCHAR AdjustReason;
      CHAR AdjustIncrement;
      UCHAR Spare01;
      CHAR Saturation;
      ULONG SystemCallNumber;
      ULONG Spare02;
      ULONG UserAffinity;
      PKPROCESS Process;
      ULONG Affinity;
      PKAPC_STATE ApcStatePointer[];
      union
      {
           KAPC_STATE SavedApcState;
           UCHAR SavedApcStateFill[];
      };
      CHAR FreezeCount;
      CHAR SuspendCount;
      UCHAR UserIdealProcessor;
      UCHAR Spare03;
      UCHAR Iopl;
      PVOID Win32Thread;
      PVOID StackBase;
      union
      {
           KAPC SuspendApc;
           struct
           {
                UCHAR SuspendApcFill0[];
                CHAR Spare04;
           };
           struct
           {
                UCHAR SuspendApcFill1[];
                UCHAR QuantumReset;
           };
           struct
           {
                UCHAR SuspendApcFill2[];
                ULONG KernelTime;
           };
           struct
           {
                UCHAR SuspendApcFill3[];
                PKPRCB WaitPrcb;
           };
           struct
           {
                UCHAR SuspendApcFill4[];
                PVOID LegoData;
           };
           UCHAR SuspendApcFill5[];
      };
      UCHAR PowerState;
      ULONG UserTime;
      union
      {
           KSEMAPHORE SuspendSemaphore;
           UCHAR SuspendSemaphorefill[];
      };
      ULONG SListFaultCount;
      LIST_ENTRY ThreadListEntry;
      LIST_ENTRY MutantListHead;
      PVOID SListFaultAddress;
      PVOID MdlForLockedTeb;
 } KTHREAD, *PKTHREAD;

KTHREAD

 typedef struct _ETHREAD
 {
      KTHREAD Tcb;
      LARGE_INTEGER CreateTime;
      union
      {
           LARGE_INTEGER ExitTime;
           LIST_ENTRY KeyedWaitChain;
      };
      union
      {
           LONG ExitStatus;
           PVOID OfsChain;
      };
      union
      {
           LIST_ENTRY PostBlockList;
           struct
           {
                PVOID ForwardLinkShadow;
                PVOID StartAddress;
           };
      };
      union
      {
           PTERMINATION_PORT TerminationPort;
           PETHREAD ReaperLink;
           PVOID KeyedWaitValue;
           PVOID Win32StartParameter;
      };
      ULONG ActiveTimerListLock;
      LIST_ENTRY ActiveTimerListHead;
      CLIENT_ID Cid;
      union
      {
           KSEMAPHORE KeyedWaitSemaphore;
           KSEMAPHORE AlpcWaitSemaphore;
      };
      PS_CLIENT_SECURITY_CONTEXT ClientSecurity;
      LIST_ENTRY IrpList;
      ULONG TopLevelIrp;
      PDEVICE_OBJECT DeviceToVerify;
      _PSP_RATE_APC * RateControlApc;
      PVOID Win32StartAddress;
      PVOID SparePtr0;
      LIST_ENTRY ThreadListEntry;
      EX_RUNDOWN_REF RundownProtect;
      EX_PUSH_LOCK ThreadLock;
      ULONG ReadClusterSize;
      LONG MmLockOrdering;
      ULONG CrossThreadFlags;
      ULONG Terminated: ;
      ULONG ThreadInserted: ;
      ULONG HideFromDebugger: ;
      ULONG ActiveImpersonationInfo: ;
      ULONG SystemThread: ;
      ULONG HardErrorsAreDisabled: ;
      ULONG BreakOnTermination: ;
      ULONG SkipCreationMsg: ;
      ULONG SkipTerminationMsg: ;
      ULONG CopyTokenOnOpen: ;
      ULONG ThreadIoPriority: ;
      ULONG ThreadPagePriority: ;
      ULONG RundownFail: ;
      ULONG SameThreadPassiveFlags;
      ULONG ActiveExWorker: ;
      ULONG ExWorkerCanWaitUser: ;
      ULONG MemoryMaker: ;
      ULONG ClonedThread: ;
      ULONG KeyedEventInUse: ;
      ULONG RateApcState: ;
      ULONG SelfTerminate: ;
      ULONG SameThreadApcFlags;
      ULONG Spare: ;
      ULONG StartAddressInvalid: ;
      ULONG EtwPageFaultCalloutActive: ;
      ULONG OwnsProcessWorkingSetExclusive: ;
      ULONG OwnsProcessWorkingSetShared: ;
      ULONG OwnsSystemWorkingSetExclusive: ;
      ULONG OwnsSystemWorkingSetShared: ;
      ULONG OwnsSessionWorkingSetExclusive: ;
      ULONG OwnsSessionWorkingSetShared: ;
      ULONG OwnsProcessAddressSpaceExclusive: ;
      ULONG OwnsProcessAddressSpaceShared: ;
      ULONG SuppressSymbolLoad: ;
      ULONG Prefetching: ;
      ULONG OwnsDynamicMemoryShared: ;
      ULONG OwnsChangeControlAreaExclusive: ;
      ULONG OwnsChangeControlAreaShared: ;
      ULONG PriorityRegionActive: ;
      UCHAR CacheManagerActive;
      UCHAR DisablePageFaultClustering;
      UCHAR ActiveFaultCount;
      ULONG AlpcMessageId;
      union
      {
           PVOID AlpcMessage;
           ULONG AlpcReceiveAttributeSet;
      };
      LIST_ENTRY AlpcWaitListEntry;
      ULONG CacheManagerCount;
 } ETHREAD, *PETHREAD;

ETHREAD

杀死线程是通过APC来实现的。首先会判断当前线程是否是最后的线程，如果是就直接调用     结束当前线程。如果有别的线程就向它们插入一个APC，用于结束。