?????????Process????????????????????????????????????????????л????????????????????????????????λ?????????????????????????????????κ????е???壬???????????塣?????????????????????????????????У???????????塣???????????????????????У??????????????????????????????????????????????????????????????????????????е????????????
????????Thread?????????????壬??CPU??????????????λ???????????????У???????????????У????????????????п????????????????????????????????????????????????????????????????????????????
???????????ó?????????????????????????CreateProcess??????????????????(???windows??????????????????????explorer.exe????CreateProcess?????)??????????????????????2?????????
????1.???????y???????е?????????
????2.????Windows???????????
????3.??????????????????л???????????????????????
????4.??Windows??????????????(?????????????????????????Э??????????????????/???????????????????????Csrss.exe)??
????5.?????г?????(???????????????????CREATE_SUSPENDED?????????????????)??
????6.??????????????????????????????????????????DLL????????????????????С?
?????????????????????????????????????????????????????????????????????
????1.???????y???????е?????????
??????????????????е?Windows?????????????????????????潫??????μ??????????С?
????2.????Windows???????????
???????????????????????????????NtCreateProcess?????????Windwos??????????????崠?????
????(1)????EPROCESS
????*?????????EPROCESS????
????*??????????е????????????????
????*?????????С???????????????????????PsMinimumWorkingSet PsMaximumWorkingSet??
????*???????????????????????????????????????????????????ü???
????*???Windows???豸??????
????*???????????ID???????????????InheritedFormUniqueProcessId??
????*?????y??????????????
????*?????????????
????*??????????????????STATUS_PENDING
????(2)?????????????????
????*???????????д??????????????????
????*??MmresidentAvailablePage??????????????С
????*????????????????????????????????
????(3)????????????KPROCESS
????(4)?????????????????????
????(5)????PEB
????(6)??????????????????????
????3.??????????????????л???????????????????????
?????????Windows??????????????????????????????????????????????У?????????????NtCreateThread?????????????????????????????????塣
????4.??Windows??????????????(?????????????????????????Э??????????????????/???????????????????????Csrss.exe)?????????????????????(Kernel32.dll)??Windows????(Csrss)?????????????????????????????????????????????????????顣??Csrss?????????????????????????
????*???????y?????????
????*???y????????
????*????Csrss?????
????*???????????????????Csrss?У????????y???????????Csrss?????????????
????*?????????Csrss????
????*?????????????????б???
????*????????Csrss??????б???
????*?????????????
????5.?????г?????(???????????????????CREATE_SUSPENDED?????????????????)????????????????????????????п??????????????????????????????????
????6.??????????????????????????????????????????DLL????????????????????С?
????????????????ldrInitializeThunk??????????????????????NLS??TLS????????????????????????κα??????DLL??????
????DLL_PROCESS_ATTACH??????????????DLL??????????????????????????????APC?????????????????????????У?????????????????????????С?
???????????????????????е??????????????д????????????????????????????????