分享别人写的老代码,驱动保护进程 委员长 · · Windows程序设计
36 3 1

本文共计3092个字,预计阅读时长12.4分钟。

#include <ntddk.h>
#include <windef.h>
#include <stdlib.h>
#include <ntimage.h>
#include "declare.h"
#include "MyDriver.h"    
#include "LDasm.h"  
#include "ssdt.h"
#include "hookkifc.h"

VOID DriverUnload(PDRIVER_OBJECT pDriverObj)
{	
	UNICODE_STRING strLink;
	RtlInitUnicodeString(&strLink, LINK_NAME);
	IoDeleteSymbolicLink(&strLink);
	IoDeleteDevice(pDriverObj->DeviceObject);
}

NTSTATUS DispatchCreate(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}

NTSTATUS DispatchClose(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}

NTSTATUS DispatchIoctl(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST,st2;
	PIO_STACK_LOCATION pIrpStack;
	ULONG uIoControlCode;
	PVOID pIoBuffer;
	ULONG uInSize;
	ULONG uOutSize;
	//
	pIrpStack = IoGetCurrentIrpStackLocation(pIrp);
	uIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;
	pIoBuffer = pIrp->AssociatedIrp.SystemBuffer;
	uInSize = pIrpStack->Parameters.DeviceIoControl.InputBufferLength;
	uOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;
	//
	switch(uIoControlCode)
	{
		case IOCTL_ULR3IN:
		{	
			memcpy(&ppid,pIoBuffer,sizeof(ppid));
			DbgPrint("LONG From R3: %ld",ppid);
			st2=PsLookupProcessByProcessId((HANDLE)ppid,&ppep);
			if (NT_SUCCESS(st2))
				LoadKiHooker();
			status = STATUS_SUCCESS;
			break;
		}
		case IOCTL_NULLIN:
		{
			UnloadKiHooker();
			status = STATUS_SUCCESS;
			break;
		}
	}
	if(status == STATUS_SUCCESS)
		pIrp->IoStatus.Information = uOutSize;
	else
		pIrp->IoStatus.Information = 0;	
	pIrp->IoStatus.Status = status;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return status;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString)
{
	NTSTATUS status = STATUS_SUCCESS;
	UNICODE_STRING ustrLinkName;
	UNICODE_STRING ustrDevName;  
	PDEVICE_OBJECT pDevObj;
	pDriverObj->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
	pDriverObj->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
	pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl;
	pDriverObj->DriverUnload = DriverUnload;
	RtlInitUnicodeString(&ustrDevName, DEVICE_NAME);
	status = IoCreateDevice(pDriverObj, 0, &ustrDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDevObj);
	if(!NT_SUCCESS(status))	return status;
	if(IoIsWdmVersionAvailable(1, 0x10))
		RtlInitUnicodeString(&ustrLinkName, LINK_GLOBAL_NAME);
	else
		RtlInitUnicodeString(&ustrLinkName, LINK_NAME);
	status = IoCreateSymbolicLink(&ustrLinkName, &ustrDevName);  	
	if(!NT_SUCCESS(status))
	{
		IoDeleteDevice(pDevObj); 
		return status;
	}
	return STATUS_SUCCESS;
}

用到的其他头文件和整个工程请下载附件

 

 

 

最后于 2023-1-30 被admin编辑 ,原因:
本帖中包含附件 XIUNO提示您如需下载请先回复并刷新本帖!

最新回复 ( 36 )
全部楼主
  • 19980626 @Ta
    0 2
  • 1140046011 @Ta
    0 3
    看看
  • xjjds2002 @Ta
    0 4
    学习学习
  • 蓝海随风 @Ta
    0 5
    学习
  • niurenyu @Ta
    0 6
    学习学习
  • aSnake @Ta
    0 7
    谢谢分享
  • k0sibe @Ta
    0 8
    学习感谢大佬
  • StupidLBLD @Ta
    0 9
    学习
  • GustabM @Ta
    0 10
    谢谢大佬