jiurldriver.cpp

关于win2000核心编程的文章

#include "JiurlDriver.h"

void DriverUnload(IN PDRIVER_OBJECT DriverObject);

NTSTATUS DriverDispatch (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);

BOOLEAN JiurlMmIsBlockValid (PVOID StartVa,ULONG nBytes);

BOOLEAN JiurlReadMemory(
			PVOID  StartVa,
			ULONG  nBytes,
			PVOID  lpBuffer);

BOOLEAN JiurlReadProcessMemory(
			PVOID  pEProcess,
			PVOID  StartVa,
			ULONG  nBytes,
			PVOID  lpBuffer);

NTSTATUS 
DriverEntry(IN PDRIVER_OBJECT DriverObject,
			IN PUNICODE_STRING RegistryPath)
{
	DbgPrint("Hello, from DriverEntry\n");

	DriverObject->MajorFunction[IRP_MJ_CREATE]         =
	DriverObject->MajorFunction[IRP_MJ_CLOSE]          =
	DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DriverDispatch;

	DriverObject->DriverUnload=DriverUnload;

	/////////////////////////////////////////////////////

	NTSTATUS ret;

	PDEVICE_OBJECT deviceObject= NULL;

	WCHAR deviceNameBuffer[]= L"\\Device\\JiurlDriver";
	UNICODE_STRING deviceNameUnicodeString;
	RtlInitUnicodeString (&deviceNameUnicodeString, deviceNameBuffer);

	ret=IoCreateDevice(DriverObject,0,&deviceNameUnicodeString,
		FILE_DEVICE_UNKNOWN,0,FALSE,&deviceObject);


	WCHAR deviceLinkBuffer[]= L"\\??\\JiurlSymbolicLink";
	UNICODE_STRING deviceLinkUnicodeString;
	RtlInitUnicodeString (&deviceLinkUnicodeString, deviceLinkBuffer);

	ret=IoCreateSymbolicLink(&deviceLinkUnicodeString,
		&deviceNameUnicodeString);

	return STATUS_SUCCESS;
}

// -----------------------------------------------------------------

void DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
	DbgPrint("Bye, from DriverUnload\n");

	WCHAR deviceLinkBuffer[]= L"\\??\\JiurlSymbolicLink";
	UNICODE_STRING deviceLinkUnicodeString;
	RtlInitUnicodeString (&deviceLinkUnicodeString, deviceLinkBuffer);

    IoDeleteSymbolicLink (&deviceLinkUnicodeString);
	IoDeleteDevice( DriverObject->DeviceObject );
}

// -----------------------------------------------------------------

NTSTATUS
DriverDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
    PIO_STACK_LOCATION  irpStack;

    PVOID               ioBuffer;
    ULONG               inputBufferLength;
    ULONG               outputBufferLength;
    ULONG               ioControlCode;
    NTSTATUS            ntStatus;

    Irp->IoStatus.Status      = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;

    irpStack = IoGetCurrentIrpStackLocation (Irp);

    ioBuffer           = Irp->AssociatedIrp.SystemBuffer;
    inputBufferLength  = irpStack->Parameters.DeviceIoControl.InputBufferLength;
    outputBufferLength = irpStack->Parameters.DeviceIoControl.OutputBufferLength;

	int ret;

    switch (irpStack->MajorFunction)
    {
    case IRP_MJ_DEVICE_CONTROL:
		{
			DbgPrint("IRP_MJ_DEVICE_CONTROL\n");

			ioControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;

			switch (ioControlCode)
			{
			case IOCTL_MEM_OUTPUT:
				{
					DbgPrint("IOCTL_MEM_OUTPUT\n");

					PMEMORY_INFO pMemInfo;
					pMemInfo=(PMEMORY_INFO)ioBuffer;

					PVOID StartVa=(PVOID)pMemInfo->StartVa;
					ULONG nBytes=pMemInfo->nBytes;
					ULONG ProcessId=pMemInfo->ProcessId;

					PVOID pEProcess;

					if(ProcessId==0)
					{
						pEProcess=(PEPROCESS)*(ULONG*)PsIdleProcess;
					}
					else
					{
						ret= PsLookupProcessByProcessId(ProcessId,&pEProcess);

						if(!NT_SUCCESS(ret))
						{
							DbgPrint("Error PsLookupProcessByProcessId 0x%08x\n",ret);
							break;
						}
					}

					ret=JiurlReadProcessMemory(
						pEProcess,StartVa,nBytes,ioBuffer);
					if(ret==1)
					{
						DbgPrint("nBytes 0x%08x\n",nBytes);
						Irp->IoStatus.Information=nBytes;
					}
					
					break;
				}

			case IOCTL_PROCESS_NAME_OUTPUT:
				{
					DbgPrint("IOCTL_PROCESS_NAME_OUTPUT\n");

					ULONG ProcessId=*(ULONG*)ioBuffer;
					PVOID pEProcess;

					if(ProcessId==0)
					{
						pEProcess=(PEPROCESS)*(ULONG*)PsIdleProcess;
					}
					else
					{
						ret= PsLookupProcessByProcessId(ProcessId,&pEProcess);

						if(!NT_SUCCESS(ret))
						{
							DbgPrint("Error PsLookupProcessByProcessId 0x%08x\n",ret);
							break;
						}
					}

					if(pEProcess!=0)
					{
						RtlCopyMemory (ioBuffer, 
							((char *)pEProcess)+PROCESS_NAME_OFFSET, 16);
						Irp->IoStatus.Information=16;
					}
					break;
				}

			default:
				{
					DbgPrint("unknown IRP_MJ_DEVICE_CONTROL\n");
					Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;

					break;
				}
			}

			break;
		}

	case IRP_MJ_CREATE:
		{
			DbgPrint("DispatchCreate\n");
			break;
		}

	case IRP_MJ_CLOSE:
		{
			DbgPrint("DispatchClose\n");
			break;
		}
    }

    ntStatus = Irp->IoStatus.Status;
    IoCompleteRequest (Irp,IO_NO_INCREMENT);

    return ntStatus;
}

// -----------------------------------------------------------------

BOOLEAN JiurlMmIsBlockValid (PVOID StartVa,ULONG nBytes)
{
	PCHAR pData;
	ULONG nData;
		
	BOOLEAN ret;

	ret=TRUE;

	if(nBytes!=0)
	{
		pData=(char*)((unsigned int)StartVa & 0xFFFFF000);
		nData=(((nBytes+ (((unsigned int)StartVa)&0x00000FFF) -1)/PAGE_SIZE)+1)*PAGE_SIZE;

		do
		{
			ret=MmIsAddressValid(pData);

			nData -= PAGE_SIZE;

			pData += PAGE_SIZE;
		}
		while(ret && nData);
	}

	return ret;
}

// -----------------------------------------------------------------

BOOLEAN JiurlReadMemory(
			PVOID  StartVa,
			ULONG  nBytes,
			PVOID  lpBuffer)
{
	BOOLEAN ret;

	ret=JiurlMmIsBlockValid( StartVa, nBytes );

	if(ret==1) 
	{
		DbgPrint("Mem Valid\n");

		RtlCopyMemory (lpBuffer, StartVa, nBytes);
	}
	else 
	{
		DbgPrint("Mem Not Valid\n");
	}

	return ret;
}

// -----------------------------------------------------------------

BOOLEAN JiurlReadProcessMemory(
			PVOID  pEProcess,
			PVOID  StartVa,
			ULONG  nBytes,
			PVOID  lpBuffer)
{
	BOOLEAN ret;

	KeAttachProcess(pEProcess);

	ret=JiurlReadMemory(StartVa,nBytes,lpBuffer);

	KeDetachProcess();

	if(ret==1) 
	{
		DbgPrint("JiurlReadProcessMemory SUCCESS\n");
	}
	else 
	{
		DbgPrint("JiurlReadProcessMemory ERROR\n");
	}

	return ret;
}

// -----------------------------------------------------------------