t-procmon.h

剖析Windows系统服务调用机制相关及驱动编程模式

#ifndef T_PROCMON_H
#define T_PROCMON_H

#include "windows.h"
#include "winioctl.h"
#include "stdio.h"
#include "tchar.h"
#include "../Driver/T-ProcMonCtl.h"

#ifndef INVALID_SET_FILE_POINTER
#define INVALID_SET_FILE_POINTER 0xFFFFFFFF
#endif 

BOOL
LoadDeviceDriver(
IN     PTSTR   DriverName,
IN     PTSTR   DriverPath,
OUT    HANDLE* pDeviceHandle);

BOOL
UnloadDeviceDriver(
IN     PTSTR   DriverName);

BOOL
RemoveDeviceDriver(
IN     PTSTR   DriverName);

BOOL
InstallDriver(
IN     SC_HANDLE  scManager,
IN     LPTSTR     DriverName,
IN     LPTSTR     DriverPath);

BOOL
StartDriver(
IN     SC_HANDLE  scManager,
IN     LPTSTR     DriverName);

BOOL
StopDriver(
IN     SC_HANDLE  scManager,
IN     LPTSTR     DriverName);

BOOL
RemoveDriver(
IN     SC_HANDLE  scManager,
IN     LPTSTR     DriverName);

BOOL
OpenDevice(
IN     LPTSTR     DriverName,
OUT    HANDLE *   pDeviceHandle);

BOOL 
WINAPI
CtrlEvent(
IN     DWORD);

VOID
ShowMessageU(
VOID);

VOID 
Start(
VOID);

VOID
Usage(
VOID);

BOOL
GetHiddenProcessName(
VOID);

BOOL 
DelProcessName(
VOID);

BOOL 
AddProcessName(
VOID);

VOID
Abort(
VOID);

static HANDLE    SysHandle = INVALID_HANDLE_VALUE;
BOOL             bMonitor  = FALSE;
TCHAR            Message[MAX_MESSAGE];
TCHAR            DriverPath[MAX_PATH];
TCHAR            InitPath[MAX_PATH];
DWORD            MessageLength;
DWORD            dwIndex;
WIN32_FIND_DATA  FindData;
HANDLE           hFindFile;
#endif