📄 788.html
字号:
PsSetCreateProcessNotifyRoutine(ProcessCreateMon, TRUE);<br />
MyRemoveCraeteThreadNotifyRoutine(ThreadCreateMon);<br />
if(pDriverObject->DeviceObject != NULL)<br />
{<br />
status=IoDeleteSymbolicLink( &devLinkUnicd );<br />
if ( !NT_SUCCESS( status ) )<br />
{<br />
DbgPrint(( "IoDeleteSymbolicLink() failed\n" ));<br />
return status; <br />
}<br />
IoDeleteDevice( pDriverObject->DeviceObject );<br />
}<br />
return STATUS_SUCCESS;<br />
}<br />
<br />
NTSTATUS DeviceIoControlDispatch(<br />
IN PDEVICE_OBJECT DeviceObject,<br />
IN PIRP pIrp<br />
)<br />
{<br />
PIO_STACK_LOCATION irpStack;<br />
NTSTATUS status;<br />
PVOID inputBuffer;<br />
ULONG inputLength;<br />
PVOID outputBuffer;<br />
ULONG outputLength;<br />
OBJECT_HANDLE_INFORMATION objHandleInfo;<br />
<br />
status = STATUS_SUCCESS;<br />
// 取出IOCTL请求代码<br />
irpStack = IoGetCurrentIrpStackLocation(pIrp);<br />
<br />
switch (irpStack->MajorFunction)<br />
{<br />
case IRP_MJ_CREATE :<br />
DbgPrint("Call IRP_MJ_CREATE\n");<br />
break;<br />
case IRP_MJ_CLOSE:<br />
DbgPrint("Call IRP_MJ_CLOSE\n");<br />
break;<br />
case IRP_MJ_DEVICE_CONTROL:<br />
DbgPrint("IRP_MJ_DEVICE_CONTROL\n");<br />
inputLength=irpStack->Parameters.DeviceIoControl.InputBufferLength;<br />
outputLength=irpStack->Parameters.DeviceIoControl.OutputBufferLength;<br />
switch (irpStack->Parameters.DeviceIoControl.IoControlCode) <br />
{<br />
case IOCTL_PASSEVENT: //用事件做通信<br />
inputBuffer = pIrp->AssociatedIrp.SystemBuffer;<br />
<br />
DbgPrint("inputBuffer:%08x\n", (HANDLE)inputBuffer);<br />
status = ObReferenceObjectByHandle(*(HANDLE *)inputBuffer,<br />
GENERIC_ALL,<br />
NULL,<br />
KernelMode,<br />
&gpEventObject,<br />
&objHandleInfo);<br />
<br />
if(status!=STATUS_SUCCESS)<br />
{<br />
DbgPrint("wrong\n");<br />
break;<br />
}<br />
break;<br />
case IOCTL_UNPASSEVENT:<br />
if(gpEventObject)<br />
ObDereferenceObject(gpEventObject); <br />
DbgPrint("UNPASSEVENT called\n");<br />
break;<br />
case IOCTL_PASSBUF:<br />
RtlCopyMemory(pIrp->UserBuffer, outBuf, outputLength);<br />
break;<br />
case IOCTL_PASSEVSTRUCT:<br />
inputBuffer = pIrp->AssociatedIrp.SystemBuffer;<br />
memset(&CheckList, 0, sizeof(CheckList));<br />
RtlCopyMemory(&CheckList, inputBuffer, sizeof(CheckList));<br />
DbgPrint("%d:%d\n", CheckList.ONLYSHOWREMOTETHREAD, CheckList.SHOWTHREAD);<br />
break;<br />
default:<br />
break;<br />
}<br />
break;<br />
default:<br />
DbgPrint("Call IRP_MJ_UNKNOWN\n");<br />
break;<br />
}<br />
<br />
pIrp->IoStatus.Status = status; <br />
pIrp->IoStatus.Information = 0; <br />
IoCompleteRequest (pIrp, IO_NO_INCREMENT);<br />
return status;<br />
}<br />
<br />
NTSTATUS DriverEntry( IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING theRegistryPath )<br />
{<br />
NTSTATUS Status; <br />
PDEVICE_OBJECT pDevice;<br />
<br />
DbgPrint("DriverEntry called!\n");<br />
g_bMainThread = FALSE;<br />
<br />
if(1!=GetRegValue(L"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", L"CSDVersion", Version))<br />
{<br />
DbgPrint("GetRegValueDword Wrong\n");<br />
}<br />
PsGetVersion(NULL, NULL, &BuildNumber, NULL);<br />
DbgPrint("[[[%d]]]:[[[%ws]]]", BuildNumber, Version);<br />
<br />
RtlInitUnicodeString (&devNameUnicd, devName );<br />
RtlInitUnicodeString (&devLinkUnicd, devLink );<br />
<br />
Status = IoCreateDevice ( pDriverObject,<br />
0,<br />
&devNameUnicd,<br />
FILE_DEVICE_UNKNOWN,<br />
0,<br />
TRUE,<br />
&pDevice );<br />
if( !NT_SUCCESS(Status)) <br />
{<br />
DbgPrint(("Can not create device.\n"));<br />
return Status;<br />
}<br />
<br />
Status = IoCreateSymbolicLink (&devLinkUnicd, &devNameUnicd);<br />
if( !NT_SUCCESS(Status)) <br />
{<br />
DbgPrint(("Cannot create link.\n"));<br />
return Status;<br />
}<br />
<br />
ProcessNameOffset = GetProcessNameOffset();<br />
<br />
pDriverObject->DriverUnload = OnUnload; <br />
pDriverObject->MajorFunction[IRP_MJ_CREATE] = <br />
pDriverObject->MajorFunction[IRP_MJ_CLOSE] =<br />
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DeviceIoControlDispatch;<br />
<br />
Status = PsSetCreateProcessNotifyRoutine(ProcessCreateMon, FALSE);<br />
if (!NT_SUCCESS( Status ))<br />
{<br />
DbgPrint("PsSetCreateProcessNotifyRoutine()\n");<br />
return Status;<br />
}<br />
<br />
Status = PsSetCreateThreadNotifyRoutine(ThreadCreateMon);<br />
if (!NT_SUCCESS( Status ))<br />
{<br />
DbgPrint("PsSetCreateThreadNotifyRoutine()\n");<br />
return Status;<br />
}<br />
<br />
return STATUS_SUCCESS;<br />
}<br />
////////////////////////////////////////////////////////////////////////////////////////////////////////////<br />
<br />
<br />
main.c, 这里我用事件做为通信驱动<br />
////////////////////////////////////////////////////////////////////////////////////////////////////////////<br />
// Made By ZwelL<br />
<br />
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -