querymng.cpp

实现了隐藏进程,使进程对任务管理器和进程查看器均不可见,使文件对资源管理器不可见 是驱动编程入门的好例子

#include "QueryMng.h"
QueryMng::~QueryMng()
{
	mStorage.Clear();
}
bool QueryMng::AddRoutine(ULONG ControleCode,PFUNCTION_ROUTINE pFunctionPtr)
{
	return mStorage.Add(ControleCode,pFunctionPtr);
}
bool QueryMng::ProcessIrp(PIRP pIrp)
{
	ULONG BytesTxd =0; // Number of transmitted,received bytes
	NTSTATUS status = STATUS_SUCCESS;
	PIO_STACK_LOCATION IrpStack = IoGetCurrentIrpStackLocation(pIrp);

	// Getting the IOCTL code
	ULONG ControlCode =	IrpStack->Parameters.DeviceIoControl.IoControlCode;

	PVOID pFunc = mStorage.Get(ControlCode);

	if(pFunc != NULL)
	{
		// Function that process IRP will call CompleteIrp()
		return ((PFUNCTION_ROUTINE)pFunc)(pIrp);
	}
	// If no one subscribed for this IOCTL, return bad request.
	return CompleteIrp(pIrp,STATUS_INVALID_DEVICE_REQUEST,BytesTxd); 
}