main.cpp

实现了隐藏进程,使进程对任务管理器和进程查看器均不可见,使文件对资源管理器不可见 是驱动编程入门的好例子

#include "common.h"
#include "Ioctl.h"
extern "C"
{
	NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath);
	VOID	 DriverUnload(IN PDRIVER_OBJECT DriverObject);
	NTSTATUS CompleteIrp(PIRP Irp, NTSTATUS status, ULONG info);
	NTSTATUS DeviceControlRoutine( IN PDEVICE_OBJECT fdo, IN PIRP Irp );
	NTSTATUS Close_HandleIRPprocessing(IN PDEVICE_OBJECT fdo,IN PIRP Irp);
	NTSTATUS Create_File_IRPprocessing(IN PDEVICE_OBJECT fdo,IN PIRP Irp);
}// extern "C"

#include "HookFile.h"
#include "HookProcess.h"
#include "QueryMng.h"
#include "HookMng.h"
////////////////////////////////////////////////////////////////////////////////////
/*InitializeHooks: this function initializes all possible hooks*/
void InitializeHooks();
/*DeviceName: the name of current driver*/
UNICODE_STRING DeviceName;
/*SymbolicLinkName: the symbolic link of driver location*/
UNICODE_STRING SymbolicLinkName;
/*deviceObject: the object associated with the driver*/
PDEVICE_OBJECT deviceObject = NULL;
/*gQueryMng: used for dispatching IOCTL queries*/
static QueryMng gQueryMng;
/*gHookMng: used for hooking functions*/
static HookMng	 gHookMng;

////////////////////////////////////////////////////////////////////////////////////


NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,
                     IN PUNICODE_STRING RegistryPath)
{
	PDRIVER_DISPATCH *mj_func;
	NTSTATUS st;
	PCWSTR dDeviceName       = L"\\Device\\HideDriver";
    PCWSTR dSymbolicLinkName = L"\\DosDevices\\HideDriver";

	DbgPrint("\t------START------\n");


	libcpp_init();

    RtlInitUnicodeString(&DeviceName,       dDeviceName);
    RtlInitUnicodeString(&SymbolicLinkName, dSymbolicLinkName);

    st = IoCreateDevice(DriverObject,    // pointer on DriverObject
		                0,               // additional size of memory, for dev. extension
		                &DeviceName,     // pointer to UNICODE_STRING
                        FILE_DEVICE_NULL,// Device type
						0,               // Device characteristic
                        FALSE,           // "Exclusive" device
						&deviceObject);  // pointer do device object


    if (st == STATUS_SUCCESS)
      st = IoCreateSymbolicLink(&SymbolicLinkName,
	                            &DeviceName);      

	mj_func = DriverObject->MajorFunction;
	DriverObject->DriverUnload = DriverUnload;
	
	mj_func[IRP_MJ_DEVICE_CONTROL] = DeviceControlRoutine;
	mj_func[IRP_MJ_CREATE] = Create_File_IRPprocessing;
	mj_func[IRP_MJ_CLOSE]  = Close_HandleIRPprocessing;
	
	// ............................ //
	InitializeHooks();

	return STATUS_SUCCESS;
}

void InitializeHooks()
{
	gHookMng.CleanQueuedHooks();

	HookProcessInit(gHookMng,gQueryMng); //HookProcess.h
	HookFileInit(gHookMng,gQueryMng);	 //HookFile.h

	if(!gHookMng.ApplyQueuedHooks())
		DbgPrint("InitializeHooks - ERROR ApplyQueuedHooks\n");
}
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
{	
	gHookMng.ClearHooks();

	IoDeleteSymbolicLink(&SymbolicLinkName);
	IoDeleteDevice(deviceObject);

	HookFileExit();		//HookProcess.h
	HookProcessExit();	//HookFile.h
		
	// Cpp unload
	libcpp_exit();

	DbgPrint("\t------EXIT------\n");
	
	return;
}
NTSTATUS CompleteIrp( PIRP Irp, NTSTATUS status, ULONG info)
{
	Irp->IoStatus.Status = status;
	Irp->IoStatus.Information = info;
	IoCompleteRequest(Irp,IO_NO_INCREMENT);
	return status;
}
NTSTATUS DeviceControlRoutine( IN PDEVICE_OBJECT fdo, IN PIRP pIrp )
{
	/*
	* sends IRP for dispatching by Query manager
	* IRP will be completed by Query manager		
	*/
	return gQueryMng.ProcessIrp(pIrp);	
}
// Create_File_IRPprocessing: process IRP_MJ_CREATE query.
NTSTATUS Create_File_IRPprocessing(IN PDEVICE_OBJECT fdo,IN PIRP Irp)
{
	DbgPrint("-HideDriver- IRP_MJ_CREATE\n");

	return CompleteIrp(Irp,STATUS_SUCCESS,0);
}

// Close_File_IRPprocessing: process IRP_MJ_CLOSE query.
NTSTATUS Close_HandleIRPprocessing(IN PDEVICE_OBJECT fdo,IN PIRP Irp)
{
	DbgPrint("-HideDriver- IRP_MJ_CLOSE\n");

	return CompleteIrp(Irp,STATUS_SUCCESS,0);
}