ioctl.h

在驱动下读取SSDT的例子

//////////////////////////////////////////////////////////////////////////
// SSDTDump by 李马
// http://www.titilima.cn
//////////////////////////////////////////////////////////////////////////

#define FILE_DRIVER_SSDTDUMP    0x0000420

#ifndef CTL_CODE
#define CTL_CODE( DeviceType, Function, Method, Access ) (                 \
    ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
)
#endif // CTL_CODE

#ifndef METHOD_NEITHER
#define METHOD_NEITHER 3
#endif // METHOD_NEITHER

//////////////////////////////////////////////////////////////////////////

#define IOCTL_GETSSDT  (ULONG)CTL_CODE( FILE_DRIVER_SSDTDUMP, 0x01, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA )

typedef struct _tagSSDT {
    PVOID pvSSDTBase;
    PVOID pvServiceCounterTable;
    ULONG ulNumberOfServices;
    PVOID pvParamTableBase;
} SSDT, *PSSDT;

#define IOCTL_GETPROC  (ULONG)CTL_CODE( FILE_DRIVER_SSDTDUMP, 0x02, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA )