entry.cpp

在驱动下读取SSDT的例子

//////////////////////////////////////////////////////////////////////////
// SSDTDump by 李马
// http://www.titilima.cn
//////////////////////////////////////////////////////////////////////////

#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#include "Driver.h"
#include "..\SYS\ioctl.h"
#include "SSDTDump.h"

int main( void )
{
    TCHAR strDriver[MAX_PATH];
    if ( !GetDriverPath( strDriver, MAX_PATH ) )
    {
        puts( "Can't find driver!" );
        return -1;
    }

    HANDLE hDriver = LoadDriver( strDriver );
    if ( INVALID_HANDLE_VALUE == hDriver )
    {
        puts( "Load driver failed!" );
        return -1;
    }

    SSDT ssdt;
    if ( GetSSDT( hDriver, &ssdt ) )
    {
        printf( "Base Address = 0x%08X\tService Count = 0x%X\r\n",
            ssdt.pvSSDTBase, ssdt.ulNumberOfServices );
        puts( "-------------------------\t---------------------" );
    }

    HMODULE hNtDll = GetModuleHandle( _T("ntdll.dll") );
    if ( NULL == hNtDll )
    {
        puts( "Can't open ntdll.dll!" );
        return -1;
    }
    puts( "Idx\tModule\t\tAddr\t\tName" );
    puts( "------\t------------\t----------\t-------------------" );
    EnumSSDT( hDriver, hNtDll );

    UnloadDriver( hDriver );

    return EXIT_SUCCESS;
}