commonfunc.cpp

在驱动下实现进程隐藏,在驱动下实现进程隐藏.

#include "CommonFunc.h"
bool PackadgeParser(WCHAR* pBuf,
					PUNICODE_STRING pName,
					PUNICODE_STRING pUser,
					PUNICODE_STRING pProc)
/*++

Routine Description:

Arguments:

Return Value:

--*/
{
	WCHAR* pFirstEndSymbol = wcschr(pBuf,L';');
	WCHAR* pSecondEndSymbol = wcschr(pFirstEndSymbol+1,L';');
	WCHAR* pThirdEndSymbol = wcschr(pSecondEndSymbol+1,L';');

	bool bad_search;
	bad_search =  pFirstEndSymbol == NULL;
	bad_search |= pSecondEndSymbol == NULL;
	bad_search |= pThirdEndSymbol == NULL;
	if(bad_search)
		return false;

	size_t str_size;
	// Copying file name
	str_size = pFirstEndSymbol - pBuf;
	WCHAR *BufName = new WCHAR[str_size+1];
	memcpy(BufName,pBuf,2*str_size);
	BufName[str_size] = L'\0';

	++pFirstEndSymbol; // Moving through ';' symbol
	str_size = pSecondEndSymbol - pFirstEndSymbol;
	WCHAR *BufUser = new WCHAR[str_size+1];
	memcpy(BufUser,pFirstEndSymbol,2*str_size);
	BufUser[str_size] = L'\0';

	++pSecondEndSymbol; // Moving through ';' symbol
	str_size = pThirdEndSymbol - pSecondEndSymbol;
	WCHAR *BufProc = new WCHAR[str_size+1];
	memcpy(BufProc,pSecondEndSymbol,2*str_size);
	BufProc[str_size] = L'\0';


	RtlInitUnicodeString(pName,BufName);
	RtlInitUnicodeString(pUser,BufUser);
	RtlInitUnicodeString(pProc,BufProc);

	return true;
}