mydriver.cpp

PhantOm,Ollydbg隐藏调试的辅助插件代码！

// MyDriver.cpp : Defines the entry point for the application.
//

/*
#include "stdafx.h"

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
 	// TODO: Place code here.

	return 0;
}

*/

//-------------------------------------------------------------------------------------------------------------
//包含必要头文件:
#include <stdio.h>
#include <ntddk.h>
#include <string.h>

//我的头文件:
#include "MyDriver.h"


//-------------------------------------------------------------------------------------------------------------
//全局变量在这里定义:

//-------------------------------------------------------------------------------------------------------------
//这里开始声明函数:

/*
#ifdef	__NMAKE_BUILD__ 
	NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
#endif //__NMAKE_BUILD__ end.
*/



//----------------------------------------------------------------------------------------------------------
//如果不用NMAKE编译的话,可以在头文件里取掉这个标志:
#ifndef	__NMAKE_BUILD__ 


//----------------------------------------------------------------------------------------------------------
//
//Routine Description:
//
//    Installable driver initialization entry point.
//    This entry point is called directly by the I/O system.
//
//Arguments:
//
//    DriverObject - pointer to the driver object
//
//    RegistryPath - pointer to a unicode string representing the path
//                   to driver-specific key in the registry
//
//Return Value:
//
//    STATUS_SUCCESS if successful,
//    STATUS_UNSUCCESSFUL otherwise

NTSTATUS _DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS ntStatus = STATUS_SUCCESS;

	UNICODE_STRING usDriverName, usDosDeviceName;
    DbgPrint("DriverEntry Called \r\n");
	
    RtlInitUnicodeString(&usDriverName, L"\\Device\\Example");
    RtlInitUnicodeString(&usDosDeviceName, L"\\DosDevices\\Example");
	DbgPrint("%S",usDriverName);

    return ntStatus;
}

#else //__NMAKE_BUILD__ else.

//---------------------------------------------------------------------------------------------------------
//nmake 编译驱动的时候默认的入口必须是这个:
//不然会提示找不到入口:
//CPP文件必须用extern "C",不然找不到函数:
//
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS ntStatus = STATUS_SUCCESS;

    return ntStatus;
}

#endif //__NMAKE_BUILD__ end.