[C] 纯文本查看 复制代码#include

/*

First Driver

*/

//未文档化的函数->通过名字获取设备对象

NTKERNELAPI

NTSTATUS

ObReferenceObjectByName(

IN PUNICODE_STRING ObjectName,

IN ULONG Attributes,

IN PACCESS_STATE PassedAccessState OPTIONAL,

IN ACCESS_MASK DesiredAccess OPTIONAL,

IN POBJECT_TYPE ObjectType OPTIONAL,

IN KPROCESSOR_MODE AccessMode,

IN OUT PVOID ParseContext OPTIONAL,

OUT PVOID *Object

);

extern POBJECT_TYPE *IoDriverObjectType;

PDRIVER_OBJECT g_FilterDriverObject;

//保存以前的驱动请求例程

PDRIVER_DISPATCH g_OrigReadCompeleteRoutine;

//驱动过滤例程

NTSTATUS FilterReadCompeleteRoutine(__in struct _DEVICE_OBJECT *DeviceObject,__inout struct _IRP *Irp)

{

KdPrint(("拦截到数据读取！"));

return g_OrigReadCompeleteRoutine(DeviceObject, Irp);

}

//卸载HOOK函数

NTSTATUS UnfilterDriverRoutinue()

{

//检测地址是否有效(可读可写)

if (MmIsAddressValid(g_FilterDriverObject))

{

//写回原例程

g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = g_OrigReadCompeleteRoutine;

}

return STATUS_SUCCESS;

}

//驱动过滤函数->配合 ObReferenceObjectByname

NTSTATUS FilterDriverQuery()

{

NTSTATUS Status ;

UNICODE_STRING usObjectName;

RtlInitUnicodeString(&usObjectName, L"\\Driver\\Xuetr");

//取出驱动对象

Status = ObReferenceObjectByName(

&usObjectName,

OBJ_CASE_INSENSITIVE,

NULL,

0,

*IoDriverObjectType,

KernelMode,

NULL,

(PVOID*)&g_FilterDriverObject

);

if (!NT_SUCCESS(Status)) {

//返回失败值

KdPrint(("取出驱动对象失败！！！"));

return Status;

}

//打印驱动指针对象地址

KdPrint(("驱动指针地址：0x%x", g_FilterDriverObject));

//保存原有驱动实例

g_OrigReadCompeleteRoutine = g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL];

//启动过滤

g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = FilterReadCompeleteRoutine;

return STATUS_SUCCESS;

}

//卸载函数

NTSTATUS Unload(IN PDRIVER_OBJECT pDriverObject)

{

//清理符号连接和设备对象，避免内存泄漏

UNICODE_STRING usSysname;

RtlInitUnicodeString(&usSysname, L"\\??\\CEpassTP");

if (pDriverObject->DeviceObject != NULL)

{

IoDeleteSymbolicLink(&usSysname);

IoDeleteDevice(pDriverObject->DeviceObject);

KdPrint(("删除设备对象和符号连接完成！"));

}

UnfilterDriverRoutinue();

return STATUS_SUCCESS;

}

//创建设备对象

NTSTATUS CreatDevice(PDRIVER_OBJECT pDriverObject)

{

//记录返回值

NTSTATUS Status;

//定义设备对象

PDEVICE_OBJECT pDevobj;

//设备对象名字字符串

UNICODE_STRING usDevName;

//设备符号连接字符串

UNICODE_STRING usSysName;

//初始化设备名

RtlInitUnicodeString(&usDevName, L"\\Device\\CEpassTP");

//创建设备->赋值创建状态

Status = IoCreateDevice(pDriverObject, \

0, \

&usDevName, \

FILE_DEVICE_UNKNOWN, \

FILE_DEVICE_SECURE_OPEN,\

TRUE,\

&pDevobj

);

//通过宏->判断创建状态

if (!(NT_SUCCESS(Status)))

{

return Status;

}

//或运算赋值

pDevobj->Flags |= DO_BUFFERED_IO;

//初始化符号连接名

RtlInitUnicodeString(&usSysName, L"\\??\\CEpassTP");

//创建符号连接

Status = IoCreateSymbolicLink(&usSysName, &usDevName);

if (!NT_SUCCESS(Status))

{

//不成功删除设备对象-返回错误值

IoDeleteDevice(pDevobj);

return Status;

}

return STATUS_SUCCESS;

}

//PIRP 传送数据包

NTSTATUS CreateCompleteRoutine(PDEVICE_OBJECT pDeviceobj,PIRP pIrp)

{

//注册标准参数实例例程，避免蓝屏

NTSTATUS Status;

Status = STATUS_SUCCESS;

KdPrint(("驱动例程创建完成！"));

pIrp->IoStatus.Status = Status;//设置传送状态

pIrp->IoStatus.Information = 0;//操作字节数返回

IoCompleteRequest(pIrp, IO_NO_INCREMENT);//终结IRP传递

return Status;

}

NTSTATUS CloseCompleteRoutine(PDEVICE_OBJECT pDeviceobj, PIRP pIrp)

{

//注册标准参数实例例程，避免蓝屏

NTSTATUS Status;

Status = STATUS_SUCCESS;

KdPrint(("驱动例程关闭成功！"));

pIrp->IoStatus.Status = Status;//设置传送状态

pIrp->IoStatus.Information = 0;//操作字节数返回

IoCompleteRequest(pIrp, IO_NO_INCREMENT);//终结IRP传递

return Status;

}

NTSTATUS ReadCompleteRoutine(PDEVICE_OBJECT pDeviceobj, PIRP pIrp)

{

//注册标准参数实例例程，避免蓝屏

NTSTATUS Status;

Status = STATUS_SUCCESS;

KdPrint(("例程内存读取！"));

pIrp->IoStatus.Status = Status;//设置传送状态

pIrp->IoStatus.Information = 0;//操作字节数返回

IoCompleteRequest(pIrp, IO_NO_INCREMENT);//终结IRP传递

return Status;

}

NTSTATUS WriteCompleteRoutine(PDEVICE_OBJECT pDeviceobj, PIRP pIrp)

{

//注册标准参数实例例程，避免蓝屏

NTSTATUS Status;

Status = STATUS_SUCCESS;

KdPrint(("例程写内存！"));

pIrp->IoStatus.Status = Status;//设置传送状态

pIrp->IoStatus.Information = 0;//操作字节数返回

IoCompleteRequest(pIrp, IO_NO_INCREMENT);//终结IRP传递

return Status;

}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING RegistryPath){

//KdBreakPoint();//断点

NTSTATUS Status;

Status = CreatDevice(pDriverObject);

if (!NT_SUCCESS(Status))

{

KdPrint(("创建设备对象失败！"));

}

else

{

KdPrint(("创建设备对象成功！\n"));

KdPrint(("注册表路径：%wZ ",RegistryPath));

}

//注册请求例程->发送到IO管理器进行处理

pDriverObject->MajorFunction[IRP_MJ_CREATE] = CreateCompleteRoutine;

pDriverObject->MajorFunction[IRP_MJ_CLOSE] = CloseCompleteRoutine;

pDriverObject->MajorFunction[IRP_MJ_READ] = ReadCompleteRoutine;

pDriverObject->MajorFunction[IRP_MJ_WRITE] = WriteCompleteRoutine;

pDriverObject->DriverUnload = Unload;

//开启驱动过滤

FilterDriverQuery();

return STATUS_SUCCESS;

}