int _tmain(int argc, _TCHAR* argv[])
{
//int nResult;
//int nNum1 = 1111, nNum2 = 2222;
//nResult = add(nNum1, nNum2);
//printf("%d + %d = %d\n",nNum1, nNum2, nResult);
ULONG pId;
HookNtOpenProcess(404);
//UnHookNtOpenProcess();
system("pause");
return 0;
}
/*******************************************************************************
*
* 函 数 名 : DriverEntry
* 功能描述 : D R I V E R E N T R Y P O I N T
* 参数列表 : pDriverObj --
* pRegistryString
* 说 明 :
* 返回结果 :
*
*******************************************************************************/
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObj,
IN PUNICODE_STRING pRegistryString)
{
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING ustrLinkName;
UNICODE_STRING ustrDevName;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pde = NULL ;
int i = 0;
dprintf("ProcessManageSys Driver\r\n"
"Compiled %s %s\r\nIn DriverEntry : %wZ\r\n",
__DATE__, __TIME__, pRegistryString);
// Register dispatch routines
/*
for(i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
{
pDriverObj->MajorFunction[i] = DispatchCommon;
}
*/
pDriverObj->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
pDriverObj->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
// Dispatch routine for communications
pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchDeviceControl;
// Unload routine
pDriverObj->DriverUnload = DriverUnload;
// Initialize the device name.
RtlInitUnicodeString(&ustrDevName, NT_DEVICE_NAME);
// Create the device object and device extension
status = IoCreateDevice(pDriverObj,
sizeof(DEVICE_EXTENSION),
&ustrDevName,
FILE_DEVICE_UNKNOWN,
0,
FALSE,
&pDevObj);
if(!NT_SUCCESS(status))
{
dprintf("Error, IoCreateDevice = 0x%x\r\n", status);
return status;
}
//// Get a pointer to our device extension
//deviceExtension = (PDEVICE_EXTENSION) deviceObject->DeviceExtension;
pde = (PDEVICE_EXTENSION)(pDevObj->DeviceExtension) ;
g_pde = pde ;
//// Save a pointer to the device object
//deviceExtension->DeviceObject = deviceObject;
if(IoIsWdmVersionAvailable(1,0x10))
{
//如果是支持符号链接用户相关性的系统
RtlInitUnicodeString(&ustrLinkName, SYMBOLIC_LINK_GLOBAL_NAME);
}
else
{
//不支持
RtlInitUnicodeString(&ustrLinkName, SYMBOLIC_LINK_NAME);
}
// Create a symbolic link to allow USER applications to access it.
status = IoCreateSymbolicLink(&ustrLinkName, &ustrDevName);
if(!NT_SUCCESS(status))
{
dprintf("Error, IoCreateSymbolicLink = 0x%x\r\n", status);
IoDeleteDevice(pDevObj);
return status;
}
//
// TODO: Add initialization code here.
//
// 成功之后就开始初始化我们的设备扩展结构体了
InitlizedDeviceExtension(pde) ;
// 这里也可以用来监控
//if(NT_SUCCESS(PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, FALSE)))
//{
// // 这里做标记
// pde->bIsSetCreateProcessNotifyRoutine = true ;
//}
// 挂钩NtOpenProcess
if(HookNtOpenProcess(pDevObj))
{
pde->bIsHookNtOpenProcess = true ;
}
// 挂钩NtQuerySystemInformation
if(HookNtQuerySystemInformation(pDevObj))
{
pde->bIsHookNtQuerySystemInformation = true ;
}
//// Tell the I/O Manger to do BUFFERED IO
// 读写操作使用缓冲区方式访问用户模式数据
// 一次只允许一个线程打开设备句柄
pDevObj->Flags |= DO_BUFFERED_IO | DO_EXCLUSIVE ;
// 移除初始标志
pDevObj->Flags &= ~DO_DEVICE_INITIALIZING ;
//// Save the DeviveObject
InitializeKernelUserManage() ;
Test() ;
dprintf("DriverEntry Success\r\n");
return STATUS_SUCCESS;
}
