.386
.model flat, stdcall
option casemap:none

include D:\MASMPlus\Include\ntddk.inc
includelib D:\MASMPlus\lib\ntoskrnl.lib
include D:\MASMPlus\Include\ntoskrnl.inc

.data
KiSystemServicestr db "KiSystemService Addr%08X",0
DriverUnloadStr db "DriverUnload",0
KiSystemService dd ?

.code
DriverUnload proc pDriverObject:PDRIVER_OBJECT
Invoke DbgPrint,addr DriverUnloadStr
mov eax, STATUS_SUCCESS
ret
DriverUnload endp

.code INIT
DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING
local idtr[8]:BYTE 

             		    ;int 3
			    sidt idtr
			    lea ebx,idtr
			    mov ecx,DWORD  ptr[ebx+2]
			    add ecx,368 ;KiSystemService 2E*8
			    mov ebx,0
			    mov bx,WORD  ptr[ecx+6]
			    shl ebx,16
			    mov bx,WORD  ptr[ecx]
			    mov KiSystemService,ebx
			    invoke DbgPrint,addr KiSystemServicestr,ebx
            mov eax, pDriverObject
            assume eax:PTR DRIVER_OBJECT
            mov [eax].DriverUnload, offset DriverUnload
            assume eax:nothing
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
mov eax, STATUS_SUCCESS
ret
DriverEntry endp

end DriverEntry

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课