typedef NTSTATUS (FASTCALL *PMYIOCALLDRIVER)(IN PDEVICE_OBJECT,IN PIRP);

PMYIOCALLDRIVER g_Old_IoCallDriver=NULL;

NTSTATUS FASTCALL NewIoCallDriver(IN PDEVICE_OBJECT device,IN PIRP Irp)
{
	NTSTATUS status=STATUS_SUCCESS;
	
	
	if(!g_Old_IoCallDriver)
			return status;
	
	__asm
	{
		 jmp g_Old_IoCallDriver
	}
	
	return status;	
}

PMYIOCALLDRIVER HookRoutine(PMYIOCALLDRIVER ChangeIoCallDriver,BOOLEAN HookOrNot)
{
		PMYIOCALLDRIVER Old_Io_CallDriver=NULL;
		UNICODE_STRING FunName;
		PCHAR address;
		
		RtlInitUnicodeString(&FunName,L"IofCallDriver");
		
		address=MmGetSystemRoutineAddress(&FunName);
		
		if(address==NULL)
				return NULL;
				
		if(HookOrNot)
		{
			 Old_Io_CallDriver=(PMYIOCALLDRIVER)(address+2);
			 g_Old_IoCallDriver=Old_Io_CallDriver;
			 InterlockedExchange((PLONG)(address+2),(LONG)ChangeIoCallDriver);
			 return Old_Io_CallDriver;
		}
		else
		{
			 g_Old_IoCallDriver=NULL;
			 InterlockedExchange((PLONG)(address+2),(LONG)ChangeIoCallDriver);
		}	
		
		return Old_Io_CallDriver; 
}

void HookIoCallUnload(IN  PDRIVER_OBJECT  DriverObject)
{
	 if(g_Old_IoCallDriver)
	 {
	 		HookRoutine(g_Old_IoCallDriver,FALSE);	
   }
}

NTSTATUS DriverEntry(
    IN  PDRIVER_OBJECT  DriverObject,
    IN  PUNICODE_STRING RegistryPath
    )
{
		
		DriverObject->DriverUnload = HookIoCallUnload;
		
		g_Old_IoCallDriver=HookRoutine(NewIoCallDriver,TRUE);
		
    return STATUS_SUCCESS;
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！