整个项目比较大,代码上千行!!!
仅修改里面几行引起很怪的问题：
修改前：
RtlInitUnicodeString(&mKbdD, L"\\Driver\\kbdclass");
mStatus = ObReferenceObjectByName(&mKbdD, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &gKbdDO);
if (!NT_SUCCESS(mStatus)) {
DbgPrint("ObReferenceObjectByName \\Driver\\kbdclass failed %x.\n", mStatus);
return mStatus;
}
ObfDereferenceObject(gKbdDO);
KeAcquireSpinLock(&Globals.SpinLock, &mKirql);
MmPressKeyRecord = (PUCHAR)ExAllocatePoolWithTag(NonPagedPool, MAXPRESSKEYSIZE, MemoryTag);
if (NULL != MmPressKeyRecord) {
OldKeyboardRead = (OldMajorFunc)gKbdDO->MajorFunction[IRP_MJ_READ];
InterlockedCompareExchangePointer((PVOID)&gKbdDO->MajorFunction[IRP_MJ_READ], MyIRPKeyboardRead, OldKeyboardRead);//多CPU HOOK:本处指令,有待测试
}
KeReleaseSpinLock(&Globals.SpinLock, mKirql);
修改后：
RtlInitUnicodeString(&mKbdD, L"\\Driver\\kbdclass");
mStatus = ObReferenceObjectByName(&mKbdD, OBJ_CASE_INSENSITIVE, NULL, 0, (POBJECT_TYPE)IoDriverObjectType, KernelMode, NULL, &gKbdDO);
if (!NT_SUCCESS(mStatus)) {
DbgPrint("ObReferenceObjectByName \\Driver\\kbdclass failed %x.\n", mStatus);
return mStatus;
}
//KeAcquireSpinLock(&Globals.SpinLock, &mKirql);
KeRaiseIrql(HIGH_LEVEL, &mKirql);
MmPressKeyRecord = (PUCHAR)ExAllocatePoolWithTag(NonPagedPool, MAXPRESSKEYSIZE, MemoryTag);
if (NULL != MmPressKeyRecord) {
OldKeyboardRead = (OldMajorFunc)gKbdDO->MajorFunction[IRP_MJ_READ];
//InterlockedCompareExchangePointer((PVOID)&gKbdDO->MajorFunction[IRP_MJ_READ], MyIRPKeyboardRead, OldKeyboardRead);//多CPU HOOK:本处指令,有待测试
gKbdDO->MajorFunction[IRP_MJ_READ] = MyIRPKeyboardRead;
}
//KeReleaseSpinLock(&Globals.SpinLock, mKirql);
KeLowerIrql(mKirql);
ObfDereferenceObject(gKbdDO);
修改后的加载
提示!!!ObReferenceObjectByName \Driver\kbdclass failed c0000024.
使用WINDBG加载上PDB调试,蓝屏位置在代码其他处！！！！
修改前的加载,测试很久无此问题.......
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
