听人说替换beep.sys可以过驱动防火墙,自己试验了一下,在xp3里还真行。但由于一个很蠢的错误,使得我把beep.sys全逆了(驱动不大)。感觉这个驱动对于异步处理IRP有些指导意义,发上来和大家分享。
#include<ntddk.h>
#pragma warning(disable:4996 )
#define DEVICE_NAME (L"\\Device\\Beep")
#if 0
DRIVER_INITIALIZE DriverEntry;
DRIVER_UNLOAD DriverUnload;
DRIVER_STARTIO BeepStartIoRoutine;
KDEFERRED_ROUTINE BeepDpcRoutine;
DRIVER_CANCEL BeepCancelRoutine;
DRIVER_STARTIO BeepStartIoRoutine;
__drv_dispatchType(IRP_MJ_CLEANUP) DRIVER_DISPATCH BeepDispatchCleanup;
__drv_dispatchType(IRP_MJ_DEVICE_CONTROL) DRIVER_DISPATCH BeepDispatchDeviceControl;
__drv_dispatchType(IRP_MJ_CREATE) DRIVER_DISPATCH BeepDispatchCreate;
__drv_dispatchType(IRP_MJ_CLOSE) DRIVER_DISPATCH BeepDispatchClose;
#endif
//大小为0x58字节
typedef struct _MYDEVICE_EXTENSION
{
KTIMER timer;
FAST_MUTEX mutex;
LONG count_open;
LONG count_timer;
PVOID hLockedSection;
}MYDEVICE_EXTENSION,*PMYDEVICE_EXTENSION;
VOID
BeepCancelRoutine(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
);
NTSTATUS
BeepDispatchCleanup(
IN PDEVICE_OBJECT deviceObject,
IN PIRP irp
);
NTSTATUS
BeepDispatchDeviceControl (
IN PDEVICE_OBJECT deviceObject,
IN PIRP irp
);
NTSTATUS
BeepDispatchCreate (
IN PDEVICE_OBJECT deviceObject,
IN PIRP irp
);
NTSTATUS
BeepDispatchClose (
IN PDEVICE_OBJECT deviceObject,
IN PIRP irp
);
VOID
BeepStartIoRoutine(
IN OUT PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
);
VOID
BeepDpcRoutine(
IN PKDPC Dpc,
OPTIONAL IN PVOID DeferredContext,
OPTIONAL IN PVOID SystemArgument1,
OPTIONAL IN PVOID SystemArgument2
);
VOID
DriverUnload(
IN PDRIVER_OBJECT driverObject
);
NTSTATUS
DriverEntry(
IN PDRIVER_OBJECT driverObject,
IN PUNICODE_STRING registryPath
);
//===================================实现===================================
VOID
BeepCancelRoutine(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
{
if( Irp == DeviceObject->CurrentIrp ||
!KeRemoveEntryDeviceQueue( &DeviceObject->DeviceQueue,&Irp->Tail.Overlay.DeviceQueueEntry))
{
IoReleaseCancelSpinLock( Irp->CancelIrql );
}
else
{
IoReleaseCancelSpinLock( Irp->CancelIrql );
Irp->IoStatus.Information = 0;
Irp->IoStatus.Status = 0xc0000120;
IoCompleteRequest( Irp,IO_NO_INCREMENT );
}
}
NTSTATUS
BeepDispatchCleanup(
IN PDEVICE_OBJECT deviceObject,
IN PIRP irp
)
{
KIRQL irql,oldIrql;
PIRP currIrp = NULL;
oldIrql = KeRaiseIrqlToDpcLevel();
IoAcquireCancelSpinLock( &irql );
currIrp = deviceObject->CurrentIrp;
deviceObject->CurrentIrp = NULL;
if( currIrp != NULL )
{
PKDEVICE_QUEUE_ENTRY entry = NULL;
for( entry = KeRemoveDeviceQueue( &deviceObject->DeviceQueue);
entry != NULL;
entry = KeRemoveDeviceQueue( &deviceObject->DeviceQueue))
{
PIRP pIrp = (PIRP)CONTAINING_RECORD( entry,IRP,Tail.Overlay.DeviceQueueEntry);
pIrp->CancelRoutine = NULL;
pIrp->IoStatus.Information = 0;
pIrp->IoStatus.Status = 0xc0000120;
IoReleaseCancelSpinLock( irql );
IoCompleteRequest( pIrp,IO_NO_INCREMENT );
IoAcquireCancelSpinLock( &irql );
}//for
}//if
IoReleaseCancelSpinLock( irql );
KeLowerIrql( oldIrql);
irp->IoStatus.Status = STATUS_SUCCESS;
irp->IoStatus.Information = 0;
IoCompleteRequest( irp,IO_NO_INCREMENT );
HalMakeBeep( 0 );
return STATUS_SUCCESS;
}
NTSTATUS
BeepDispatchDeviceControl (
IN PDEVICE_OBJECT deviceObject,
IN PIRP irp
)
{
PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation( irp );
NTSTATUS status = STATUS_SUCCESS;
PULONG in_buffer = NULL;
if( irpSp->Parameters.DeviceIoControl.IoControlCode != 0x10000 ||
irpSp->Parameters.DeviceIoControl.InputBufferLength < 8 )
{
status = STATUS_INVALID_PARAMETER;
goto exit;
}
in_buffer = (PULONG)irp->AssociatedIrp.SystemBuffer;
if( in_buffer[0] != 0 && in_buffer[1] == 0 )
status = STATUS_SUCCESS;
else
status = 0x103;
exit:
irp->IoStatus.Information = 0;
irp->IoStatus.Status = status;
if( status == 0x103 )
{
irpSp->Control |= SL_PENDING_RETURNED;
IoStartPacket( deviceObject,irp,0,(PDRIVER_CANCEL)BeepCancelRoutine );
}
else
IoCompleteRequest( irp,IO_NO_INCREMENT );
return status;
}
NTSTATUS
BeepDispatchCreate (
IN PDEVICE_OBJECT deviceObject,
IN PIRP irp
)
{
PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)deviceObject->DeviceExtension;
ExAcquireFastMutex( &devExt->mutex );
if( ++devExt->count_open == 1 )
{
devExt->hLockedSection = MmLockPagableDataSection( BeepDispatchCreate );
}
ExReleaseFastMutex( &devExt->mutex );
irp->IoStatus.Status = STATUS_SUCCESS;
irp->IoStatus.Information = 0;
IoCompleteRequest( irp,IO_NO_INCREMENT );
return STATUS_SUCCESS;
}
NTSTATUS
BeepDispatchClose (
IN PDEVICE_OBJECT deviceObject,
IN PIRP irp
)
{
PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)deviceObject->DeviceExtension;
ExAcquireFastMutex( &devExt->mutex );
if( --devExt->count_open == 0 )
{
MmUnlockPagableImageSection( &devExt->hLockedSection );
if( devExt->count_timer != 0 && KeCancelTimer( &devExt->timer ))
InterlockedDecrement( &devExt->count_timer);
}
ExReleaseFastMutex( &devExt->mutex );
irp->IoStatus.Status = STATUS_SUCCESS;
irp->IoStatus.Information = 0;
IoCompleteRequest( irp,IO_NO_INCREMENT );
return STATUS_SUCCESS;
}
VOID
BeepStartIoRoutine(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
{
KIRQL irql;
PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)DeviceObject->DeviceExtension;
PKTIMER timer = &devExt->timer;
PIO_STACK_LOCATION irpSp = NULL;
NTSTATUS status = STATUS_SUCCESS;
IoAcquireCancelSpinLock( &irql );
if( NULL == Irp )
{
IoReleaseCancelSpinLock( irql );
return;
}
Irp->CancelRoutine = NULL;
IoReleaseCancelSpinLock( irql );
irpSp = IoGetCurrentIrpStackLocation( Irp );
if( irpSp->Parameters.DeviceIoControl.IoControlCode != 0x10000 )
status = STATUS_INVALID_PARAMETER;
else
{
PULONG in_buffer = Irp->AssociatedIrp.SystemBuffer;
if( devExt->count_timer != 0 && KeCancelTimer( timer ))
InterlockedDecrement( &devExt->count_timer );
if( HalMakeBeep(in_buffer[0]))
{
LARGE_INTEGER dueTime={0};
status = STATUS_SUCCESS;
InterlockedIncrement( &devExt->count_timer );
dueTime.QuadPart = (LONGLONG)-10000 * in_buffer[1];
if(KeSetTimer( timer,dueTime,&DeviceObject->Dpc ))
InterlockedDecrement( &devExt->count_timer);
}
else
status = STATUS_INVALID_PARAMETER;
}
Irp->IoStatus.Information = 0;
Irp->IoStatus.Status = status;
IoStartNextPacket( DeviceObject,TRUE );
IoCompleteRequest( Irp,IO_NO_INCREMENT );
}
VOID
BeepDpcRoutine(
IN PKDPC Dpc,
OPTIONAL IN PVOID DeferredContext,
OPTIONAL IN PVOID SystemArgument1,
OPTIONAL IN PVOID SystemArgument2
)
{
PDEVICE_OBJECT devObj = (PDEVICE_OBJECT)DeferredContext;
PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)devObj->DeviceExtension;
HalMakeBeep( 0 );
InterlockedDecrement( &devExt->count_timer );
}
VOID
DriverUnload(
IN PDRIVER_OBJECT driverObject
)
{
PDEVICE_OBJECT devObj = driverObject->DeviceObject;
PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)devObj->DeviceExtension;
if( devExt->count_timer != 0 && KeCancelTimer( &devExt->timer))
InterlockedDecrement( &devExt->count_timer );
IoDeleteDevice( devObj );
}
NTSTATUS
DriverEntry(
IN PDRIVER_OBJECT driverObject,
IN PUNICODE_STRING registryPath
)
/*++
--*/
{
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING devName = {0};
PDEVICE_OBJECT devObj = NULL;
PMYDEVICE_EXTENSION devExt = NULL;
_asm int 3;
RtlInitUnicodeString( &devName,DEVICE_NAME );
status = IoCreateDevice( driverObject,
sizeof(MYDEVICE_EXTENSION),
&devName,
FILE_DEVICE_BEEP,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&devObj);
if( STATUS_SUCCESS != status )
goto exit_with_status;
devObj->Flags |= DO_BUFFERED_IO;
devExt = (PMYDEVICE_EXTENSION)devObj->DeviceExtension;
KeInitializeDpc( &devObj->Dpc,(PKDEFERRED_ROUTINE )BeepDpcRoutine,devObj);
KeInitializeTimer( &devExt->timer );
ExInitializeFastMutex( &devExt->mutex );
devExt->count_timer = devExt->count_open = 0;
driverObject->DriverStartIo = BeepStartIoRoutine;
driverObject->DriverUnload = DriverUnload;
driverObject->MajorFunction[IRP_MJ_CREATE] = BeepDispatchCreate;
driverObject->MajorFunction[IRP_MJ_CLOSE] = BeepDispatchClose;
driverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = BeepDispatchDeviceControl;
driverObject->MajorFunction[IRP_MJ_CLEANUP] = BeepDispatchCleanup;
return STATUS_SUCCESS;
exit_with_status:
return status;
}
[课程]FART 脱壳王!加量不加价!FART作者讲授!