检查了好几次找不到是什么地方的问题，所以就来网上求助，
代码：
#include <ntddk.h>
VOID DriverUnload(PDRIVER_OBJECT driver);
NTSTATUS ddk_Disp(IN PDEVICE_OBJECT dev,PIRP pIrp); //派遣函数
NTSTATUS CreateDevice(IN PDRIVER_OBJECT pDriverObject,IN UNICODE_STRING _devName,IN UNICODE_STRING _symLinkName);// 函数申明
UNICODE_STRING str1=RTL_CONSTANT_STRING(L"Hello，STRING\n");
NTSTATUS DriverEntry(PDRIVER_OBJECT driver,PUNICODE_STRING reg_ptr)
{
ULONG SSDT_NtOpenProcess_Cur_Addr;
UNICODE_STRING devname;
UNICODE_STRING linkname;
extern long KeServiceDescriptorTable;
DbgPrint("Load Driver!");
RtlInitUnicodeString(&devname,L"\\Device\\MyFirstDevice");
RtlInitUnicodeString(&linkname,L"\\??\\yjx888");
driver->MajorFunction[IRP_MJ_CREATE]=ddk_Disp;
driver->MajorFunction[IRP_MJ_CLOSE]=ddk_Disp;
driver->MajorFunction[IRP_MJ_READ]=ddk_Disp;
driver->MajorFunction[IRP_MJ_DEVICE_CONTROL]=ddk_Disp;
//CreateDevice(driver,devname,linkname); // 创建一个设备
driver->DriverUnload=DriverUnload;
_asm{
push ebx
push eax
mov ebx,KeServiceDescriptorTable
mov ebx,[ebx]
mov eax,0x1E8
add ebx,eax //NTopenprocess
mov ebx,[ebx]
mov SSDT_NtOpenProcess_Cur_Addr,ebx
pop eax
pop ebx
int 3
}
KdPrint(("当前SSDT_NtOpenProcess_Cur_Addr地址为%x \n",SSDT_NtOpenProcess_Cur_Addr));
return STATUS_SUCCESS;
}
VOID DriverUnload(PDRIVER_OBJECT driver)
{
DbgPrint("Unload Driver!\n");
}
NTSTATUS
CreateDevice(IN PDRIVER_OBJECT pDriverObject,IN UNICODE_STRING _devName,IN UNICODE_STRING _symLinkName)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;/*用来返回创建设备*/
PUNICODE_STRING devName=&_devName;
PUNICODE_STRING symLinkName=&_symLinkName;
//创建设备
status = IoCreateDevice( pDriverObject,\
0,\
devName,\
FILE_DEVICE_UNKNOWN,\
0, TRUE,\
&pDevObj);
if (!NT_SUCCESS(status))
{
DbgPrint("创建设备失败！");
return status;
}
pDevObj->Flags |= DO_BUFFERED_IO; // 直接缓冲I/O 读写模式
status = IoCreateSymbolicLink( symLinkName,devName );
//以上
if (!NT_SUCCESS(status))
{
IoDeleteDevice( pDevObj );
return status;
}
DbgPrint("创建设备成功！");
return STATUS_SUCCESS;
}
NTSTATUS ddk_Disp(IN PDEVICE_OBJECT dev,PIRP pIrp)
{
pIrp->IoStatus.Information=0;
pIrp->IoStatus.Status=STATUS_SUCCESS;
IoCompleteRequest(pIrp,IO_NO_INCREMENT);
DbgPrint(("离开派遣函数\n"));//调试信息
return STATUS_SUCCESS; //返回成功
}
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
