ring3:
#include <iostream>
#include <windows.h>
#include <winioctl.h>
using namespace std;
#define IOCTL_TEST CTL_CODE(\
FILE_DEVICE_UNKNOWN, \
0x800, \
METHOD_BUFFERED, \
FILE_ANY_ACCESS)
void main()
{
HANDLE hDevice =
CreateFile("\\\\.\\HelloDDK",
GENERIC_READ | GENERIC_WRITE,
0,         // share mode none
NULL,        // no security
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL );         // no template
cout<<GetLastError();
BYTE InputBuffer[10]={0};
BYTE OutputBuffer[10];
DWORD dwOutput;
DeviceIoControl(hDevice, IOCTL_TEST,InputBuffer, 10, OutputBuffer, 10, &dwOutput, NULL);
for (int i=0;i<(int)dwOutput;i++)
{
cout<<OutputBuffer[i];
}
cout<<dwOutput;
CloseHandle(hDevice);
}

ring0:
NTSTATUS HelloDDKDeviceIOControl(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp)
{
NTSTATUS status = STATUS_SUCCESS;
KdPrint(("Enter HelloDDKDeviceIOControl\n"));

//得到当前堆栈
PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
//得到输入缓冲区大小
ULONG cbin = stack->Parameters.DeviceIoControl.InputBufferLength;
//得到输出缓冲区大小
ULONG cbout = stack->Parameters.DeviceIoControl.OutputBufferLength;
//得到IOCTL码
ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;

ULONG info = 0;

switch (code)
{         // process request

case IOCTL_TEST:
{
UCHAR* UserInputBuffer = (UCHAR*)stack->Parameters.DeviceIoControl.Type3InputBuffer;
KdPrint(("UserInputBuffer:0X%0X\n",UserInputBuffer));//这里显示地址为0

//得到用户模式地址
PVOID UserOutputBuffer = pIrp->UserBuffer;

KdPrint(("UserOutputBuffer:0X%0X\n",UserOutputBuffer));
__try
{
KdPrint(("Enter __try block\n"));

//判断指针是否可读
ProbeForRead(UserInputBuffer,cbin,4);
//显示输入缓冲区内容
for (ULONG i=0;i<cbin;i++)
{
KdPrint(("%X\n",UserInputBuffer[i]));
}

//判断指针是否可写
ProbeForWrite(UserOutputBuffer,cbout,4);

memset(UserOutputBuffer,0xAA,cbout);

info = cbout;

KdPrint(("Leave __try block\n"));
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
KdPrint(("Catch the exception\n"));
KdPrint(("The program will keep going\n"));
status = STATUS_UNSUCCESSFUL;
}
         info = cbout;
break;
}

default:
status = STATUS_INVALID_VARIANT;
}

// 完成IRP
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = info;        // bytes xfered
IoCompleteRequest( pIrp, IO_NO_INCREMENT );

KdPrint(("Leave HelloDDKDeviceIOControl\n"));

return status;
}

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法