DriverUnload proc pDriverObject:PDRIVER_OBJECT
local @lDelay:LARGE_INTEGER
invoke RtlConvertLongToLargeInteger, 5000000 * -10
lea ecx,@lDelay.QuadPart
mov DWORD ptr [ecx],eax
mov DWORD ptr [ecx+4],edx
push eax
invoke DbgPrint, $CTA0("edx %x\n"),edx
pop eax
invoke DbgPrint, $CTA0("eax %x\n"),eax
invoke IoDetachDevice,dwTargetDeviceObject
invoke KeDelayExecutionThread,KernelMode, FALSE, addr @lDelay
invoke _a1,addr szSymbolicLinkName,addr stUnicodeRing
invoke IoDeleteSymbolicLink, addr stUnicodeRing
invoke DbgPrint, $CTA0("删除SymbolicLink.\n")
mov eax, pDriverObject
assume eax:ptr DRIVER_OBJECT
invoke IoDeleteDevice, [eax].DeviceObject
assume eax:nothing
ret
DriverUnload endp
_IrpMxaimumFunction proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
IoGetCurrentIrpStackLocation pIrp
movzx ecx,(IO_STACK_LOCATION PTR [EAX]).MajorFunction
.if !ecx
push ecx
invoke PsGetCurrentProcessId
invoke DbgPrint, $CTA0("进程ID %x\n"),eax
pop ecx
invoke DbgPrint, $CTA0("MajorFunction %x\n"),ecx
.endif
IoSkipCurrentIrpStackLocation pIrp
invoke IoCallDriver,dwTargetDeviceObject,pIrp
ret
mov eax,pIrp
mov (_IRP ptr [eax]).IoStatus.Status,STATUS_INVALID_PARAMETER
invoke DbgPrint, $CTA0("PDEVICE_OBJECT %x\n"),pDeviceObject
IoGetCurrentIrpStackLocation pIrp
movzx ecx,(IO_STACK_LOCATION PTR [EAX]).MajorFunction
invoke DbgPrint, $CTA0("MajorFunction %x\n"),ecx
invoke IoCompleteRequest,pIrp,IO_NO_INCREMENT
mov eax,STATUS_INVALID_PARAMETER
ret
_IrpMxaimumFunction endp
_ControlDevice proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
ret
_ControlDevice endp
DriverEntry proc pDriverObject:PDRIVER_OBJECT,pusRegistryPath:PUNICODE_STRING
invoke _a1,addr szDeviceName,addr stUnicodeRing
invoke DbgPrint, $CTA0("MajorFunction地址 %wZ\n"),addr stUnicodeRing
invoke IoCreateDevice, pDriverObject,0, addr stUnicodeRing, FILE_DEVICE_UNKNOWN, 0, FALSE, addr dwDeviceObject
.if eax
invoke DbgPrint, $CTA0("建立设备失败.\n")
mov eax,STATUS_DEVICE_CONFIGURATION_ERROR
ret
.endif
invoke _a1,addr szSymbolicLinkName,addr stUnicodeRing1
invoke IoCreateSymbolicLink,addr stUnicodeRing1,addr stUnicodeRing
.if eax
push eax
invoke DbgPrint, $CTA0("建立符号名失败.\n")
invoke IoDeleteDevice,dwDeviceObject
pop eax
ret
.endif
mov eax,dwDeviceObject
mov (DEVICE_OBJECT ptr [eax]).Flags,DO_DIRECT_IO
mov edx,pDriverObject
mov ecx,IRP_MJ_MAXIMUM_FUNCTION+1
mov eax,offset _IrpMxaimumFunction
push edi
lea edi,(DRIVER_OBJECT ptr [edx]).MajorFunction
cld
rep STOSd
pop edi
mov eax,pDriverObject
mov (DRIVER_OBJECT ptr [eax]).DriverUnload,offset DriverUnload
;mov edx,pDriverObject
;mov (DRIVER_OBJECT ptr [edx]).MajorFunction[IRP_MJ_INTERNAL_DEVICE_CONTROL* (sizeof PVOID)], offset _ControlDevice
invoke _a1,addr szTcpDeviceName,addr stUnicodeRing1
invoke IoAttachDevice,dwDeviceObject,addr stUnicodeRing1,addr dwTargetDeviceObject
.if eax
invoke IoDeleteDevice,dwDeviceObject
invoke _a1,addr szSymbolicLinkName,addr stUnicodeRing
invoke IoDeleteSymbolicLink, addr stUnicodeRing
invoke DbgPrint, $CTA0("附加失败.\n")
mov eax,STATUS_DEVICE_CONFIGURATION_ERROR
.endif
ret
DriverEntry endp
[课程]Linux pwn 探索篇！
