---------------------------------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
Driver.c
#include "driver.h"
//此模板来自Tesla.Angela
//HideDrv By isdebug
typedef VOID (NTAPI* pfn_MiProcessLoaderEntry) (IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN BOOLEAN Insert);
//nt!MiProcessLoaderEntry:
//fffff800`04169780 48895c2408 mov qword ptr[rsp + 8], rbx
//fffff800`04169785 48896c2418 mov qword ptr[rsp + 18h], rbp
//fffff800`0416978a 4889742420 mov qword ptr[rsp + 20h], rsi
//fffff800`0416978f 57 push rdi
//fffff800`04169790 4154 push r12
//fffff800`04169792 4155 push r13
//fffff800`04169794 4156 push r14
//fffff800`04169796 4157 push r15
//fffff800`04169798 4883ec30 sub rsp, 30h
//fffff800`0416979c 488bf9 mov rdi, rcx
//fffff800`0416979f 448bf2 mov r14d, edx
//fffff800`041697a2 bb01000000 mov ebx, 1
pfn_MiProcessLoaderEntry MiProcessLoaderEntry = 0xfffff80004169780;//这里直接填的地址,该函数未导出,不过只要思想不滑坡,办法总比问题多..
BOOLEAN KiSleep (ULONG MillionSecond) {
NTSTATUS st;
LARGE_INTEGER DelayTime;
DelayTime = RtlConvertLongToLargeInteger (-10000 * MillionSecond);
st = KeDelayExecutionThread (KernelMode, FALSE, &DelayTime);
return (NT_SUCCESS (st));
}
VOID TestDP (PVOID p) {
int j = 0;
while (1) {
KiSleep (1000);
j++;
KdPrint (("TestDP:%d \n", j));
}
}
VOID DriverUnload (PDRIVER_OBJECT pDriverObj) {
UNICODE_STRING strLink;
DbgPrint ("[TestDrv]DriverUnload\n");
MiProcessLoaderEntry (pDriverObj->DriverSection, FALSE);
pDriverObj->DriverSection = ExAllocatePool (NonPagedPool, 4096);
//删除符号连接和设备
RtlInitUnicodeString (&strLink, LINK_NAME);
IoDeleteSymbolicLink (&strLink);
IoDeleteDevice (pDriverObj->DeviceObject);
}
NTSTATUS DispatchCreate (PDEVICE_OBJECT pDevObj, PIRP pIrp) {
DbgPrint ("[TestDrv]DispatchCreate\n");
pIrp->IoStatus.Status = STATUS_SUCCESS;
pIrp->IoStatus.Information = 0;
IoCompleteRequest (pIrp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
NTSTATUS DispatchClose (PDEVICE_OBJECT pDevObj, PIRP pIrp) {
DbgPrint ("[TestDrv]DispatchClose\n");
pIrp->IoStatus.Status = STATUS_SUCCESS;
pIrp->IoStatus.Information = 0;
IoCompleteRequest (pIrp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
NTSTATUS DispatchIoctl (PDEVICE_OBJECT pDevObj, PIRP pIrp) {
NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;
PIO_STACK_LOCATION pIrpStack;
ULONG uIoControlCode;
PVOID pIoBuffer;
ULONG uInSize;
ULONG uOutSize;
DbgPrint ("[TestDrv]DispatchIoctl\n");
//获得IRP里的关键数据
pIrpStack = IoGetCurrentIrpStackLocation (pIrp);
//控制码
uIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;
//输入和输出的缓冲区（DeviceIoControl的InBuffer和OutBuffer都是它）
pIoBuffer = pIrp->AssociatedIrp.SystemBuffer;
//EXE发送传入数据的BUFFER长度（DeviceIoControl的nInBufferSize）
uInSize = pIrpStack->Parameters.DeviceIoControl.InputBufferLength;
//EXE接收传出数据的BUFFER长度（DeviceIoControl的nOutBufferSize）
uOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;
switch (uIoControlCode) {
//在这里加入接口
case IOCTL_IO_TEST: {
DWORD dw = 0;
//输入
memcpy (&dw, pIoBuffer, sizeof (DWORD));
//使用
dw++;
//输出
memcpy (pIoBuffer, &dw, sizeof (DWORD));
//返回通信状态
status = STATUS_SUCCESS;
break;
}
case IOCTL_SAY_HELLO: {
DbgPrint ("[TestDrv]IOCTL_SAY_HELLO\n");
status = STATUS_SUCCESS;
break;
}
}
//这里设定DeviceIoControl的*lpBytesReturned的值（如果通信失败则返回0长度）
if (status == STATUS_SUCCESS)
{ pIrp->IoStatus.Information = uOutSize; }
else
{ pIrp->IoStatus.Information = 0; }
//这里设定DeviceIoControl的返回值是成功还是失败
pIrp->IoStatus.Status = status;
IoCompleteRequest (pIrp, IO_NO_INCREMENT);
return status;
}
NTSTATUS DriverEntry (PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString) {
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING ustrLinkName;
UNICODE_STRING ustrDevName;
PDEVICE_OBJECT pDevObj;
pDriverObj->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
pDriverObj->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl;
pDriverObj->DriverUnload = DriverUnload;
//创建一个设备
RtlInitUnicodeString (&ustrDevName, DEVICE_NAME);
status = IoCreateDevice (pDriverObj, 0, &ustrDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDevObj);
if (!NT_SUCCESS (status)) { return status; }
//判断支持的WDM版本，其实这个已经不需要了，纯属WIN9X和WINNT并存时代的残留物
if (IoIsWdmVersionAvailable (1, 0x10)) {
RtlInitUnicodeString (&ustrLinkName, LINK_GLOBAL_NAME);
} else {
RtlInitUnicodeString (&ustrLinkName, LINK_NAME);
}
// 创建符号连接
status = IoCreateSymbolicLink (&ustrLinkName, &ustrDevName);
if (!NT_SUCCESS (status)) {
IoDeleteDevice (pDevObj);
return status;
}
DbgPrint ("[TestDrv]DriverEntry\n");
HANDLE hThread = 0;
if (NT_SUCCESS (PsCreateSystemThread (&hThread, 0, NULL, (HANDLE) - 1, NULL, &TestDP, NULL))) {
ZwClose (hThread);
}
//返回加载驱动的状态（如果返回失败，驱动讲被清除出内核空间）
return STATUS_SUCCESS;
}
iceway
malokch
