-
-
[原创]没什么卵用的——驱动运行过程中自卸载(我 卸 我 自 己)
-
发表于: 2019-3-17 08:55
-
如果你试过sc start TesSafe，你会发现：它在没有通信的情况下，几秒后会自动unload自己
那么这是怎么做到的呢?
当当当。。。。。
PUNICODE_STRING g_pRegistryPath = NULL; PWORK_QUEUE_ITEM g_pUnloadWorkItem =NULL;
PUNICODE_STRING g_pRegistryPath = NULL; PWORK_QUEUE_ITEM g_pUnloadWorkItem =NULL;
DriverEntry:
g_pRegistryPath = (PUNICODE_STRING)ExAllocatePool(NonPagedPool, sizeof(UNICODE_STRING)); g_pRegistryPath ->Buffer = (PWCH)ExAllocatePool(NonPagedPool, registry_path->MaximumLength); g_pRegistryPath ->Length = registry_path->Length; g_pRegistryPath ->MaximumLength = registry_path->MaximumLength; memcpy(g_pRegistryPath->Buffer, registry_path->Buffer, g_pRegistryPath->Length); g_pUnloadWorkItem = (PWORK_QUEUE_ITEM)ExAllocatePool(NonPagedPool, sizeof(WORK_QUEUE_ITEM)); ExInitializeWorkItem(g_pUnloadWorkItem, (PWORKER_THREAD_ROUTINE)ZwUnloadDriver, g_pRegistryPath);
g_pRegistryPath = (PUNICODE_STRING)ExAllocatePool(NonPagedPool, sizeof(UNICODE_STRING)); g_pRegistryPath ->Buffer = (PWCH)ExAllocatePool(NonPagedPool, registry_path->MaximumLength); g_pRegistryPath ->Length = registry_path->Length; g_pRegistryPath ->MaximumLength = registry_path->MaximumLength; memcpy(g_pRegistryPath->Buffer, registry_path->Buffer, g_pRegistryPath->Length); g_pUnloadWorkItem = (PWORK_QUEUE_ITEM)ExAllocatePool(NonPagedPool, sizeof(WORK_QUEUE_ITEM)); ExInitializeWorkItem(g_pUnloadWorkItem, (PWORKER_THREAD_ROUTINE)ZwUnloadDriver, g_pRegistryPath);
当要自卸载时：
ExQueueWorkItem(g_pUnloadWorkItem, DelayedWorkQueue);
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
最后于 2019-3-18 09:22
被hzqst编辑
，原因：
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
