PVOID g_NmiCountText = 0;
PVOID g_Nmiaffinity = 0;
PVOID g_Nmipag = 0;
typedef struct _KAFFINITY_EX {
SHORT Count;
SHORT Size;
ULONG Padding;
ULONG64 bitmap[20];
} KAFFINITYEX, * PKAFFINITYEX;
typedef void (__fastcall* _KeInitializeAffinityEx)(PKAFFINITYEX pkaff);
typedef void (__fastcall* _KeAddProcessorAffinityEx)(PKAFFINITYEX pkaff, ULONG nmu);
typedef void (__fastcall *_HalSendNMI)(ULONG64 a1);
//每个核插入
VOID
KeGenericCallDpc(
__in PKDEFERRED_ROUTINE Routine,
__in_opt PVOID Context
);
//释放锁
VOID
KeSignalCallDpcDone(
__in PVOID SystemArgument1
);
VOID
DpcCallback1(
_In_ struct _KDPC* Dpc,
_In_opt_ PVOID DeferredContext,
_In_opt_ PVOID SystemArgument1,
_In_opt_ PVOID SystemArgument2
)
{
DbgBreakPoint();
ULONG number = KeGetCurrentProcessorNumber();
KdPrintEx((77, 0, "DpcCallback CALL %d\r\n", number));
//释放锁
KeSignalCallDpcDone(SystemArgument1);
}
//等待函数
VOID KernelSleep(ULONG_PTR mm, BOOLEAN isAlert)
{
/***********************************************************************************************
*函数名 ：KernelSleep
*函数功能描述 ：等待函数
*函数参数 ：
参数1：毫秒
参数2：可报错TRUE or FALSE
*函数返回值 ：HANDLE
***********************************************************************************************/
LARGE_INTEGER in = { 0 };
in.QuadPart = -10000 * mm;
KeDelayExecutionThread(KernelMode, isAlert, &in);
}
//出发nmi中断
BOOLEAN NmiThread()
{
UNICODE_STRING SystemRoutineName = { 0 };
ULONG numCors= KeQueryActiveProcessorCountEx(0);
RtlInitUnicodeString(&SystemRoutineName, L"HalSendNMI");
_HalSendNMI HalSendNMI= MmGetSystemRoutineAddress(&SystemRoutineName);
RtlInitUnicodeString(&SystemRoutineName, L"KeInitializeAffinityEx");
_KeInitializeAffinityEx KeInitializeAffinityEx = MmGetSystemRoutineAddress(&SystemRoutineName);
RtlInitUnicodeString(&SystemRoutineName, L"KeAddProcessorAffinityEx");
_KeAddProcessorAffinityEx KeAddProcessorAffinityEx = MmGetSystemRoutineAddress(&SystemRoutineName);
while (1)
{
//每个核执行一次nmi 2号中断
for (size_t i = 0; i < numCors; i++)
{
KeInitializeAffinityEx(g_Nmiaffinity);
KeAddProcessorAffinityEx(g_Nmiaffinity, i);
HalSendNMI(g_Nmiaffinity);
KernelSleep(1000,1);
}
}
}
BOOLEAN DpcThread()
{
while (1)
{
KeGenericCallDpc(DpcCallback1, NULL);
KernelSleep(1000, 0);
}
}
//nmi回调
BOOLEAN NmiCallBack(PVOID Context,BOOLEAN handule)
{
KdPrint((77,0,"触发一次nmi\r\n"));
//必须返回1不处理0交给操作系统处理（蓝屏）
return 1;
}
//驱动卸载回调
VOID DriverUpload(PDRIVER_OBJECT pDriver)
{
KdPrintEx((77, 0, "________驱动卸载__________\r\n"));
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegString)
{
//1.做掉目标线程
//2.堆栈数据检测
//3.根据堆栈回缩无模块驱动检测
//-----------------------------------------------------------------------------
//nmi
HANDLE thread_hanlde[10];
ULONG numCors= KeQueryActiveProcessorCountEx(0);//几个核心
g_NmiCountText= ExAllocatePoolWithTag(NonPagedPool, numCors * 0x500, 'tag');
g_Nmiaffinity= ExAllocatePoolWithTag(NonPagedPool, sizeof(KAFFINITYEX), 'tag');
g_Nmipag= ExAllocatePoolWithTag(NonPagedPool, 0x1000, 'tag');
KeRegisterNmiCallback(NmiCallBack, g_NmiCountText);
PsCreateSystemThread(&thread_hanlde[0],
THREAD_ALL_ACCESS, NULL, NtCurrentProcess(), NULL, NmiThread, 0);
//-----------------------------------------------------------------------------
//-----------------------------------------------------------------------------
//dpc
PsCreateSystemThread(&thread_hanlde[1],
THREAD_ALL_ACCESS, NULL, NtCurrentProcess(), NULL, DpcThread, 0);
//-----------------------------------------------------------------------------
//-----------------------------------------------------------------------------
//apc我就不写了大家都懂愿意写源码一堆
//-----------------------------------------------------------------------------
KdPrintEx((77, 0, "________加载成功__________\r\n"));
pDriverObject->DriverUnload = DriverUpload;
return STATUS_SUCCESS;
}
。
hzqst
