驱动

admin管理员组

文章数量:1122851

驱动

//自定义消息
#define Ergodicdrivelist CTL_CODE( FILE_DEVICE_UNKNOWN, 0x801, METHOD_IN_DIRECT, FILE_ANY_ACCESS )
#define Hidedriver CTL_CODE( FILE_DEVICE_UNKNOWN, 0x802, METHOD_IN_DIRECT, FILE_ANY_ACCESS )
// 遍历驱动
void Ergodicdrivelistfun(PIRP Irp)
{PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(Irp);// 通过当前驱动获取驱动链，指针指向的就是当前驱动在链表中对应的项PLDR_DATA_TABLE_ENTRY current = (PLDR_DATA_TABLE_ENTRY)g_DriverObject->DriverSection;PLDR_DATA_TABLE_ENTRY item = (PLDR_DATA_TABLE_ENTRY)g_DriverObject->DriverSection;// 获取输出缓冲区PVOID Buffer = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);PDRIVERINFO outbuff = (PDRIVERINFO)Buffer;// 跳过头节点current = current->InLoadOrderLinks.Flink;// 第一个item = (PLDR_DATA_TABLE_ENTRY)item->InLoadOrderLinks.Flink;item = (PLDR_DATA_TABLE_ENTRY)item->InLoadOrderLinks.Flink;// 循环链表的遍历，结束条件是遍历到的内容不是自己int index = 0;do {RtlZeroMemory(outbuff, sizeof(DRIVERINFO));RtlCopyMemory(outbuff->wcDriverBasePath, item->BaseDllName.Buffer, item->BaseDllName.Length);RtlCopyMemory(outbuff->wcDriverFullPath, item->FullDllName.Buffer, item->FullDllName.Length);outbuff->DllBase = item->DllBase;outbuff++;// 获取当前元素指向的下一个元素item = (PLDR_DATA_TABLE_ENTRY)item->InLoadOrderLinks.Flink;index++;} while (current != item);Irp->IoStatus.Information = 20;
}
// 隐藏驱动
void Hidedriverfun(PIRP Irp)
{// 指针指向的就是当前驱动在链表中对应的项PLDR_DATA_TABLE_ENTRY current = (PLDR_DATA_TABLE_ENTRY)g_DriverObject->DriverSection;PLDR_DATA_TABLE_ENTRY item = (PLDR_DATA_TABLE_ENTRY)g_DriverObject->DriverSection;// 获取输入缓冲区PVOID InBuff = Irp->AssociatedIrp.SystemBuffer;// 初始化字符串,获取要隐藏的驱动名UNICODE_STRING pHideDriverName = { 0 };RtlInitUnicodeString(&pHideDriverName, (PCWSTR)InBuff);do{if (RtlCompareUnicodeString(&item->BaseDllName, &pHideDriverName, FALSE) == 0){//修改Flink和Blink指针，以跳过我们要隐藏的驱动//在驱动链中将当前驱动的上一个驱动的下级指针指向下一个驱动//再将下一个驱动的上级指针指向上一个驱动item->InLoadOrderLinks.Blink->Flink = item->InLoadOrderLinks.Flink;item->InLoadOrderLinks.Flink->Blink = item->InLoadOrderLinks.Blink;break;}item = item->InLoadOrderLinks.Flink;} while (item != current);
}// 用于实现自定义的消息派遣函数
NTSTATUS DeviceIoControlDispatch(PDEVICE_OBJECT DeviceObject,		// 表示当前的消息是那个设备对象产生的PIRP Irp)							// IRP，对应的是三环程序的消息，保存了一些附加参数
{UNREFERENCED_PARAMETER(DeviceObject);PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(Irp);// 设置消息的处理状态： 成功或失败 -> GetLastErrorIrp->IoStatus.Status = STATUS_SUCCESS;// 读取内容switch (Stack->Parameters.DeviceIoControl.IoControlCode){// 遍历驱动case Ergodicdrivelist:{Ergodicdrivelistfun(Irp);}break;// 隐藏驱动case Hidedriver:{Hidedriverfun(Irp);}break;}// 通知操作已经完成，完成后不提高当前的 IRQLIoCompleteRequest(Irp, IO_NO_INCREMENT);return Irp->IoStatus.Status;
}
``

本文标签： 驱动