1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97
| #include<ntifs.h> #include "main.h" #define SYMBOL L"\\??\\xia0ji2333" #define kprintf(format, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, format, ##__VA_ARGS__)
NTSTATUS CreateDevice(PDEVICE_OBJECT driver) { NTSTATUS status; UNICODE_STRING MyDriver; PDEVICE_OBJECT device = NULL; RtlInitUnicodeString(&MyDriver, L"\\DEVICE\\xia0ji233"); status = IoCreateDevice( driver, sizeof(driver->DeviceExtension), &MyDriver, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &device ); if (status == STATUS_SUCCESS) { UNICODE_STRING Sym; RtlInitUnicodeString(&Sym, SYMBOL); status = IoCreateSymbolicLink(&Sym, &MyDriver); if (status == STATUS_SUCCESS) { kprintf(("Line %d:xia0ji233: symbol linked success\n"), __LINE__); } else { kprintf(("Line %d:xia0ji233: symbol linked failed status=%x\n"), __LINE__, status); } } else { kprintf(("Line %d:xia0ji233: create device fail status=%x\n"), __LINE__, status); } } NTSTATUS DeviceIrpCtl(PDEVICE_OBJECT driver, PIRP pirp) { kprintf(("Line %d:xia0ji233: enter IRP Function\n"), __LINE__); PIO_STACK_LOCATION irpStackL; ULONG CtlCode; ULONG InputBuffLength; irpStackL = IoGetCurrentIrpStackLocation(pirp); switch (irpStackL->MajorFunction) { case IRP_MJ_DEVICE_CONTROL: { kprintf(("Line %d:xia0ji233: ring3 calls DEVICE CONTROL\n"), __LINE__); break; } case IRP_MJ_CREATE: { kprintf(("Line %d:xia0ji233: ring3 calls CREATE\n"), __LINE__); break; } case IRP_MJ_CLOSE: { kprintf(("Line %d:xia0ji233: ring3 calls CLOSE\n"), __LINE__); break; } default: break; } pirp->IoStatus.Status = STATUS_SUCCESS; pirp->IoStatus.Information = 4; IoCompleteRequest(pirp, IO_NO_INCREMENT); kprintf(("Line %d:xia0ji233: leave IRP Function\n"), __LINE__); return STATUS_SUCCESS; }
void DriverUnload(PDRIVER_OBJECT pDriver) { kprintf(("Line %d:xia0ji233: start unload\n"), __LINE__); DeleteDevice(pDriver); }
NTSTATUS DriverEntry( _In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath ){ DriverObject->DriverUnload = DriverUnload; DriverObject->MajorFunction[IRP_MJ_CREATE] = DeviceIrpCtl; DriverObject->MajorFunction[IRP_MJ_CLOSE] = DeviceIrpCtl; DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DeviceIrpCtl; CreateDevice(DriverObject); kprintf(("Line %d:xia0ji233: RegistryPath = %S\n"),__LINE__,RegistryPath->Buffer); kprintf(("Line %d:xia0ji233: work success\n"), __LINE__); return 0; }
void DeleteDevice(PDRIVER_OBJECT pDriver) { kprintf(("Line %d:xia0ji233: start delete device\n"), __LINE__); if (pDriver->DeviceObject) { UNICODE_STRING Sym; RtlInitUnicodeString(&Sym, SYMBOL); kprintf(("Line %d:xia0ji233: Delete Symbol\n"), __LINE__); IoDeleteSymbolicLink(&Sym); kprintf(("Line %d:xia0ji233: Delete Device\n"), __LINE__); IoDeleteDevice(pDriver->DeviceObject); } kprintf(("Line %d:xia0ji233: end delete device\n"), __LINE__); }
|