.sys
#include "zhudongfangyu.h"
BOOLEAN g_bIsNotifyRoutineSetted;
PKEVENT g_pEventObject0 = NULL;
PKEVENT g_pEventObject3 = NULL;
HANDLEg_hEvent = NULL;
BOOLEANg_bREPLY;
UNICODE_STRINGEventName;
OBJECT_HANDLE_INFORMATION g_ObjectHandleInfo;
VOID PrintIrpInfo( PIRP Irp );
VOID MyUnload( PDRIVER_OBJECT pDerverObject )
{ PDEVICE_OBJECTdevObj = pDerverObject->DeviceObject;
UNICODE_STRINGsymbolicName;
RtlInitUnicodeString( &symbolicName, SYMBOLICNAME );
IoDeleteSymbolicLink( &symbolicName );
if ( devObj != NULL )
{ IoDeleteDevice( devObj ); }
DbgPrint( "MyUnload" ); }
NTSTATUS SioctlCreateClose( PDEVICE_OBJECT DeviceObject, PIRP irp )
{ irp->IoStatus.Status = STATUS_SUCCESS;
irp->IoStatus.Information = 0;
IoCompleteRequest( irp, IO_NO_INCREMENT );
return(STATUS_SUCCESS); }
PROCERSSINFO pi;
VOID CreateProcessNotifyFunction( IN HANDLE hParentId, IN HANDLE hProcessId, IN BOOLEAN bCreate )
{ PEPROCESSlProcess;
ANSI_STRINGExePath;
if ( bCreate )
{ PsLookupProcessByProcessId( hProcessId, &lProcess );
GetProcPath( hProcessId, &ExePath );
RtlCopyBytes( (PVOID) pi.name, (PVOID) ( (char *) lProcess + 0x16c), 15 );
RtlCopyBytes( pi.PATH, ExePath.Buffer, ExePath.Length );
pi.PID = hProcessId;
DbgPrint( " %s", pi.name );
DbgPrint( "%s", pi.PATH );
DbgPrint( "%x", pi.PID );
KeSetEvent( g_pEventObject0, 0, FALSE );
KeClearEvent( g_pEventObject3 );
DbgPrint( "-- Ring3 应该 反馈 --" );
KeWaitForSingleObject( g_pEventObject3, Executive, KernelMode, FALSE, NULL );
DbgPrint( "-- RIng3 来了反馈--" );
if ( g_bREPLY != TRUE )
{ DbgPrint( "-- Ring3 决定结束进程 --" );
}
DbgPrint( "-- Ring3 决定 放行 --" );
KeClearEvent( g_pEventObject3 ); } }
NTSTATUS SioctlDeviceControl( PDEVICE_OBJECT DeviceObject, PIRP irp )
{ PIO_STACK_LOCATIONirpSp;
ULONGinputBuffLength;
NTSTATUSstatus = STATUS_SUCCESS;
PCHARinBuf, outBuf;
PCHARbuffer = NULL;
ULONGOutputBuffLength;
HANDLEINFOhi;
irpSp = IoGetCurrentIrpStackLocation( irp );
inputBuffLength = irpSp->Parameters.DeviceIoControl.InputBufferLength;
OutputBuffLength = irpSp->Parameters.DeviceIoControl.OutputBufferLength;
inBuf = (PCHAR) irp->AssociatedIrp.SystemBuffer;
outBuf = (PCHAR) irp->AssociatedIrp.SystemBuffer;
switch ( irpSp->Parameters.DeviceIoControl.IoControlCode )
{ case IOCTL_START:
{ DbgPrint( " -- START --" );
hi = *(PHANDLEINFO ) inBuf;
status = ObReferenceObjectByHandle( hi.arg1, \
GENERIC_ALL, NULL, KernelMode, (PVOID *) &g_pEventObject0, &g_ObjectHandleInfo );
status = ObReferenceObjectByHandle( hi.arg2, \
GENERIC_ALL, NULL, KernelMode, (PVOID *) &g_pEventObject3, &g_ObjectHandleInfo );
KdPrint( ("g_pEventObject0 = 0x%X , g_pEventObject3 = 0x%X\n", g_pEventObject0, g_pEventObject3) );
if ( !g_bIsNotifyRoutineSetted )
{ PsSetCreateProcessNotifyRoutine( CreateProcessNotifyFunction, FALSE );
g_bIsNotifyRoutineSetted = TRUE; }
break; }
case IOCTL_STOP:
{ DbgPrint( " -- STOP --" );
if ( g_bIsNotifyRoutineSetted )
{
PsSetCreateProcessNotifyRoutine( CreateProcessNotifyFunction, TRUE );
g_bIsNotifyRoutineSetted = FALSE; }
if ( g_pEventObject0 != NULL )
{ ObDereferenceObject( g_pEventObject0 );
g_pEventObject0 = NULL; }
if ( g_pEventObject3 != NULL )
{ ObDereferenceObject( g_pEventObject3 );
g_pEventObject3 = NULL; }
break; }
case IOCTL_GET_DATA:
{ ULONG nLength = sizeof(pi);
DbgPrint( " -- GET_DATA --" );
if ( outBuf == NULL && (OutputBuffLength < nLength) )
{ KdPrint( ("OutputBufferSize is too small ~!\n") );
break; }
RtlCopyBytes( (PCHAR) outBuf, (PVOID) &pi, nLength );
OutputBuffLength = nLength;
break; }
case IOCTL_SET_REPLY:
{ RtlCopyBytes( (PVOID) &g_bREPLY, inBuf, inputBuffLength );
DbgPrint( "IOCTL_SET_REPLY: %d ", g_bREPLY );
break; } }
END:
irp->IoStatus.Status = STATUS_SUCCESS;
irp->IoStatus.Information = OutputBuffLength;
IoCompleteRequest( irp, IO_NO_INCREMENT );
return(STATUS_SUCCESS); }
NTSTATUS DriverEntry( PDRIVER_OBJECT pDriverObject, PUNICODE_STRING RegPath )
{ NTSTATUS status;
UNICODE_STRING DriverName;
UNICODE_STRING symbolicName;
PDEVICE_OBJECT deviceObject;
RtlInitUnicodeString( &DriverName, DRIVERNAME );
RtlInitUnicodeString( &symbolicName, SYMBOLICNAME );
DbgPrint( "DriverEntry" );
status = IoCreateDevice(
pDriverObject,
0,
&DriverName,
FILE_DEVICE_UNKNOWN,
0,
TRUE,
&deviceObject );
if ( !NT_SUCCESS( status ) )
{ DbgPrint( ("Couldn't create the device object %x \n"), status );
return(status); }
g_bIsNotifyRoutineSetted = FALSE;
pDriverObject->MajorFunction[IRP_MJ_CREATE] = SioctlCreateClose;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = SioctlCreateClose;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = SioctlDeviceControl;
pDriverObject->DriverUnload = MyUnload;
status = IoCreateSymbolicLink( &symbolicName, &DriverName );
if ( !NT_SUCCESS( status ) )
{ DbgPrint( ("Couldn't create the symboliclink \n") );
IoDeleteDevice( deviceObject );
return(status); } return(STATUS_SUCCESS); }
VOID PrintIrpInfo( PIRP Irp ) { PIO_STACK_LOCATION irpSp; irpSp = IoGetCurrentIrpStackLocation( Irp ); PAGED_CODE(); DbgPrint( "\tIrp->AssociatedIrp.SystemBuffer = 0x%p\n",Irp->AssociatedIrp.SystemBuffer );
DbgPrint( "\tIrp->UserBuffer = 0x%p\n", Irp->UserBuffer );
DbgPrint( "\tirpSp->Parameters.DeviceIoControl.Type3InputBuffer = 0x%p\n",irpSp->Parameters.DeviceIoControl.Type3InputBuffer );
DbgPrint( "\tirpSp->Parameters.DeviceIoControl.InputBufferLength = %d\n",irpSp->Parameters.DeviceIoControl.InputBufferLength );
DbgPrint( "\tirpSp->Parameters.DeviceIoControl.OutputBufferLength = %d\n",irpSp->Parameters.DeviceIoControl.OutputBufferLength );
DbgPrint( "\t irpSp->Parameters.DeviceIoControl.IoControlCode = %x\n", irpSp->Parameters.DeviceIoControl.IoControlCode );
return; }
|