C/C++底层实现指定磁盘只读

最新推荐文章于 2020-05-03 21:23:15 发布
最新推荐文章于 2020-05-03 21:23:15 发布
阅读量1.4k 收藏
点赞数
分类专栏： window系统内核编程 软件安全 文章标签： 磁盘 extension object query file header
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/zacklin/article/details/7780550
版权
燕狂徒写的驱动挂钩，限制磁盘只读，

用于保证涉密计算机的稳定，相当于将磁盘变成ROM

#include "ntddk.h"
#include <srb.h>
#include <scsi.h>

#define DRIVERNAME "OnlyRead(GongXiPeng!)"     // for use in messages

typedef struct tagDEVICE_EXTENSION {
 PDEVICE_OBJECT DeviceObject;   // device object this extension belongs to
 PDEVICE_OBJECT LowerDeviceObject;  // next lower driver in same stack
 PDEVICE_OBJECT Pdo;      // the PDO
 IO_REMOVE_LOCK RemoveLock;
 } DEVICE_EXTENSION, *PDEVICE_EXTENSION;

VOID RemoveDevice(IN PDEVICE_OBJECT fdo);
NTSTATUS CompleteRequest(IN PIRP Irp, IN NTSTATUS status, IN ULONG_PTR info);
NTSTATUS DispatchForSCSI(IN PDEVICE_OBJECT fido, IN PIRP Irp);
NTSTATUS AddDevice(IN PDRIVER_OBJECT DriverObject, IN PDEVICE_OBJECT pdo);

NTSTATUS DispatchAny(IN PDEVICE_OBJECT fido, IN PIRP Irp);
NTSTATUS DispatchPower(IN PDEVICE_OBJECT fido, IN PIRP Irp);
NTSTATUS DispatchPnp(IN PDEVICE_OBJECT fido, IN PIRP Irp);
NTSTATUS DispatchWmi(IN PDEVICE_OBJECT fido, IN PIRP Irp);
ULONG GetDeviceTypeToUse(PDEVICE_OBJECT pdo);
NTSTATUS StartDeviceCompletionRoutine(PDEVICE_OBJECT fido, PIRP Irp, PDEVICE_EXTENSION pdx);
NTSTATUS UsageNotificationCompletionRoutine(PDEVICE_OBJECT fido, PIRP Irp, PDEVICE_EXTENSION pdx);

VOID DriverUnload(IN PDRIVER_OBJECT fido);

NTSTATUS
DriverEntry(
    IN PDRIVER_OBJECT DriverObject,
    IN PUNICODE_STRING RegistryPath
    )
{
 int i;
 
 KdPrint(("准备驱动加载"));
 UNREFERENCED_PARAMETER(RegistryPath);
 DriverObject->DriverUnload = DriverUnload;
 DriverObject->DriverExtension->AddDevice = AddDevice;
 for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; ++i)
  DriverObject->MajorFunction[i] = DispatchAny;
 DriverObject->MajorFunction[IRP_MJ_POWER] = DispatchPower;
    DriverObject->MajorFunction[IRP_MJ_PNP] = DispatchPnp;
 DriverObject->MajorFunction[IRP_MJ_SCSI] = DispatchForSCSI;

 return(STATUS_SUCCESS);
}

VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
{       // DriverUnload
 PAGED_CODE();
 //UNREFERENCED_PARAMETER(DriverObject);
 KdPrint((DRIVERNAME " - Entering DriverUnload: DriverObject %8.8lX\n", DriverObject));
}

NTSTATUS AddDevice(IN PDRIVER_OBJECT DriverObject, IN PDEVICE_OBJECT pdo)
{       // AddDevice
 
 NTSTATUS status;
 PDEVICE_OBJECT fido;
 PDEVICE_EXTENSION pdx;
 PDEVICE_OBJECT fdo;

 PAGED_CODE();

 status = IoCreateDevice(DriverObject, sizeof(DEVICE_EXTENSION), NULL,
  GetDeviceTypeToUse(pdo), 0, FALSE, &fido);
 if (!NT_SUCCESS(status))
 {      // can't create device object
  KdPrint((DRIVERNAME " - IoCreateDevice failed - %X\n", status));
  return status;
 }      // can't create device object
 
 pdx = (PDEVICE_EXTENSION) fido->DeviceExtension;
 do
 {      // finish initialization
  IoInitializeRemoveLock(&pdx->RemoveLock, 0, 0, 0);
  pdx->DeviceObject = fido;
  pdx->Pdo = pdo;
  //将过滤驱动附加在底层驱动之上
  fdo = IoAttachDeviceToDeviceStack(fido, pdo);
  if (!fdo)
  {     // can't attach         
   KdPrint((DRIVERNAME " - IoAttachDeviceToDeviceStack failed\n"));
   status = STATUS_DEVICE_REMOVED;
   break;
  }     // can't attach
  //记录底层驱动
  pdx->LowerDeviceObject = fdo;
  //由于不知道底层驱动是直接IO还是BufferIO，因此将标志都置上
  fido->Flags |= fdo->Flags & (DO_DIRECT_IO | DO_BUFFERED_IO | DO_POWER_PAGABLE);
  // Clear the "initializing" flag so that we can get IRPs
  fido->Flags &= ~DO_DEVICE_INITIALIZING;
 } while (FALSE);     // finish initialization

 if (!NT_SUCCESS(status))
 {     // need to cleanup
  if (pdx->LowerDeviceObject)
   IoDetachDevice(pdx->LowerDeviceObject);
  IoDeleteDevice(fido);
 }     // need to cleanup

 return status;
}       // AddDevice

///
// GetDeviceTypeToUse returns the device object type of the next lower device
// object. This helps overcome a bug in some Win2K file systems which expect the
// topmost FiDO in a storage stack to have a VPB and, hence, to have been created
// with a type such as FILE_DEVICE_DISK.
#pragma PAGEDCODE
ULONG GetDeviceTypeToUse(PDEVICE_OBJECT pdo)
{       // GetDeviceTypeToUse
 PDEVICE_OBJECT ldo;
 ULONG devtype;
 ldo = IoGetAttachedDeviceReference(pdo);
 if (!ldo)
  return FILE_DEVICE_UNKNOWN;
 devtype = ldo->DeviceType;
 ObDereferenceObject(ldo);
 return devtype;
}       // GetDeviceTypeToUse

///
#pragma LOCKEDCODE    // make no assumptions about pageability of dispatch fcns
NTSTATUS DispatchAny(IN PDEVICE_OBJECT fido, IN PIRP Irp)
{       // DispatchAny
 NTSTATUS status;
 PDEVICE_EXTENSION pdx;
 PIO_STACK_LOCATION stack;

#if DBG
 static char* irpname[] = 
 {
  "IRP_MJ_CREATE",
  "IRP_MJ_CREATE_NAMED_PIPE",
  "IRP_MJ_CLOSE",
  "IRP_MJ_READ",
  "IRP_MJ_WRITE",
  "IRP_MJ_QUERY_INFORMATION",
  "IRP_MJ_SET_INFORMATION",
  "IRP_MJ_QUERY_EA",
  "IRP_MJ_SET_EA",
  "IRP_MJ_FLUSH_BUFFERS",
  "IRP_MJ_QUERY_VOLUME_INFORMATION",
  "IRP_MJ_SET_VOLUME_INFORMATION",
  "IRP_MJ_DIRECTORY_CONTROL",
  "IRP_MJ_FILE_SYSTEM_CONTROL",
  "IRP_MJ_DEVICE_CONTROL",
  "IRP_MJ_INTERNAL_DEVICE_CONTROL",
  "IRP_MJ_SHUTDOWN",
  "IRP_MJ_LOCK_CONTROL",
  "IRP_MJ_CLEANUP",
  "IRP_MJ_CREATE_MAILSLOT",
  "IRP_MJ_QUERY_SECURITY",
  "IRP_MJ_SET_SECURITY",
  "IRP_MJ_POWER",
  "IRP_MJ_SYSTEM_CONTROL",
  "IRP_MJ_DEVICE_CHANGE",
  "IRP_MJ_QUERY_QUOTA",
  "IRP_MJ_SET_QUOTA",
  "IRP_MJ_PNP",
 };
 UCHAR type;
#endif
 
 pdx = (PDEVICE_EXTENSION) fido->DeviceExtension;
 stack = IoGetCurrentIrpStackLocation(Irp);
#if DBG
 type = stack->MajorFunction;
 if (type >= IRP_MJ_MAXIMUM_FUNCTION)
  KdPrint((DRIVERNAME " - Unknown IRP, major type %X\n", type));
 else
  KdPrint((DRIVERNAME " - %s\n", irpname[type]));
#endif
 // Pass request down without additional processing
 status = IoAcquireRemoveLock(&pdx->RemoveLock, Irp);
 if (!NT_SUCCESS(status))
  return CompleteRequest(Irp, status, 0);
 IoSkipCurrentIrpStackLocation(Irp);
 status = IoCallDriver(pdx->LowerDeviceObject, Irp);
 IoReleaseRemoveLock(&pdx->RemoveLock, Irp);
 return status;
}       // DispatchAny

///
#pragma LOCKEDCODE
NTSTATUS CompleteRequest(IN PIRP Irp, IN NTSTATUS status, IN ULONG_PTR info)
{       // CompleteRequest
 Irp->IoStatus.Status = status;
 Irp->IoStatus.Information = info;
 IoCompleteRequest(Irp, IO_NO_INCREMENT);
 return status;
}       // CompleteRequest

NTSTATUS
USBSCSICompletion( IN PDEVICE_OBJECT DeviceObject,
                   IN PIRP Irp,
                   IN PVOID Context )
{
 PDEVICE_EXTENSION pdx;
 PIO_STACK_LOCATION irpStack;
 PSCSI_REQUEST_BLOCK CurSrb;
 PCDB cdb;
 UCHAR opCode;
 PMODE_PARAMETER_HEADER modeData;
    
 pdx = ( PDEVICE_EXTENSION )DeviceObject->DeviceExtension;
 IoAcquireRemoveLock(&pdx->RemoveLock,Irp);
    irpStack = IoGetCurrentIrpStackLocation( Irp );

 CurSrb=irpStack->Parameters.Scsi.Srb; 
 cdb = (PCDB)CurSrb->Cdb; 
 opCode=cdb->CDB6GENERIC.OperationCode; 
 if(opCode==SCSIOP_MODE_SENSE  && CurSrb->DataBuffer 
  && CurSrb->DataTransferLength >= 
  sizeof(MODE_PARAMETER_HEADER))
 {
  KdPrint(("SCSIOP_MODE_SENSE comming!\n"));
  modeData = (PMODE_PARAMETER_HEADER)CurSrb->DataBuffer;
  modeData->DeviceSpecificParameter |= MODE_DSP_WRITE_PROTECT;
 } 

 if ( Irp->PendingReturned )
 {
  IoMarkIrpPending( Irp );
 } 
 IoReleaseRemoveLock(&pdx->RemoveLock,Irp);
 return Irp->IoStatus.Status ;
} 

///
NTSTATUS DispatchPower(IN PDEVICE_OBJECT fido, IN PIRP Irp)
{       // DispatchPower
/*
#if DBG
 PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
 ULONG fcn = stack->MinorFunction;
 static char* fcnname[] = 
 {
  "IRP_MN_WAIT_WAKE",
  "IRP_MN_POWER_SEQUENCE",
  "IRP_MN_SET_POWER",
  "IRP_MN_QUERY_POWER",
 };

 if (fcn == IRP_MN_SET_POWER || fcn == IRP_MN_QUERY_POWER)
 {
  static char* sysstate[] = 
  {
   "PowerSystemUnspecified",
   "PowerSystemWorking",
   "PowerSystemSleeping1",
   "PowerSystemSleeping2",
   "PowerSystemSleeping3",
   "PowerSystemHibernate",
   "PowerSystemShutdown",
   "PowerSystemMaximum",
  };

  static char* devstate[] = 
  {
   "PowerDeviceUnspecified",
   "PowerDeviceD0",
   "PowerDeviceD1",
   "PowerDeviceD2",
   "PowerDeviceD3",
   "PowerDeviceMaximum",
  };

  ULONG context = stack->Parameters.Power.SystemContext;
  POWER_STATE_TYPE type = stack->Parameters.Power.Type;
  KdPrint((DRIVERNAME " - IRP_MJ_POWER (%s)", fcnname[fcn]));
  if (type == SystemPowerState)
   KdPrint((", SystemPowerState = %s\n", sysstate[stack->Parameters.Power.State.SystemState]));
  else
   KdPrint((", DevicePowerState = %s\n", devstate[stack->Parameters.Power.State.DeviceState]));
 }
 else if (fcn < arraysize(fcnname))
  KdPrint((DRIVERNAME " - IRP_MJ_POWER (%s)\n", fcnname[fcn]));
 else
  KdPrint((DRIVERNAME " - IRP_MJ_POWER (%2.2X)\n", fcn));
#endif // DBG
*/
 PDEVICE_EXTENSION pdx;
 NTSTATUS status;

 pdx = (PDEVICE_EXTENSION) fido->DeviceExtension;
 PoStartNextPowerIrp(Irp); // must be done while we own the IRP
 status = IoAcquireRemoveLock(&pdx->RemoveLock, Irp);
 if (!NT_SUCCESS(status))
  return CompleteRequest(Irp, status, 0);
 IoSkipCurrentIrpStackLocation(Irp);
 status = PoCallDriver(pdx->LowerDeviceObject, Irp);
 IoReleaseRemoveLock(&pdx->RemoveLock, Irp);
 return status;
}       // DispatchPower

///
NTSTATUS DispatchPnp(IN PDEVICE_OBJECT fido, IN PIRP Irp)
{       // DispatchPnp
 PIO_STACK_LOCATION stack;
 ULONG fcn; 
 NTSTATUS status;
 PDEVICE_EXTENSION pdx;
 
 stack = IoGetCurrentIrpStackLocation(Irp);
 fcn = stack->MinorFunction;
 pdx = (PDEVICE_EXTENSION) fido->DeviceExtension;
 status = IoAcquireRemoveLock(&pdx->RemoveLock, Irp);
 if (!NT_SUCCESS(status))
  return CompleteRequest(Irp, status, 0);
 // Handle usage notification specially in order to track power pageable
 // flag correctly. We need to avoid allowing a non-pageable handler to be
 // layered on top of a pageable handler.
 if (fcn == IRP_MN_DEVICE_USAGE_NOTIFICATION)
 {      // usage notification
  if (!fido->AttachedDevice || (fido->AttachedDevice->Flags & DO_POWER_PAGABLE))
   fido->Flags |= DO_POWER_PAGABLE;
  IoCopyCurrentIrpStackLocationToNext(Irp);
  IoSetCompletionRoutine(Irp, (PIO_COMPLETION_ROUTINE) UsageNotificationCompletionRoutine,
   (PVOID) pdx, TRUE, TRUE, TRUE);
  return IoCallDriver(pdx->LowerDeviceObject, Irp);
 }      // usage notification

 // Handle start device specially in order to correctly inherit
 // FILE_REMOVABLE_MEDIA
 if (fcn == IRP_MN_START_DEVICE)
 {      // device start
  IoCopyCurrentIrpStackLocationToNext(Irp);
  IoSetCompletionRoutine(Irp, (PIO_COMPLETION_ROUTINE) StartDeviceCompletionRoutine,
   (PVOID) pdx, TRUE, TRUE, TRUE);
  return IoCallDriver(pdx->LowerDeviceObject, Irp);
 }      // device start

 // Handle remove device specially in order to cleanup device stack
 if (fcn == IRP_MN_REMOVE_DEVICE)
 {      // remove device
  IoSkipCurrentIrpStackLocation(Irp);
  status = IoCallDriver(pdx->LowerDeviceObject, Irp);
  IoReleaseRemoveLockAndWait(&pdx->RemoveLock, Irp);
  RemoveDevice(fido);
  return status;
 }      // remove device

 // Simply forward any other type of PnP request
 IoSkipCurrentIrpStackLocation(Irp);
 status = IoCallDriver(pdx->LowerDeviceObject, Irp);
 IoReleaseRemoveLock(&pdx->RemoveLock, Irp);
 return status;
} 

///
#pragma PAGEDCODE
VOID RemoveDevice(IN PDEVICE_OBJECT fido)
{       // RemoveDevice
 PDEVICE_EXTENSION pdx;

 KdPrint(("Enter RemoveDevice"));
 PAGED_CODE();
 pdx = (PDEVICE_EXTENSION) fido->DeviceExtension;
 if (pdx->LowerDeviceObject)
  IoDetachDevice(pdx->LowerDeviceObject);
 IoDeleteDevice(fido);
} 

///
#pragma LOCKEDCODE
NTSTATUS StartDeviceCompletionRoutine(PDEVICE_OBJECT fido, PIRP Irp, PDEVICE_EXTENSION pdx)
{       // StartDeviceCompletionRoutine
 if (Irp->PendingReturned)
  IoMarkIrpPending(Irp);
 // Inherit FILE_REMOVABLE_MEDIA flag from lower object. This is necessary
 // for a disk filter, but it isn't available until start-device time. Drivers
 // above us may examine the flag as part of their own start-device processing, too.
 if (pdx->LowerDeviceObject->Characteristics & FILE_REMOVABLE_MEDIA)
  fido->Characteristics |= FILE_REMOVABLE_MEDIA;
 IoReleaseRemoveLock(&pdx->RemoveLock, Irp);
 return STATUS_SUCCESS;
}       // StartDeviceCompletionRoutine

///
#pragma LOCKEDCODE
NTSTATUS UsageNotificationCompletionRoutine(PDEVICE_OBJECT fido, PIRP Irp, PDEVICE_EXTENSION pdx)
{       // UsageNotificationCompletionRoutine
 if (Irp->PendingReturned)
  IoMarkIrpPending(Irp);
 // If lower driver cleared pageable flag, we must do the same
 if (!(pdx->LowerDeviceObject->Flags & DO_POWER_PAGABLE))
  fido->Flags &= ~DO_POWER_PAGABLE;
 IoReleaseRemoveLock(&pdx->RemoveLock, Irp);
 return STATUS_SUCCESS;
}       // UsageNotificationCompletionRoutine

#pragma LOCKEDCODE    // force inline functions into nonpaged code


#pragma LOCKEDCODE
NTSTATUS DispatchForSCSI(IN PDEVICE_OBJECT fido, IN PIRP Irp)
{
 PDEVICE_EXTENSION pdx;
 PIO_STACK_LOCATION irpStack; 
 NTSTATUS status;

 // KdPrint((DRIVERNAME " - Enter DispatchForSCSI \n"));
 pdx = (PDEVICE_EXTENSION) fido->DeviceExtension;
 irpStack = IoGetCurrentIrpStackLocation(Irp); 
 // Pass request down without additional processing
 status = IoAcquireRemoveLock(&pdx->RemoveLock, Irp);
 if (!NT_SUCCESS(status))
  return CompleteRequest(Irp, status, 0);
 IoCopyCurrentIrpStackLocationToNext(Irp);
 IoSetCompletionRoutine( Irp,
       USBSCSICompletion,
       NULL,
       TRUE,
       TRUE,
       TRUE ); 
 status = IoCallDriver(pdx->LowerDeviceObject, Irp);
 IoReleaseRemoveLock(&pdx->RemoveLock, Irp);
 return status;
}
///
#pragma LOCKEDCODE    // make no assumptions about pageability of dispatch fcns

zacklin
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
密码学：C／C++语言实现(第2版)
04-27
密码学：C/C++语言实现(原书第2版)主要阐述如何使用C和C++语言实现密码学算法，包括编写专家级的密码所需要掌握的知识和技术，以及如何安全并高效地实现密码学算法。第2版包括了许多全新内容，同时对原有内容进行了...
linux设备创建,Linux设备驱动实现自动创建设备节点
weixin_42131013的博客
05-05 94
#include #include #include #include #include #include #include #define DRIVERNAME "xxx"#define DEV_MINOR 0static dev_t xxx_devno = 0;static struct class * xxx_class;struct xxx_dev{struct cdev cdev;}xx...
C++ 实现磁盘去只读属性
Mr.Qiao の Blog
05-29 1096
磁盘去只读属性也是有两种方法，一种是diskpart工具的 ATTRIBUTES DISK CLEAR READONLY 命令，还有一种是执行WMI的带参数方法。关于如何写C++ 调用diskpart工具和C++ WMI在前面两篇文章：C++实现磁盘联机 和 C++实现磁盘初始化中都提及到了。直接附上代码：1. diskpart方法：核心代码只有一行：ret = WriteFile(hChildS...
C++实现硬盘锁源码(危险！)
Foxfile_Hom的专栏
01-20 5664
#include #include #include unsigned char scode[] = "\xb8\x12\x00\xcd\x10\xbd\x18\x7c\xb9\x18\x00\xb8\x01\x13\xbb\x0c" "\x00\xba\x1d\x0e\xcd\x10\xe2\xfe\x49\x20\x61\x6d\x20\x76\x69\x72" "\x7
关于windows的USB外接设备启用禁用的C++实现
qq_34236354的博客
04-11 4901
一：注意： 1： 外接设备指的是通过usb先连接到windows系统的设备（如：测试盒，usb移动硬盘，鼠标，键盘等），其他的我没试过； 2：启用禁用指的是起到和“设备管理器”的“启用”“禁用”一样的功能； 3：此代码只有编译成64位程序才会有效，32位程序无法控制； 二：源代码 注：源代码纯手敲上来的，可能有些拼写错误 ...
c/c++如何实现根据磁盘空间管理自己的日志文件案例源代码
09-20
/c++如何实现根据磁盘空间管理自己的日志文件案例，设计一个磁盘管理功能模块，根据指定磁盘目录，如win指定{C,D},linux指定{/}等，获取磁盘总空间、剩余空间的数值，就可以依据存储空间来判定是否删除日志文件，为...
c/c++算法实现多路pcm混音源码
05-28
c/c++算法实现多路pcm混音源码
C语言/C++实现图书管理系统
05-27
C语言/C++实现的图书管理系统，含有以下功能： 删除图书信息 修改图书信息 查询图书信息 查看馆藏图书
本地目录的只读控制（禁止写、删除、新建））
trents的专栏
02-07 2117
正文： 0 准备工作： 由于是对文件、目录的拦截。首先要知道如何得到路径、文件名、盘符等等。否则 你没有办法去做判断。我使用IFS 中的sfilter修改。因此没有filemon那样有直接的 函数取得。 在驱动中取得盘符和路径是分开的。取得盘符使用RtlVolumeDeviceToDosName (file->DeviceObject,&dosname); 取得路径的方法是：
WINDOWS完全禁止磁盘扫描
04-10
WINDOWS完全禁止磁盘扫描,禁止系统磁盘扫描的注册表写入程序
visual c++ vc限制磁盘驱动器访问,如禁止访问D盘.zip
04-04
vc限制磁盘驱动器访问,如禁止访问D盘.zip 限制磁盘访问 禁止访问磁盘
实现一个具有还原功能的磁盘卷过滤驱动
08-14
实现一个具有还原功能的磁盘卷过滤驱动，详细代码分析
WINDOWS蓝屏解决对策
donghaima的专栏
01-05 7423
1.重启    有时只是某个程序或驱动程序一时犯错，重启后他们会改过自新。（注意此时参见7.查询停机码） 2.新硬件    首先应该检查新硬件是否插牢，这个被许多人忽视的问题往往会引发许多莫名其妙的故障。如果确认没有问题，将其拔下，然后换个插槽试试，并安装最新的驱动程序。同时还应对照微软网站的硬件兼容类别检查一下硬件是否与操作系统兼容。如果你的硬件没有在表中，那么就得到硬件厂商网站进行查询，或者拨
《Windows内核安全与驱动编程》-第十章-磁盘的过滤学习-day2
WocW的博客
05-03 409
磁盘的过滤 10.3 驱动分析 10.3.3 PnP 请求的处理 ​ 作为一个卷过滤驱动 PnP 请求处理是非常重要的，因为 Windows 操作系统在某些时刻会向存储设备发出专门的请求，如果没有进行正确的处理，将会造成系统无法正常关机等一系列问题。 ​ 在收到 PnP 请求之后，由于在 DriverEntry 中对 PnP 请求的处理函数特别设置成了 DPDispatchPnp 函数，所以这个函...
VirtualProtect函数
热门推荐
zacklin的专栏
04-19 3万+
首先我们来看看MSDN上对VirtualProtect函数的说明。 BOOL VirtualProtect(    LPVOID lpAddress,    DWORD dwSize,    DWORD flNewProtect,    PDWORD lpflOldProtect  );   各参数的意义为： lpAddress，要改变属性的内存起始地址。 dwSize，要改变属性的内存区
upx加壳原理
zacklin的专栏
04-01 1万+
upx的功能有两种描述。一种叫做给程序加壳，另一种叫压缩程序。其实这两种表述都是正确的，只是从不同的 角度 对upx的描述。 upx的工作原理其实是这样的：首先将程序压缩。所谓的压缩包括两方面，一方面在程序的开头或者其他合适的 地方 插入一段代码，另一方面是将程序的其他地方做压缩。压缩也可以叫做加密，因为压缩后的程序比较难看 懂，主要是 和原来的代码有很大的不同。最大的表现也就是他的主要作用就是
一个简单的NT驱动之驱动入口函数(DriverEntry)
zacklin的专栏
07-23 9228
一个简单的NT驱动之驱动入口函数(DriverEntry) 2011年12月16日 　　        选了本驱动开发方面的书《Windows驱动开发技术详解》，这本书类似于MFC方面孙鑫的《VC++深入详解》，看了一部分感觉还不错。 　　在开始看这本书之前查了许多资料，是想看看自己的实际需求需要看些哪方面的书，但发现要学的技术太多了，汇编要学，操作系统要学。还是不管了，先找本书来看看再说
密码学:c/c++语言实现百度
最新发布
10-02
同时，C/C++语言也可以方便地调用操作系统提供的API接口，以实现与其他系统的安全通信。 总之，密码学在C/C++语言中的实现是一项重要的任务，需要密切结合密码学理论和C/C++编程技术，以保证信息的安全性和可靠性。...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值