PsSetLoadImageNotifyRoutine回调列子

最新推荐文章于 2023-12-01 16:30:18 发布

Cosmop01itan

最新推荐文章于 2023-12-01 16:30:18 发布

阅读量1k

点赞数

分类专栏：二进制

本文链接：https://blog.csdn.net/CosmopolitanMe/article/details/102456032

版权

二进制专栏收录该内容

43 篇文章 0 订阅

订阅专栏

#include <ntddk.h>

VOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE  ProcessId, PIMAGE_INFO  ImageInfor);
NTSTATUS	Unload(PDRIVER_OBJECT driver)
{
	DbgPrint("unload driver");
	PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine);
	return STATUS_SUCCESS;
}

VOID UnicodeToChar(PUNICODE_STRING uniSource, CHAR *szDest)
{
	ANSI_STRING ansiTemp;
	RtlUnicodeStringToAnsiString(&ansiTemp, uniSource, TRUE);

	strcpy(szDest, ansiTemp.Buffer);
	RtlFreeAnsiString(&ansiTemp);
}

VOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE  ProcessId, PIMAGE_INFO  ImageInfor)
{
	PVOID DriverEntryAddress = NULL;
	char szFullImageName[260] = { 0 };

	if (ProcessId)
	{
		UnicodeToChar(FullImageName, szFullImageName);
		//        DbgPrint("FullImageName:%s\r\n",szFullImageName);
		
		DbgPrint("%s LoadImage\r\n",szFullImageName);
		
	}
}




NTSTATUS	DriverEntry(PDRIVER_OBJECT	driver, PUNICODE_STRING	RegPath)
{
	DbgPrint("Driver Entry");
	driver->DriverUnload = Unload;

	PsSetLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)LoadImageNotifyRoutine);
	return STATUS_SUCCESS;
}