驱动开发 借壳通信

Ring3

#include <stdio.h>
#include <windows.h>

#define LINK_NAME L"\\\\.\\ndis"

//控制码起始地址
#define  IRP_IOCTRL_BASE 0x8000
//控制码宏定义
#define IRP_IOCTRL_CODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN,IRP_IOCTRL_BASE + i,METHOD_BUFFERED,FILE_ALL_ACCESS)
//控制码定义
#define CTL_PRINT IRP_IOCTRL_CODE(0)
int main()
{
	HANDLE hDeviceHandle = CreateFile(LINK_NAME, GENERIC_ALL,0,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
	if (hDeviceHandle == INVALID_HANDLE_VALUE)
	{
		printf("ERROR:%d\n",GetLastError());
		system("pause");
		return 0;
	}
	
	//IRP_MJ_DEVICE_CONTROL
	while (1)
	{
		char InputBuffer[MAX_PATH] = { 0 };
		char OutBuffer[MAX_PATH] = { 0 };
		ULONG uRet = 0;
		printf("输入字符串");
		scanf("%s", InputBuffer);
		DeviceIoControl(hDeviceHandle, CTL_PRINT, InputBuffer, sizeof(InputBuffer), OutBuffer, sizeof(OutBuffer), &uRet, NULL);
		printf("Return %d bytes!\n", uRet);
		printf("Return Buffer:%s\n", OutBuffer);
	}
	CloseHandle(hDeviceHandle);
	
	system("pause");
	return 0;

Ring0

#include <ntifs.h>

#define DRIVER_NAME L"\\Driver\\NDIS"

//控制码起始地址
#define  IRP_IOCTRL_BASE 0x8000
//控制码宏定义
#define IRP_IOCTRL_CODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN,IRP_IOCTRL_BASE + i,METHOD_BUFFERED,FILE_ALL_ACCESS)
//控制码定义
#define CTL_PRINT IRP_IOCTRL_CODE(0)


//保存原始的处理函数
PDRIVER_DISPATCH OldDriverObject;

//设备类型
//extern POBJECT_TYPE IoDeviceObjectType;

extern POBJECT_TYPE *IoDriverObjectType;
extern NTSTATUS ObReferenceObjectByName(
	IN PUNICODE_STRING ObjectPath,
	IN ULONG Attributes,
	IN PACCESS_STATE PassedAccessState OPTIONAL,
	IN ACCESS_MASK DesiredAccess OPTIONAL,
	IN POBJECT_TYPE ObjectType,
	IN KPROCESSOR_MODE AccessMode,
	IN OUT PVOID ParseContext OPTIONAL,
	OUT PVOID *ObjectPtr
);

//IRP派遣函数-控制
NTSTATUS DispatchIoCtrl(PDEVICE_OBJECT DeviceObject, PIRP pIrp)
{
	//控制码
	ULONG uIoCode = 0;
	//输入缓冲区
	PVOID pInputBuffer = NULL;
	//输出缓冲区
	PVOID pOutPutBuffer = NULL;
	//获取输入缓冲区长度
	ULONG uInputBufferLenth = 0;
	//栈结构指针
	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
	//获取缓冲区
	pInputBuffer = pOutPutBuffer = pIrp->AssociatedIrp.SystemBuffer;
	//获取缓冲区长度
	uInputBufferLenth = pStack->Parameters.DeviceIoControl.InputBufferLength;
	//获取控制码
	uIoCode = pStack->Parameters.DeviceIoControl.IoControlCode;
	//按照控制码进行分发
	switch (uIoCode)
	{
	case CTL_PRINT:
	{
		DbgPrint("%s", pInputBuffer);
		//初始化缓冲区内存
		RtlZeroMemory(pOutPutBuffer, 256);
		//
		ULONG uStrLenth = strlen("Io Success!Mikasys!!!");
		RtlCopyMemory(pOutPutBuffer, "Io Success!Mikasys!!!", uStrLenth);

		//设置IRP处理成功
		pIrp->IoStatus.Status = STATUS_SUCCESS;
		//设置返回的字节数
		pIrp->IoStatus.Information = uStrLenth;
		//结束IRP处理流程
		IoCompleteRequest(pIrp, IO_NO_INCREMENT);
		//返回
		return STATUS_SUCCESS;
	}
	}
	if (pIrp->IoStatus.Status)
	{
		IoCompleteRequest(pIrp, 0);
		return OldDriverObject(DeviceObject, pIrp);
	}
}

VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
	//创建设备名称
	
	UNICODE_STRING uDriverName = { 0 };
	//初始化
	RtlInitUnicodeString(&uDriverName, DRIVER_NAME);
	//驱动对象
	PDRIVER_OBJECT pOthersDriver = NULL;
	//获取驱动对象-借壳通信
	NTSTATUS ntStatus = ObReferenceObjectByName(&uDriverName, OBJ_CASE_INSENSITIVE, NULL, FILE_ALL_ACCESS, *IoDriverObjectType, KernelMode, NULL, &pOthersDriver);
	if (!NT_SUCCESS(ntStatus))
	{
		DbgPrint("%X", ntStatus);
		return;
	}
//	pOthersDriver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = OldDriverObject;
	
	DbgPrint("卸载成功!\n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{
	UNREFERENCED_PARAMETER(pRegPath);
	pDriver->DriverUnload = DriverUnload;
	//创建设备名称和符号链接名称
	UNICODE_STRING uDriverName = { 0 };
	//初始化
	RtlInitUnicodeString(&uDriverName, DRIVER_NAME);
	//驱动对象
	PDRIVER_OBJECT pDriverObject = NULL;
	NTSTATUS ntStatus = 0;	
	//获取驱动对象-借壳通信
	ntStatus = ObReferenceObjectByName(&uDriverName, OBJ_CASE_INSENSITIVE, NULL, FILE_ALL_ACCESS, *IoDriverObjectType, KernelMode, NULL, &pDriverObject);

	if (!NT_SUCCESS(ntStatus))
	{
		DbgPrint("%X", ntStatus);
		return STATUS_SUCCESS;
	}
	if (!pDriverObject)
	{
		DbgPrint("%X", pDriverObject);
		ObDereferenceObject(pDriverObject);
		return STATUS_SUCCESS;
	}
	
	OldDriverObject = pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL];
	pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoCtrl;
	
	//加载成功
	DbgPrint("Driver Load SuccessN!");
	
	return STATUS_SUCCESS;
}