Ring3
#include <stdio.h>
#include <windows.h>
#define LINK_NAME L"\\\\.\\ndis"
//控制码起始地址
#define IRP_IOCTRL_BASE 0x8000
//控制码宏定义
#define IRP_IOCTRL_CODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN,IRP_IOCTRL_BASE + i,METHOD_BUFFERED,FILE_ALL_ACCESS)
//控制码定义
#define CTL_PRINT IRP_IOCTRL_CODE(0)
int main()
{
HANDLE hDeviceHandle = CreateFile(LINK_NAME, GENERIC_ALL,0,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
if (hDeviceHandle == INVALID_HANDLE_VALUE)
{
printf("ERROR:%d\n",GetLastError());
system("pause");
return 0;
}
//IRP_MJ_DEVICE_CONTROL
while (1)
{
char InputBuffer[MAX_PATH] = { 0 };
char OutBuffer[MAX_PATH] = { 0 };
ULONG uRet = 0;
printf("输入字符串");
scanf("%s", InputBuffer);
DeviceIoControl(hDeviceHandle, CTL_PRINT, InputBuffer, sizeof(InputBuffer), OutBuffer, sizeof(OutBuffer), &uRet, NULL);
printf("Return %d bytes!\n", uRet);
printf("Return Buffer:%s\n", OutBuffer);
}
CloseHandle(hDeviceHandle);
system("pause");
return 0;
Ring0
#include <ntifs.h>
#define DRIVER_NAME L"\\Driver\\NDIS"
//控制码起始地址
#define IRP_IOCTRL_BASE 0x8000
//控制码宏定义
#define IRP_IOCTRL_CODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN,IRP_IOCTRL_BASE + i,METHOD_BUFFERED,FILE_ALL_ACCESS)
//控制码定义
#define CTL_PRINT IRP_IOCTRL_CODE(0)
//保存原始的处理函数
PDRIVER_DISPATCH OldDriverObject;
//设备类型
//extern POBJECT_TYPE IoDeviceObjectType;
extern POBJECT_TYPE *IoDriverObjectType;
extern NTSTATUS ObReferenceObjectByName(
IN PUNICODE_STRING ObjectPath,
IN ULONG Attributes,
IN PACCESS_STATE PassedAccessState OPTIONAL,
IN ACCESS_MASK DesiredAccess OPTIONAL,
IN POBJECT_TYPE ObjectType,
IN KPROCESSOR_MODE AccessMode,
IN OUT PVOID ParseContext OPTIONAL,
OUT PVOID *ObjectPtr
);
//IRP派遣函数-控制
NTSTATUS DispatchIoCtrl(PDEVICE_OBJECT DeviceObject, PIRP pIrp)
{
//控制码
ULONG uIoCode = 0;
//输入缓冲区
PVOID pInputBuffer = NULL;
//输出缓冲区
PVOID pOutPutBuffer = NULL;
//获取输入缓冲区长度
ULONG uInputBufferLenth = 0;
//栈结构指针
PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
//获取缓冲区
pInputBuffer = pOutPutBuffer = pIrp->AssociatedIrp.SystemBuffer;
//获取缓冲区长度
uInputBufferLenth = pStack->Parameters.DeviceIoControl.InputBufferLength;
//获取控制码
uIoCode = pStack->Parameters.DeviceIoControl.IoControlCode;
//按照控制码进行分发
switch (uIoCode)
{
case CTL_PRINT:
{
DbgPrint("%s", pInputBuffer);
//初始化缓冲区内存
RtlZeroMemory(pOutPutBuffer, 256);
//
ULONG uStrLenth = strlen("Io Success!Mikasys!!!");
RtlCopyMemory(pOutPutBuffer, "Io Success!Mikasys!!!", uStrLenth);
//设置IRP处理成功
pIrp->IoStatus.Status = STATUS_SUCCESS;
//设置返回的字节数
pIrp->IoStatus.Information = uStrLenth;
//结束IRP处理流程
IoCompleteRequest(pIrp, IO_NO_INCREMENT);
//返回
return STATUS_SUCCESS;
}
}
if (pIrp->IoStatus.Status)
{
IoCompleteRequest(pIrp, 0);
return OldDriverObject(DeviceObject, pIrp);
}
}
VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
//创建设备名称
UNICODE_STRING uDriverName = { 0 };
//初始化
RtlInitUnicodeString(&uDriverName, DRIVER_NAME);
//驱动对象
PDRIVER_OBJECT pOthersDriver = NULL;
//获取驱动对象-借壳通信
NTSTATUS ntStatus = ObReferenceObjectByName(&uDriverName, OBJ_CASE_INSENSITIVE, NULL, FILE_ALL_ACCESS, *IoDriverObjectType, KernelMode, NULL, &pOthersDriver);
if (!NT_SUCCESS(ntStatus))
{
DbgPrint("%X", ntStatus);
return;
}
// pOthersDriver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = OldDriverObject;
DbgPrint("卸载成功!\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{
UNREFERENCED_PARAMETER(pRegPath);
pDriver->DriverUnload = DriverUnload;
//创建设备名称和符号链接名称
UNICODE_STRING uDriverName = { 0 };
//初始化
RtlInitUnicodeString(&uDriverName, DRIVER_NAME);
//驱动对象
PDRIVER_OBJECT pDriverObject = NULL;
NTSTATUS ntStatus = 0;
//获取驱动对象-借壳通信
ntStatus = ObReferenceObjectByName(&uDriverName, OBJ_CASE_INSENSITIVE, NULL, FILE_ALL_ACCESS, *IoDriverObjectType, KernelMode, NULL, &pDriverObject);
if (!NT_SUCCESS(ntStatus))
{
DbgPrint("%X", ntStatus);
return STATUS_SUCCESS;
}
if (!pDriverObject)
{
DbgPrint("%X", pDriverObject);
ObDereferenceObject(pDriverObject);
return STATUS_SUCCESS;
}
OldDriverObject = pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL];
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoCtrl;
//加载成功
DbgPrint("Driver Load SuccessN!");
return STATUS_SUCCESS;
}