#include <ntddk.h>
#define MAKELONG(low, high) \
((ULONG)(((USHORT)((ULONG)(low) & 0xffff)) | ((ULONG)((USHORT)((ULONG)(high) & 0xffff))) << 16))
#define GET_LOW16_OF_32(data) \
((USHORT)(((ULONG)data) & 0xffff))
#define GET_HIGH16_OF_32(data) \
((USHORT)(((ULONG)data) >> 16))
#pragma pack(push,1)
typedef struct IDTR_
{
USHORT limit;
ULONG base;
} IDTR, *P_IDTR;
typedef struct IDTENTRY_
{
USHORT offset_low;
USHORT selector;
UCHAR reserved;
UCHAR type:4;
UCHAR always0:1;
UCHAR dpl:2;
UCHAR present:1;
USHORT offset_high;
} IDTENTRY, *P_IDTENTRY;
#pragma pack(pop)
ULONG Offset = 0;
ULONG HOOK_IDT_INDEX[] = {0x01, 0x03};
#define HOOK_IDT_NUM sizeof(HOOK_IDT_INDEX)/sizeof(ULONG)
VOID *g_old_entry[HOOK_IDT_NUM] = {0};
VOID *GetIdt()
{
IDTR idtr;
_asm sidt idtr
return (VOID *)idtr.base;
}
VOID MyUserFilter()
{
KdPrint(("Crurrent IRQL: %d\n",KeGetCurrentIrql()));
if (Offset &
一个禁止任何ring3调试的驱动
最新推荐文章于 2021-10-20 13:40:47 发布
![](https://img-home.csdnimg.cn/images/20240711042549.png)