驱动枚举进程

Driver.cpp

 

// DriEnumProcess.cpp : Defines the entry point for the console application.
//

#include "Driver.h"
#include "ntddk.h"
#include <ntddkbd.h>
#include "stdarg.h"
#include "stdio.h"
#include "ntddkbd.h"

typedef enum _SYSTEM_INFORMATION_CLASS {   
  SystemBasicInformation,   
  SystemProcessorInformation,   
  SystemPerformanceInformation,   
  SystemTimeOfDayInformation,   
  SystemNotImplemented1,   
  SystemProcessesAndThreadsInformation,   
  SystemCallCounts,   
  SystemConfigurationInformation,   
  SystemProcessorTimes,   
  SystemGlobalFlag,   
  SystemNotImplemented2,   
  SystemModuleInformation,   
  SystemLockInformation,   
  SystemNotImplemented3,   
  SystemNotImplemented4,   
  SystemNotImplemented5,   
  SystemHandleInformation,   
  SystemObjectInformation,   
  SystemPagefileInformation,   
  SystemInstructionEmulationCounts,   
  SystemInvalidInfoClass1,   
  SystemCacheInformation,   
  SystemPoolTagInformation,   
  SystemProcessorStatistics,   
  SystemDpcInformation,   
  SystemNotImplemented6,   
  SystemLoadImage,   
  SystemUnloadImage,   
  SystemTimeAdjustment,   
  SystemNotImplemented7,   
  SystemNotImplemented8,   
  SystemNotImplemented9,   
  SystemCrashDumpInformation,   
  SystemExceptionInformation,   
  SystemCrashDumpStateInformation,   
  SystemKernelDebuggerInformation,   
  SystemContextSwitchInformation,   
  SystemRegistryQuotaInformation,   
  SystemLoadAndCallImage,   
  SystemPrioritySeparation,   
  SystemNotImplemented10,   
  SystemNotImplemented11,   
  SystemInvalidInfoClass2,   
  SystemInvalidInfoClass3,   
  SystemTimeZoneInformation,   
  SystemLookasideInformation,   
  SystemSetTimeSlipEvent,   
  SystemCreateSession,   
  SystemDeleteSession,   
  SystemInvalidInfoClass4,   
  SystemRangeStartInformation,   
  SystemVerifierInformation,   
  SystemAddVerifier,   
    SystemSessionProcessesInformation   
} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;   
//------------------------------

//---------线程信息结构---------
typedef struct _SYSTEM_THREAD {   
  LARGE_INTEGER           KernelTime;   
  LARGE_INTEGER           UserTime;   
  LARGE_INTEGER           CreateTime;   
ULONG                   WaitTime;   
PVOID                   StartAddress;   
  CLIENT_ID               ClientId;   
  KPRIORITY               Priority;   
LONG                    BasePriority;   
ULONG                   ContextSwitchCount;   
ULONG                   State;   
  KWAIT_REASON            WaitReason;   
} SYSTEM_THREAD, *PSYSTEM_THREAD;   
//------------------------------

//---------进程信息结构---------
typedef struct _SYSTEM_PROCESS_INFORMATION {   
ULONG                   NextEntryOffset; //NextEntryDelta 构成结构序列的偏移量
ULONG                   NumberOfThreads; //线程数目
  LARGE_INTEGER           Reserved[3];   
  LARGE_INTEGER           CreateTime;   //创建时间
  LARGE_INTEGER           UserTime;     //用户模式(Ring 3)的CPU时间
  LARGE_INTEGER           KernelTime;   //内核模式(Ring 0)的CPU时间
  UNICODE_STRING          ImageName;    //进程名称
  KPRIORITY               BasePriority; //进程优先权
HANDLE                  ProcessId;    //ULONG UniqueProcessId 进程标识符
HANDLE                  InheritedFromProcessId; //父进程的标识符
ULONG                   HandleCount; //句柄数目
ULONG                   Reserved2[2];   
ULONG                   PrivatePageCount;   
  VM_COUNTERS             VirtualMemoryCounters; //虚拟存储器的结构
  IO_COUNTERS             IoCounters; //IO计数结构
  SYSTEM_THREAD           Threads[0]; //进程相关线程的结构数组
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;   

NTSYSAPI    
extern "C"
NTSTATUS   
NTAPI   
NtQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,   
             OUT PVOID SystemInformation,   
             IN ULONG SystemInformationLength,   
             OUT PULONG ReturnLength OPTIONAL);   

 

 

EnumProcess()
{
 ULONG pNeededSize=0;
 int iCount = 1;
 int bOver=0;
 NTSTATUS status;
 ULONG uSize;
 PVOID pSi=NULL; 
 PSYSTEM_PROCESS_INFORMATION pSpiNext = NULL;
 uSize=0x8000;
 pSi=ExAllocatePoolWithTag(NonPagedPool,uSize,'tag1');
 if (pSi!=NULL)
 {
  status=NtQuerySystemInformation(SystemProcessesAndThreadsInformation,pSi,uSize,&pNeededSize);
  DbgPrint("[Aliwy] SUCCESS uSize = %.8X, pNeededSize = %.8X, status = %.8X/n", uSize, pNeededSize, status);
  uSize=pNeededSize;
  status=NtQuerySystemInformation(SystemProcessesAndThreadsInformation,pSi,uSize,&pNeededSize);
  if (STATUS_SUCCESS==status)
  {
   pSpiNext=(PSYSTEM_PROCESS_INFORMATION) pSi;
   while (TRUE)
   {
    if (pSpiNext->ProcessId==0)
    {
     KdPrint(("[Aliwy] %d - System Idle Process/n",pSpiNext->ProcessId));
    }
    else
    {
     KdPrint(("[Aliwy] %d - %wZ/n",pSpiNext->ProcessId,&pSpiNext->ImageName));
    }
    if (pSpiNext->NextEntryOffset==0)
    {
     KdPrint(("[Aliwy] EnumProcess Over, Count is: %d/n"),iCount);
     bOver=1;
     break;
    }
    pSpiNext = (PSYSTEM_PROCESS_INFORMATION)((ULONG)pSpiNext + pSpiNext->NextEntryOffset); 
          iCount++; 
   }
   ExFreePool(pSi);
  
  }
  else
  {
   DbgPrint("[Aliwy] SUCCESS uSize = %.8X, pNeededSize = %.8X, status = %.8X/n", uSize, pNeededSize, status);
 
  }

 }
 

 
  

 
  return STATUS_SUCCESS;

}
#pragma INITCODE
extern "C" NTSTATUS DriverEntry (
   IN PDRIVER_OBJECT pDriverObject,
   IN PUNICODE_STRING pRegistryPath )
{
 NTSTATUS status;
 KdPrint(("Enter DriverEntry/n"));

 //注册其他驱动调用函数入口
 pDriverObject->DriverUnload = HelloDDKUnload;
 pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine;
 pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutine;
 pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine;
 pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKDispatchRoutine;
 
 //创建驱动设备对象
 status = CreateDevice(pDriverObject);

 EnumProcess();
 KdPrint(("DriverEntry end/n"));
 return status;
}

/************************************************************************
* 函数名称:CreateDevice
* 功能描述:初始化设备对象
* 参数列表:
      pDriverObject:从I/O管理器中传进来的驱动对象
* 返回 值:返回初始化状态
*************************************************************************/
#pragma INITCODE
NTSTATUS CreateDevice (
  IN PDRIVER_OBJECT pDriverObject)
{
 NTSTATUS status;
 PDEVICE_OBJECT pDevObj;
 PDEVICE_EXTENSION pDevExt;
 
 //创建设备名称
 UNICODE_STRING devName;
 RtlInitUnicodeString(&devName,L"//Device//MyDDKDevice");
 
 //创建设备
 status = IoCreateDevice( pDriverObject,
      sizeof(DEVICE_EXTENSION),
      &(UNICODE_STRING)devName,
      FILE_DEVICE_UNKNOWN,
      0, TRUE,
      &pDevObj );
 if (!NT_SUCCESS(status))
  return status;

 pDevObj->Flags |= DO_BUFFERED_IO;
 pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
 pDevExt->pDevice = pDevObj;
 pDevExt->ustrDeviceName = devName;
 //创建符号链接
 UNICODE_STRING symLinkName;
 RtlInitUnicodeString(&symLinkName,L"//??//HelloDDK");
 pDevExt->ustrSymLinkName = symLinkName;
 status = IoCreateSymbolicLink( &symLinkName,&devName );
 if (!NT_SUCCESS(status))
 {
  IoDeleteDevice( pDevObj );
  return status;
 }
 return STATUS_SUCCESS;
}

/************************************************************************
* 函数名称:HelloDDKUnload
* 功能描述:负责驱动程序的卸载操作
* 参数列表:
      pDriverObject:驱动对象
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject)
{
 PDEVICE_OBJECT pNextObj;
 KdPrint(("Enter DriverUnload/n"));
 pNextObj = pDriverObject->DeviceObject;
 while (pNextObj != NULL)
 {
  PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
   pNextObj->DeviceExtension;

  //删除符号链接
  UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
  IoDeleteSymbolicLink(&pLinkName);
  pNextObj = pNextObj->NextDevice;
  IoDeleteDevice( pDevExt->pDevice );
 }
}

/************************************************************************
* 函数名称:HelloDDKDispatchRoutine
* 功能描述:对读IRP进行处理
* 参数列表:
      pDevObj:功能设备对象
      pIrp:从IO请求包
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
         IN PIRP pIrp)
{
 KdPrint(("Enter HelloDDKDispatchRoutine/n"));
 NTSTATUS status = STATUS_SUCCESS;
 // 完成IRP
 pIrp->IoStatus.Status = status;
 pIrp->IoStatus.Information = 0; // bytes xfered
 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
 KdPrint(("Leave HelloDDKDispatchRoutine/n"));
 return status;
}

 

 

 

 

//Driver.h

 

#pragma once

#ifdef __cplusplus
extern "C"
{
#endif
#include <NTDDK.h>
#ifdef __cplusplus
}
#endif

#define PAGEDCODE code_seg("PAGE")
#define LOCKEDCODE code_seg()
#define INITCODE code_seg("INIT")

#define PAGEDDATA data_seg("PAGE")
#define LOCKEDDATA data_seg()
#define INITDATA data_seg("INIT")

#define arraysize(p) (sizeof(p)/sizeof((p)[0]))

typedef struct _DEVICE_EXTENSION {
 PDEVICE_OBJECT pDevice;
 UNICODE_STRING ustrDeviceName; //设备名称
 UNICODE_STRING ustrSymLinkName; //符号链接名
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;

 

// 函数声明

NTSTATUS CreateDevice (IN PDRIVER_OBJECT pDriverObject);
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject);
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
         IN PIRP pIrp);

 

 

下一个写一下查杀指定的进程，今天到此为止