驱动抢占最早开机时机

抢占最早开机时间条件:
1.关机回调最晚执行(可其他骚操作)
2.第一:System Reserved
第二:想要执行的模块

VOID
ChangeServiceGroupOrder(
    __in PVOID Context
)
{
    NTSTATUS Status = STATUS_UNSUCCESSFUL;
    PKEY_VALUE_PARTIAL_INFORMATION ValueData = NULL;
    ULONG ValueLength = 0;
    PWSTR Current = NULL;
    PWSTR NewCurrent = NULL;
    UNICODE_STRING CurrentGroup = { 0 };
    PVOID Buffer = NULL;
    ULONG Size = 0, NumberCount = 0;
#define GROUPNAME L"XXXXSSSS"
    UNICODE_STRING BaseString = RTL_CONSTANT_STRING(GROUPNAME);
    BOOLEAN Exist = FALSE;

    do
    {
        Status = reg::RKQueryValue(
            L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ServiceGroupOrder",
            L"List",
            &ValueData,
            &ValueLength
            );
        if (!NT_SUCCESS(Status))
        {
            break;
        }

        Buffer = ExAllocatePoolWithTag(
            PagedPool,
            (ValueData->DataLength + sizeof(WCHAR)) * 2 + wcslen(GROUPNAME) * 2 + sizeof(WCHAR),
            '9977'
            );
        if (Buffer == NULL)
        {
            break;
        }
        RtlZeroMemory(Buffer, (ValueData->DataLength + sizeof(WCHAR)) * 2 + wcslen(GROUPNAME) * 2 + sizeof(WCHAR));
        RtlCopyMemory(Buffer, ValueData->Data, ValueData->DataLength);

        Current = (PWSTR)Buffer;
        NewCurrent = (WCHAR*)((PUCHAR)Buffer + ValueData->DataLength + sizeof(WCHAR));
        Size = ValueData->DataLength + sizeof(WCHAR) + wcslen(GROUPNAME) * 2 + sizeof(WCHAR);
        while (Current < (PWSTR)((PUCHAR)Buffer + ValueData->DataLength + sizeof(WCHAR)))
        {
            if (*Current == UNICODE_NULL)
            {
                break;
            }

            RtlInitUnicodeString(&CurrentGroup, Current);
            if (NumberCount == 1)
            {
                if (RtlCompareUnicodeString(&CurrentGroup, &BaseString, TRUE) == 0)
                {
                    break;
                }

                RtlStringCbCatW(
                    NewCurrent,
                    Size,
                    BaseString.Buffer
                    );
                *(PWSTR)((PUCHAR)NewCurrent + BaseString.Length) = UNICODE_NULL;
                NewCurrent = (PWSTR)((PUCHAR)NewCurrent + BaseString.MaximumLength);
                Size -= BaseString.MaximumLength;
            }
            else
            {
                if (NumberCount != 0 && RtlCompareUnicodeString(&CurrentGroup, &BaseString, TRUE) == 0)
                {
                    Exist = TRUE;
                    Current = (PWSTR)((PUCHAR)Current + CurrentGroup.MaximumLength);
                }
                else
                {
                    RtlStringCbCatW(
                        NewCurrent,
                        Size,
                        CurrentGroup.Buffer
                        );
                    *(PWSTR)((PUCHAR)NewCurrent + CurrentGroup.Length) = UNICODE_NULL;
                    NewCurrent = (PWSTR)((PUCHAR)NewCurrent + CurrentGroup.MaximumLength);
                    Size -= CurrentGroup.MaximumLength;
                    Current = (PWSTR)((PUCHAR)Current + CurrentGroup.MaximumLength);
                }
            }

            NumberCount++;
        }

        if (NumberCount != 1)
        {
            reg::RKSetValue(
                L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ServiceGroupOrder",
                L"List",
                REG_MULTI_SZ,
                (WCHAR*)((PUCHAR)Buffer + ValueData->DataLength + sizeof(WCHAR)),
                Exist ? ValueData->DataLength : ValueData->DataLength + wcslen(GROUPNAME) * 2 + sizeof(WCHAR)
                );
        }

    } while (FALSE);

    if (Buffer != NULL)
    {
        ExFreePoolWithTag(Buffer, '9977');
    }
    if (ValueData != NULL)
    {
        ExFreePool(ValueData);
    }
}