第二十五课_对象类型的几个回调函数介绍

#include"ntddk.h"  

typedef enum _OB_OPEN_REASON {
	ObCreateHandle,
	ObOpenHandle,
	ObDuplicateHandle,
	ObInheritHandle,
	ObMaxOpenReason
} OB_OPEN_REASON;
typedef NTSTATUS(*OB_OPEN_METHOD)(
	IN ULONG unknown,
	IN OB_OPEN_REASON OpenReason,
	IN PEPROCESS Process OPTIONAL,
	IN PVOID Object,
	IN ACCESS_MASK GrantedAccess,
	IN ULONG HandleCount
	);//OpenProcedure 的类型
ULONG g_orig_openprocedure;
BOOLEAN g_bhook_sucess;
NTSTATUS openprocesscallback(
	IN ULONG unknown,
	IN OB_OPEN_REASON OpenReason,
	IN PEPROCESS Process OPTIONAL,
	IN PVOID Object,
	IN ACCESS_MASK GrantedAccess,
	IN ULONG HandleCount
	)
{
	KdPrint(("%s\n", (char*)Process + 0x16c));//源进程
	KdPrint(("%s\n", (char*)Object + 0x16c));//目标进程
	return ((OB_OPEN_METHOD)g_orig_openprocedure)(unknown,OpenReason, Process, \
		Object, GrantedAccess, HandleCount);
}
void setprocesscallback()//安装替换
{
	g_orig_openprocedure = *(ULONG*)((ULONG)*PsProcessType + 0x5c);
	*(ULONG*)((ULONG)*PsProcessType + 0x5c) = (ULONG)openprocesscallback;
}
void resprocesscallback()//还原
{
	*(ULONG*)((ULONG)*PsProcessType + 0x5c) = g_orig_openprocedure;
}
VOID xiezai1(PDRIVER_OBJECT qudongduixiang)
{
	resprocesscallback();//还原
	KdPrint(("已经执行到了 驱动卸载历程\n"));
}
NTSTATUS DriverEntry(PDRIVER_OBJECT qudongduixiang, PUNICODE_STRING zhucebiao1)
{
	setprocesscallback();//安装替换
	qudongduixiang->DriverUnload = xiezai1;
	return STATUS_SUCCESS;
}