java 内核驱动_简单的内核模式驱动程序

我正在创建简单的内核模式驱动程序(空项目)来尝试一些

在用户模式应用程序上读/写内存操作 .

我在编译项目时遇到错误在这些方面：

NTSTATUS NTAPI MmCopyVirtualMemory(PEPROCESS SourceProcess, PVOID

SourceAddress, PEPROCESS TargetProcess, PVOID TargetAddress, SIZE_T

BufferSize, KPROCESSOR_MODE PreviousMode, PSIZE_T ReturnSize);

NTSTATUS PsLookupProcessByProcessId(_In_ HANDLE ProcessId, _Outptr_

PEPROCESS *Process);

KernelWPM(Process, &Writeval, 0x010F29B0, sizeof(__int32));

VS编译错误：

Severity Code Description Project File Line Suppression State

Error C2371 'PEPROCESS': redefinition; different basic types INR

C:\Program Files (x86)\Windows Kits\10\Include\10.0.16299.0\km\ntifs.h 85

Warning C4022 'GetProcessByID': pointer mismatch for actual parameter 1

INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c 62

Error C2371 'PETHREAD': redefinition; different basic types INR

C:\Program Files (x86)\Windows Kits\10\Include\10.0.16299.0\km\ntifs.h 86

Warning C4047 'function': 'PEPROCESS' differs in levels of indirection

from 'PEPROCESS **' INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c 62

Warning C4024 'GetProcessByID': different types for formal and actual

parameter 2 INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c 62

Warning C4047 'function': 'PEPROCESS' differs in levels of indirection

from 'PEPROCESS *' INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c 64

Warning C4024 'KernelWPM': different types for formal and actual parameter

1 INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c 64

Warning C4022 'KernelWPM': pointer mismatch for actual parameter 3 INR

C:\Users\NAKEDRAT\Desktop\INR\INR\main.c 64

这是我的代码：也使用相同的SDK和WDK版本

#include

#include

#include

DRIVER_INITIALIZE DriverEntry;

#pragma alloc_text(INIT, DriverEntry)

NTSTATUS NTAPI MmCopyVirtualMemory(PEPROCESS SourceProcess, PVOID

SourceAddress, PEPROCESS TargetProcess, PVOID TargetAddress, SIZE_T

BufferSize, KPROCESSOR_MODE PreviousMode, PSIZE_T ReturnSize);

NTSTATUS PsLookupProcessByProcessId(_In_ HANDLE ProcessId, _Outptr_

PEPROCESS *Process);

NTSTATUS KernelRPM(PEPROCESS Process, PVOID SourceAddress, PVOID

TargetAddress, SIZE_T Size)

{

PEPROCESS SourceProcess = Process;

PEPROCESS TargetProcess = PsGetCurrentProcess();

SIZE_T Result;

if (NT_SUCCESS(MmCopyVirtualMemory(SourceProcess, SourceAddress,

TargetProcess, TargetAddress, Size, KernelMode, &Result)))

return STATUS_SUCCESS;

else

return STATUS_ACCESS_DENIED;

}

NTSTATUS KernelWPM(PEPROCESS Process, PVOID SourceAddress, PVOID

TargetAddress, SIZE_T Size)

{

PEPROCESS SourceProcess = PsGetCurrentProcess();

PEPROCESS TargetProcess = Process;

SIZE_T Result;

if (NT_SUCCESS(MmCopyVirtualMemory(SourceProcess, SourceAddress,

TargetProcess, TargetAddress, Size, KernelMode, &Result)))

return STATUS_SUCCESS;

else

return STATUS_ACCESS_DENIED;

}

NTSTATUS DriverEntry(_In_ struct _DRIVER_OBJECT *DriverObject, _In_

PUNICODE_STRING RegistryPath)

{

int Writeval = 666;

PEPROCESS *Process;

GetProcessByID(4872, &Process);

KernelWPM(Process, &Writeval, 0x010F29B0, sizeof(__int32));

DbgPrint("Value of int i: %d", Writeval);

return STATUS_SUCCESS;

}

我究竟做错了什么？我怎么能改进，有什么建议吗？谢谢 .