2008-3-20 12:37
我把代码放上来 LS两位帮我看一下:
main文件:
#include
#include
#include
#include "D:\\c\\define.h"
#include
int main ()
{
HANDLE hDevice;
BOOL Status;
ULONG dwReturn;
char outBuf[4096];
hDevice=CreateFile("\\\\.\\MyEvent",GENERIC_READ | GENERIC_WRITE,
0,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,
NULL);
if(hDevice==INVALID_HANDLE_VALUE)
{
printf("createfile wrong\n");
getchar();
return 0;
}
Status=DeviceIoControl(hDevice,IOCTL_PASSBUF,NULL,0,
outBuf,sizeof(outBuf),&dwReturn,NULL);
if(!Status)
{
printf("Io wrong\n");
getchar();
return 0;
}
printf("%s\n",outBuf);
Status = CloseHandle( hDevice );
getchar();
return 0;
}
驱动:
#include
#include
#include
#define FLINKOFFSET 0x88
#define PIDOFFSET 0x84
UNICODE_STRING devNameUnicd,devLinkUnicd;
PKEVENT pEvent;
CHAR outBuf[255];
CHAR xxx[4096];
ULONG GetLocationOfProcessName()
{
ULONG pEProcess;
ULONG NameOffset;
pEProcess=(ULONG)PsGetCurrentProcess();
for(NameOffset=0;NameOffset<=PAGE_SIZE;NameOffset++)
{
if(!strncmp("System",(PCHAR)(pEProcess+NameOffset),strlen("System")))
{
return NameOffset;
}
}
return (ULONG)0;
}
VOID FindProcessByPId()
{
ULONG pEProcess;
ULONG FlinkAddress;
ULONG NameOffset;
PLIST_ENTRY pListEntry;
char* Name;
int i;
int Start_PId=0;
int Current_PId=0;
int Count=0;
pEProcess=(ULONG)PsGetCurrentProcess();
NameOffset=GetLocationOfProcessName();
FlinkAddress=pEProcess+FLINKOFFSET;
Name=(char*)(pEProcess+NameOffset);
Start_PId=*((int*)(pEProcess+PIDOFFSET));
Current_PId=Start_PId;
pListEntry=(PLIST_ENTRY)FlinkAddress;
while(Count==0||Current_PId!=Start_PId)
{
if(Current_PId<0) {Current_PId=0;}
DbgPrint("进程ID:%d 进程名:%s \n",Current_PId,Name);
sprintf(outBuf,"进程ID:%d 进程名:%s \n",Current_PId,Name);
if(Count==0) strcpy(xxx,outBuf);
else
strcat(xxx,outBuf);
pListEntry=pListEntry->Flink;
pEProcess=(ULONG)pListEntry-FLINKOFFSET;
Name=(char*)(pEProcess+NameOffset);
Current_PId=*((int*)(pEProcess+PIDOFFSET));
Count++;
}
}
NTSTATUS DeviceIoControlDispatch(IN PDEVICE_OBJECT pDeviceObject,IN PIRP pIrp)
{
PIO_STACK_LOCATION irpStack;
NTSTATUS Status;
PVOID InPutBuffer;
ULONG ioControlCode;
ULONG OutPutLen;
Status=STATUS_SUCCESS;
irpStack=IoGetCurrentIrpStackLocation(pIrp);
ioControlCode=irpStack->Parameters.DeviceIoControl.IoControlCode;
switch(irpStack->MajorFunction)
{
case IRP_MJ_CREATE:
DbgPrint("Call IRP_MJ_CREATE\n");
break;
case IRP_MJ_CLOSE:
break;
case IRP_MJ_DEVICE_CONTROL:
OutPutLen=irpStack->Parameters.DeviceIoControl.OutputBufferLength;
switch(ioControlCode)
{
case IOCTL_PASSBUF:
RtlCopyMemory(pIrp->UserBuffer,xxx, OutPutLen);
break;
default:
break;
}
break;
default:
DbgPrint("no match control\n");
break;
}
pIrp->IoStatus.Status = Status;
pIrp->IoStatus.Information = 0;
IoCompleteRequest (pIrp, IO_NO_INCREMENT);
return Status;
}
NTSTATUS OnUnload (IN PDRIVER_OBJECT pDriverObject)
{
NTSTATUS Status;
DbgPrint("Onload called\n");
if(pDriverObject->DeviceObject!=NULL)
{
Status=IoDeleteSymbolicLink(&devLinkUnicd);
if(!NT_SUCCESS(Status))
{
DbgPrint(("IoDeleteSymbolicLink() failed\n"));
return Status;
}
IoDeleteDevice(pDriverObject->DeviceObject);
}
return STATUS_SUCCESS;
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING pRegistryPath)
{
NTSTATUS Status;
PDEVICE_OBJECT pDevice;
RtlInitUnicodeString(&devNameUnicd,L"\\Device\\MyEvent");
RtlInitUnicodeString(&devLinkUnicd,L"\\??\\MyEvent");
Status=IoCreateDevice(pDriverObject,0,&devNameUnicd,FILE_DEVICE_UNKNOWN,
0,FALSE,&pDevice);
if(!NT_SUCCESS(Status))
{
DbgPrint(("Can not create device.\n"));
return Status;
}
Status=IoCreateSymbolicLink(&devLinkUnicd,&devNameUnicd);
if(!NT_SUCCESS(Status))
{
DbgPrint(("Can not create device.\n"));
return Status;
}
pDriverObject->DriverUnload=OnUnload;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=pDriverObject->MajorFunction[IRP_MJ_CREATE]=
pDriverObject->MajorFunction[IRP_MJ_CLOSE]=DeviceIoControlDispatch;
FindProcessByPId();
return STATUS_SUCCESS;
}