驱动学习三

#include<ntddk.h>
#include<windef.h>
#include<intrin.h>

PVOID OpenProcessAddr = NULL;
PVOID jmpAddr         = NULL;



KIRQL  WPOFFx64()
{
	KIRQL irql = KeRaiseIrqlToDpcLevel();

	DWORD64 cr0 =__readcr0();

	cr0 &= 0xfffffffffffeffff;

	__writecr0(cr0);

	_disable();

	return irql;

}


void WPONx64(KIRQL irql)
{
	DWORD64 cr0 = __readcr0();

	cr0 |= 0x10000;

	__writecr0(cr0);

	_enable();

	KeLowerIrql(irql);

	return;

}


typedef NTSTATUS(*PNtOpenProcess)
(
	PHANDLE            ProcessHandle,
	ACCESS_MASK        DesiredAccess,
	POBJECT_ATTRIBUTES ObjectAttributes,
	PCLIENT_ID         ClientId
	);






void DrvUnload(PDRIVER_OBJECT driver)
{
	KIRQL tempirql = WPOFFx64();

	RtlCopyMemory(OpenProcessAddr,jmpAddr,13);

	WPONx64(tempirql);

	ExFreePool(jmpAddr);

	jmpAddr = NULL;

	DbgPrint("the Driver has been unload");

	return;
}

NTSTATUS MyNtOpenProcess(
         PHANDLE            ProcessHandle,
         ACCESS_MASK        DesiredAccess,
         POBJECT_ATTRIBUTES ObjectAttributes,
		 PCLIENT_ID         ClientId
)
{
	
	if (ClientId->UniqueProcess == 4116)return STATUS_UNSUCCESSFUL;


	PNtOpenProcess tempaddr = (PNtOpenProcess)jmpAddr;


	return tempaddr(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
}









NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING pregpath)
{
	UNREFERENCED_PARAMETER(pregpath);
	
	UNICODE_STRING g_openprocess = { 0 };
	RtlInitUnicodeString(&g_openprocess, L"NtOpenProcess");
	OpenProcessAddr = MmGetSystemRoutineAddress(&g_openprocess);
	if (!OpenProcessAddr)
	{
		return STATUS_NOT_FOUND;
	}

	//DbgPrint("%p",OpenProcessAddr);


	BYTE hookcode[] = { 0x48,0xb8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff,0xe0 };

	ULONG tag=NULL;
	//jmpAddr = ExAllocatePool2(POOL_FLAG_NON_PAGED,0x1000,tag);

	jmpAddr = ExAllocatePool(NonPagedPool, 0x1000);

	RtlZeroMemory(jmpAddr, 0x1000);
	RtlCopyMemory(jmpAddr,OpenProcessAddr,13);

	*((PULONG_PTR)(hookcode + 2)) = ((ULONG_PTR)OpenProcessAddr+13);

	RtlCopyMemory((PUCHAR)jmpAddr+13, hookcode, sizeof(hookcode));

	*((PULONG_PTR)(hookcode + 2)) = (PULONG_PTR)&MyNtOpenProcess;

	KIRQL    tempirql = WPOFFx64();

	RtlCopyMemory(OpenProcessAddr, hookcode, sizeof(hookcode));

	WPONx64(tempirql);


	driver->DriverUnload = DrvUnload;




	return STATUS_SUCCESS;
}