Kernel Detours

最新推荐文章于 2022-04-23 13:39:40 发布

xiaoqiangvs007

最新推荐文章于 2022-04-23 13:39:40 发布

阅读量1.3k

点赞数

分类专栏： Rootkit或网络安全文章标签： function resources object null build date

Rootkit或网络安全专栏收录该内容

9 篇文章 0 订阅

订阅专栏

2007年02月19日星期一上午 08:58

修改了微软的Detours库使之可以在驱动中使用，并且可以用在DriverWorks类库环境中，运行测试通过，感觉巨爽！呵呵！

// KnlDetoursDriver.cpp
//
// Generated by DriverWizard 3.2.0 (Build 2485)
// Requires DDK and DriverWorks
// File created on 2/19/2007
//
// This source file contains the implementation of a subclass of KDriver.
// All drivers implement a subclass of KDriver and override member
// function DriverEntry.
//

#define VDW_MAIN
#include <vdw.h>
#include "function.h"
#include "KnlDetoursDriver.h"
#include "KnlDetoursDevice.h"
#include "detours.h"

#pragma hdrstop("KnlDetours.pch")

// Memory allocation pool tag
// Override this value using the global function SetPoolTag().
POOLTAG DefaultPoolTag('DlnK');

// Global driver trace object
// TODO: Use KDebugOnlyTrace if you want trace messages
//   to appear only in checked builds.  Use KTrace if
//   you want trace messages to always appear.  Call
//   method SetOutputLevel to set the output threshold.
KDebugOnlyTrace T("KnlDetours");

///
// Begin INIT section
#pragma code_seg("INIT")

DECLARE_DRIVER_CLASS(KnlDetoursDriver, NULL)

DETOUR_TRAMPOLINE(
NTSTATUS
Trampoline_IoCreateDevice(
    IN PDRIVER_OBJECT  DriverObject,
    IN ULONG  DeviceExtensionSize,
    IN PUNICODE_STRING  DeviceName  OPTIONAL,
    IN DEVICE_TYPE  DeviceType,
    IN ULONG  DeviceCharacteristics,
    IN BOOLEAN  Exclusive,
    OUT PDEVICE_OBJECT  *DeviceObject
    ),
IoCreateDevice
);

NTSTATUS
  Mine_IoCreateDevice(
    IN PDRIVER_OBJECT  DriverObject,
    IN ULONG  DeviceExtensionSize,
    IN PUNICODE_STRING  DeviceName  OPTIONAL,
    IN DEVICE_TYPE  DeviceType,
    IN ULONG  DeviceCharacteristics,
    IN BOOLEAN  Exclusive,
    OUT PDEVICE_OBJECT  *DeviceObject
    )
{
DbgPrint(__FUNCTION__"/n");
return Trampoline_IoCreateDevice(DriverObject,DeviceExtensionSize,DeviceName,DeviceType,DeviceCharacteristics
  ,Exclusive,DeviceObject);
}

///
//  KnlDetoursDriver::DriverEntry
//  This routine is called when the driver is loaded.  NT drivers
//  create device objects.  Drivers often read the registry for
//  configurable parameters.
//
// Arguments:
//  IN RegistryPath
//    pointer to a unicode string representing the path to
//    driver-specific key in the registry.  Look for:
//    HKLM/SYSTEM/CurrentControlSet/Services/KnlDetours
//
// Return Value:
//  NTSTATUS code
//

NTSTATUS KnlDetoursDriver::DriverEntry(PUNICODE_STRING RegistryPath)
{
T.Trace(TraceInfo, __FUNCTION__"++. Compiled at " __TIME__ " on " __DATE__ "/n");

#ifdef DBG
//DbgBreakPoint();
#endif

//挂钩IoCreateDevice
DetourFunctionWithTrampoline((PUCHAR)&Trampoline_IoCreateDevice,(PUCHAR)&Mine_IoCreateDevice);

NTSTATUS status = STATUS_SUCCESS;

// This macro suppresses compiler warning for unreferenced variable.
// If you reference this parameter, simply remove the macro.
UNREFERENCED_PARAMETER(RegistryPath);

// TODO: If you want multiple instances of this device, edit
//   the following code to create (using 'new') additional
//   instances of the class "KnlDetoursDevice".  For
//   example, a serial driver with 6 ports would create 6
//   instances of the class, one for each port.
int unit = 0;

// Create KnlDetoursDevice using a form of "placement" new
// that is a member operator of KDevice.  This will use storage
// in the system device object extension to store the class instance.
KnlDetoursDevice* pDevice = new (
   static_cast<PCWSTR>(KUnitizedName(L"KnlDetoursDevice", unit)),
   FILE_DEVICE_UNKNOWN,
   static_cast<PCWSTR>(KUnitizedName(L"KnlDetoursDevice", unit)),
   0,
   DO_DIRECT_IO
   )
  KnlDetoursDevice();

if (pDevice == NULL)
{
  status = STATUS_INSUFFICIENT_RESOURCES;
}
else
{
  status = pDevice->ConstructorStatus();
  if (!NT_SUCCESS(status))
  {
   delete pDevice;
  }
}

T.Trace(TraceInfo, __FUNCTION__"--. STATUS %x/n", status);

return status;
}

///
#pragma code_seg() // end INIT code
///

///
//  KnlDetoursDriver::Unload
//  This routine is called when the driver is unloaded.  Delete any
//  device objects created in DriverEntry by calling base class method
//  Unload().  Cleanup any allocations made for registry values in
//  DriverEntry.
//
// Arguments:
//  none
//
// Return Value:
//  none
//
VOID KnlDetoursDriver::Unload(VOID)
{
T.Trace(TraceInfo, __FUNCTION__"++./n");

// If you don't need to perform any functions
// except to call the base class KDriver::Unload(),
// then this entire routine may be safely deleted.

// Call base class to delete all devices.
KDriver::Unload();

//脱钩IoCreateDevice
DetourRemove((PUCHAR)&Trampoline_IoCreateDevice,(PUCHAR)&Mine_IoCreateDevice);

T.Trace(TraceInfo, __FUNCTION__"--./n");
}