PsSetLoadImageNotifyRoutine
#include <ntifs.h>
#include <ntddk.h>
#include <Ntstrsafe.h>
#include <fltKernel.h>
//删除指针
#define SafeFreeDelete(pData) { if(pData){ExFreePool(pData);pData=NULL;} }
//减少对象引用计数
#define SafeDereferenceObject(Object) { if(Object){ObDereferenceObject(Object);Object=NULL;} }
//关闭句柄
#define SafeCloseHandle(Handle) { if(Handle){ZwClose(Handle);Handle=NULL;} }
//分配内存
PUNICODE_STRING ExAllocateUnicodeStingPool(PUNICODE_STRING strBuff)
{
PUNICODE_STRING AllocateString = NULL;
if (MmIsAddressValid(strBuff) == FALSE || strBuff == NULL || strBuff->Buffer == NULL || strBuff->Length < sizeof(wchar_t))
{
ASSERT(FALSE);
return NULL;
}
AllocateString = ExAllocatePool(NonPagedPool, sizeof(UNICODE_STRING) + strBuff->Length + sizeof(wchar_t));
if (AllocateString == NULL)
{
ASSERT(FALSE);
return NULL;
}
RtlZeroMemory(AllocateString, sizeof(UNICODE_STRING) + strBuff->Length + sizeof(wchar_t));
AllocateString->Length = strBuff->Length;
AllocateString->MaximumLength = AllocateString->Length + sizeof(wchar_t);
AllocateString->Buffer = (PWSTR)(((PUCHAR)AllocateString) + sizeof(UNICODE_STRING));
RtlCopyMemory(AllocateString->Buffer, strBuff->Buffer, strBuff->Length);
return AllocateString;
}
//获取符号链接对象
NTSTATUS GetSymbolicLinkObject(PUNICODE_STRING pDeviceLinkName, PDEVICE_OBJECT* pDeviceObject, PFILE_OBJECT* pFileObject,PUNICODE_STRING* pDeviceVolumeName)
{
NTSTATUS status = STATUS_UNSUCCESSFUL;
#include <ntifs.h>
#include <ntddk.h>
#include <Ntstrsafe.h>
#include <fltKernel.h>
//删除指针
#define SafeFreeDelete(pData) { if(pData){ExFreePool(pData);pData=NULL;} }
//减少对象引用计数
#define SafeDereferenceObject(Object) { if(Object){ObDereferenceObject(Object);Object=NULL;} }
//关闭句柄
#define SafeCloseHandle(Handle) { if(Handle){ZwClose(Handle);Handle=NULL;} }
//分配内存
PUNICODE_STRING ExAllocateUnicodeStingPool(PUNICODE_STRING strBuff)
{
PUNICODE_STRING AllocateString = NULL;
if (MmIsAddressValid(strBuff) == FALSE || strBuff == NULL || strBuff->Buffer == NULL || strBuff->Length < sizeof(wchar_t))
{
ASSERT(FALSE);
return NULL;
}
AllocateString = ExAllocatePool(NonPagedPool, sizeof(UNICODE_STRING) + strBuff->Length + sizeof(wchar_t));
if (AllocateString == NULL)
{
ASSERT(FALSE);
return NULL;
}
RtlZeroMemory(AllocateString, sizeof(UNICODE_STRING) + strBuff->Length + sizeof(wchar_t));
AllocateString->Length = strBuff->Length;
AllocateString->MaximumLength = AllocateString->Length + sizeof(wchar_t);
AllocateString->Buffer = (PWSTR)(((PUCHAR)AllocateString) + sizeof(UNICODE_STRING));
RtlCopyMemory(AllocateString->Buffer, strBuff->Buffer, strBuff->Length);
return AllocateString;
}
//获取符号链接对象
NTSTATUS GetSymbolicLinkObject(PUNICODE_STRING pDeviceLinkName, PDEVICE_OBJECT* pDeviceObject, PFILE_OBJECT* pFileObject,PUNICODE_STRING* pDeviceVolumeName)
{
NTSTATUS status = STATUS_UNSUCCESSFUL;