驱动框架

头文件：

#ifndef _CHECKSSDT_H_
#define _CHECKSSDT_H_

#include <ntddk.h>

typedef enum _SYSTEM_INFORMATION_CLASS   
{   
	SystemBasicInformation,                 //  0 Y N   
	SystemProcessorInformation,             //  1 Y N   
	SystemPerformanceInformation,           //  2 Y N   
	SystemTimeOfDayInformation,             //  3 Y N   
	SystemNotImplemented1,                  //  4 Y N   
	SystemProcessesAndThreadsInformation,   //  5 Y N   
	SystemCallCounts,                       //  6 Y N   
	SystemConfigurationInformation,         //  7 Y N   
	SystemProcessorTimes,                   //  8 Y N   
	SystemGlobalFlag,                       //  9 Y Y   
	SystemNotImplemented2,                  // 10 Y N   
	SystemModuleInformation,                // 11 Y N   
	SystemLockInformation,                  // 12 Y N   
	SystemNotImplemented3,                  // 13 Y N   
	SystemNotImplemented4,                  // 14 Y N   
	SystemNotImplemented5,                  // 15 Y N   
	SystemHandleInformation,                // 16 Y N   
	SystemObjectInformation,                // 17 Y N   
	SystemPagefileInformation,              // 18 Y N   
	SystemInstructionEmulationCounts,       // 19 Y N   
	SystemInvalidInfoClass1,                // 20   
	SystemCacheInformation,                 // 21 Y Y   
	SystemPoolTagInformation,               // 22 Y N   
	SystemProcessorStatistics,              // 23 Y N   
	SystemDpcInformation,                   // 24 Y Y   
	SystemNotImplemented6,                  // 25 Y N   
	SystemLoadImage,                        // 26 N Y   
	SystemUnloadImage,                      // 27 N Y   
	SystemTimeAdjustment,                   // 28 Y Y   
	SystemNotImplemented7,                  // 29 Y N   
	SystemNotImplemented8,                  // 30 Y N   
	SystemNotImplemented9,                  // 31 Y N   
	SystemCrashDumpInformation,             // 32 Y N   
	SystemExceptionInformation,             // 33 Y N   
	SystemCrashDumpStateInformation,        // 34 Y Y/N   
	SystemKernelDebuggerInformation,        // 35 Y N   
	SystemContextSwitchInformation,         // 36 Y N   
	SystemRegistryQuotaInformation,         // 37 Y Y   
	SystemLoadAndCallImage,                 // 38 N Y   
	SystemPrioritySeparation,               // 39 N Y   
	SystemNotImplemented10,                 // 40 Y N   
	SystemNotImplemented11,                 // 41 Y N   
	SystemInvalidInfoClass2,                // 42   
	SystemInvalidInfoClass3,                // 43   
	SystemTimeZoneInformation,              // 44 Y N   
	SystemLookasideInformation,             // 45 Y N   
	SystemSetTimeSlipEvent,                 // 46 N Y   
	SystemCreateSession,                    // 47 N Y   
	SystemDeleteSession,                    // 48 N Y   
	SystemInvalidInfoClass4,                // 49   
	SystemRangeStartInformation,            // 50 Y N   
	SystemVerifierInformation,              // 51 Y Y   
	SystemAddVerifier,                      // 52 N Y   
	SystemSessionProcessesInformation       // 53 Y N   

} SYSTEM_INFORMATION_CLASS; 

typedef struct _SYSTEM_MODULE_INFORMATION { 
	ULONG Reserved[2]; 
	PVOID Base; 
	ULONG Size; 
	ULONG Flags; 
	USHORT Index; 
	USHORT Unknown; 
	USHORT LoadCount; 
	USHORT ModuleNameOffset; 
	CHAR ImageName[256]; 
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; 

typedef struct _tagSysModuleList {
	ULONG ulCount;
	SYSTEM_MODULE_INFORMATION smi[1];
} SYSMODULELIST, *PSYSMODULELIST;

#pragma pack(1)
typedef struct _SYSTEM_SERVICE_TABLE
{
	PVOID ServiceTableBase; //这个指向系统服务函数地址表
	PULONG ServiceCounterTableBase;
	ULONG NumberOfService; //服务函数的个数
	ULONG ParamTableBase;
}SYSTEM_SERVICE_TABLE,*PSYSTEM_SERVICE_TABLE;
#pragma pack()

extern PSYSTEM_SERVICE_TABLE KeServiceDscriptorTable;

#define DEVICE_NAME L"\\device\\xiaob"
#define SYMLINK_NAME L"\\??\\xiaob"

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver,PUNICODE_STRING pRegPath);
VOID UnLoadDriver(PDRIVER_OBJECT pDriver);
NTSTATUS MyCreateDevice(PDRIVER_OBJECT pDriver);
NTSTATUS MyDispath(PDEVICE_OBJECT pDev,PIRP Irp );

#endif

.c 文件

#include <ntddk.h>
#include "CheckSSDT.h"

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver,PUNICODE_STRING pRegPath)
{
	NTSTATUS status;
	int i = 0;

	KdPrint(("进入驱动！\n"));
	pDriver->DriverUnload = UnLoadDriver;
	for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
	{
		pDriver->MajorFunction[i] = MyDispath;
	}

	status = MyCreateDevice(pDriver);

	return status;
}

VOID UnLoadDriver(PDRIVER_OBJECT pDriver)
{
	PDEVICE_OBJECT pDev;
	UNICODE_STRING uniSymLinkName;

	RtlInitUnicodeString(&uniSymLinkName,SYMLINK_NAME);

	pDev = pDriver->DeviceObject;
	IoDeleteDevice(pDev);
	IoDeleteSymbolicLink(uniSymLinkName);

	KdPrint(("卸载驱动成功！\n"));

}

NTSTATUS MyCreateDevice(PDRIVER_OBJECT pDriver)
{
	NTSTATUS status;
	PDEVICE_OBJECT pDev;
	UNICODE_STRING uniDeviceName;
	UNICODE_STRING uniSymLinkName;

	KdPrint(("创建驱动设备！\n"));
	RtlInitUnicodeString(&uniDeviceName,DEVICE_NAME);
	RtlInitUnicodeString(&uniSymLinkName,SYMLINK_NAME);

	status = IoCreateDevice(
		pDriver,
		0,
		&uniDeviceName,
		FILE_DEVICE_UNKNOWN,
		0,
		TRUE,
		&pDev
		);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("驱动文件创建失败！\n"));
		return status;
	}

	pDev->Flags |= DO_BUFFERED_IO;

	status = IoCreateSymbolicLink(&uniSymLinkName,&uniDeviceName);
	if (!NT_SUCCESS(status))
	{
		IoDeleteDevice(pDev);
		KdPrint(("驱动文件创建失败！\n"));
		return status;
	}
	KdPrint(("驱动设备创建成功!\n"));
	return status;
}

NTSTATUS MyDispath(PDEVICE_OBJECT pDev,PIRP Irp )
{
	Irp->IoStatus.Status = STATUS_SUCCESS;
	Irp->IoStatus.Information = 0;
	IoCompleteRequest(Irp,IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}

开始正式踏上驱动学习路程。下一篇写关于SSDT的。虽然SSDT在驱动里面已经被大牛们玩到烂了，但是对于小菜来说，还是很难理解得了。