IRP HOOK

流程

相比较R3 HOOK，R0的HOOK还是比较简单的(毕竟共享一块内存)

直接IoGetDeviceObjectPointer根据名称获取驱动对象，然后更改分发函数数组元素即可HOOK指定IRP分发函数

实现

NTSTATUS InstallTCPDriverHook()
{
    NTSTATUS       ntStatus;
    UNICODE_STRING deviceTCPUnicodeString;
    WCHAR deviceTCPNameBuffer[]  = L"\\Device\\Tcp";
    pFile_tcp  = NULL;
    pDev_tcp   = NULL;
    pDrv_tcpip = NULL;

    RtlInitUnicodeString (&deviceTCPUnicodeString, deviceTCPNameBuffer);

    ntStatus = IoGetDeviceObjectPointer(&deviceTCPUnicodeString, FILE_READ_DATA, &pFile_tcp, &pDev_tcp);//获取驱动对象

    if(!NT_SUCCESS(ntStatus)) 
        return ntStatus;
    pDrv_tcpip = pDev_tcp->DriverObject;

    OldIrpMjDeviceControl = pDrv_tcpip->MajorFunction[IRP_MJ_DEVICE_CONTROL]; 
    //保存原始函数用于处理后下发

    if (OldIrpMjDeviceControl)
        InterlockedExchange ((PLONG)&pDrv_tcpip->MajorFunction[IRP_MJ_DEVICE_CONTROL], (LONG)HookedDeviceControl);

    return STATUS_SUCCESS;
}