【C】驱动加载/卸载/通信代码（兼容WIN32/WIN64）

Golden Blonde

1. //整理者：Tesla.Angela（原代码来源于网络，原作者不明）
   
2. /*
   
3. 使用方法：修改DRV_NAME和DRV_FILENAME
   
4. HANDLE openDriver(void)：打开驱动建立的符号链接的句柄
   
5. void uninstallDriver(void)：卸载驱动（只有把openDriver打开的句柄关闭才可以成功卸载）
   
6. */
   
7. /*
   
8. 使用示例：
   
9. VOID TEST()
   
10. {
    
11.     HANDLE hMyDrv;
    
12.     hMyDrv=openDriver();
    
13.     IoControl(hMyDrv, CTL_CODE_GEN(0x802), &fn_index, 4, &ssdt_func_addr, 8);
    
14.     uninstallDriver();
    
15.     CloseHandle(hMyDrv);
    
16. }
    
17. */
    
18. 
    
19. #pragma comment(lib,"user32.lib")
    
20. #pragma comment(lib,"Advapi32.lib")
    
21. 
    
22. #define DRV_NAME                "xxxxxxxx"//驱动链接名
    
23. #define DRV_FILENAME        "xxxxxxxx.sys"//驱动文件
    
24. #define STATUS_SUCCESS     ((NTSTATUS)0x00000000L)
    
25. typedef LONG NTSTATUS;
    
26. 
    
27. typedef struct _STRING
    
28. {
    
29.     USHORT  Length;
    
30.     USHORT  MaximumLength;
    
31.     PCHAR  Buffer;
    
32. } ANSI_STRING, *PANSI_STRING;
    
33. 
    
34. typedef struct _UNICODE_STRING
    
35. {
    
36.     USHORT  Length;
    
37.     USHORT  MaximumLength;
    
38.     PWSTR  Buffer;
    
39. } UNICODE_STRING, *PUNICODE_STRING;
    
40. 
    
41. VOID AfxMessageBox(char *sz)
    
42. {
    
43.     //下面这句可以随时注释掉
    
44.     //MessageBoxA(0,sz,DRV_NAME,0);
    
45. }
    
46. 
    
47. //*********************************************************************************************
    
48. // Assign loaddriver priviledge to our process, so we can load our support driver.
    
49. //*********************************************************************************************
    
50. BOOL getLoadDriverPriv()
    
51. {
    
52.     HANDLE hToken;
    
53.     if(OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken))
    
54.     {
    
55.         LUID huid;
    
56.         if(LookupPrivilegeValueA(NULL, "SeLoadDriverPrivilege", &huid))
    
57.         {
    
58.             LUID_AND_ATTRIBUTES priv;
    
59.             priv.Attributes = SE_PRIVILEGE_ENABLED;
    
60.             priv.Luid = huid;
    
61.             TOKEN_PRIVILEGES tp;
    
62.             tp.PrivilegeCount = 1;
    
63.             tp.Privileges[0] = priv;
    
64.             if(AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, NULL))
    
65.             {
    
66.                 return TRUE;
    
67.             }
    
68.         }
    
69.     }
    
70.     return FALSE;
    
71. }
    
72. 
    
73. //*********************************************************************************************
    
74. // Sets up the necessary registry settings to load the support driver
    
75. //*********************************************************************************************
    
76. BOOL setupRegistry()
    
77. {
    
78.     HKEY hkey;
    
79.     if(RegCreateKeyA(HKEY_LOCAL_MACHINE, "System\\CurrentControlSet\\Services\"DRV_NAME, &hkey) != ERROR_SUCCESS)
    
80.         return FALSE;
    
81.     DWORD val;
    
82.     val = 1;
    
83.     if(RegSetValueExA(hkey, "Type", 0, REG_DWORD, (PBYTE)&val, sizeof(val)) != ERROR_SUCCESS)
    
84.         return FALSE;
    
85.     if(RegSetValueExA(hkey, "ErrorControl", 0, REG_DWORD, (PBYTE)&val, sizeof(val)) != ERROR_SUCCESS)
    
86.         return FALSE;
    
87.     val = 3;
    
88.     if(RegSetValueExA(hkey, "Start", 0, REG_DWORD, (PBYTE)&val, sizeof(val)) != ERROR_SUCCESS)        //0为boot驱动
    
89.         return FALSE;
    
90.     char *imgName = "System32\\DRIVERS\"DRV_FILENAME;
    
91.     if(RegSetValueExA(hkey, "ImagePath", 0, REG_EXPAND_SZ, (PBYTE)imgName, strlen(imgName)) != ERROR_SUCCESS)
    
92.         return FALSE;
    
93.     return TRUE;
    
94. }
    
95. 
    
96. //*********************************************************************************************
    
97. // Actual code to load our driver into memory
    
98. //*********************************************************************************************
    
99. BOOL loadDriver()
    
100. {
     
101.     HMODULE hntdll = GetModuleHandleA("ntdll.dll");
     
102.     NTSTATUS (WINAPI *_RtlAnsiStringToUnicodeString)(PUNICODE_STRING  DestinationString,IN PANSI_STRING  SourceString,IN BOOLEAN);
     
103.     VOID (WINAPI *_RtlInitAnsiString)(IN OUT PANSI_STRING  DestinationString, IN PCHAR  SourceString);
     
104.     NTSTATUS (WINAPI * _ZwLoadDriver)(IN PUNICODE_STRING DriverServiceName);
     
105.     NTSTATUS (WINAPI * _ZwUnloadDriver)(IN PUNICODE_STRING DriverServiceName);
     
106.     VOID (WINAPI * _RtlFreeUnicodeString)(IN PUNICODE_STRING  UnicodeString);
     
107.     *(FARPROC *)&_ZwLoadDriver = GetProcAddress(hntdll, "NtLoadDriver");
     
108.     *(FARPROC *)&_ZwUnloadDriver = GetProcAddress(hntdll, "NtUnloadDriver");
     
109.     *(FARPROC *)&_RtlAnsiStringToUnicodeString = GetProcAddress(hntdll, "RtlAnsiStringToUnicodeString");
     
110.     *(FARPROC *)&_RtlInitAnsiString = GetProcAddress(hntdll, "RtlInitAnsiString");
     
111.     *(FARPROC *)&_RtlFreeUnicodeString = GetProcAddress(hntdll, "RtlFreeUnicodeString");
     
112.     if(_ZwLoadDriver && _ZwUnloadDriver && _RtlAnsiStringToUnicodeString && _RtlInitAnsiString && _RtlFreeUnicodeString)
     
113.     {
     
114.         ANSI_STRING aStr;
     
115.         _RtlInitAnsiString(&aStr, "\\Registry\\Machine\\System\\CurrentControlSet\\Services\"DRV_NAME);
     
116.         UNICODE_STRING uStr;
     
117.         if(_RtlAnsiStringToUnicodeString(&uStr, &aStr, TRUE) != STATUS_SUCCESS)
     
118.             return FALSE;
     
119.         else
     
120.         {
     
121.             if(_ZwLoadDriver(&uStr) == STATUS_SUCCESS)
     
122.             {
     
123.                 _RtlFreeUnicodeString(&uStr);
     
124.                 return TRUE;
     
125.             }
     
126.             _RtlFreeUnicodeString(&uStr);
     
127.         }
     
128.     }
     
129.     return FALSE;
     
130. }
     
131. 
     
132. //*********************************************************************************************
     
133. // Actual code to remove our driver from memory
     
134. //*********************************************************************************************
     
135. BOOL unloadDriver()
     
136. {
     
137.     HMODULE hntdll = GetModuleHandleA("ntdll.dll");
     
138.     NTSTATUS (WINAPI * _RtlAnsiStringToUnicodeString)(PUNICODE_STRING  DestinationString, IN PANSI_STRING  SourceString, IN BOOLEAN);
     
139.     VOID (WINAPI *_RtlInitAnsiString)(IN OUT PANSI_STRING  DestinationString,IN PCHAR  SourceString);
     
140.     NTSTATUS (WINAPI * _ZwLoadDriver)(IN PUNICODE_STRING DriverServiceName);
     
141.     NTSTATUS (WINAPI * _ZwUnloadDriver)(IN PUNICODE_STRING DriverServiceName);
     
142.     VOID (WINAPI * _RtlFreeUnicodeString)(IN PUNICODE_STRING  UnicodeString);
     
143.     *(FARPROC *)&_ZwLoadDriver = GetProcAddress(hntdll, "NtLoadDriver");
     
144.     *(FARPROC *)&_ZwUnloadDriver = GetProcAddress(hntdll, "NtUnloadDriver");
     
145.     *(FARPROC *)&_RtlAnsiStringToUnicodeString = GetProcAddress(hntdll, "RtlAnsiStringToUnicodeString");
     
146.     *(FARPROC *)&_RtlInitAnsiString = GetProcAddress(hntdll, "RtlInitAnsiString");
     
147.     *(FARPROC *)&_RtlFreeUnicodeString = GetProcAddress(hntdll, "RtlFreeUnicodeString");
     
148.     if(_ZwLoadDriver && _ZwUnloadDriver && _RtlAnsiStringToUnicodeString && _RtlInitAnsiString && _RtlFreeUnicodeString)
     
149.     {
     
150.         ANSI_STRING aStr;
     
151.         _RtlInitAnsiString(&aStr, "\\Registry\\Machine\\System\\CurrentControlSet\\Services\"DRV_NAME);
     
152.         UNICODE_STRING uStr;
     
153.         if(_RtlAnsiStringToUnicodeString(&uStr, &aStr, TRUE) != STATUS_SUCCESS)
     
154.             return FALSE;
     
155.         else
     
156.         {
     
157.             if(_ZwUnloadDriver(&uStr) == STATUS_SUCCESS)
     
158.             {
     
159.                 _RtlFreeUnicodeString(&uStr);
     
160.                 return TRUE;
     
161.             }
     
162.             _RtlFreeUnicodeString(&uStr);
     
163.         }
     
164.     }
     
165.     return FALSE;
     
166. }
     
167. 
     
168. //*********************************************************************************************
     
169. // Removes our driver file and registry settings
     
170. //*********************************************************************************************
     
171. void cleanupDriver(void)
     
172. {
     
173.     char sysDir[MAX_PATH + 1];
     
174.     GetSystemDirectoryA(sysDir, MAX_PATH);
     
175.     strncat(sysDir, "\\drivers\"DRV_FILENAME, MAX_PATH);
     
176.     DeleteFileA(sysDir);
     
177.     RegDeleteKeyA(HKEY_LOCAL_MACHINE, "System\\CurrentControlSet\\Services\"DRV_NAME"\\Enum");
     
178.     RegDeleteKeyA(HKEY_LOCAL_MACHINE, "System\\CurrentControlSet\\Services\"DRV_NAME);
     
179. }
     
180. 
     
181. //*********************************************************************************************
     
182. // Attempts to get a handle to our kernel driver.  If fails, try to install the driver.
     
183. //*********************************************************************************************
     
184. HANDLE openDriver(void)
     
185. {
     
186.     HANDLE hDevice=NULL;
     
187.     //CreateFile打开驱动建立的符号链接，得根据驱动中建立的名字更改
     
188.     hDevice = CreateFileA("\\\\.\"DRV_NAME, GENERIC_WRITE | GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
     
189.     if(hDevice == INVALID_HANDLE_VALUE)
     
190.     {
     
191.         char drvFullPath[MAX_PATH+1];
     
192.         char *filePart;
     
193.         ZeroMemory(drvFullPath, MAX_PATH);
     
194.         GetFullPathNameA(DRV_FILENAME, MAX_PATH, drvFullPath, &filePart);//MessageBoxA(0,drvFullPath,0,0);
     
195.         HANDLE hFile = CreateFileA(drvFullPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
     
196.         if(hFile == INVALID_HANDLE_VALUE)
     
197.         {
     
198.             AfxMessageBox("Cannot find required driver file");
     
199.             return INVALID_HANDLE_VALUE;
     
200.         }
     
201.         else
     
202.         {
     
203.             CloseHandle(hFile);
     
204.             char sysDir[MAX_PATH + 1];
     
205.             GetSystemDirectoryA(sysDir, MAX_PATH);
     
206.             strncat(sysDir, "\\drivers\"DRV_FILENAME, MAX_PATH);
     
207.             CopyFileA(drvFullPath, sysDir, TRUE);
     
208.             if(!getLoadDriverPriv())
     
209.             {
     
210.                 AfxMessageBox("Error getting load driver privilege! ");
     
211.             }
     
212.             else
     
213.             {
     
214.                 if(!setupRegistry())
     
215.                 {
     
216.                     AfxMessageBox("Error setting driver registry keys! Make sure you are running this as Administrator. ");
     
217.                 }
     
218.                 else
     
219.                 {
     
220.                     loadDriver();
     
221.                     hDevice = CreateFileA("\\\\.\"DRV_NAME, GENERIC_WRITE | GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
     
222.                                           NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
     
223.                     if(hDevice == INVALID_HANDLE_VALUE)
     
224.                     {
     
225.                         AfxMessageBox("Error loading kernel support driver! Make sure you are running this as Administrator. ");
     
226.                     }
     
227.                     else
     
228.                     {
     
229.                         AfxMessageBox("loading kernel support driver success");
     
230.                     }
     
231.                 }
     
232.             }
     
233.             cleanupDriver();
     
234.         }
     
235.     }
     
236.     return hDevice;
     
237. }
     
238. 
     
239. //*********************************************************************************************
     
240. // Remove our kernel driver from memory
     
241. //*********************************************************************************************
     
242. void uninstallDriver(void)
     
243. {
     
244.     char drvFullPath[MAX_PATH+1];
     
245.     char *filePart;
     
246.     ZeroMemory(drvFullPath, MAX_PATH);
     
247.     GetFullPathNameA(DRV_FILENAME, MAX_PATH, drvFullPath, &filePart);
     
248.     HANDLE hFile = CreateFileA(drvFullPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
     
249.     if(hFile == INVALID_HANDLE_VALUE)
     
250.     {
     
251.         AfxMessageBox("Cannot find required driver file ");
     
252.         return;
     
253.     }
     
254.     else
     
255.     {
     
256.         CloseHandle(hFile);
     
257.         char sysDir[MAX_PATH + 1];
     
258.         GetSystemDirectoryA(sysDir, MAX_PATH);
     
259.         strncat(sysDir, "\\drivers\"DRV_FILENAME, MAX_PATH);
     
260.         CopyFileA(drvFullPath, sysDir, TRUE);
     
261.         if(!getLoadDriverPriv())
     
262.         {
     
263.             AfxMessageBox("Error getting load driver privilege! ");
     
264.         }
     
265.         else
     
266.         {
     
267.             if(!setupRegistry())
     
268.             {
     
269.                 AfxMessageBox("Error setting driver registry keys! Make sure you are running this as Administrator. ");
     
270.             }
     
271.             else
     
272.             {
     
273.                 if(unloadDriver())
     
274.                     AfxMessageBox("Support driver successfully unloaded. ");
     
275.                 else
     
276.                     AfxMessageBox("Unload support driver failed.  It is probably not loaded. ");
     
277.             }
     
278.         }
     
279.         cleanupDriver();
     
280.     }
     
281. }
     
282. 
     
283. DWORD CTL_CODE_GEN(DWORD lngFunction)
     
284. {
     
285.     return (FILE_DEVICE_UNKNOWN * 65536) | (FILE_ANY_ACCESS * 16384) | (lngFunction * 4) | METHOD_BUFFERED;
     
286. }
     
287. 
     
288. BOOL IoControl(HANDLE hDrvHandle, DWORD dwIoControlCode, PVOID lpInBuffer, DWORD nInBufferSize, PVOID lpOutBuffer, DWORD nOutBufferSize)
     
289. {
     
290.     DWORD lDrvRetSize;
     
291.     return DeviceIoControl(hDrvHandle, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, &lDrvRetSize, 0);
     
292. }

复制代码

CTW

你是TA？

xiawan

如此好贴,必须支持~~~