0x01 目的
测试函数 ZwOpenProcess 与 ZwAllocateVirtualMemory
0x02 驱动代码
#include <ntddk.h>
NTSTATUS
ZwAllocateVirtualMemory(
__in HANDLE ProcessHandle,
__inout PVOID *BaseAddress,
__in ULONG_PTR ZeroBits,
__inout PSIZE_T RegionSiz...
详细的操作实例
相关内核API
ZwCreateFile
ZwOpenFile
ZwSetInformationFile
ZwQueryInfomationFile
ZwReadFile
ZwWriteFile
代码实例
#include <ntddk.h>
#define TAG 'tset' //驱动在内存的标志,即test
NTSTATUS MyCreateFile()
{
HANDLE hFile;
UNICODE_STRING usFileName;
OBJEC...
typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG32 SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING Bas...
0x01 说明
测试驱动开发HelloWorld
0x02文件准备
hello.c
#include <ntddk.h>
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
DbgPrint("Goodbye Gyarmy\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
pDriverObject->...