驅動讀寫進程內存R3,R0通信

本文轉載自查看原文 2015-09-21 15:00 4169 驅動開發入門筆記

 1 stdafx.h 頭文件代碼
 2 
 3 #ifndef _WIN32_WINNT        // Allow use of features specific to Windows XP or later.                   
 4 #define _WIN32_WINNT 0x0501    // Change this to the appropriate value to target other versions of Windows.
 5 #endif                        
 6 
 7 #ifdef __cplusplus
 8 extern "C" 
 9 {
10 
11 #endif
12 
13 #include <ntddk.h>
14 #include <ntddstor.h>
15 #include <mountdev.h>
16 #include <ntddvol.h>
17 
18 
19 #ifdef __cplusplus
20 }
21 #endif

  1 驅動讀寫 C++代碼
  2 
  3 #include <ntifs.h>
  4 #include <ntddk.h>
  5 #include "stdafx.h"
  6 
  7 
  8 extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING  RegistryPath);
  9 
 10 
 11 #define arraysize(p) (sizeof(p)/sizeof((p)[0]))
 12 NTSTATUS ControlCode(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp);
 13 NTSTATUS CreateMyDevice(IN PDRIVER_OBJECT pDriverObject);
 14 NTSTATUS NtCreateMessage(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp);
 15 int ReadProcessMemory(PVOID Address, SIZE_T BYTE_size, int PID);
 16 int WriteProcessMemory(VOID* Address, SIZE_T BYTE_size, VOID *VirtualAddress, int PID);
 17 #define READPROCESSMEMORY CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
 18 #define WRITEPROCESSMEMORY CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
 19 #define WRITEPROCESSMEMORY_BYTE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)
 20 
 21 //卸載回調
 22 void UnloadDriver(PDRIVER_OBJECT pDriverObject)
 23 {
 24     //用來取得要刪除設備對象
 25     PDEVICE_OBJECT pDev;
 26     UNICODE_STRING symLinkName;
 27     pDev = pDriverObject->DeviceObject;
 28     //刪除設備
 29     IoDeleteDevice(pDev); 
 30 
 31     //取符號鏈接名字
 32     RtlInitUnicodeString(&symLinkName, L"\\??\\My_DriverLinkName");
 33     //刪除符號鏈接
 34     IoDeleteSymbolicLink(&symLinkName);
 35     KdPrint(("驅動成功卸載\n"));
 36 }
 37 
 38 NTSTATUS DriverEntry(PDRIVER_OBJECT  pDriverObject,PUNICODE_STRING  RegistryPath)
 39 {
 40     //設置卸載函數
 41     pDriverObject->DriverUnload = UnloadDriver;
 42     //處理R3的CreateFile操作不然會失敗
 43     pDriverObject->MajorFunction[IRP_MJ_CREATE] = NtCreateMessage;
 44     //處理R3的控制代碼
 45     pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = ControlCode;
 46     //創建相應的設備
 47     CreateMyDevice(pDriverObject);
 48     KdPrint(("驅動成功加載\n"));
 49     return STATUS_SUCCESS;
 50 }
 51 //處理控制IO代碼
 52 NTSTATUS ControlCode(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp)
 53 {
 54     NTSTATUS status = STATUS_SUCCESS;
 55     KdPrint(("Enter HelloDDKDeviceIOControl\n"));
 56 
 57     //得到當前堆棧
 58     PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
 59     //得到輸入緩沖區大小
 60     ULONG cbin = stack->Parameters.DeviceIoControl.InputBufferLength;
 61     //得到輸出緩沖區大小
 62     ULONG cbout = stack->Parameters.DeviceIoControl.OutputBufferLength;
 63     //得到IOCTL碼
 64     ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;
 65 
 66     ULONG info = 0;
 67 
 68     switch (code)
 69     {
 70     case  READPROCESSMEMORY://讀4字節整數型
 71         {
 72             //顯示輸入緩沖區數據
 73             int PID = 0, Address = 0, BYTE_size=0;
 74             int *InputBuffer = (int*)pIrp->AssociatedIrp.SystemBuffer;
 75             _asm
 76             {
 77                 MOV EAX,InputBuffer
 78                     MOV EBX, DWORD PTR DS : [EAX]
 79                 MOV PID,EBX
 80                     MOV EBX, DWORD PTR DS : [EAX + 4]
 81                 MOV Address,EBX
 82                     MOV EBX,DWORD PTR DS:[EAX + 8]
 83                 MOV BYTE_size, EBX
 84             }
 85             //操作輸出緩沖區
 86             int *OutputBuffer = (int*)pIrp->AssociatedIrp.SystemBuffer;
 87             *OutputBuffer = ReadProcessMemory((VOID*)Address, BYTE_size, PID);
 88             //設置實際操作輸出緩沖區長度
 89             info = 4;
 90             break;
 91         }
 92     case  WRITEPROCESSMEMORY://寫4字節整數型
 93         {
 94             //顯示輸入緩沖區數據
 95             int PID = 0, Address = 0,buff ,BYTE_size = 0;
 96             int *InputBuffer = (int*)pIrp->AssociatedIrp.SystemBuffer;
 97             _asm
 98             {
 99                 MOV EAX, InputBuffer
100                     MOV EBX, DWORD PTR DS : [EAX]
101                 MOV PID, EBX
102                     MOV EBX, DWORD PTR DS : [EAX + 4]
103                 MOV Address, EBX
104                     MOV EBX, DWORD PTR DS : [EAX + 8]
105                 MOV buff, EBX
106                     MOV EBX, DWORD PTR DS : [EAX + 0xC]
107                 MOV BYTE_size, EBX
108             }
109             //操作輸出緩沖區
110             int *OutputBuffer = (int*)pIrp->AssociatedIrp.SystemBuffer;
111             *OutputBuffer = WriteProcessMemory((VOID*)Address, BYTE_size, &buff, PID);
112             //設置實際操作輸出緩沖區長度
113             info = 4;
114             break;
115         }
116     case  WRITEPROCESSMEMORY_BYTE://寫字節集
117         {
118             //顯示輸入緩沖區數據
119             int PID = 0, Address = 0, buff, BYTE_size = 0;
120             int *InputBuffer = (int*)pIrp->AssociatedIrp.SystemBuffer;
121             _asm
122             {
123                 MOV EAX, InputBuffer
124                     MOV EBX, DWORD PTR DS : [EAX]
125                 MOV PID, EBX
126                     MOV EBX, DWORD PTR DS : [EAX + 4]
127                 MOV Address, EBX
128                     MOV EBX, DWORD PTR DS : [EAX + 8]
129                 MOV buff, EBX
130                     MOV EBX, DWORD PTR DS : [EAX + 0xC]
131                 MOV BYTE_size, EBX
132             }
133             //操作輸出緩沖區
134             int *OutputBuffer = (int*)pIrp->AssociatedIrp.SystemBuffer;
135             *OutputBuffer = WriteProcessMemory((VOID*)Address, BYTE_size, (VOID*)buff, PID);
136             //設置實際操作輸出緩沖區長度
137             info = 4;
138             break;
139         }
140     default:
141         status = STATUS_INVALID_VARIANT;
142     }
143     // 完成IRP
144     pIrp->IoStatus.Status = status;
145     pIrp->IoStatus.Information = info;
146     IoCompleteRequest(pIrp, IO_NO_INCREMENT);
147     return status;
148 }
149 
150 typedef struct _DEVICE_EXTENSION {
151     PDEVICE_OBJECT pDevice;
152     UNICODE_STRING ustrDeviceName;    //設備名稱
153     UNICODE_STRING ustrSymLinkName;    //符號鏈接名
154 
155     PUCHAR buffer;//緩沖區
156     ULONG file_length;//模擬的文件長度，必須小於MAX_FILE_LENGTH
157 } DEVICE_EXTENSION, *PDEVICE_EXTENSION;
158 #pragma INITCODE /*指的代碼運行后 就從內存釋放掉*/
159 //創建符號鏈接
160 NTSTATUS CreateMyDevice(IN PDRIVER_OBJECT pDriverObject)
161 {
162     NTSTATUS status;
163     PDEVICE_OBJECT pDevObj;
164     PDEVICE_EXTENSION pDevExt;
165 
166     //創建設備名稱
167     UNICODE_STRING devName;
168     RtlInitUnicodeString(&devName, L"\\Device\\My_DriverLinkName");
169 
170     //創建設備
171     status = IoCreateDevice(pDriverObject,sizeof(DEVICE_EXTENSION),&devName,FILE_DEVICE_UNKNOWN,0, FALSE,&pDevObj);
172     if (!NT_SUCCESS(status))
173         return status;
174 
175     pDevObj->Flags |= DO_DIRECT_IO;
176     pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
177     pDevExt->pDevice = pDevObj;
178     pDevExt->ustrDeviceName = devName;
179 
180     //申請模擬文件的緩沖區
181     pDevExt->buffer = (PUCHAR)ExAllocatePool(PagedPool, 1024);
182     //設置模擬文件大小
183     pDevExt->file_length = 0;
184 
185     //創建符號鏈接
186     UNICODE_STRING symLinkName;
187     RtlInitUnicodeString(&symLinkName, L"\\??\\My_DriverLinkName");
188     pDevExt->ustrSymLinkName = symLinkName;
189     status = IoCreateSymbolicLink(&symLinkName, &devName);
190 
191     if (!NT_SUCCESS(status))
192     {
193         IoDeleteDevice(pDevObj);
194         return status;
195     }
196     return STATUS_SUCCESS;
197 }
198 
199 //處理其他IO消息直接返回成功
200 #pragma PAGEDCODE
201 NTSTATUS NtCreateMessage(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp)
202 {
203 
204     NTSTATUS status = STATUS_SUCCESS;
205     // 完成IRP
206     pIrp->IoStatus.Status = status;
207     pIrp->IoStatus.Information = 0;    // bytes xfered
208     IoCompleteRequest(pIrp, IO_NO_INCREMENT);
209     return status;
210 }
211 
212 //讀內存整數型
213 int ReadProcessMemory(VOID* Address, SIZE_T BYTE_size, int PID)
214 {
215     PEPROCESS pEProcess;
216     PVOID buff1;
217     VOID *buff2;
218     int MemoryNumerical =0;
219     KAPC_STATE   KAPC = { 0 };
220     __try
221     {
222         //得到進程EPROCESS
223         PsLookupProcessByProcessId((HANDLE)PID, &pEProcess);
224         //分配內存
225         buff1 = ExAllocatePoolWithTag((POOL_TYPE)0, BYTE_size, 1222);
226         buff2 = buff1;
227         *(int*)buff1 = 1;
228         //附加到要讀寫的進程
229         KeStackAttachProcess((PRKPROCESS)pEProcess, &KAPC);
230         // 判斷內存是否可讀
231         ProbeForRead(Address, BYTE_size, 1);
232         //復制內存
233         memcpy(buff2, Address, BYTE_size);
234         // 剝離附加的進程
235         KeUnstackDetachProcess(&KAPC);
236         //讀內存
237         MemoryNumerical = *(int*)buff2;
238         // 釋放申請的內存
239         ExFreePoolWithTag(buff2, 1222);
240     }
241     __except (EXCEPTION_EXECUTE_HANDLER)
242     {
243         KdPrint(("錯誤\n"));
244     }
245     return MemoryNumerical;
246 
247 }
248 //寫內存整數型
249 int WriteProcessMemory(VOID* Address, SIZE_T BYTE_size, VOID *VirtualAddress,int PID)
250 {
251     PEPROCESS pEProcess;
252     PVOID buff1;
253     VOID *buff2;
254     int MemoryNumerical = 0;
255     KAPC_STATE   KAPC = { 0 };
256     __try
257     {
258         //得到進程EPROCESS
259         PsLookupProcessByProcessId((HANDLE)PID, &pEProcess);
260         //分配內存
261         buff1 = ExAllocatePoolWithTag((POOL_TYPE)0, BYTE_size, 1111);
262         buff2 = buff1;
263         *(int*)buff1 = 1;
264         if (MmIsAddressValid((PVOID)VirtualAddress))
265         {
266             //復制內存
267             memcpy(buff2, VirtualAddress, BYTE_size);
268         }
269         else
270         {
271             return 0;
272         }
273         //附加到要讀寫的進程
274         KeStackAttachProcess((PRKPROCESS)pEProcess, &KAPC);
275         if (MmIsAddressValid((PVOID)Address))
276         {
277             //判斷地址是否可寫
278             ProbeForWrite(Address, BYTE_size, 1);
279             //復制內存
280             memcpy(Address, buff2, BYTE_size);
281         }
282         else
283         {
284             return 0;
285         }
286         // 剝離附加的進程
287         KeUnstackDetachProcess(&KAPC);
288         ExFreePoolWithTag(buff2, 1111);
289     }
290     __except (EXCEPTION_EXECUTE_HANDLER)
291     {
292         KdPrint(("錯誤\n"));
293     }
294     return 1;
295 }

 1 R3通信代碼
 2 
 3 #include <stdio.h>
 4 #include <windows.h>
 5 #include<winioctl.h> 
 6 #define READPROCESSMEMORY CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
 7 #define WRITEPROCESSMEMORY CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
 8 #define WRITEPROCESSMEMORY_BYTE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)
 9 int ReadMemory(HANDLE hDevice, int PID,int Address,int size)//讀內存
10 {
11     
12     int port[3];
13     int bufret;
14     DWORD dwWrite;
15     port[0]=PID;
16     port[1]=Address;
17     port[2]=size;
18     DeviceIoControl(hDevice,READPROCESSMEMORY, &port, 12, &bufret, 4, &dwWrite, NULL);
19     return bufret;
20 
21 }
22 
23 int WriteMemory_int(HANDLE hDevice, int PID,int Address,int buff,int size)//寫內存整數型
24 {
25     
26     int port[4];
27     int bufret;
28     DWORD dwWrite;
29     port[0]=PID;
30     port[1]=Address;
31     port[2]=buff;
32     port[3]=size;
33     DeviceIoControl(hDevice,WRITEPROCESSMEMORY, &port, 16, &bufret, 4, &dwWrite, NULL);
34     return bufret;
35 
36 }
37 
38 int WriteMemory_byte(HANDLE hDevice, int PID,int Address,BYTE *buff,int size)//寫內存字節集
39 {
40     int port[4];
41     int bufret;
42     DWORD dwWrite;
43     port[0]=PID;
44     port[1]=Address;
45     port[2]=(int)buff;
46     port[3]=size;
47     DeviceIoControl(hDevice,WRITEPROCESSMEMORY_BYTE, &port, 16, &bufret, 4, &dwWrite, NULL);
48     return bufret;
49 
50 }
51 int main(int argc, char* argv[])
52 {
53     HANDLE hDevice = CreateFileW(L"\\\\.\\My_DriverLinkName", GENERIC_READ | GENERIC_WRITE,0,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL );    
54     if (hDevice == INVALID_HANDLE_VALUE)
55     {
56         printf("獲取驅動失敗: %s with Win32 error code: %d\n","MyDriver", GetLastError() );
57         getchar();
58         return -1;
59     }
60     int PID=0;
61     printf("輸入進程ID！\n");
62     scanf("%d",&PID);
63     BYTE a[]={0x01,0x02,0x03,0x04,0x05};
64   int r=WriteMemory_byte(hDevice,PID,9165792,a,5);//寫內存字節集
65   printf("0x8BDBE0=%d\n",r);
66    getchar();
67    getchar();
68     return 0;
69 }

免責聲明！

本站轉載的文章為個人學習借鑒使用，本站對版權不負任何法律責任。如果侵犯了您的隱私權益，請聯系本站郵箱yoyou2525@163.com刪除。

猜您在找 Windows驅動開發-r3和r0通信 C++強制讀寫進程內存 R0與R3法強制讀寫進程的內存從零開始的Arduino UNO R3 手把手教你R0下通過EPROCESS獲取進程加載模塊 R3 x64枚舉進程句柄 R3環申請內存時頁面保護與_MMVAD_FLAGS.Protection位的對應關系 c# r3 inline hook 用arduino UNO R3板為pro mini板燒錄bootloaders SAP版本演進及區別-S/4 HANA 與R3(ECC)