梦织未来Windows驱动编程 第05课 小结(读取另一驱动，遍历所有驱动)

//FilterDriver.c
//2016.07.15 #include "ntddk.h" NTKERNELAPI
NTSTATUS
ObReferenceObjectByName(
IN PUNICODE_STRING ObjectName,
IN ULONG Attributes,
IN PACCESS_STATE PassedAccessState OPTIONAL,
IN ACCESS_MASK DesiredAccess OPTIONAL,
IN POBJECT_TYPE ObjectType,
IN KPROCESSOR_MODE AccessMode,
IN OUT PVOID ParseContext OPTIONAL,
OUT PVOID *Object
); extern POBJECT_TYPE *IoDriverObjectType; //global
PDRIVER_OBJECT g_FilterDriverObject;
PDRIVER_DISPATCH gfn_OrigReadCompleteRoutine; //我们的驱动分发函数
NTSTATUS FilterReadCompleteRoutine(
__in struct _DEVICE_OBJECT *DeviceObject,
__inout struct _IRP *Irp)
{
KdPrint(("IRP_MJ_DEVICE_CONTROL coming.")); //处理完毕后，要调用原分发例程
return gfn_OrigReadCompleteRoutine(DeviceObject, Irp);
} //驱动卸载函数
VOID UnFilterDriverRoutine(__in struct _DRIVER_OBJECT *DriverObject)
{
//此内存可读时，恢复
if (MmIsAddressValid(gfn_OrigReadCompleteRoutine))
{
KdPrint(("UnFilterDriverRoutine Success.")); //卸载时恢复原分发例程
g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = gfn_OrigReadCompleteRoutine;
}
} //过滤函数
NTSTATUS FilterDriverQuery()
{
NTSTATUS Status;
UNICODE_STRING usObjectName; RtlInitUnicodeString (&usObjectName, L"\\Driver\\XueTr"); //根据驱动名称获得驱动对象
Status = ObReferenceObjectByName (
&usObjectName,
OBJ_CASE_INSENSITIVE, //大小写不敏感
NULL,
, //访问权限，0是所有权限
*IoDriverObjectType,
KernelMode, //处理器模式
NULL,
(PVOID*)&g_FilterDriverObject
);
if (!NT_SUCCESS(Status))
{
KdPrint(("Filter Failed!"));
return Status;
} KdPrint(("0x%X", g_FilterDriverObject)); //打印驱动对象地址 //保存原分发例程，并修改为我们的函数
gfn_OrigReadCompleteRoutine = g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL];
g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = (PDRIVER_DISPATCH)FilterReadCompleteRoutine; ObDereferenceObject(g_FilterDriverObject); //清除引用计数 return STATUS_SUCCESS;
} //驱动程序入口函数
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
pDriverObject->DriverUnload = UnFilterDriverRoutine;
FilterDriverQuery (); return STATUS_SUCCESS;
}

//EnumDriver.c
//2016.07.17 #include <ntddk.h> typedef struct _LDR_DATA_TABLE_ENTRY{
LIST_ENTRY InLoadOrderLinks; //链表 保存了所有已经读取到内存中的驱动地址
LIST_ENTRY InMemoryOrderLinks; //链表 保存了已经安装，但没启动(没执行DriverEntry)的驱动地址
LIST_ENTRY InInitializationOrderLinks; //链表 保存了已经安装，同时也启动了(执行了DriverEntry)的驱动地址
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
LIST_ENTRY HashLinks;
PVOID SectionPointer;
ULONG CheckSum;
ULONG TimeDateStamp;
PVOID LoadedImports;
PVOID EntryPointActivationContext;
PVOID PatchInformation;
}LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; VOID MyDriverUnload(PDRIVER_OBJECT pDriverObject)
{
//
KdPrint(("Unload EnumDriver.sys Success."));
} VOID EnumDriver(PDRIVER_OBJECT pDriverObject)
{
PLDR_DATA_TABLE_ENTRY pLdrDataTableEntry, pTempLdrDataTableEntry;
PLIST_ENTRY pList;
int i = ; pLdrDataTableEntry = (PLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection;
if (!MmIsAddressValid(pLdrDataTableEntry))
{
return;
} pList = &pLdrDataTableEntry->InLoadOrderLinks; while (pList != pLdrDataTableEntry->InLoadOrderLinks.Blink)
{
//ToDo
pTempLdrDataTableEntry = (PLDR_DATA_TABLE_ENTRY)pList;
i++; if(MmIsAddressValid(pTempLdrDataTableEntry))
{
if (MmIsAddressValid(&pTempLdrDataTableEntry->BaseDllName) && MmIsAddressValid(&pTempLdrDataTableEntry->BaseDllName))
KdPrint(("%d:%wZ\t%wZ", i, &pTempLdrDataTableEntry->BaseDllName, &pTempLdrDataTableEntry->FullDllName));
} pList = pList->Flink;
}
} NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
pDriverObject->DriverUnload = MyDriverUnload;
EnumDriver(pDriverObject); return STATUS_SUCCESS;
}