FSD键盘钩子框架参考爱写驱动的女装大佬

最新推荐文章于 2021-01-18 15:10:05 发布

原创最新推荐文章于 2021-01-18 15:10:05 发布 · 460 阅读

1 ·

CC 4.0 BY-SA版权

二进制专栏收录该内容

44 篇文章

订阅专栏

本文介绍如何在VS2013和WDK8.1环境下，通过修改内核模式驱动的读取操作，实现对键盘设备的驱动劫持。展示了使用ObReferenceObjectByName函数打开目标驱动，替换其IRP_MJ_READ处理函数的具体过程。

环境：vs2013+wdk8.1

#include <ntddk.h>

extern	POBJECT_TYPE *IoDriverObjectType;
PDRIVER_OBJECT kbdriver = NULL;
typedef	NTSTATUS(*pBeforeRead)(PDEVICE_OBJECT pDevice, PIRP pIrp);

pBeforeRead BeforeRead = NULL;


NTSTATUS
ObReferenceObjectByName(
__in PUNICODE_STRING ObjectName,
__in ULONG Attributes,
__in_opt PACCESS_STATE AccessState,
__in_opt ACCESS_MASK DesiredAccess,
__in POBJECT_TYPE ObjectType,
__in KPROCESSOR_MODE AccessMode,
__inout_opt PVOID ParseContext,
__out PVOID *Object
);

NTSTATUS Unload(PDRIVER_OBJECT driver)
{
	DbgPrint("Unload me");
	return STATUS_SUCCESS;
}

NTSTATUS MyRead(PDEVICE_OBJECT pDevice, PIRP pIrp)
{
	DbgPrint("====Read====");
	/*do something you like*/
	return BeforeRead(pDevice, pIrp);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING regpath)
{
	UNICODE_STRING	kbdname = RTL_CONSTANT_STRING(L"\\Driver\\Kbdclass");
	NTSTATUS status = ObReferenceObjectByName(&kbdname, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &kbdriver);
	if (!NT_SUCCESS(status)){
		DbgPrint("Open Kbdclass Failed");
		return STATUS_SUCCESS;
	}
	else{
		ObDereferenceObject(kbdriver);
	}

	BeforeRead = kbdriver->MajorFunction[IRP_MJ_READ];
	kbdriver->MajorFunction[IRP_MJ_READ] = MyRead;

	return STATUS_SUCCESS;
}

在这里插入图片描述