FSD键盘钩子框架参考爱写驱动的女装大佬

应用层到内核数据的输入与输出,常规的通讯(派遣函数) 功能:应用层与内核可以通讯,交互数据,这里演示的是常规IO输入输出的通讯。 学习自B站 UP主:写驱动的女装大佬《中级篇第三课》 阅读详情

环境:vs2013+wdk8.1

#include <ntddk.h>

extern	POBJECT_TYPE *IoDriverObjectType;
PDRIVER_OBJECT kbdriver = NULL;
typedef	NTSTATUS(*pBeforeRead)(PDEVICE_OBJECT pDevice, PIRP pIrp);

pBeforeRead BeforeRead = NULL;


NTSTATUS
ObReferenceObjectByName(
__in PUNICODE_STRING ObjectName,
__in ULONG Attributes,
__in_opt PACCESS_STATE AccessState,
__in_opt ACCESS_MASK DesiredAccess,
__in POBJECT_TYPE ObjectType,
__in KPROCESSOR_MODE AccessMode,
__inout_opt PVOID ParseContext,
__out PVOID *Object
);

NTSTATUS Unload(PDRIVER_OBJECT driver)
{
	DbgPrint("Unload me");
	return STATUS_SUCCESS;
}

NTSTATUS MyRead(PDEVICE_OBJECT pDevice, PIRP pIrp)
{
	DbgPrint("====Read====");
	/*do something you like*/
	return BeforeRead(pDevice, pIrp);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING regpath)
{
	UNICODE_STRING	kbdname = RTL_CONSTANT_STRING(L"\\Driver\\Kbdclass");
	NTSTATUS status = ObReferenceObjectByName(&kbdname, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &kbdriver);
	if (!NT_SUCCESS(status)){
		DbgPrint("Open Kbdclass Failed");
		return STATUS_SUCCESS;
	}
	else{
		ObDereferenceObject(kbdriver);
	}

	BeforeRead = kbdriver->MajorFunction[IRP_MJ_READ];
	kbdriver->MajorFunction[IRP_MJ_READ] = MyRead;

	return STATUS_SUCCESS;
}

在这里插入图片描述

内核模块字符相关处理 一、初始化字符串 : RtlInitUnicodeString(&deviceanme, DEVICE_NAME) #define DEVICE_NAME L"\\Device\\MyfirstDevice" //定义一个驱动的名字 UNICODE_STRING deviceanme = { 0 };//初始一个存储设备名字的内存空间 RtlInitUnicodeString(&deviceanme, DEVICE_NAME);//初始化一个字符串 DbgPrint("--:%wZ 阅读详情

相关推荐

Windows钩子教程

windows钩子入门教程,适合新手。 来源:一路采撷 Blog:http://blog.youkuaiyun.com/MaybeHelios/

驱动层虚拟机检测参考爱写驱动的女装大佬

#include <ntddk.h> #include <windef.h> typedef struct _SYSTEM_MODULE_INFORMATION{ HANDLE Section; PVOID MappedBase; PVOID base; ULONG Size; ULONG Flags; USHORT LoadOrderIndex; ...

Cosmopolitan的博客 610

FEniCS学习笔记01:centos7下通过conda安装FEniCSx0.7

2023年版本的Fenicsx0.7,官网推荐使用conda命令安装集成好的Python包,因此我们的安装思路是先安装Anaconda,再按照官网步骤安装Fenics。

huahua_xiao的博客 5058

Windows驱动学习(六)-- FSD钩子

教程参考自:https://www.bilibili.com/video/av26193169/?p=8 代码地址:https://github.com/G4rb3n/Windows-Driver/tree/master/MT_FSDHook 1. 概述 FSD钩子是一种较实用的过滤方法,对比于上一章的添加键盘过滤设备,这种方法更显得简单高效。 2. 驱动编写 2.1 驱动入口函数 入口函数简单明...

安全杂货铺 2748

『ISOBUS 入门』第 00 节 导言:ISOBUS 的宏观图景与入门路径

ISOBUS 是由三部分构成的集成系统:两段CAN网络(拖拉机与农具侧)、标准化通信约定及认证流程。其核心在于通过统一协议实现跨品牌设备即插即用。标准体系以ISO 11783为基础,分层涵盖物理层、传输层至应用层,关键功能如虚拟终端(VT)、任务控制器(TC)和文件服务器依赖严格的会话管理与角色分工。实际部署中,总线上传输多种协议报文,故障排查需结合地址声明、多包传输与角色权限分析。学习应从真实报文入手,建立“角色—数据流—功能块”认知链,避免仅学标准或仿真替代实测,方能有效应对复杂现场问题。

linx295的博客 286

手把手教你用STM32实现SPWM逆变器控制(附完整代码)

本文详细介绍了如何使用STM32微控制器实现SPWM逆变器控制,包括硬件设计、PWM生成配置、正弦表生成与DMA传输,以及闭环控制与性能优化。通过完整的代码示例和实测数据,帮助开发者快速掌握SPWM技术,应用于新能源和电力电子领域。

weixin_29296241的博客 319

驱动层和r3程序通讯的列子参考爱写驱动的女装大佬

开发环境:VS2013+WDK8.1 驱动层: #include <ntddk.h> #define DEVICE_NAME "\\Device\\MyReadDevice" #define SYM_LINK_NAME "\\??\\MyRead" NTSTATUS DriverUnload(PDRIVER_OBJECT driver) { DbgPrint("unload ...

Cosmopolitan的博客 526

(SCADA)监控与数据采集系统

SCADA应用于监控和采集数据来控制工业过程软件。它通过收集和传输实时数据,帮助操作员监视和控制各种设备和过程。

软件技术的专栏 4545

FSD HOOK与SSDT HOOK恢复简单思路

FSD 解释: File System Driver文件系统驱动程序,分为本地FSD和远程FSD。 (1) 本地FSD:允许用户访问本地计算机上的数据 ——本地FSD负责向I/O管理器注册自己,当开始访问某个卷时,I/O管理器调用FSD来进行卷识别。 ——完成卷识别后,本地FSD创建一个设备对象以表示所装载的文件系统。 ——I/O管理器通过卷参数块(VPB)在存...

weixin_34292924的博客 401

gesp c++ 八级知识点

gesp c++ 八级知识点

MMD.然大大 2243

Quartus Prime 软件 USB-blaster 驱动安装失败【已解决】

一、安装步骤 1、将FPGA 开发板插入电脑时,未安装驱动的电脑会提示安装usb-Blaster驱动。Windows搜索框打开设备管理器,在“其他设备”下会发现黄色感叹号的“USB-Blaster”的设备驱动。 2、Quartus系列软件的安装目录下自带USB-blaster的驱动程序,右键更新驱动,选择驱动目录:(D:\intelFPGA\18.1\quartus\drivers\usb-blaster,文件位置和版本请按照自己安装的路径选择),点击Next开始安装。 3、安装成功,重启电脑即可使

adolphwang_909086的博客 6万+

fsd

fds<!--v/:* {behavior:url(#default#VML);}o/:* {behavior:url(#default#VML);}w/:* {behavior:url(#default#VML);}.shape {behavior:url(#default#VML);}--> Normal 0 7.8 磅 0

Continue strive 444

SAP Gateway Foundation OData V4 服务管理深度解析,从 Service Repository 到 Service Group 的完整运行逻辑

本文解析了SAP S/4HANA中OData V4 API的技术架构,重点阐述Service Repository、Service与Service Group的三层管理体系。以SalesOrder和PurchaseOrder API为例,说明不同服务可能属于特定repository(如srvd_a2x)而非默认DEFAULT库。Service Group作为业务模型组合单元,支持跨服务引用和统一配置,其发布状态直接影响服务可用性。文中对比了后台管理事务/IWBEP/V4_ADMIN与网关端/IWFND/V4

2007 年 ~ 2025 年,深耕 SAP 技术 18 年 90

FSDHOOK恢复

WCHAR DriverName[] = L"\\FileSystem\\ntfs"; WCHAR DriverPath[] = L"\\??\\C:\\WINDOWS\\system32\\drivers\\ntfs.sys"; RestoreFSDMajorRoutine(&DriverName, &DriverPath, IRP_MJ_CREATE); //函数名: Resto

125096 720

36 Agent Memory:如何让智能体记住该记的东西

Agent 会调用工具,只能说明它有了行动能力。要让它跨会话、跨任务持续工作,还需要一套可治理的 Memory 系统。本文讲清上下文窗口、RAG 和 Agent Memory 的区别,以及工作记忆、情景记忆、语义记忆、程序记忆该如何分层设计。

老于的笔记的专栏 90

Outlook Express 6 (OE6) for Win7/Win8/Win10

英文版 Outlook Express6.0, 兼容Win7/Win10/WinXP,解压就可用。

挂钩FSD实现文件隐藏

【文章标题】: 挂钩FSD实现文件隐藏 【文章作者】: index09 【作者声明】: 只是感兴趣,没有其他目的。失误之处敬请诸位大侠赐教! -------------------------------------------------------------------------------- 【详细过程】 最近看Fastfat驱动想到的方法。查了一下又是被别人玩过了,还是简单说一下吧

zacklin的专栏 1865

jdk-8u144-linux-x64.tar.gz.

该资源为搭建Linux系统Java环境用,资源的后缀为tar.gz格式的压缩包

几种钩子类型

1.函数钩子:可以向被注入线程插入木马代码2.系统API钩子,通过给系统的API附加上一段小程序,达到监视甚至控制应用程序对API的调用。3.输入地址表(IAT)钩子,用另一个函数的地址替换DLL输入函数的地址4.中断分配表(IDT)钩子,替换中断分配表中中断服务程序(ISR)的入口地址5.IO请求包函数表(IRP)钩子,替换IRP函数表的一些表项来达到隐藏目的,如文件.网络端口.注册表项等。6....

inuo2011的博客 2053

深度学习工具包 DeepLearningToolbox

深度学习工具包Deprecation notice.-----This toolbox is outdated and no longer maintained.There are much better tools available for deep learning than this toolbox, e.g. [Theano](http://deeplearning.net/software/theano/), [torch](http://torch.ch/) or [tensorflow](http://www.tensorflow.org/)I would suggest you use one of the tools mentioned above rather than use this toolbox.Best, Rasmus.DeepLearnToolbox================A Matlab toolbox for Deep Learning.Deep Learning is a new subfield of machine learning that focuses on learning deep hierarchical models of data.It is inspired by the human brain's apparent deep (layered, hierarchical) architecture.A good overview of the theory of Deep Learning theory is[Learning Deep Architectures for AI](http://www.iro.umontreal.ca/~bengioy/papers/ftml_book.pdf)For a more informal introduction, see the following videos by Geoffrey Hinton and Andrew Ng.* [The Next Generation of Neural Networks](http://www.youtube.com/watch?v=AyzOUbkUf3M) (Hinton, 2007)* [Recent Developments in Deep Learning](http://www.youtube.com/watch?v=VdIURAu1-aU) (Hinton, 2010)* [Unsupervised Feature Learning and Deep Learning](http://www.youtube.com/watch?v=ZmNOAtZIgIk) (Ng, 2011)If you use this toolbox in your research please cite [Prediction as a candidate for learning deep hierarchical models of data](http://www2.imm.dtu.dk/pubdb/views/publication_details.php?id=6284)```@MASTERSTHESIS\{IMM2012-06284, author = "R. B. Palm", title = "Prediction as a candidate for learning deep hierarchical models of data", year = "2012",}```Contact: rasmusbergpalm at gmail dot comDirectories included in the toolbox-----------------------------------`NN/` - A library for Feedforward Backpropagation Neural Networks`CNN/` - A library for Convolutional Neural Networks`DBN/` - A library for Deep Belief Networks`SAE/` - A library for Stacked Auto-Encoders`CAE/` - A library for Convolutional Auto-Encoders`util/` - Utility functions used by the libraries`data/` - Data used by the examples`tests/` - unit tests to verify toolbox is workingFor references on each library check REFS.mdSetup-----1. Download.2. addpath(genpath('DeepLearnToolbox'));Example: Deep Belief Network---------------------```matlabfunction test_example_DBNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit RBM and visualize its weightsrand('state',0)dbn.sizes = [100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);figure; visualize(dbn.rbm{1}.W'); % Visualize the RBM weights%% ex2 train a 100-100 hidden unit DBN and use its weights to initialize a NNrand('state',0)%train dbndbn.sizes = [100 100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);%unfold dbn to nnnn = dbnunfoldtonn(dbn, 10);nn.activation_function = 'sigm';%train nnopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.10, 'Too big error');```Example: Stacked Auto-Encoders---------------------```matlabfunction test_example_SAEload mnist_uint8;train_x = double(train_x)/255;test_x = double(test_x)/255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit SDAE and use it to initialize a FFNN% Setup and train a stacked denoising autoencoder (SDAE)rand('state',0)sae = saesetup([784 100]);sae.ae{1}.activation_function = 'sigm';sae.ae{1}.learningRate = 1;sae.ae{1}.inputZeroMaskedFraction = 0.5;opts.numepochs = 1;opts.batchsize = 100;sae = saetrain(sae, train_x, opts);visualize(sae.ae{1}.W{1}(:,2:end)')% Use the SDAE to initialize a FFNNnn = nnsetup([784 100 10]);nn.activation_function = 'sigm';nn.learningRate = 1;nn.W{1} = sae.ae{1}.W{1};% Train the FFNNopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.16, 'Too big error');```Example: Convolutional Neural Nets---------------------```matlabfunction test_example_CNNload mnist_uint8;train_x = double(reshape(train_x',28,28,60000))/255;test_x = double(reshape(test_x',28,28,10000))/255;train_y = double(train_y');test_y = double(test_y');%% ex1 Train a 6c-2s-12c-2s Convolutional neural network %will run 1 epoch in about 200 second and get around 11% error. %With 100 epochs you'll get around 1.2% errorrand('state',0)cnn.layers = { struct('type', 'i') %input layer struct('type', 'c', 'outputmaps', 6, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %sub sampling layer struct('type', 'c', 'outputmaps', 12, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %subsampling layer};cnn = cnnsetup(cnn, train_x, train_y);opts.alpha = 1;opts.batchsize = 50;opts.numepochs = 1;cnn = cnntrain(cnn, train_x, train_y, opts);[er, bad] = cnntest(cnn, test_x, test_y);%plot mean squared errorfigure; plot(cnn.rL);assert(er<0.12, 'Too big error');```Example: Neural Networks---------------------```matlabfunction test_example_NNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);% normalize[train_x, mu, sigma] = zscore(train_x);test_x = normalize(test_x, mu, sigma);%% ex1 vanilla neural netrand('state',0)nn = nnsetup([784 100 10]);opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samples[nn, L] = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.08, 'Too big error');%% ex2 neural net with L2 weight decayrand('state',0)nn = nnsetup([784 100 10]);nn.weightPenaltyL2 = 1e-4; % L2 weight decayopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex3 neural net with dropoutrand('state',0)nn = nnsetup([784 100 10]);nn.dropoutFraction = 0.5; % Dropout fraction opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex4 neural net with sigmoid activation functionrand('state',0)nn = nnsetup([784 100 10]);nn.activation_function = 'sigm'; % Sigmoid activation functionnn.learningRate = 1; % Sigm require a lower learning rateopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex5 plotting functionalityrand('state',0)nn = nnsetup([784 20 10]);opts.numepochs = 5; % Number of full sweeps through datann.output = 'softmax'; % use softmax outputopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex6 neural net with sigmoid activation and plotting of validation and training error% split training data into training and validation datavx = train_x(1:10000,:);tx = train_x(10001:end,:);vy = train_y(1:10000,:);ty = train_y(10001:end,:);rand('state',0)nn = nnsetup([784 20 10]); nn.output = 'softmax'; % use softmax outputopts.numepochs = 5; % Number of full sweeps through dataopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, tx, ty, opts, vx, vy); % nntrain takes validation set as last two arguments (optionally)[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');```[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/rasmusbergpalm/deeplearntoolbox/trend.png)](https://bitdeli.com/free "Bitdeli Badge")

visio安装包

Microsoft Office Visio 是一款专业的制图软件。利用经过更新的形状、协作工具和数据链接图表,创建专业级图表以简化复杂的信息。

对付kernel / fsd inline hook/ssdt hook

<!-- if (!document.phpAds_used) document.phpAds_used = ,; phpAds_random = new String (Math.random()); phpAds_random = phpAds_random.substring(2,11); document.write ("<" + "script

1072

8.2.1 找到所有的键盘设备

找到所有的键盘设备 先打开驱动对象KbdClass,然后绑定它下面的所有设备

张昆 632

驱动键盘钩子

现在网上很多盗QQ的木马,发现都不管用得,顺便做了这只QQ木马,这里发布一部分核心的代码内核代码,用于记录QQ密码,此代码编译后可以在win2000到win7下正常运行,百分百能获取正确的QQ和密码,用户太下面的代码,只能获取QQ和密码,不带邮件发送功能,和系统隐藏功能,主要是怕有些人哪去干坏事,所以我不发布完整版的代码,以下驱动代码需要编译为NTI0.SYS文件放到C:\\Windo...

weixin_30443731的博客 471

XP中Inline HOOK 8042驱动实现键盘钩子的方法

首先说说我写这个驱动的动机,说来特别搞笑。首先是QQ的Nportect有时候会搞得我的键盘按键混乱,这搞得我很郁闷。这使我对键盘产生了兴趣,但是真正让我动手写的原因却更有趣。公司有一台老机器给我们用于测试,但机器的键盘却不好用,我们只能把测试用的命令复制到文本中上传上去。如此的不便使我动手写了一个远程控制键盘的驱动,由于我不知道每个键的scancode,网上的资料又乱七八糟懒得仔细看了,所以顺编写

1987

win7下全局低层键盘钩子实现

上一篇博客中介绍了一般全局键盘钩子,但是有几个缺点,一是代码不够简洁,需要两部分实现,二是效果不佳,对于64位进程无能为力。这篇博客介绍的低层键盘钩子,克服了以上缺点,在win7系统下做过测试,效果非常不错。 实现的原理是通过SetWindowsHookEx接口安装低层键盘钩子,低层键盘钩子由于是最底层的,系统的按键消息会优先发到安装低层键盘钩子线程的消息队列中,让它获得优先处理消息的能力,通过

zjuman2007的博客 8448

钩子的类型和实现

         Windows系统是建立在事件驱动的机制上的,说穿了就是整个系统都是通过消息的传递来实现的。而钩子是Windows系统中非常重要的系统接口,用它可以截获并处理送给 其他应用程序的消息,来完成普通应用程序难以实现的功能。钩子可以监视系统或进程中的各种事件消息,截获发往目标窗口的消息并进行处理。这样,我们就可以在系统中安装自定义的钩子,监视系统中特定事件的发生,完成特定的功能,比如截

专著记录 1799

ObReferenceObjectByName 函数解析

一、由于ObReferenceObjectByName没有文档化,故在使用前先做声明: #ifdef __cplusplus extern "C" { #endif #include <NTDDK.h> NTKERNELAPI NTSTATUS ObReferenceObjectByName( IN PUNICODE_STRING ObjectName, I...

weixin_30311605的博客 299

NDIS and TDI Hooking, Part II

NDIS and TDI Hooking, Part II By: andreas This is the second and last article on how to hook into the NDIS and TDI layer. The approach we will use will be slightly different from the NDIS case. Ho

白日梦 1948
上一篇: 驱动层和r3程序通讯的列子参考爱写驱动的女装大佬
下一篇: 内核线程创建列子
Cosmop01itan
博客等级 码龄10年 144粉丝 182原创
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付:10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值