weixin_42071117的博客

// driverA.c#include <ntddk.h>// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject){ UNICODE_STRING DevSymboliclinkName = { 0 }; RtlInitUnicodeString(&DevSymboliclinkName, L"\\??\\LayerDriver"); IoDeleteSymbolicLink(&DevSymbolicl

// driver.c#include <ntddk.h>typedef struct _DEVICE_EXTENSION{ PDEVICE_OBJECT AttachDevice; // ...} DEVICE_EXTENSION, *PDEVICE_EXTENSION;// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject){ KdPrint(("驱动卸载\n")); UNREFERENCED_PARAM.

// driver.c#include <ntifs.h>#include <ntddk.h>extern POBJECT_TYPE* IoDriverObjectType;NTSTATUSObReferenceObjectByName( __in PUNICODE_STRING ObjectName, __in ULONG Attributes, __in_opt PACCESS_STATE AccessState, __in_opt ACCESS_MASK

// driver.c#include <ntddk.h>// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject){ KdPrint(("驱动卸载\n")); UNREFERENCED_PARAMETER(pDriverObject);}// 测试函数VOID CallDriverTest(){ NTSTATUS status = STATUS_SUCCESS; PFILE_OBJECT pFileObj =

// dest#include <ntddk.h>// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject){ KdPrint(("驱动卸载\n")); UNREFERENCED_PARAMETER(pDriverObject); UNICODE_STRING DevSymbolicLinkName = { 0 }; RtlInitUnicodeString(&DevSymbolicLinkName, L"\\?

// 目标驱动#include <ntddk.h>// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject){ UNICODE_STRING DevSymbolicLink = { 0 }; KdPrint(("驱动卸载\n")); UNREFERENCED_PARAMETER(pDriverObject); RtlInitUnicodeString(&DevSymbolicLink, L"\\??\\Driv

#include <ntddk.h>// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject);// 时间函数测试VOID TimeTest();// 入口函数NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath){ NTSTATUS status = STATUS_SUCCESS; KdPri

// driver.c#include <ntddk.h>KDPC dpc;KTIMER timer;LARGE_INTEGER timeout;// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject);// 普通分发函数NTSTATUS DispatchRoutine(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp);// 时钟处理函数VOID IoTimerTes

#include <ntddk.h>// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject);// 派遣函数-常规NTSTATUS DispatchRoutine(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp);// 派遣函数-读操作NTSTATUS DispatchRead(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp);/

// driver.c#include <ntddk.h>LIST_ENTRY ListHeader;// 派遣函数-常规NTSTATUS DispatchRoutine(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp);// 派遣函数-读操作NTSTATUS DispatchRead(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp);// 派遣函数-清理NTSTATUS Dispat

// 同步#include <Windows.h>#include <stdio.h>int main(){ HANDLE hFile = CreateFile(L"Sync.txt", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); if (hFile == INVALID_HANDL

#include <Windows.h>#include <stdio.h>#pragma pack(1)typedef struct _STCode{ BYTE PushCode; // push指令码 DWORD DllAddress; // 注入的dll字符串地址 USHORT CallCode; // call指令码 DWORD FuncAddress; // LoadLibrary函数地址 BYTE LoopCode[7]; // 循环指令}ST

// console#include <Windows.h>#include <stdio.h>typedef LRESULT (*TestHookProc)(int code, WPARAM wParam, LPARAM lParam);int main(){ HWND hwnd = FindWindow(NULL, L"SetWindowHook"); DWORD dwThreadId = 0; DWORD dwProcessId = 0; HMODULE

// driver.c#include <ntddk.h>typedef struct _DeviceExtension{ PDEVICE_OBJECT AttachDevice; IO_REMOVE_LOCK RemoveLock;} DeviceExtension, *PDeviceExtension;// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT DriverObject);// 根据名称获取设备对象PDEVICE_OBJEC

// 驱动代码#include <ntddk.h>#define CTLBUFFERED CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)#define CTLDIRECTIN CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_IN_DIRECT, FILE_ANY_ACCESS)#define CTLDIRECTOUT CTL_CODE(FILE_DEVI

// 驱动代码#include <ntddk.h>#define MAX_FILE_LEN 4096// 设备扩展结构体typedef struct _FileExtend{ PCHAR Buffer; ULONG Length;} FileExtend, *PFileExtend;// 卸载函数VOID DriverUnload(IN PDRIVER_OBJECT DriverObject);// 派遣函数-基本操作NTSTATUS DispatchGeneri

// 驱动代码#include <ntddk.h>VOID DriverUnload(IN PDRIVER_OBJECT DriverObject){ UNICODE_STRING SymbolicLinkName = RTL_CONSTANT_STRING(L"\\??\\HelloDDK"); KdPrint(("驱动卸载\n")); UNREFERENCED_PARAMETER(DriverObject); IoDeleteSymbolicLink(&Symbol

#include <ntddk.h>#include <windef.h>VOID DriverUnload(IN PDRIVER_OBJECT DriverObject){ KdPrint(("驱动卸载\n")); UNREFERENCED_PARAMETER(DriverObject);}VOID RegCreateTest(){ NTSTATUS status = STATUS_SUCCESS; HANDLE hKey = NULL; HANDLE h

#include <ntddk.h>VOID DriverUnload(IN PDRIVER_OBJECT DriverObject){ KdPrint(("驱动卸载\n")); UNREFERENCED_PARAMETER(DriverObject);}// 创建文件VOID CreateFileTest();// 写入文件VOID WriteFileTest();// 读取文件VOID ReadFileTest();// 读取文件属性VOID ReadF

#include <ntddk.h>typedef struct _MYDATA{ int number;} MYDATA, *PMYDATA;VOID DriverUnload(IN PDRIVER_OBJECT DriverObject){ UNREFERENCED_PARAMETER(DriverObject); KdPrint(("驱动卸载\n"));}VOID LookAsideListTest(){ int i = 0; PMYDATA pdata[

#include <ntddk.h>extern POBJECT_TYPE IoDriverObjectType;#define KDB_DRIVER_NAME L"\\Driver\\Kdbclass"#define DELAY_ONE_MICROSECOND (-10)#define DELAY_ONE_MILLISECOND (DELAY_ONE_MICROSECOND * 1000)#define DELAY_ONE_SECOND (DELAY_ONE_MILLISECON

#include <ntddk.h>#include <ntstrsafe.h>// 设定计算机上只有32个串口#define CCP_MAX_COM_ID 32#define DELAY_ONE_MICROSECOND (-10)#define DELAY_ONE_MILLISECOND (DELAY_ONE_MICROSECOND * 1000)#define DELAY_ONE_SECOND (DELAY_ONE_MILLISECOND * 1000)// 保

#include <iostream>#include <Windows.h>#define SER_NAME L"FirstDriver"#define SER_DISPLAY_NAME L"第一个驱动"int main(){ SC_HANDLE hSCM = NULL; SC_HANDLE hSer = NULL; do { hSCM = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE

// first.c#include <ntddk.h>VOID DriverUnload(PDRIVER_OBJECT DriverObject){ if (DriverObject != NULL) { DbgPrint("[%ws]Driver upload, Driver Object Address: %p", __FUNCTIONW__, DriverObject); }}NTSTATUS DriverEntry(PDRIVER_OBJECT DriverO