键盘过滤驱动学习.doc

/pushad/item/0a78c3ba0812e6afeaba9399寒江独钓 IRP HOOK 键盘过滤之替换原键盘分发函数MajorFunction.h#ifndef _MAJORFUNCTION_HEADERS_#define _MAJORFUNCTION_HEADERS_#include #define DELAY_ONE_MILLISECOND 1000000extern POBJECT_TYPE *IoDriverObjectType;extern NTSTATUS ObReferenceObjectByName( IN PUNICODE_STRING ObjectPath, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState OPTIONAL, IN ACCESS_MASK DesiredAccess OPTIONAL, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, OUT PVOID *ObjectPtr); PDRIVER_DISPATCH OldMajorFunctionIRP_MJ_MAXIMUM_FUNCTION+1;#endif#include MajorFunction.h/ 原键盘驱动分发统一处理NTSTATUS OldKeyBoardDispath(PDEVICE_OBJECT DeviceObject, PIRP pIrp) NTSTATUS Status = STATUS_UNSUCCESSFUL; PIO_STACK_LOCATION irpStack = NULL; irpStack = IoGetCurrentIrpStackLocation(pIrp); Status = OldMajorFunctionirpStack-MajorFunction(DeviceObject, pIrp); DbgPrint(IRP_MJ_FUNCTIOIN complete successful!n); return Status;/ HOOK 函数， 替换键盘原来的MajorFunctionNTSTATUS MajorFunctionHook(PDRIVER_OBJECT DriverObject) NTSTATUS Status = STATUS_UNSUCCESSFUL; PDRIVER_OBJECT KeyBoardDriverObject = NULL; UNICODE_STRING KeyBoardDriverName; PFILE_OBJECT pFileObject = NULL; int nIndex = 0; RtlInitUnicodeString(&KeyBoardDriverName, LDriverKbdclass); Status = ObReferenceObjectByName(&KeyBoardDriverName, OBJ_CASE_INSENSITIVE, NULL, 0, IoDriverObjectType, KernelMode, NULL, &KeyBoardDriverObject); if (!NT_SUCCESS(Status) DbgPrint(in MajorFunctionHook Get ObReferenceObjectByName by KeyBoardDriverObject Errorn); goto Exit0; /保存及设置新键盘的MajorFunction for(nIndex = 0; nIndex MajorFunctionnIndex; InterlockedExchangePointer(&KeyBoardDriverObject-MajorFunctionnIndex, DriverObject-MajorFunctionnIndex); DbgPrint(IRP_MJ_FUNCTION Hook Successful!n); / 解除引用 ObDereferenceObject(KeyBoardDriverObject);Exit0: return Status;/ 卸载函数NTSTATUS UnLoadDriver(PDRIVER_OBJECT DriverObject) NTSTATUS Status = STATUS_UNSUCCESSFUL; int nIndex = 0; PDRIVER_OBJECT KeyBoardDriverObject = NULL; UNICODE_STRING KeyBoardName; LARGE_INTEGER Delay; RtlInitUnicodeString(&KeyBoardName, LDriverKbdclass); Status = ObReferenceObjectByName(&KeyBoardName, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &KeyBoardDriverObject); if (!NT_SUCCESS(Status) DbgPrint(UnloadDriver Get Keyboard Driver Object Errorn); goto Exit0; / 交换原来的分发函数 for (nIndex; nIndex MajorFunctionnIndex, OldMajorFunctionnIndex); DbgPrint(Change MajorFunction Successful!n); Delay = RtlConvertLongToLargeInteger(5* DELAY_ONE_MILLISECOND); / 延时等待完成 KeDelayExecutionThread(KernelMode, FALSE, &Delay); ObReferenceObject(KeyBoardDriverObject);Exit0: return Status;NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegisterPath) NTSTATUS Status = STATUS_UNSUCCESSFUL; int nIndex = 0; / 设置新的键盘分发函数 for (nIndex;