键盘过滤驱动学习VIP专享VIP免费

下载本文档

阅读 66
下载 17
格式 doc
大小 20.5 KB
约4页
2024-11-09 发布于河南
收藏
评论
点赞(0)
海报
举报

1/4页

2/4页

3/4页

在线预览已结束，请下载后查看完整版，加入VIP享文档下载特权

文本预览下载提示常见问题

http://hi.baidu.com/pushad/item/0a78c3ba0812e6afeaba9399[寒江独钓]IRPHOOK键盘过滤之替换原键盘分发函数MajorFunction.h#ifndef_MAJORFUNCTION_HEADERS_#define_MAJORFUNCTION_HEADERS_#include#defineDELAY_ONE_MILLISECOND1000000externPOBJECT_TYPE*IoDriverObjectType;externNTSTATUSObReferenceObjectByName(INPUNICODE_STRINGObjectPath,INULONGAttributes,INPACCESS_STATEPassedAccessStateOPTIONAL,INACCESS_MASKDesiredAccessOPTIONAL,INPOBJECT_TYPEObjectType,INKPROCESSOR_MODEAccessMode,INOUTPVOIDParseContextOPTIONAL,OUTPVOID*ObjectPtr);PDRIVER_DISPATCHOldMajorFunction[IRP_MJ_MAXIMUM_FUNCTION+1];#endif#include"MajorFunction.h"//原键盘驱动分发统一处理NTSTATUSOldKeyBoardDispath(PDEVICE_OBJECTDeviceObject,PIRPpIrp){NTSTATUSStatus=STATUS_UNSUCCESSFUL;PIO_STACK_LOCATIONirpStack=NULL;irpStack=IoGetCurrentIrpStackLocation(pIrp);Status=OldMajorFunction[irpStack->MajorFunction](DeviceObject,pIrp);DbgPrint("IRP_MJ_FUNCTIOINcompletesuccessful!\n");returnStatus;}//HOOK函数，替换键盘原来的MajorFunctionNTSTATUSMajorFunctionHook(PDRIVER_OBJECTDriverObject){NTSTATUSStatus=STATUS_UNSUCCESSFUL;PDRIVER_OBJECTKeyBoardDriverObject=NULL;UNICODE_STRINGKeyBoardDriverName;PFILE_OBJECTpFileObject=NULL;intnIndex=0;RtlInitUnicodeString(&KeyBoardDriverName,L"\\Driver\\Kbdclass");Status=ObReferenceObjectByName(&KeyBoardDriverName,OBJ_CASE_INSENSITIVE,\NULL,0,IoDriverObjectType,KernelMode,NULL,&KeyBoardDriverObject);if(!NT_SUCCESS(Status)){DbgPrint("inMajorFunctionHookGetObReferenceObjectByNamebyKeyBoardDriverObjectError\n");gotoExit0;}//保存及设置新键盘的MajorFunctionfor(nIndex=0;nIndexMajorFunction[nIndex];InterlockedExchangePointer(&KeyBoardDriverObject->MajorFunction[nIndex],DriverObject->MajorFunction[nIndex]);}DbgPrint("IRP_MJ_FUNCTIONHookSuccessful!\n");//解除引用ObDereferenceObject(KeyBoardDriverObject);Exit0:returnStatus;}//卸载函数NTSTATUSUnLoadDriver(PDRIVER_OBJECTDriverObject){NTSTATUSStatus=STATUS_UNSUCCESSFUL;intnIndex=0;PDRIVER_OBJECTKeyBoardDriverObject=NULL;UNICODE_STRINGKeyBoardName;LARGE_INTEGERDelay;RtlInitUnicodeString(&KeyBoardName,L"\\Driver\\Kbdclass");Status=ObReferenceObjectByName(&KeyBoardName,OBJ_CASE_INSENSITIVE,NULL,0,*IoDriverObjectType,\KernelMode,NULL,&KeyBoardDriverObject);if(!NT_SUCCESS(Status)){DbgPrint("UnloadDriverGetKeyboardDriverObjectError\n");gotoExit0;}//交换原来的分发函数for(nIndex;nIndexMajorFunction[nIndex],OldMajorFunction[nIndex]);}DbgPrint("ChangeMajorFunctionSuccessful!\n");Delay=RtlConvertLongToLargeInteger(5*DELAY_ONE_MILLISECOND);//延时等待完成KeDelayExecutionThread(KernelMode,FALSE,&Delay);ObReferenceObject(KeyBoardDriverObject);Exit0:returnStatus;}NTSTATUSDriverEntry(PDRIVER_OBJECTDriverObject,PUNICODE_STRINGRegisterPath){NTSTATUSStatus=STATUS_UNSUCCESSFUL;intnIndex=0;//设置新的键盘分发函数for(nIndex;nIndexMajorFunction[nIndex]=OldKeyBoardDispath;}DriverObject->DriverUnload=UnLoadDriver;Status=MajorFunctionHook(DriverObject);returnStatus;}

1、当您付费下载文档后，您只拥有了使用权限，并不意味着购买了版权，文档只能用于自身使用，不得用于其他商业用途（如 [转卖]进行直接盈利或[编辑后售卖]进行间接盈利）。
2、本站所有内容均由合作方或网友上传，本站不对文档的完整性、权威性及其观点立场正确性做任何保证或承诺！文档内容仅供研究参考，付费前请自行鉴别。
3、如文档内容存在违规，或者侵犯商业秘密、侵犯著作权等，请点击“违规举报”。

碎片内容

键盘过滤驱动学习

http://hi

com/pushad/item/0a78c3ba0812e6afeaba9399[寒江独钓]IRPHOOK键盘过滤之替换原键盘分发函数MajorFunction

h#ifndef_MAJORFUNCTION_HEADERS_#define_MAJORFUNCTION_HEADERS_#include#defineDELAY_ONE_MILLISECOND1000000externPOBJECT_TYPE*IoDriverObjectType;externNTSTATUSObReferenceObjectByName(INPUNICODE_STRINGObjectPath,INULONGAttributes,INPACCESS_STATEPassedAccessStateOPTIONAL,INACCESS_MASKDesiredAccessOPTIONAL,INPOBJECT_TYPEObjectType,INKPROCESSOR_MODEAccessMode,INOUTPVOIDParseContextOPTIONAL,OUTPVOID*ObjectPtr);PDRIVER_DISPATCHOldMajorFunction[IRP_MJ_MAXIMUM_FUNCTION+1];#endif#include"MajorFunction

h"//原键盘驱动分发统一处理NTSTATUSOldKeyBoardDispath(PDEVICE_OBJECTDeviceObject,PIRPpIrp){NTSTATUSStatus=STATUS_UNSUCCESSFUL;PIO_STACK_LOCATIONirpStack=NULL;irpStack=IoGetCurrentIrpStackLocation(pIrp);Status=OldMajorFun

您可能关注的文档

金钥匙书屋 + 关注: 实名认证
内容提供者

热爱教育事业，爱好互联网行业

收藏店铺进入空间

键盘过滤驱动学习VIP专享VIP免费

键盘过滤驱动学习

您可能关注的文档

相关文档

热门下载

相关标签