|
阅读:1285回复:0
请教 怎么获取驱动的对象? \Driver 目录下面的!gDiskSymbolLink dw '\','D','o','s','D','e','v','i','c','e','s','\','T','c','p',0,0
_GetpDeviceObject proc uses ebx esi edi
local SymbolLink: UNICODE_STRING
local hFile: dword
local IoStatus: IO_STATUS_BLOCK
local pFileObject: dword
local oa:OBJECT_ATTRIBUTES
lea edi,SymbolLink
lea esi,gDiskSymbolLink
invoke RtlInitUnicodeString,edi,esi
mov [oa._Length],sizeof( OBJECT_ATTRIBUTES )
mov [oa.RootDirectory],NULL
mov [oa.ObjectName],edi
mov [oa.Attributes],OBJ_CASE_INSENSITIVE
mov [oa.SecurityDescriptor],NULL
mov [oa.SecurityQualityOfService],NULL
lea esi,oa
lea edi,hFile
lea ebx,IoStatus
int 3
invoke ZwCreateFile,edi,SYNCHRONIZE or FILE_ANY_ACCESS,esi,ebx,0,0,FILE_SHARE_READ or FILE_SHARE_WRITE,FILE_OPEN,FILE_SYNCHRONOUS_IO_NONALERT or FILE_DIRECTORY_FILE,0,0
test eax,eax
jnl short _OpenFileOk
xor eax,eax
jmp short _FailExit
_OpenFileOk:
lea esi,pFileObject
invoke ObReferenceObjectByHandle,dword ptr[edi],FILE_READ_DATA,0,0,esi,0
test eax,eax
jnl short _ReferenceObjectOk
invoke ZwClose,dword ptr[edi]
xor eax,eax
jmp short _FailExit
_ReferenceObjectOk:
invoke IoGetRelatedDeviceObject,dword ptr [esi]
mov ebx,eax
invoke ObDereferenceObject,dword ptr[esi]
invoke ZwClose,dword ptr[esi]
test ebx,ebx
jnz short _GetRelatedDeviceOk
xor eax,eax
jmp short _FailExit
_GetRelatedDeviceOk:
mov eax,ebx
_FailExit:
ret
_GetpDeviceObject endp这样可以实现得到设备的对象。 可是 \Driver 目录下面的就不行了!! 指点有一下。谢谢 |
|