阅读:2247回复:14
4年前我写的第一个驱动代码,他居然返回错误码,请高手看看
我已经拥有administrator权限,为什么不可以读PhysicalMemory,
ZwOpenSection老是返回错误码。高手帮看看。。!!!! #include <ntddk.h> #include \"link.h\" NTSTATUS DriverEntry (IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { NTSTATUS ntStatus; UNICODE_STRING newString; UNICODE_STRING OldString; OBJECT_ATTRIBUTES os; HANDLE Section,SymLink; DriverObject->DriverUnload=Unload; RtlInitUnicodeString(&newString,L\"\\\\??\\YANGMIN\"); RtlInitUnicodeString(&OldString,L\"\\\\Device\\PhysicalMemory\"); ntStatus=IoCreateSymbolicLink(&newString,&OldString); if(!NT_SUCCESS(ntStatus)) { DbgPrint(\"IoCreateSymbolicLink error (code %x)\\n\",ntStatus); return (0); } InitializeObjectAttributes(&os,&newString,OBJ_CASE_INSENSITIVE,NULL,NULL); ntStatus=ZwOpenSection(&Section,SECTION_MAP_READ,&os); if(!NT_SUCCESS(ntStatus)) { DbgPrint(\"ZwOpenSection error (code %x)\\n\",ntStatus); return (0); } else { DbgPrint(\"ZwOpenSection Ok\\n\"); ZwClose(Section); } return (0); } VOID Unload(IN PDRIVER_OBJECT DriverObject) { PDEVICE_OBJECT DeviceObject; PDEVICE_OBJECT OldDeviceObject; int i=0; DbgPrint(\"Free link\\n\"); DeviceObject=DriverObject->DeviceObject; while(DeviceObject!=NULL) { OldDeviceObject=DeviceObject; DeviceObject=DeviceObject->NextDevice; IoDeleteDevice(OldDeviceObject); i=i+1; DbgPrint(\"Del %d\\n\",i); } } |
|
|
沙发#
发布于:2003-09-12 15:18
很正常啊,没有错误
|
|
板凳#
发布于:2003-09-12 15:36
InitializeObjectAttributes(&os,&OldString,OBJ_CASE_INSENSITIVE,NULL,NULL);
|
|
|
地板#
发布于:2003-09-12 15:47
没有错误我发帖子做什么。ZwOpenSection返回错误码!!!!!
据估计,是权限不够。我我已经有Administrators拉/ 下面可以清楚看到Administrators可以读。SYSTEM可以写 PhysicalMemory Section DACL - Ace[ 0] - Grant - 0xf001f - NT AUTHORITY\\SYSTEM Inherit: Access: 0x001F and ( D RCtl WOwn WDacl ) Ace[ 1] - Grant - 0x2000d - BUILTIN\\Administrators Inherit: Access: 0x000D and ( RCtl ) |
|
|
地下室#
发布于:2003-09-12 15:55
Driver routines that run in a process context other than that of the system process must set the OBJ_KERNEL_HANDLE attribute for the ObjectAttributes parameter of ZwOpenSection
InitializeObjectAttributes(&os,&OldString,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE ,NULL,NULL); |
|
|
5楼#
发布于:2003-09-12 16:08
我已经使用过
InitializeObjectAttributes(&os,&OldString,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE ,NULL,NULL); 没有用呀,一样返回错误码 |
|
|
6楼#
发布于:2003-09-12 20:47
4年前就已经写驱动了???
从高中就开始写驱动了??? 高人啊! |
|
7楼#
发布于:2003-09-16 15:17
error code 是什么?
|
|
8楼#
发布于:2003-09-16 18:42
你这家伙,又在网上骗人了。。。。。
还装个女的。。 |
|
9楼#
发布于:2003-09-19 16:09
gx_kyw家伙,我即不认识你又没和你说过话,你怎么这么肯定我不是女的。 哈哈,不要极度我技术比你厉害,难到女的就不可以学计算机,。 你这个垃圾
|
|
|
10楼#
发布于:2003-09-19 18:04
请大家讨论技术时不要转为互相对骂!
|
|
11楼#
发布于:2003-09-19 23:06
#include <ntddk.h>
#include \"link.h\" NTSTATUS DriverEntry (IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { NTSTATUS ntStatus; UNICODE_STRING newString; UNICODE_STRING OldString; OBJECT_ATTRIBUTES os; HANDLE Section,SymLink; DriverObject->DriverUnload=Unload; RtlInitUnicodeString(&OldString,L\"\\\\Device\\\\PhysicalMemory\"); RtlZeroMemory(&os,sizeof(os)); InitializeObjectAttributes(&os,&OldString,OBJ_CASE_INSENSITIVE,NULL,NULL); ntStatus=ZwOpenSection(&Section,SECTION_MAP_READ,&os); if(!NT_SUCCESS(ntStatus)) { DbgPrint(\"ZwOpenSection error (code %x)\\n\",ntStatus); return (0); } else { DbgPrint(\"ZwOpenSection Ok\\n\"); ZwClose(Section); } return (0); } VOID Unload(IN PDRIVER_OBJECT DriverObject) { PDEVICE_OBJECT DeviceObject; PDEVICE_OBJECT OldDeviceObject; int i=0; DbgPrint(\"Free link\\n\"); DeviceObject=DriverObject->DeviceObject; while(DeviceObject!=NULL) { OldDeviceObject=DeviceObject; DeviceObject=DeviceObject->NextDevice; IoDeleteDevice(OldDeviceObject); i=i+1; DbgPrint(\"Del %d\\n\",i); } } |
|
|
12楼#
发布于:2003-09-19 23:09
不好意思。还是错误~~ 返回错误码 c0000024
|
|
|
13楼#
发布于:2003-09-20 02:20
os 的属性可能有问题,试着把InitializeObjectAttributes的第三个参数修改一下。再式试
|
|
14楼#
发布于:2003-09-20 11:30
//
// MessageId: STATUS_OBJECT_TYPE_MISMATCH // // MessageText: // // {Wrong Type} // There is a mismatch between the type of object required by the requested operation and the type of object that is specified in the request. // #define STATUS_OBJECT_TYPE_MISMATCH ((NTSTATUS)0xC0000024L) |
|