jwihack
驱动牛犊
驱动牛犊
  • 注册日期2007-01-11
  • 最后登录2010-12-16
  • 粉丝0
  • 关注0
  • 积分0分
  • 威望20点
  • 贡献值0点
  • 好评度19点
  • 原创分0分
  • 专家分0分
阅读:1187回复:0

请教 怎么获取驱动的对象? \Driver 目录下面的!

楼主#
更多 发布于:2007-01-31 19:06
  
gDiskSymbolLink        dw     '\','D','o','s','D','e','v','i','c','e','s','\','T','c','p',0,0  

_GetpDeviceObject proc uses ebx esi edi

    local    SymbolLink: UNICODE_STRING
    local    hFile: dword
    local    IoStatus: IO_STATUS_BLOCK
    local    pFileObject: dword
    local    oa:OBJECT_ATTRIBUTES


    lea    edi,SymbolLink
    lea    esi,gDiskSymbolLink
    invoke    RtlInitUnicodeString,edi,esi

    mov    [oa._Length],sizeof( OBJECT_ATTRIBUTES )
    mov    [oa.RootDirectory],NULL
    mov    [oa.ObjectName],edi
    mov    [oa.Attributes],OBJ_CASE_INSENSITIVE
    mov    [oa.SecurityDescriptor],NULL
    mov    [oa.SecurityQualityOfService],NULL

    lea    esi,oa
    lea    edi,hFile
    lea    ebx,IoStatus
    int 3

    invoke    ZwCreateFile,edi,SYNCHRONIZE or FILE_ANY_ACCESS,esi,ebx,0,0,FILE_SHARE_READ or FILE_SHARE_WRITE,FILE_OPEN,FILE_SYNCHRONOUS_IO_NONALERT or FILE_DIRECTORY_FILE,0,0
    test    eax,eax
    jnl    short _OpenFileOk
    xor    eax,eax
    jmp    short _FailExit

_OpenFileOk:
    lea    esi,pFileObject
    invoke    ObReferenceObjectByHandle,dword ptr[edi],FILE_READ_DATA,0,0,esi,0
    test    eax,eax
    jnl    short _ReferenceObjectOk
    invoke    ZwClose,dword ptr[edi]
    xor    eax,eax
    jmp    short _FailExit

_ReferenceObjectOk:
    
    invoke    IoGetRelatedDeviceObject,dword ptr [esi]
    mov    ebx,eax
    invoke    ObDereferenceObject,dword ptr[esi]
    invoke    ZwClose,dword ptr[esi]
    test    ebx,ebx
    jnz    short _GetRelatedDeviceOk
    xor    eax,eax
    jmp    short _FailExit
_GetRelatedDeviceOk:
    mov    eax,ebx
_FailExit:
    ret
_GetpDeviceObject endp


这样可以实现得到设备的对象。 可是
\Driver 目录下面的就不行了!!

指点有一下。谢谢
游客

返回顶部