键盘过滤驱动学习文.pdfVIP

/pushad/item/0a78c3ba0812e6afeaba9399 [ 寒江独钓 ] IRP HOOK 键盘过滤之替换原键盘分发函数 MajorFunction.h #ifndef _MAJORFUNCTION_HEADERS_ #define _MAJORFUNCTION_HEADERS_ #include ntddk.h #define DELAY_ONE_MILLISECOND 1000000 extern POBJECT_TYPE *IoDriverObjectType; extern NTSTATUS ObReferenceObjectByName( IN PUNICODE_STRING ObjectPath, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState OPTIONAL, IN ACCESS_MASK DesiredAccess OPTIONAL, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, OUT PVOID *ObjectPtr); PDRIVER_DISPATCH OldMajorFunction[IRP_MJ_MAXIMUM_FUNCTION+1]; #endif #include MajorFunction.h // 原键盘驱动分发统一处理 NTSTATUS OldKeyBoardDispath(PDEVICE_OBJECT DeviceObject, PIRP pIrp) { NTSTATUS Status = STATUS_UNSUCCESSFUL; PIO_STACK_LOCATION irpStack = NULL; irpStack = IoGetCurrentIrpStackLocation(pIrp); Status = OldMajorFunction[irpStack-MajorFunction](DeviceObject, pIrp); DbgPrint(IRP_MJ_FUNCTIOIN complete successful!\n); return Status; } // HOOK 函数， 替换键盘原来的 MajorFunction NTSTATUS MajorFunctionHook(PDRIVER_OBJECT DriverObject) { NTSTATUS Status = STATUS_UNSUCCESSFUL; PDRIVER_OBJECT KeyBoardDriverObject = NULL; UNICODE_STRING KeyBoardDriverName; PFILE_OBJECT pFileObject = NULL; int nIndex = 0; RtlInitUnicodeString(KeyBoardDriverName, L\\Driver\\Kbdclass); Status = ObReferenceObjectByName(KeyBoardDriverName, OBJ_CASE_INSENSITIVE,\ NULL, 0, IoDriverObjectType, KernelMode, NULL, KeyBoardDriverObject); if (!NT_SUCCESS(Status)) { DbgPrint(in MajorFunctionHook Get ObReferenceObjectByName by KeyBoardDriverObject Error\n); goto Exit0; } // 保存及设置新键盘的 MajorFunction for(nIndex = 0; nIndex IRP_MJ_MAXIM