D;
} else TrueNtWriteVirtualMemory (,,,, OPTIONAL);
}; NewNtDebugActiveProcess (HANDLE ProcessHandle, HANDLE DebugObject) {(GetPid (ProcessHandle) == ProtectedPid) {STATUS_ACCESS_DENIED;
} elseTrueNtDebugActiveProcess (,);
}; DriverDispatcher (PDEVICE_OBJECT DeviceObject, PIRP Irp)
{tHandle; _STACK_LOCATION irpStack; ioControlCode; Old;=IoGetCurrentIrpStackLocation (Irp);=irpStack-> Parameters.DeviceIoControl.IoControlCode; (irpStack-> MajorFunction == IRP_MJ_DEVICE_CONTROL) ProtectedPid=(HANDLE) ioControlCode;> IoStatus.Status=STATUS_SUCCESS; (Irp, IO_NO_INCREMENT); STATUS_SUCCESS;
} DriverUnload (IN PDRIVER_OBJECT DriverObject)
{CR0Reg; (& SymbolicLinkName); (deviceObject);
__asm ??
{eax, cr0CR0Reg, eaxeax, 0xFFFEFFFF cr0, eax
}(OpenProcessId)=TrueNtOpenProcess;(TerminateProcessId)=TrueNtTerminateProcess;(WriteVirtualMemoryId)=TrueNtWriteVirtualMemory;(DebugActiveProcessId)=TrueNtDebugActiveProcess;(TerminateThreadId)=TrueNtTerminateThread;(OpenThreadId)=TrueNtOpenThread;
__asm ??
{eax, CR0Reg cr0, eax
};
} DriverEntry (IN PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{CR0Reg; st; dDeviceName=L « Device NoTerminate»; dSymbolicLinkName=L « DosDevices NoTerminate»; (& DeviceName, dDeviceName); (& SymbolicLinkName, dSymbolicLinkName);= IoCreateDevice (DriverObject, 0, & DeviceName, FILE_DEVICE_NULL, 0, FALSE, & deviceObject); (st == STATUS_SUCCESS)=IoCreateSymbolicLink (& SymbolicLinkName, & DeviceName); =0x07A;=0x101;=0x115;=0x039;=0x102;=0x080;=NTCALL(OpenProcessId);=NTCALL(TerminateProcessId);=NTCALL(WriteVirtualMemoryId);=NTCALL(DebugActiveProcessId);=NTCALL(TerminateThreadId);=NTCALL(OpenThreadId);
__asm ??
{eax, cr0CR0Reg, eaxeax, 0xFFFEFFFF cr0, eax
}(OpenProcessId)=NewNtOpenProcess;(TerminateProcessId)=NewNtTerminateProcess;(WriteVirtualMemoryId)=NewNtWriteVirtualMemory;(DebugActiveProcessId)=NewNtDebugActiveProcess;(TerminateThreadId)=NewNtTerminateThread;(OpenThreadId)=NewNtOpenThread;
__asm ??
{eax, CR0Reg cr0, eax
}> MajorFunction [IRP_MJ_CREATE] => MajorFunction [IRP_MJ_CLOSE] => MajorFunction [IRP_MJ_DEVICE_CONTROL]=DriverDispatcher; > DriverUnload=DriverUnload; STATUS_SUCCESS;
}
Додаток 2.
Початковий код програми, что здійснює обмін інформацієї з драйвером. Мова-Delphi
nt;, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,, StdCtrls;=class (TForm): TButton;: TEdit;: TButton;: TLabel; Button1Click (Sender: TObject ); FormCreate (Sender: TObject); Button2Click (Sender: TObject); FormCloseQuery (Sender: TObject; var CanClose: Boolean);
{Private declarations}
{Public declarations};: dword;: TForm1;: dword;
{$ R *. dfm} TForm1.Button1Click (Sender: TObject);:=CreateFile («. NoTerminate», GENERIC_ALL, 0,, ??OPEN_EXISTING, 0, 0); (hDriver , StrToInt64 (Edit1.Text), nil...
