易语言系统驱动服务源码

易语言系统驱动服务源码系统结构:DriverEntry,DispatchDeviceControl,DriverUnload,DispatchCreate,DispatchClose,OnLoad,GetSSDTTableAddress,OnHook,UnHook,IsProtect,New_NtUserFindWindowEx,New_NtUserGetForegroundWindow,New_NtUserQueryWindow,New_NtUserWindowFromPoint,New_NtUserBuildHwndList,New_NtUserSetWindowLong,IoGetCurrentIrpStackLocation,指针到整数_,写内存整数_,子程序指针到整数型_,UserAddress,GetFunctionAddress,GetWindowsVersion,VAR_OSVERSIONINFOEX,RtlGetVersion,MmCreateMDL,MmMapMDL,MmUnMapMDL,GetShadowFunction,SetShadowFunction,GetShadowBase,GetShadowCount,pNtUserFindWindowEx,pNtUserGetForegroundWindow,pNtUserQueryWindow,pNtUserWindowFromPoint,pNtUserBuildHwndList,pNtUserSetWindowLong,DbgPrint,DbgPrintInt,IoCreateDevice,IoCreateSymbolicLink,RtlAnsiStringToUnicodeString,RtlInitAnsiString,RtlFreeUnicodeString,IoIsWdmVersionAvailable,IoDeleteDevice,IoDeleteSymbolicLink,IoCompleteRequest,PsLookupProcessByProcessId,KeStackAttachProcess,ZwOpenProcess,ZwCreateJobObject,ZwAssignProcessToJobObject,ZwTerminateJobObject,KeUnstackDetachProcess,ZwAllocateVirtualMemory,ZwClose,MmUnsecureVirtualMemory,ZwQueryVirtualMemory,InterlockedExchange,MmGetSystemRoutineAddress,ZwQuerySystemInformation,memcpy,PsGetVersion,MmCreateMdl,MmBuildMdlForNonPagedPool,MmMapLockedPages,MmUnmapLockedPages,IoFreeMdl,MmIsAddressValid,PsGetCurrentProcessId, ======DriverMain || ||------_启动子程序 || ||------DriverEntry || ||------DispatchDeviceControl || ||------DriverUnload || ||------DispatchCreate || ||------DispatchClose || ||------OnLoad || ||------GetSSDTTableAddress || ||------OnHook || ||------UnHook || ||------IsProtect || ||------New_NtUserFindWindowEx || ||------New_NtUserGetForegroundWindow || ||------New_NtUserQueryWindow || ||------New_NtUserWindowFromPoint || ||------New_NtUserBuildHwndList || ||------New_NtUserSetWindowLong || || ======DriverHelper || ||------IoGetCurrentIrpStackLocation || ||------指针到整数_ || ||------写内存整数_ || ||------子程序指针到整数型_ || ||------UserAddress || ||------GetFunctionAddress || ||------GetWindowsVersion || ||------VAR_OSVERSIONINFOEX || ||------RtlGetVersion || ||------MmCreateMDL || ||------MmMapMDL || ||------MmUnMapMDL || ||------GetShadowFunction || ||------SetShadowFunction || ||------GetShadowBase || ||------GetShadowCount || || ======DriverFunDef || ||------pNtUserFindWindowEx || ||------pNtUserGetForegroundWindow || ||------pNtUserQueryWindow || ||------pNtUserWindowFromPoint || ||------pNtUserBuildHwndList || ||------pNtUserSetWindowLong || || ======调用的Dll || ||---[dll]------DbgPrint || ||---[dll]------DbgPrintInt || ||---[dll]------_Write_Int || ||---[dll]------_Read_Int || ||---[dll]------_Read_Allocate || ||---[dll]------_Write_DRIVER_OBJECT || ||---[dll]------_Read_DRIVER_OBJECT || ||---[dll]------_Write_IRP || ||---[dll]------_Read_IRP || ||---[dll]------IoCreateDevice || ||---[dll]------IoCreateSymbolicLink || ||---[dll]------RtlAnsiStringToUnicodeString || ||---[dll]------RtlInitAnsiString || ||---[dll]------RtlFreeUnicodeString || ||---[dll]------IoIsWdmVersionAvailable || ||---[dll]------IoDeleteDevice || ||---[dll]------IoDeleteSymbolicLink || ||---[dll]------IoCompleteRequest || ||---[dll]------PsLookupProcessByProcessId || ||---[dll]------KeStackAttachProcess || ||---[dll]------ZwOpenProcess || ||---[dll]------ZwCreateJobObject || ||---[dll]------ZwAssignProcessToJobObject || ||---[dll]------ZwTerminateJobObject || ||---[dll]------KeUnstackDetachProcess || ||---[dll]------ZwAllocateVirtualMemory || ||---[dll]------ZwClose || ||---[dll]------MmUnsecureVirtualMemory || ||---[dll]------ZwQueryVirtualMemory || ||---[dll]------InterlockedExchange || ||---[dll]------MmGetSystemRoutineAddress || ||---[dll]------ZwQuerySystemInformation || ||---[dll]------memcpy || ||---[dll]------_Read_Input || ||---[dll]------_Write_Output || ||---[dll]------_Read_IO_STACK_LOCATION || ||---[dll]------PsGetVersion || ||---[dll]------MmCreateMdl || ||---[dll]------MmBuildMdlForNonPagedPool || ||---[dll]------MmMapLockedPages || ||---[dll]------MmUnmapLockedPages || ||---[dll]------IoFreeMdl || ||---[dll]------MmIsAddressValid || ||---[dll]------PsGetCurrentProcessId 调用的DLL命令: .DLL命令DbgPrint,,"ntoskrnl.lib","@_DbgPrint" .参数Buffer,文本型 .DLL命令DbgPrintInt,,"ntoskrnl.lib","@_DbgPrint" .参数Format,文本型 .参数Value,整数型 .DLL命令_Write_Int,,"ntoskrnl.lib","@_memcpy" .参数目的地址,整数型 .参数源变量,整数型,传址 .参数大小,整数型 .DLL命令_Read_Int,,"ntoskrnl.lib","@_memcpy" .参数目的变量,整数型,传址 .参数源地址,整数型 .参数大小,整数型 .DLL命令_Read_Allocate,,"ntoskrnl.lib","_Read_Int" .参数目的变量,ALLOCATE_,传址 .参数源地址,整数型 .参数大小,整数型 .DLL命令_Write_DRIVER_OBJECT,,"ntoskrnl.lib","@_memcpy" .参数目的地址,整数型 .参数源变量,DRIVER_OBJECT,传址 .参数大小,整数型 .DLL命令_Read_DRIVER_OBJECT,,"ntoskrnl.lib","@_memcpy" .参数目的变量,DRIVER_OBJECT,传址 .参数源地址,整数型 .参数大小,整数型 .DLL命令_Write_IRP,,"ntoskrnl.lib","@_memcpy" .参数目的地址,整数型 .参数源变量,IRP,传址 .参数大小,整数型 .DLL命令_Read_IRP,,"ntoskrnl.lib","@_memcpy" .参数目的变量,IRP,传址 .参数源地址,整数型 .参数大小,整数型 .DLL命令IoCreateDevice,整数型,"ntoskrnl.lib","_IoCreateDevice@28",,. .参数DriverObject,整数型 .参数DeviceExtensionSize,整数型 .参数DeviceName,UNICODE_STRING,传址 .参数DeviceType,整数型 .参数DeviceCharacteristics,整数型 .参数Exclusive,逻辑型 .参数DeviceObject,整数型,传址 .DLL命令IoCreateSymbolicLink,整数型,"ntoskrnl.lib","_IoCreateSymbolicLink@8" .参数SymbolicLinkName,UNICODE_STRING,传址 .参数DeviceName,UNICODE_STRING,传址 .DLL命令RtlAnsiStringToUnicodeString,整数型,"ntoskrnl.lib","_RtlAnsiStringToUnicodeString@12" .参数DestinationString,UNICODE_STRING,传址 .参数SourceString,ANSI_STRING,传址 .参数AllocateDestinationString,逻辑型 .DLL命令RtlInitAnsiString,,"ntoskrnl.lib","_RtlInitAnsiString@8" .参数DestinationString,ANSI_STRING,传址 .参数SourceString,文本型,传址 .DLL命令RtlFreeUnicodeString,,"ntoskrnl.lib","_RtlFreeUnicodeString@4" .参数UnicodeString,UNICODE_STRING,传址 .DLL命令IoIsWdmVersionAvailable,逻辑型,"ntoskrnl.lib","_IoIsWdmVersionAvailable@8" .参数MajorVersion,字节型 .参数MinorVersion,字节型 .DLL命令IoDeleteDevice,,"ntoskrnl.lib","_IoDeleteDevice@4" .参数DeviceObject,整数型 .DLL命令IoDeleteSymbolicLink,,"ntoskrnl.lib","_IoDeleteSymbolicLink@4" .参数SymbolicLinkName,UNICODE_STRING,传址 .DLL命令IoCompleteRequest,,"ntoskrnl.lib","_IoCompleteRequest@8" .参数Irp,整数型 .参数PriorityBoost,整数型 .DLL命令PsLookupProcessByProcessId,整数型,"ntoskrnl.lib","_PsLookupProcessByProcessId@8" .参数ProcessID,整数型 .参数EProcess,整数型,传址 .DLL命令KeStackAttachProcess,,"ntoskrnl.lib","_KeStackAttachProcess@8" .参数EProcess,整数型 .参数ApcState,APC_STATE,传址 .DLL命令ZwOpenProcess,整数型,"ntoskrnl.lib","_ZwOpenProcess@16" .参数hProcess,整数型,传址 .参数DesiredAccess,整数型 .参数ObjectAttributes,OBJECT_ATTRIBUTES .参数ClientId,CLIENT_ID .DLL命令ZwCreateJobObject,整数型,"ntoskrnl.lib","_ZwCreateJobObject@12" .参数JobHandle,整数型,传址,4 .参数DesiredAccess,整数型,,4 .参数ObjectAttributes,OBJECT_ATTRIBUTES,,4 .DLL命令ZwAssignProcessToJobObject,整数型,"ntoskrnl.lib","_ZwAssignProcessToJobObject@8" .参数JobHandle,整数型 .参数ProcessHandle,整数型 .DLL命令ZwTerminateJobObject,整数型,"ntoskrnl.lib","_ZwTerminateJobObject@8" .参数JobHandle,整数型 .参数ExitStatus,整数型 .DLL命令KeUnstackDetachProcess,,"ntoskrnl.lib","_KeUnstackDetachProcess@4" .参数ApcState,APC_STATE .DLL命令ZwAllocateVirtualMemory,整数型,"ntoskrnl.lib","_ZwAllocateVirtualMemory@24" .参数ProcessHandle,整数型 .参数BaseAddress,整数型 .参数ZeroBits,整数型 .参数RegionSize,整数型 .参数AllocationType,整数型 .参数Protect,整数型 .DLL命令ZwClose,整数型,"ntoskrnl.lib","_ZwClose@4" .参数ObjectHandle,整数型 .DLL命令MmUnsecureVirtualMemory,整数型,"ntoskrnl.lib","_MmUnsecureVirtualMemory@4" .参数Address,整数型 .参数Size,整数型 .参数ProbeMode,整数型 .DLL命令ZwQueryVirtualMemory,整数型,"ntoskrnl.lib","_ZwQueryVirtualMemory@24" .参数ProcessHandle,整数型 .参数BaseAddress,整数型 .参数MemoryInformationClass,MEMORY_INFORMATION_CLASS .参数MemoryInformation,整数型 .参数MemoryInformationLength,整数型 .参数ReturnLength,整数型,传址 .DLL命令InterlockedExchange,整数型,"ntoskrnl.lib","_@InterlockedExchange@8" .参数volatile,长整数型,传址 .参数Value,长整数型,,Value .DLL命令MmGetSystemRoutineAddress,整数型,"ntoskrnl.lib","_MmGetSystemRoutineAddress@4" .参数SystemRoutineName,UNICODE_STRING .DLL命令ZwQuerySystemInformation,整数型,"ntoskrnl.lib","_ZwQuerySystemInformation@16" .参数CLASS,整数型 .参数INFORMATION,整数型 .参数INFORMATIONLENGTH,整数型 .参数RET,整数型,传址 .DLL命令memcpy,,"ntoskrnl.lib","@_memcpy" .参数目的变量,整数型 .参数源地址,整数型 .参数大小,整数型 .DLL命令_Read_Input,,"ntoskrnl.lib","@_memcpy" .参数目的变量,Protect,传址 .参数源地址,整数型 .参数大小,整数型 .DLL命令_Write_Output,,"ntoskrnl.lib","@_memcpy" .参数目的变量,整数型 .参数源地址,Protect,传址 .参数大小,整数型 .DLL命令_Read_IO_STACK_LOCATION,,"ntoskrnl.lib","@_memcpy" .参数dest,IO_STACK_LOCATION .参数src,整数型 .参数length,整数型 .DLL命令PsGetVersion,整数型,"ntoskrnl.lib","_PsGetVersion@16" .参数MajorVersion,整数型,传址 .参数MinorVersion,整数型,传址 .参数BuildNumber,整数型,传址 .参数CSDVersion,UNICODE_STRING,传址 .DLL命令MmCreateMdl,整数型,"ntoskrnl.lib","_MmCreateMdl@12" .参数MemoryDescriptorList,整数型 .参数Base,整数型 .参数Size,整数型 .DLL命令MmBuildMdlForNonPagedPool,整数型,"ntoskrnl.lib","_MmBuildMdlForNonPagedPool@4" .参数MemoryDescriptorList,整数型 .DLL命令MmMapLockedPages,整数型,"ntoskrnl.lib","_MmMapLockedPages@8",,返回Mapped .参数MemoryDescriptorList,整数型 .参数AccessMode,整数型 .DLL命令MmUnmapLockedPages,整数型,"ntoskrnl.lib","_MmUnmapLockedPages@8" .参数Mapped,整数型 .参数MemoryDescriptorList,整数型 .DLL命令IoFreeMdl,整数型,"ntoskrnl.lib","_IoFreeMdl@4" .参数MemoryDescriptorList,整数型 .DLL命令MmIsAddressValid,整数型,"ntoskrnl.lib","_MmIsAddressValid@4" .参数Address,整数型 .DLL命令PsGetCurrentProcessId,整数型,"ntoskrnl.lib","_PsGetCurrentProcessId@0"