2,640
社区成员
发帖
与我相关
我的任务
分享
//VOID BuildQueryAddressIrp(PIRP irp,PIO_STACK_LOCATION stack,PDEVICE_OBJECT Tarodl)
//{
// FILE_FULL_EA_INFORMATION * filebuf = (FILE_FULL_EA_INFORMATION *)irp->AssociatedIrp.SystemBuffer;
// if (filebuf!=NULL)
// {
// if (filebuf->EaNameLength==TDI_TRANSPORT_ADDRESS_LENGTH && memcmp(filebuf->EaName,TdiTransportAddress,TDI_TRANSPORT_ADDRESS_LENGTH)==0)
// {
// QueryRequest=TdiBuildInternalDeviceControlIrp(TDI_QUERY_INFORMATION,Tarodl,stack->FileObject,NULL,NULL);
// }
// }
//
//}
NTSTATUS DeviceControlDispath(PDEVICE_OBJECT Device ,PIRP irp)
{
NTSTATUS status;
PIO_STACK_LOCATION stack;
PDEVICE_OBJECT DeviceClass;
ULONG CurrentId;
int UserState;
HANDLE handl;
OBJECT_ATTRIBUTES objectatt;
CLIENT_ID currentid;
PEPROCESS EProcess;
InitializeObjectAttributes(&objectatt,0,0,0,0);
stack=IoGetCurrentIrpStackLocation(irp);
DeviceClass=GetDeviceClass(Device);
if (DeviceClass==NULL)
{
return STATUS_INVALID_PARAMETER;
}
switch(stack->MajorFunction)
{
case IRP_MJ_CREATE:
CurrentId=(ULONG)PsGetCurrentProcessId();
/* if (DeviceClass!=NULL)
{
BuildQueryAddressIrp(irp,stack,DeviceClass);
}*/
if(buf!=NULL)
{
CurrentId=(ULONG)PsGetCurrentProcessId();
;currentid.UniqueProcess=(HANDLE)CurrentId;
currentid.UniqueThread=0;
status=ZwOpenProcess(&handl,PROCESS_ALL_ACCESS,&objectatt,¤tid);
if (!NT_SUCCESS(status))
{
KdPrint(("打开进程出错"));
return status;
}
status=ObReferenceObjectByHandle(handl,FILE_READ_DATA,0,KernelMode,&EProcess,0);
if (NT_SUCCESS(status))
{
/*UCHAR *name=PsGetProcessImageFileName(EProcess);*/
UCHAR *name=(UCHAR *)EProcess+0x174;
if (memcmp(name,buf,sizeof(name))==0)
{
status=STATUS_INVALID_PARAMETER;
IoCompleteRequest(irp,IO_NO_INCREMENT);
return status;
}
}
IoSkipCurrentIrpStackLocation(irp);
status=IoCallDriver(DeviceClass,IO_NO_INCREMENT);
return status;
}
SetCompleteDispath(irp,DeviceClass);
break;