用Visual studio2012在Windows8上开发内核驱动监视进程创建

 

在Windows NT中，80386保护模式的“保护”比Windows 95中更坚固，这个“镀金的笼子”更加结实，更加难以打破。在Windows 95中，至少应用程序I/O操作是不受限制的，而在Windows NT中，我们的应用程序连这点权限都被剥夺了。在NT中几乎不太可能进入真正的ring0层。 
在Windows NT中，存在三种Device Driver：

  1．“Virtual device Driver” (VDD)。通过VDD，16位应用程序，如DOS 和Win16应用程序可以访问特定的I/O端口（注意，不是直接访问，而是要通过VDD来实现访问）。

  2．“GDI Driver”，提供显示和打印所需的GDI函数。

  3．“Kernel Mode Driver”，实现对特定硬件的操作，比如说CreateFile, CloseHandle (对于文件对象而言), ReadFile, WriteFile, DeviceIoControl 等操作。“Kernel Mode Driver”还是Windows NT中唯一可以对硬件中断和DMA进行操作的Driver。SCSI 小端口驱动和 网卡NDIS 驱动都是Kernel Mode Driver的一种特殊形式。

 

 

Visual studio2012与Windows8带来格外不同的新体验

 

1.启动Vs2012

2.看见满目的驱动开发模板

3.选择一个驱动模式，有内核模式与用户模式两种的驱动

 

4.创建一个驱动程序，KMDF DriverMVP

 

5.我们选择的是内核模式的驱动程序，下面是创建成功后的界面，分别是驱动程序本身，与驱动安装包

6.按下F5，选择驱动编译，

 

 

插入下列代码实现内核的进程创建

 

#include "ProcMon.h"
#include "../inc/ioctls.h"

//
//////////////////////////////////////////////////////////////////////////

//////////////////////////////////////////////////////////////////////////
//
// 全局变量
//

PDEVICE_OBJECT  g_pDeviceObject;

//
//////////////////////////////////////////////////////////////////////////

//////////////////////////////////////////////////////////////////////////
//
// 函数实现
//

NTSTATUS
DriverEntry(
    IN PDRIVER_OBJECT       DriverObject,
    IN PUNICODE_STRING      RegistryPath
)
{
    NTSTATUS            Status = STATUS_SUCCESS;
    UNICODE_STRING      ntDeviceName;
    UNICODE_STRING      dosDeviceName;
    UNICODE_STRING      ProcessEventString;
    PDEVICE_EXTENSION   deviceExtension;
    PDEVICE_OBJECT      deviceObject = NULL;

    KdPrint(("[ProcMon] DriverEntry: %wZ\n", RegistryPath));

    //
    // 创建设备对象
    //
    RtlInitUnicodeString(&ntDeviceName, PROCMON_DEVICE_NAME_W);

    Status = IoCreateDevice(
                        DriverObject,
                        sizeof(DEVICE_EXTENSION),       // DeviceExtensionSize
                        &ntDeviceName,                  // DeviceName
                        FILE_DEVICE_PROCMON,            // DeviceType
                        0,                              // DeviceCharacteristics
                        TRUE,                           // Exclusive
                        &deviceObject                   // [OUT]
                        );

    if(!NT_SUCCESS(Status))
    {
        KdPrint(("[ProcMon] IoCreateDevice Error Code = 0x%X\n", Status));

        return Status;
    }

    //
    // 设置扩展结构
    //
    deviceExtension = (PDEVICE_EXTENSION)deviceObject->DeviceExtension;

    //
    // Set up synchronization objects, state info,, etc.
    //
    deviceObject->Flags |= DO_BUFFERED_IO;

    //
    // 创建符号链接
    //
    RtlInitUnicodeString(&dosDeviceName, PROCMON_DOS_DEVICE_NAME_W);

    Status = IoCreateSymbolicLink(&dosDeviceName, &ntDeviceName);

    if(!NT_SUCCESS(Status))
    {
        KdPrint(("[ProcMon] IoCreateSymbolicLink Error Code = 0x%X\n", Status));

        IoDeleteDevice(deviceObject);

        return Status;
    }

    //
    // 分发IRP
    //
    DriverObject->MajorFunction[IRP_MJ_CREATE]           = ProcmonDispatchCreate;
    DriverObject->MajorFunction[IRP_MJ_CLOSE]            = ProcmonDispatchClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]   = ProcmonDispatchDeviceControl;
    DriverObject->DriverUnload                           = ProcmonUnload;

    //
    // 保存设备对象指针
    //
    g_pDeviceObject = deviceObject;

    //
    // 创建事件对象与应用层通信
    //
    RtlInitUnicodeString(&ProcessEventString, EVENT_NAME);

    deviceExtension->ProcessEvent = IoCreateNotificationEvent(&ProcessEventString, &deviceExtension->hProcessHandle);
    KeClearEvent(deviceExtension->ProcessEvent);         // 非受信状态

    //
    // 设置回调例程
    //
    Status = PsSetCreateProcessNotifyRoutine(ProcessCallback, FALSE);

    return Status;
}

NTSTATUS
ProcmonDispatchCreate(
    IN PDEVICE_OBJECT       DeviceObject,
    IN PIRP                 Irp
)
{
    NTSTATUS Status = STATUS_SUCCESS;

    Irp->IoStatus.Information = 0;

    KdPrint(("[ProcMon] IRP_MJ_CREATE\n"));

    Irp->IoStatus.Status = Status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);

    return Status;
}

NTSTATUS
ProcmonDispatchClose(
    IN PDEVICE_OBJECT       DeviceObject,
    IN PIRP                 Irp
)
{
    NTSTATUS Status = STATUS_SUCCESS;

    Irp->IoStatus.Information = 0;

    KdPrint(("[ProcMon] IRP_MJ_CLOSE\n"));

    Irp->IoStatus.Status = Status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);

    return Status;
}

NTSTATUS
ProcmonDispatchDeviceControl(
    IN PDEVICE_OBJECT       DeviceObject,
    IN PIRP                 Irp
)
{
    NTSTATUS            Status = STATUS_SUCCESS;
    PIO_STACK_LOCATION  irpStack;
    PDEVICE_EXTENSION   deviceExtension;
    ULONG               inBufLength, outBufLength;
    ULONG               ioControlCode;
    PCALLBACK_INFO      pCallbackInfo;

    // 获取当前设备栈
    irpStack = IoGetCurrentIrpStackLocation(Irp);
    deviceExtension = (PDEVICE_EXTENSION)DeviceObject->DeviceExtension;

    // 提取信息
    pCallbackInfo = Irp->AssociatedIrp.SystemBuffer;
    inBufLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;
    outBufLength = irpStack->Parameters.DeviceIoControl.OutputBufferLength;
    ioControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;

    // 处理不同的IOCTL
    switch (ioControlCode)
    {
    case IOCTL_PROC_MON:
        {
            KdPrint(("[ProcMon] IOCTL: 0x%X", ioControlCode));

            if (outBufLength >= sizeof(PCALLBACK_INFO))
            {
                pCallbackInfo->hParentId = deviceExtension->hParentId;
                pCallbackInfo->hProcessId = deviceExtension->hProcessId;
                pCallbackInfo->bCreate = deviceExtension->bCreate;

                Irp->IoStatus.Information = outBufLength;
            }
            break;
        }

    default:
        {
            Status = STATUS_INVALID_PARAMETER;
            Irp->IoStatus.Information = 0;

            KdPrint(("[ProcMon] Unknown IOCTL: 0x%X (%04X,%04X)", \
                    ioControlCode, DEVICE_TYPE_FROM_CTL_CODE(ioControlCode), \
                    IoGetFunctionCodeFromCtlCode(ioControlCode)));

            break;
        }
    }

    Irp->IoStatus.Status = Status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);

    return Status;
}

VOID
ProcmonUnload(
    IN PDRIVER_OBJECT       DriverObject
)
{
    UNICODE_STRING dosDeviceName;

    //
    // Free any resources
    //

    // 卸载回调例程
    PsSetCreateProcessNotifyRoutine(ProcessCallback, TRUE);

    //
    // Delete the symbolic link
    //

    RtlInitUnicodeString(&dosDeviceName, PROCMON_DOS_DEVICE_NAME_W);

    IoDeleteSymbolicLink(&dosDeviceName);

    //
    // Delete the device object
    //

    IoDeleteDevice(DriverObject->DeviceObject);

    KdPrint(("[ProcMon] Unloaded"));
}

VOID
ProcessCallback(
    IN HANDLE               ParentId,           // 父进程ID
    IN HANDLE               ProcessId,          // 发生事件的进程ID
    IN BOOLEAN              Create              // 进程是创建还是终止
)
{
    PDEVICE_EXTENSION deviceExtension = (PDEVICE_EXTENSION)g_pDeviceObject->DeviceExtension;

    deviceExtension->hParentId = ParentId;
    deviceExtension->hProcessId = ProcessId;
    deviceExtension->bCreate = Create;

    // 触发事件，通知应用程序
    KeSetEvent(deviceExtension->ProcessEvent, 0, FALSE);
    KeClearEvent(deviceExtension->ProcessEvent);
}

//
//////////////////////////////////////////////////////////////////////////

 

ring3实现应用层的调用，搞定进程创建的监视

 

 

#include "windows.h"
#include "winioctl.h"
#include "stdio.h"
#include "../inc/ioctls.h"

#define SYMBOL_LINK "\\\\.\\ProcMon"
//#define SYMBOL_LINK "\\\\.\\slNTProcDrv"

int main()
{
    CALLBACK_INFO cbkinfo, cbktemp = {0};

    // 打开驱动设备对象
    HANDLE hDriver = ::CreateFile(
                            SYMBOL_LINK,
                            GENERIC_READ | GENERIC_WRITE,
                            0,
                            NULL,
                            OPEN_EXISTING,
                            FILE_ATTRIBUTE_NORMAL,
                            NULL);
    if (hDriver == INVALID_HANDLE_VALUE)
    {
        printf("打开驱动设备对象失败！\n");

        return -1;
    }

    // 打开内核事件对象
    HANDLE hProcessEvent = ::OpenEventW(SYNCHRONIZE, FALSE, EVENT_NAME);

    while (::WaitForSingleObject(hProcessEvent, INFINITE))
    {
        DWORD   dwRet;
        BOOL    bRet;

        bRet = ::DeviceIoControl(
                            hDriver,
                            IOCTL_PROC_MON,
                            NULL,
                            0,
                            &cbkinfo,
                            sizeof(cbkinfo),
                            &dwRet,
                            NULL);

        if (bRet)
        {
            if (cbkinfo.hParentId != cbktemp.hParentId || \
                cbkinfo.hProcessId != cbktemp.hProcessId || \
                cbkinfo.bCreate != cbktemp.bCreate)
            {
                if (cbkinfo.bCreate)
                {
                    printf("有进程被创建，PID = %d\n", cbkinfo.hProcessId);
                }
                else
                {
                    printf("有进程被终止，PID = %d\n", cbkinfo.hProcessId);
                }

                cbktemp = cbkinfo;
            }
        }
        else
        {
            printf("\n获取进程信息失败！\n");
            break;
        }
    }

    ::CloseHandle(hDriver);

    return 0;
}