#include <iostream> #include <Windows.h> #include <vector>
#pragma comment(lib,"user32.lib") #pragma comment(lib,"advapi32.lib")
#define IOCTL_IO_R3StructAll 0x806
class cDrvCtrl { public: cDrvCtrl() { m_pSysPath = NULL; m_pServiceName = NULL; m_pDisplayName = NULL; m_hSCManager = NULL; m_hService = NULL; m_hDriver = INVALID_HANDLE_VALUE; } ~cDrvCtrl() { CloseServiceHandle(m_hService); CloseServiceHandle(m_hSCManager); CloseHandle(m_hDriver); }
BOOL Install(PCHAR pSysPath, PCHAR pServiceName, PCHAR pDisplayName) { m_pSysPath = pSysPath; m_pServiceName = pServiceName; m_pDisplayName = pDisplayName; m_hSCManager = OpenSCManagerA(NULL, NULL, SC_MANAGER_ALL_ACCESS); if (NULL == m_hSCManager) { m_dwLastError = GetLastError(); return FALSE; } m_hService = CreateServiceA(m_hSCManager, m_pServiceName, m_pDisplayName, SERVICE_ALL_ACCESS, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL, m_pSysPath, NULL, NULL, NULL, NULL, NULL); if (NULL == m_hService) { m_dwLastError = GetLastError(); if (ERROR_SERVICE_EXISTS == m_dwLastError) { m_hService = OpenServiceA(m_hSCManager, m_pServiceName, SERVICE_ALL_ACCESS); if (NULL == m_hService) { CloseServiceHandle(m_hSCManager); return FALSE; } } else { CloseServiceHandle(m_hSCManager); return FALSE; } } return TRUE; }
BOOL Start() { if (!StartServiceA(m_hService, NULL, NULL)) { m_dwLastError = GetLastError(); return FALSE; } return TRUE; }
BOOL Stop() { SERVICE_STATUS ss; GetSvcHandle(m_pServiceName); if (!ControlService(m_hService, SERVICE_CONTROL_STOP, &ss)) { m_dwLastError = GetLastError(); return FALSE; } return TRUE; }
BOOL Remove() { GetSvcHandle(m_pServiceName); if (!DeleteService(m_hService)) { m_dwLastError = GetLastError(); return FALSE; } return TRUE; }
BOOL Open(PCHAR pLinkName) { if (m_hDriver != INVALID_HANDLE_VALUE) return TRUE; m_hDriver = CreateFileA(pLinkName, GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); if (m_hDriver != INVALID_HANDLE_VALUE) return TRUE; else return FALSE; }
BOOL IoControl(DWORD dwIoCode, PVOID InBuff, DWORD InBuffLen, PVOID OutBuff, DWORD OutBuffLen, DWORD *RealRetBytes) { DWORD dw; BOOL b = DeviceIoControl(m_hDriver, CTL_CODE_GEN(dwIoCode), InBuff, InBuffLen, OutBuff, OutBuffLen, &dw, NULL); if (RealRetBytes) *RealRetBytes = dw; return b; } private:
BOOL GetSvcHandle(PCHAR pServiceName) { m_pServiceName = pServiceName; m_hSCManager = OpenSCManagerA(NULL, NULL, SC_MANAGER_ALL_ACCESS); if (NULL == m_hSCManager) { m_dwLastError = GetLastError(); return FALSE; } m_hService = OpenServiceA(m_hSCManager, m_pServiceName, SERVICE_ALL_ACCESS); if (NULL == m_hService) { CloseServiceHandle(m_hSCManager); return FALSE; } else { return TRUE; } }
DWORD CTL_CODE_GEN(DWORD lngFunction) { return (FILE_DEVICE_UNKNOWN * 65536) | (FILE_ANY_ACCESS * 16384) | (lngFunction * 4) | METHOD_BUFFERED; }
public: DWORD m_dwLastError; PCHAR m_pSysPath; PCHAR m_pServiceName; PCHAR m_pDisplayName; HANDLE m_hDriver; SC_HANDLE m_hSCManager; SC_HANDLE m_hService; };
void GetAppPath(char *szCurFile) { GetModuleFileNameA(0, szCurFile, MAX_PATH); for (SIZE_T i = strlen(szCurFile) - 1; i >= 0; i--) { if (szCurFile[i] == '\\') { szCurFile[i + 1] = '\0'; break; } } }
typedef struct { DWORD PID; DWORD PPID; }PROCESS_INFO, *PPROCESS_INFO;
typedef struct { ULONG_PTR nSize; PVOID BufferPtr; }BufferPointer, *pBufferPointer;
int main(int argc, char *argv[]) { cDrvCtrl DriveControl;
char szSysFile[MAX_PATH] = { 0 }; char szSvcLnkName[] = "WinDDK";; GetAppPath(szSysFile); strcat(szSysFile, "WinDDK.sys");
DriveControl.Install(szSysFile, szSvcLnkName, szSvcLnkName); DriveControl.Start();
DriveControl.Open("\\\\.\\WinDDK");
BOOL bRet = FALSE; BufferPointer pInput = { 0 }; PPROCESS_INFO pProcessInfo = NULL;
pInput.BufferPtr = (PVOID)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(PROCESS_INFO) * 1000); pInput.nSize = sizeof(PROCESS_INFO) * 1000;
ULONG nRet = 0;
if (pInput.BufferPtr) { bRet = DriveControl.IoControl(IOCTL_IO_R3StructAll, &pInput, sizeof(BufferPointer), &nRet, sizeof(ULONG), 0); }
std::cout << "[LyShark.com] 返回结构体数量: " << nRet << std::endl;
if (bRet && nRet > 0) { pProcessInfo = (PPROCESS_INFO)pInput.BufferPtr; std::vector<PROCESS_INFO> vectorProcess;
for (ULONG i = 0; i < nRet; i++) { vectorProcess.push_back(pProcessInfo[i]); }
bRet = HeapFree(GetProcessHeap(), 0, pInput.BufferPtr); std::cout << "释放状态: " << bRet << std::endl;
for (int x = 0; x < nRet; x++) { std::cout << "PID: " << vectorProcess[x].PID << " PPID: " << vectorProcess[x].PPID << std::endl; } }
CloseHandle(DriveControl.m_hDriver);
DriveControl.Stop(); DriveControl.Remove();
system("pause"); return 0; }
|