键盘过滤驱动学习

《键盘过滤驱动学习》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、http://hi.baidu.com/pushad/item/0a78c3ba0812e6afeaba9399[寒江独钓]IRPHOOK键盘过滤之替换原键盘分发函数MajorFunction.h#ifndef_MAJORFUNCTION_HEADERS_#define_MAJORFUNCTION_HEADERS_#include#defineDELAY_ONE_MILLISECOND1000000externPOBJECT_TYPE*IoDriverObjectType;externNTSTATUSObReferenceObjectByName(INPUN

2、ICODE_STRINGObjectPath,INULONGAttributes,INPACCESS_STATEPassedAccessStateOPTIONAL,INACCESS_MASKDesiredAccessOPTIONAL,INPOBJECT_TYPEObjectType,INKPROCESSOR_MODEAccessMode,INOUTPVOIDParseContextOPTIONAL,OUTPVOID*ObjectPtr);PDRIVER_DISPATCHOldMajorFunction[IRP_MJ_MAXIMUM_FUNCTION+1];#endif#inc

3、lude"MajorFunction.h"//原键盘驱动分发统一处理NTSTATUSOldKeyBoardDispath(PDEVICE_OBJECTDeviceObject,PIRPpIrp){NTSTATUSStatus=STATUS_UNSUCCESSFUL;PIO_STACK_LOCATIONirpStack=NULL;irpStack=IoGetCurrentIrpStackLocation(pIrp);Status=OldMajorFunction[irpStack->MajorFunction](DeviceObject,pIrp);DbgPrint("IRP_

4、MJ_FUNCTIOINcompletesuccessful!");returnStatus;}//HOOK函数，替换键盘原来的MajorFunctionNTSTATUSMajorFunctionHook(PDRIVER_OBJECTDriverObject){NTSTATUSStatus=STATUS_UNSUCCESSFUL;PDRIVER_OBJECTKeyBoardDriverObject=NULL;UNICODE_STRINGKeyBoardDriverName;PFILE_OBJECTpFileObject=NULL;intnIndex=0;RtlInitUn

5、icodeString(&KeyBoardDriverName,L"\Driver\Kbdclass");Status=ObReferenceObjectByName(&KeyBoardDriverName,OBJ_CASE_INSENSITIVE,NULL,0,IoDriverObjectType,KernelMode,NULL,&KeyBoardDriverObject);if(!NT_SUCCESS(Status)){DbgPrint("inMajorFunctionHookGetObReferenceObjectByNamebyKeyBoardDriverObj

6、ectError");gotoExit0;}//保存及设置新键盘的MajorFunctionfor(nIndex=0;nIndexMajorFunction[nIndex];InterlockedExchangePointer(&KeyBoardDriverObject->MajorFunction[nIndex],DriverObject->MajorFunction[nIndex]);}DbgPrint("

7、IRP_MJ_FUNCTIONHookSuccessful!");//解除引用ObDereferenceObject(KeyBoardDriverObject);Exit0:returnStatus;}//卸载函数NTSTATUSUnLoadDriver(PDRIVER_OBJECTDriverObject){NTSTATUSStatus=STATUS_UNSUCCESSFUL;intnIndex=0;PDRIVER_OBJECTKeyBoardDriverObject=NULL;UNICODE_S