我写的过TP保护的驱动在虚拟机下运行完全正常,为什么拿到物理机上面直接CPU占用率100%?
什么情况?
------解决方案--------------------
那没法,驱动编起来就这点不方便
双机调试
------解决方案--------------------
------解决方案--------------------
------解决方案--------------------
#include "DDK_ShenMing.h"
///////------------函数声明区域-------------------
int InitialDDK(PDRIVER_OBJECT pDriverObject);
int DDK_Unload(PDRIVER_OBJECT p);
NTSTATUS DispatchRoutine(PDEVICE_OBJECT pDevObj,PIRP pIrp);
void Hook();
void Unhook();
//声明函数指针
typedef NTSTATUS (_stdcall *NTTERNIMATEPROCESS)(HANDLE ProcessHandle,NTSTATUS ExitStatus); //定义一个函数指针
NTTERNIMATEPROCESS ImitateNTerminateProcess;//定义一个函数
extern PServiceDescriptorTable KeServiceDescriptorTable; //导出 KeServiceDescriptorTable
NTSTATUS MyNtTerminateProcess(HANDLE ProcessHandle,NTSTATUS ExitStatus);//自己的假冒函数
///////-------------函数声明结束-------------------
#pragma code_seg("INIT")
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING B)
{
KdPrint(("-----进入了驱动主函数。------\n"));
InitialDDK(pDriverObject);
Hook();
pDriverObject->DriverUnload=DDK_Unload;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=DispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_CREATE]=DispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_CLOSE]=DispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_READ]=DispatchRoutine;
return STATUS_SUCCESS;
}
#pragma code_seg("PAGE")
int InitialDDK(PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
UNICODE_STRING DevName,SysName;
RtlInitUnicodeString(&DevName,L"\\Device\\MyDevice");
RtlInitUnicodeString(&SysName,L"\\??\\1111");
status=IoCreateDevice(pDriverObject,0,&DevName,FILE_DEVICE_UNKNOWN,0,TRUE,&pDevObj);
if( status<0) //如果创建设备失败
{
Initial_Status=CREATE_FAILD;
return 0;
}
pDevObj->Flags |=DO_BUFFERED_IO;
status=IoCreateSymbolicLink(&SysName,&DevName);
if(status<0)
{
IoDeleteDevice(pDevObj);
Initial_Status=CREATE_FAILD;
return 0;
}
Initial_Status=CREATE_SUCCESS;
return 1;
}
#pragma code_seg("PAGE")
int DDK_Unload(PDRIVER_OBJECT p)
{
KdPrint(("-----驱动被卸载了------\n"));
if(Initial_Status==CREATE_SUCCESS)
{
PDEVICE_OBJECT pDevObj;
UNICODE_STRING SysName;
RtlInitUnicodeString(&SysName,L"\\??\\1111");
pDevObj=p->DeviceObject;
IoDeleteDevice(pDevObj);
IoDeleteSymbolicLink(&SysName);
if(IS_HOOH==HOOK_SUCCESS)
Unhook();
}
return 1;
}
#pragma code_seg("PAGE")
NTSTATUS DispatchRoutine(PDEVICE_OBJECT pDevObj,PIRP pIrp)
{
ULONG mf,CTL_code;
PIO_STACK_LOCATION stack=IoGetCurrentIrpStackLocation(pIrp);
mf=stack->MajorFunction;
CTL_code=stack->Parameters.DeviceIoControl.IoControlCode;
switch(mf)
{
case IRP_MJ_DEVICE_CONTROL: