代码这样写奇丑无比...编码前期要做好规划工作啊

NTSTATUS ScDetective_DispatchDeviceControl(
    IN PDEVICE_OBJECT        DeviceObject,
    IN PIRP                    Irp
    )
{
    NTSTATUS    ntStatus = STATUS_SUCCESS;
    PVOID       InputBuffer     = NULL;
    PVOID       OutputBuffer    = NULL;
    ULONG       cbInputBuffer   = 0;
    ULONG       cbOutputBuffer  = 0;
    PIO_STACK_LOCATION irpSp    = NULL;
    
    __try {
        irpSp = IoGetCurrentIrpStackLocation(Irp);

        InputBuffer     = Irp->AssociatedIrp.SystemBuffer;
        cbInputBuffer   = irpSp->Parameters.DeviceIoControl.InputBufferLength;
        OutputBuffer    = Irp->AssociatedIrp.SystemBuffer;
        cbOutputBuffer  = irpSp->Parameters.DeviceIoControl.OutputBufferLength;

        switch(irpSp->Parameters.DeviceIoControl.IoControlCode)
        {
        case IOCTL_DUMP_KERNEL_MEMORY: 
            {
                PVOID DumpAddress;
                PMDL MdlCreate;

                if (cbInputBuffer == sizeof(ULONG)) {
                    DumpAddress = (PVOID)((PULONG)InputBuffer)[0];
                    if (!MmIsAddressValid(DumpAddress)) {
                        ntStatus = STATUS_INVALID_ADDRESS;
                        break;
                    } else {
                        ScmMapVirtualAddress(DumpAddress, cbOutputBuffer, &MdlCreate);
                        RtlCopyMemory(OutputBuffer, DumpAddress, cbOutputBuffer);
                        ScmUnmapVirtualAddress(MdlCreate);
                        Irp->IoStatus.Information = cbOutputBuffer;  break; 
                    }
                } else {
                    ntStatus = STATUS_BUFFER_TOO_SMALL;  break;
                }
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_GET_SSDT:    // 获取 ssdt
            {         
                ULONG NeedLen = 0;
                ULONG Number = GetSsdtServiceNumber();

                NeedLen = Number * sizeof(SSDT_ADDRESS);
                if (cbOutputBuffer < NeedLen) {
                    if (cbOutputBuffer == sizeof(ULONG)) {
                        ((PULONG)OutputBuffer)[0] = NeedLen;
                        Irp->IoStatus.Information = sizeof(ULONG);
                        break;
                    }
                    ntStatus = STATUS_BUFFER_TOO_SMALL;  break;
                }
                Number = GetSsdtCurrentAddresses((PSSDT_ADDRESS)OutputBuffer, &NeedLen);
                if (Number == 0)  ntStatus = STATUS_UNSUCCESSFUL;
                Irp->IoStatus.Information = Number * sizeof(SSDT_ADDRESS);
                break;
            } 
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_UNHOOK_SSDT:          // 恢复 ssdt
            {
                PSSDT_ADDRESS SsdtOrig = (PSSDT_ADDRESS)InputBuffer;

                if (cbInputBuffer < sizeof(SSDT_ADDRESS) || 
                    InputBuffer == NULL) {
                    KdPrint(("输入缓冲区或输入缓冲区长度无效"));
                    ntStatus = STATUS_UNSUCCESSFUL;
                    break;
                }
                KdPrint(("要恢复的服务号：%d 原始地址：0x%X", 
                    SsdtOrig->nIndex, SsdtOrig->FunAddress));

                if (!UnHookSsdtItem(SsdtOrig)) {
                    KdPrint(("恢复失败"));
                    ntStatus = STATUS_UNSUCCESSFUL;
                }
                break;
            } 
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_GET_SSDTSHADOW:
            {
                ULONG Number = GetShadowSsdtServiceNumber();
                ULONG NeedLen = 0;
                
                NeedLen = Number * sizeof(SSDT_ADDRESS);
                if (cbOutputBuffer < NeedLen) {
                    if (cbOutputBuffer == sizeof(ULONG)) {
                        ((PULONG)OutputBuffer)[0] = NeedLen;
                        Irp->IoStatus.Information = sizeof(ULONG);
                        break;
                    }
                    ntStatus = STATUS_BUFFER_TOO_SMALL;  break;
                }
                Number = GetShadowSsdtCurrentAddresses((PSSDT_ADDRESS)OutputBuffer, &NeedLen);

                if (Number == 0)  ntStatus = STATUS_UNSUCCESSFUL;
                Irp->IoStatus.Information = Number * sizeof(SSDT_ADDRESS);
                break;
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_UNHOOK_SSDTSHADOW:
            {
                PSSDT_ADDRESS ShadowSsdtOrig = (PSSDT_ADDRESS)InputBuffer;

                if (cbInputBuffer < sizeof(SSDT_ADDRESS) || 
                    InputBuffer == NULL) {
                    KdPrint(("输入缓冲区或输入缓冲区长度无效"));
                    ntStatus = STATUS_UNSUCCESSFUL;  break;
                }
                KdPrint(("要恢复的服务号：%d 原始地址：0x%X", 
                    ShadowSsdtOrig->nIndex, ShadowSsdtOrig->FunAddress));

                if (!UnHookShadowSsdtItem(ShadowSsdtOrig, g_CsrssProcess)) {
                    ntStatus = STATUS_UNSUCCESSFUL;
                }
                break;
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_GET_PROCESSES:  
            {
                PPROCESS_LIST_HEAD ProcessHead;
                ULONG NeedLen;
                ULONG ReturnLength;

                ProcessHead = ScPsQuerySystemProcessList();
                NeedLen = ProcessHead->NumberOfProcesses * sizeof(PROCESS_INFO);

                if (cbOutputBuffer < NeedLen) {
                    if (cbOutputBuffer == sizeof(ULONG)) {
                        ((PULONG)OutputBuffer)[0] = NeedLen;
                        Irp->IoStatus.Information = sizeof(ULONG);
                        break;
                    }
                    ntStatus = STATUS_BUFFER_TOO_SMALL; break;
                }
                ReturnLength = ExCopyProcessList2Buffer((PPROCESS_INFO)OutputBuffer);
                if (ReturnLength == 0)  ntStatus = STATUS_UNSUCCESSFUL;
                Irp->IoStatus.Information = ReturnLength;
                break;
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_GET_PROCESS_IMAGE_PATH:
            {
                PEPROCESS Process = NULL;
                PUNICODE_STRING NameString;
                ULONG BufferSize;

                if (cbInputBuffer == sizeof(ULONG)) {
                    Process = ((PEPROCESS*)InputBuffer)[0];
                    if (Process == NULL) {
                        ntStatus = STATUS_ACCESS_DENIED; break;
                    }
                } else {
                    ntStatus = STATUS_BUFFER_TOO_SMALL;
                    break;
                }
                if (Process == g_SystemProcess) {
                    if (cbOutputBuffer > sizeof(L"System")) {
                        RtlCopyMemory(OutputBuffer, L"System", sizeof(L"System"));
                        Irp->IoStatus.Information = sizeof(L"System");
                        break; 
                    }
                } else if (Process == g_IdleProcess) {
                    if (cbOutputBuffer > sizeof(L"Idle")) {
                        RtlCopyMemory(OutputBuffer, L"Idle", sizeof(L"Idle"));
                        Irp->IoStatus.Information = sizeof(L"Idle");
                        break; 
                    }
                }
                if (cbOutputBuffer < 520) {
                    ntStatus = STATUS_BUFFER_TOO_SMALL;
                    break;
                }
                BufferSize = cbOutputBuffer + sizeof(UNICODE_STRING);
                NameString = ExAllocatePoolWithTag(NonPagedPool, BufferSize, MEM_TAG);
                NameString->Buffer = (PWCH)((ULONG)NameString + 8);
                NameString->Length = 0;
                NameString->MaximumLength = (USHORT)cbOutputBuffer;

                ntStatus = ScPsGetProcessImagePath(Process, NameString);
                if (NT_SUCCESS(ntStatus)) {
                    RtlCopyMemory(OutputBuffer, NameString->Buffer, NameString->Length);
                }
                Irp->IoStatus.Information = NameString->Length;
                ExFreePoolWithTag(NameString, MEM_TAG);
                break;
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_GET_PROCESS_THREADS:
            {            
                PTHREAD_LIST_HEAD ThreadHead = NULL;
                PEPROCESS EProcess = NULL;
                ULONG NeedLen = 0;
                ULONG ReturnLength = 0;
                
                if (cbInputBuffer == sizeof(ULONG)) {
                    EProcess = ((PEPROCESS*)InputBuffer)[0];
                } else {
                    ntStatus = STATUS_BUFFER_TOO_SMALL;
                    break;
                }
                if (EProcess == g_IdleProcess) {
                    if (cbOutputBuffer == sizeof(ULONG)) {
                        ((PULONG)OutputBuffer)[0] = NeedLen;  
                        Irp->IoStatus.Information = sizeof(ULONG);
                        break; 
                    }
                }
                ThreadHead = ScPsQueryProcessThreadList(EProcess);
                if (ThreadHead == NULL) {
                    ntStatus = STATUS_UNSUCCESSFUL;
                    break;
                }
                NeedLen = ThreadHead->NumberOfThread * sizeof(THREAD_INFO);
 
                if (cbOutputBuffer < NeedLen) {
                    if (cbOutputBuffer == sizeof(ULONG)) {
                        ((PULONG)OutputBuffer)[0] = NeedLen;
                        Irp->IoStatus.Information = sizeof(ULONG);
                        break;
                    }
                    ntStatus = STATUS_BUFFER_TOO_SMALL;  break;
                }
                ReturnLength = ExCopyThreadList2Buffer((PTHREAD_INFO)OutputBuffer);
                if (ReturnLength == 0)  ntStatus = STATUS_UNSUCCESSFUL;
                Irp->IoStatus.Information = ReturnLength;
                break;
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_GET_PROCESS_MODULES:
            {
                PMODULE_LIST_HEAD ModuleHead = NULL;
                PEPROCESS EProcess = NULL;
                ULONG NeedLen = 0;
                ULONG ReturnLength = 0;

                if (cbInputBuffer == sizeof(ULONG)) {
                    EProcess = ((PEPROCESS*)InputBuffer)[0];
                } else {
                    ntStatus = STATUS_BUFFER_TOO_SMALL;  break;
                }

                if (EProcess == g_IdleProcess) {
                    if (cbOutputBuffer = sizeof(ULONG)) {
                        ((PULONG)OutputBuffer)[0] = NeedLen;
                        Irp->IoStatus.Information = sizeof(ULONG);
                        break; 
                    }
                }
                ModuleHead = ScPsQueryProcessModuleList(EProcess);
                if (ModuleHead == NULL) {
                    ntStatus = STATUS_UNSUCCESSFUL;  break;
                }
                NeedLen = ModuleHead->NumberOfModules * sizeof(MODULE_INFO);

                if (cbOutputBuffer < NeedLen) {
                    if (cbOutputBuffer == sizeof(ULONG)) {
                        ((PULONG)OutputBuffer)[0] = NeedLen;
                        Irp->IoStatus.Information = sizeof(ULONG);
                        break;
                    }
                    ntStatus = STATUS_BUFFER_TOO_SMALL;  break;
                }
                ReturnLength = ExCopyModuleList2Buffer((PMODULE_INFO)OutputBuffer);
                if (ReturnLength == 0)  ntStatus = STATUS_UNSUCCESSFUL;
                Irp->IoStatus.Information = ReturnLength;
                break;
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_GET_DRIVER_OBJECT:
            {
                PDRIVER_LIST_HEAD DriverHead = NULL;
                PEPROCESS EProcess = NULL;
                HANDLE UserEvent;
                PKEVENT kEvent;
                ULONG NeedLen = 0;
                ULONG ReturnLength = 0;

                if (cbInputBuffer == sizeof(HANDLE) * 2) {
                    UserEvent = *(PHANDLE)InputBuffer;
                    ntStatus = ObReferenceObjectByHandle(UserEvent, 0, 
                                *ExEventObjectType, UserMode, &kEvent, NULL);
                    if (NT_SUCCESS(ntStatus)) {
                        ScObQueryDriverObject(pdoGlobalDrvObj, kEvent);
                        ObDereferenceObject(kEvent);
                    }
                    Irp->IoStatus.Information = 0;  break;
                }

                DriverHead = ScObQueryDriverObject(NULL, NULL);
                if (DriverHead == NULL) {
                    ntStatus = STATUS_UNSUCCESSFUL;  break;
                }
                NeedLen = DriverHead->NumberOfDrivers * sizeof(DRIVER_INFO);

                if (cbOutputBuffer < NeedLen) {
                    if (cbOutputBuffer == sizeof(ULONG)) {
                        ((PULONG)OutputBuffer)[0] = NeedLen;
                        Irp->IoStatus.Information = sizeof(ULONG);
                        break;
                    }
                    ntStatus = STATUS_BUFFER_TOO_SMALL;  break;
                }
                ReturnLength = ExCopyDriverList2Buffer((PDRIVER_INFO)OutputBuffer);
                if (ReturnLength == 0)  ntStatus = STATUS_UNSUCCESSFUL;
                Irp->IoStatus.Information = ReturnLength;
                break;
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_LIST_DIRECTORY:
            {
                PWCHAR pszDirectory;
                ULONG NeedLength;
                ULONG ReturnLength;
                PFILE_LIST_HEAD FileHead;

                pszDirectory = ExAllocatePoolWithTag(PagedPool, 260 * 2, MEM_TAG);
                RtlZeroMemory(pszDirectory, 260 * 2);

                if (cbInputBuffer == 260 * 2) {
                    RtlCopyMemory(pszDirectory, InputBuffer, 260 * 2);
                } else {
                    ntStatus = STATUS_BUFFER_TOO_SMALL;  break;
                }

                FileHead = ScfsQueryDirectoryInformation(pszDirectory);
                if (FileHead == NULL) {
                    ((PULONG)OutputBuffer)[0] = 0;
                    Irp->IoStatus.Information = sizeof(ULONG);
                    ntStatus = STATUS_SUCCESS;  break;
                }
                NeedLength = FileHead->NumberOfItems * sizeof(FILE_INFO);

                if (cbOutputBuffer < NeedLength) {
                    if (cbOutputBuffer == sizeof(ULONG)) {
                        ((PULONG)OutputBuffer)[0] = NeedLength;
                        Irp->IoStatus.Information = sizeof(ULONG);
                        break;
                    }
                    ntStatus = STATUS_BUFFER_TOO_SMALL; break;
                }
                ReturnLength = ExCopyFileList2Buffer((PFILE_INFO)OutputBuffer);
                if (ReturnLength == 0)  ntStatus = STATUS_UNSUCCESSFUL;
                Irp->IoStatus.Information = ReturnLength;
                ExFreePoolWithTag(pszDirectory, MEM_TAG);
                break;
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_PROTECT_MYSELF:
            {
                HANDLE ProcessId;
                if (cbInputBuffer == sizeof(ULONG)) {
                    ProcessId = ((PHANDLE)InputBuffer)[0];
                    if (ProcessId) {
                        ntStatus = ScPtHideProcessById(ProcessId);
                    }
                }
                Irp->IoStatus.Information = 0;
                break;
            }
        //////////////////////////////////////////////////////////////////////////
        case IOCTL_EXIT_PROCESS:
            ScPtUnloadRoutine();
            break;
        //////////////////////////////////////////////////////////////////////////
        default:
            Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
            Irp->IoStatus.Information = 0;
            break;
        }
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        ntStatus = GetExceptionCode();
        Irp->IoStatus.Information = 0;
    }
  
    Irp->IoStatus.Status = ntStatus;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return ntStatus;
}

 

应该像psnull那样把各个分发例程分两层处理的，不但看起来美观，而且方便管理

一旦内核和用户层交互多了，这该怎么管理啊，真后悔开始没有多参考优秀的工程啊

以后又有很多体力活要做了。。。