驱动保护 -- 向被保护的内存写数据

一、驱动层写数据源码

1、具体功能实现

BOOLEAN KWriteProcessMemory(IN PEPROCESS 目标进程, IN PVOID 被写入地址, IN UINT32 写入长度, IN PVOID 待写入数据)
{KAPC_STATE apc_state;RtlZeroMemory(&apc_state, sizeof(KAPC_STATE));//创建MDL来读取内存PMDL 映射内存结构 = IoAllocateMdl(待写入数据, 写入长度, 0, 0, NULL);if (!映射内存结构){return FALSE;}//将映射内存变成可读MmBuildMdlForNonPagedPool(映射内存结构);//获取可读的地址unsigned char* 可写内存 = (unsigned char*)MmMapLockedPages(映射内存结构, KernelMode);if (!可写内存){IoFreeMdl(映射内存结构);return FALSE;}//切换到目标进程进行操作KeStackAttachProcess((PVOID)目标进程, &apc_state);//判断该地址是否可读BOOLEAN 是否可读 = MmIsAddressValid(被写入地址);if (是否可读){RtlCopyMemory(被写入地址, 可写内存,  写入长度);}else{KdPrint(("nxyn2不可读"));}//恢复环境KeUnstackDetachProcess(&apc_state);MmUnmapLockedPages((PVOID)可写内存, 映射内存结构);IoFreeMdl(映射内存结构);return 是否可读;
}int WriteProcessMemoryForPid(UINT32 dwPid, PVOID 目标地址, PVOID 写入地址, UINT32 写入大小)
{//根据pid获取PEPROCESSPEPROCESS Seleted_pEPROCESS = NULL;if (PsLookupProcessByProcessId((PVOID)(UINT_PTR)(dwPid), &Seleted_pEPROCESS) == STATUS_SUCCESS){BOOLEAN br = KWriteProcessMemory(Seleted_pEPROCESS, (PVOID)目标地址, 写入大小, 写入地址);ObDereferenceObject(Seleted_pEPROCESS);if (br){return 写入大小;}}else{KdPrint(("nxyn 2读取失败"));}return 0;}NTSTATUS  IRP_WriteProcessMemory(PIRP pirp)
{NTSTATUS ntStatus = STATUS_SUCCESS;PIO_STACK_LOCATION     irpStack = NULL;irpStack = IoGetCurrentIrpStackLocation(pirp);#pragma pack(push)
#pragma pack(8)typedef struct TINPUT_BUF{UINT64 dwPid;//目标进程PIDPVOID 被写入地址;UINT64 写入长度;UINT64 写入地址;}TINPUT_BUF;
#pragma pack(pop)TINPUT_BUF* 输入数据 = (TINPUT_BUF*)(pirp->AssociatedIrp.SystemBuffer);WriteProcessMemoryForPid(输入数据->dwPid, 输入数据->被写入地址, 输入数据->写入地址/*起始地址*/, 输入数据->写入长度);if (irpStack) //{if (ntStatus == STATUS_SUCCESS){ //成功则返回 缓冲区大小pirp->IoStatus.Information = irpStack->Parameters.DeviceIoControl.OutputBufferLength;//DeviceIoControl}else{ //失败则不返回pirp->IoStatus.Information = 0;}//完成请求IoCompleteRequest(pirp, IO_NO_INCREMENT);}pirp->IoStatus.Status = ntStatus;return ntStatus;
}

2、在头文件声明IRP_WriteProcessMemory函数

NTSTATUS  IRP_WriteProcessMemory(PIRP pirp);

3、控制码关联

#define irp写被保护数据   CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808,     METHOD_BUFFERED,FILE_ANY_ACCESS)else if (控制码== irp写被保护数据){return IRP_WriteProcessMemory(IRP指针);}

二、应用层实现

1、添加一个按钮

2、源码实现

#define irp写被保护数据   CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808,     METHOD_BUFFERED,FILE_ANY_ACCESS)void CtestDlg::OnBnClickedButtonXrsj2()
{
#pragma pack(push)
#pragma pack(8)typedef struct TINPUT_BUF{UINT64 dwPid;//目标进程PIDPVOID 被写入地址;UINT64 写入长度;UINT64 写入地址;}TINPUT_BUF;
#pragma pack(pop)UpdateData(true);DWORD 返回字节数 = 0;DWORD 临时数据 = 0;UINT_PTR 地址 = 0x406728;UINT64 待写入数据 = 123;TINPUT_BUF 输入缓存区 = { mbpid,(PVOID)地址,4 ,(UINT64) & 待写入数据};DeviceIoControl(设备句柄,irp写被保护数据,&输入缓存区,sizeof(TINPUT_BUF),&临时数据,sizeof(临时数据),&返回字节数,NULL);char 缓存[256];sprintf_s(缓存, "2写被保护值%X", 临时数据);::MessageBoxA(0, 缓存, "2写被保护测试", MB_OK);
}