注册 登录  
 加关注
查看详情
   显示下一条  |  关闭
温馨提示!由于新浪微博认证机制调整,您的新浪微博帐号绑定已过期,请重新绑定!立即重新绑定新浪微博》  |  关闭

熊猫正正的博客

熊猫正正的天空

 
 
 

日志

 
 

传说中瑞星主动防御的一段代码(不包含处理部分)(一)  

2012-03-19 16:22:01|  分类: window驱动学习 |  标签: |举报 |字号 订阅

  下载LOFTER 我的照片书  |
#include <ntddk.h>
#include <ntimage.h>
#pragma pack(1)
typedef struct ServiceDescriptorEntry {
    unsigned int *ServiceTableBase;
    unsigned int *ServiceCounterTableBase; //Used only in checked build
    unsigned int NumberOfServices;
    unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
#define SDT    SYSTEMSERVICE
#define KSDT KeServiceDescriptorTable
#define FILE_DEVICE_UNKNOWN            0x00000022
#define IOCTL_UNKNOWN_BASE              FILE_DEVICE_UNKNOWN
#define IOCTL_INIT                      CTL_CODE(IOCTL_UNKNOWN_BASE, 0x0800, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
//补充定义数据及结构
typedef struct _INITIAL_TEB {
PVOID                StackBase;
PVOID                StackLimit;
PVOID                StackCommit;
PVOID                StackCommitMax;
PVOID                StackReserved;
} INITIAL_TEB, *PINITIAL_TEB;
typedef enum _SYSTEM_INFORMATION_CLASS
{
    SystemBasicInformation,
    SystemProcessorInformation,
    SystemPerformanceInformation,
    SystemTimeOfDayInformation,
    SystemNotImplemented1,
    SystemProcessesAndThreadsInformation,
    SystemCallCounts,
    SystemConfigurationInformation,
    SystemProcessorTimes,
    SystemGlobalFlag,
    SystemNotImplemented2,
    SystemModuleInformation,
    SystemLockInformation,
    SystemNotImplemented3,
    SystemNotImplemented4,
    SystemNotImplemented5,
    SystemHandleInformation,
    SystemObjectInformation,
    SystemPagefileInformation,
    SystemInstructionEmulationCounts,
    SystemInvalidInfoClass1,
    SystemCacheInformation,
    SystemPoolTagInformation,
    SystemProcessorStatistics,
    SystemDpcInformation,
    SystemNotImplemented6,
    SystemLoadImage,
    SystemUnloadImage,
    SystemTimeAdjustment,
    SystemNotImplemented7,
    SystemNotImplemented8,
    SystemNotImplemented9,
    SystemCrashDumpInformation,
    SystemExceptionInformation,
    SystemCrashDumpStateInformation,
    SystemKernelDebuggerInformation,
    SystemContextSwitchInformation,
    SystemRegistryQuotaInformation,
    SystemLoadAndCallImage,
    SystemPrioritySeparation,
    SystemNotImplemented10,
    SystemNotImplemented11,
    SystemInvalidInfoClass2,
    SystemInvalidInfoClass3,
    SystemTimeZoneInformation,
    SystemLookasideInformation,
    SystemSetTimeSlipEvent,
    SystemCreateSession,
    SystemDeleteSession,
    SystemInvalidInfoClass4,
    SystemRangeStartInformation,
    SystemVerifierInformation,
    SystemAddVerifier,
    SystemSessionProcessesInformation
} SYSTEM_INFORMATION_CLASS;
typedef struct _SYSTEM_HANDLE_INFORMATION
{
    ULONG            ProcessId;
    UCHAR            ObjectTypeNumber;
    UCHAR            Flags;
    USHORT          Handle;
    PVOID            Object;
    ACCESS_MASK      GrantedAccess;
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

//私有变量
typedef struct _DEVICE_EXTENSION 
{
    PDEVICE_OBJECT DeviceObject;
    PKEVENT Event;

    BOOLEAN bPCreate;
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;


//    全局设备对象
PDEVICE_OBJECT g_pDeviceObject;

UNICODE_STRING g_RegPath;

//补充定义函数
NTKERNELAPI NTSTATUS ObQueryNameString (
    IN PVOID                        Object,
    IN OUT PUNICODE_STRING            Name,
    IN ULONG                        MaximumLength,
    OUT PULONG                      ActualLength
);
NTKERNELAPI NTSTATUS ZwSetSecurityObject(
    IN HANDLE Handle,
    IN SECURITY_INFORMATION SecurityInformation,
    IN PSECURITY_DESCRIPTOR SecurityDescriptor
    );
NTKERNELAPI NTSTATUS ZwTerminateProcess(
IN HANDLE              ProcessHandle OPTIONAL,
IN NTSTATUS            ExitStatus );
NTKERNELAPI NTSTATUS ZwOpenProcess(
OUT PHANDLE            ProcessHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );
NTKERNELAPI NTSTATUS ZwOpenThread(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );
NTKERNELAPI NTSTATUS ZwLoadDriver(
IN PUNICODE_STRING DriverServiceName );
NTKERNELAPI NTSTATUS ZwSetSystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN PVOID                SystemInformation,
IN ULONG                SystemInformationLength );
NTKERNELAPI NTSTATUS ZwQuerySystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID              SystemInformation,
IN ULONG                SystemInformationLength,
OUT PULONG              ReturnLength OPTIONAL );


//函数声明
NTSTATUS DriverEntry(
IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
void UnloadDriver(PDRIVER_OBJECT DriverObject);
NTSTATUS DispatchCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchIoCtrl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
void StartHook(void);
void RemoveHook(void);
NTSTATUS Hook_ZwWriteFile(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PVOID                Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL );
NTSTATUS Hook_ZwReadFile(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
OUT PVOID              Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL );
NTSTATUS Hook_ZwSetSystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN PVOID                SystemInformation,
IN ULONG                SystemInformationLength );
NTSTATUS Hook_ZwQuerySystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID              SystemInformation,
IN ULONG                SystemInformationLength,
OUT PULONG              ReturnLength OPTIONAL );
NTSTATUS Hook_ZwLoadDriver(
IN PUNICODE_STRING DriverServiceName );
NTSTATUS Hook_ZwSetSecurityObject(
IN HANDLE              ObjectHandle,
IN SECURITY_INFORMATION SecurityInformationClass,
IN PSECURITY_DESCRIPTOR DescriptorBuffer);
NTSTATUS Hook_ZwOpenKey(
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes);
NTSTATUS Hook_ZwCreateKey (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN ULONG TitleIndex,
    IN PUNICODE_STRING Class OPTIONAL,
    IN ULONG CreateOptions,
    OUT PULONG Disposition OPTIONAL);
NTSTATUS Hook_ZwSetValueKey(
    IN HANDLE KeyHandle,
    IN PUNICODE_STRING ValueName,
    IN ULONG TitleIndex OPTIONAL,
    IN ULONG Type,
    IN PVOID Data,
    IN ULONG DataSize);
NTSTATUS Hook_ZwDeleteKey(
IN HANDLE KeyHandle);
NTSTATUS Hook_ZwDeleteValueKey(
IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName);
NTSTATUS Hook_ZwOpenSection(
OUT PHANDLE            SectionHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes );
NTSTATUS Hook_ZwCreateSection(
OUT PHANDLE            SectionHandle,
IN ULONG                DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN PLARGE_INTEGER      MaximumSize OPTIONAL,
IN ULONG                PageAttributess,
IN ULONG                SectionAttributes,
IN HANDLE              FileHandle OPTIONAL );
NTSTATUS Hook_ZwCreateProcess(
OUT PHANDLE          ProcessHandle,
IN ACCESS_MASK        DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE            ParentProcess,
IN BOOLEAN            InheritObjectTable,
IN HANDLE            SectionHandle OPTIONAL,
IN HANDLE            DebugPort OPTIONAL,
IN HANDLE            ExceptionPort OPTIONAL );
NTSTATUS Hook_ZwCreateProcessEx(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE ParentProcess,
    IN BOOLEAN InheritObjectTable,
    IN HANDLE SectionHandle OPTIONAL,
    IN HANDLE DebugPort OPTIONAL,
    IN HANDLE ExceptionPort OPTIONAL,
    IN HANDLE UnknownHandle );
NTSTATUS Hook_ZwTerminateProcess(
IN HANDLE              ProcessHandle OPTIONAL,
IN NTSTATUS            ExitStatus );
NTSTATUS Hook_ZwOpenProcess(
OUT PHANDLE            ProcessHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );
NTSTATUS Hook_ZwCreateThread(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE              ProcessHandle,
OUT PCLIENT_ID          ClientId,
IN PCONTEXT            ThreadContext,
IN PINITIAL_TEB        InitialTeb,
IN BOOLEAN              CreateSuspended );
NTSTATUS Hook_ZwTerminateThread(
IN HANDLE              ThreadHandle,
IN NTSTATUS            ExitStatus );
NTSTATUS Hook_ZwOpenThread(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );
NTSTATUS Hook_ZwCreateFile(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PLARGE_INTEGER      AllocationSize OPTIONAL,
IN ULONG                FileAttributes,
IN ULONG                ShareAccess,
IN ULONG                CreateDisposition,
IN ULONG                CreateOptions,
IN PVOID                EaBuffer OPTIONAL,
IN ULONG                EaLength );
NTSTATUS Hook_ZwOpenFile(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN ULONG                ShareAccess,
IN ULONG                OpenOptions );


NTSTATUS Hook_ZwClose(
IN HANDLE ObjectHandle );
#ifdef ALLOC_PRAGMA
#pragma alloc_text(INIT, DriverEntry)
#pragma alloc_text(INIT, StartHook)
#pragma alloc_text(PAGE, DispatchCreate)
#pragma alloc_text(PAGE, DispatchClose)
#pragma alloc_text(PAGE, DispatchIoCtrl)
#pragma alloc_text(PAGE, RemoveHook)
#pragma alloc_text(PAGE, UnloadDriver)
#pragma alloc_text(PAGE, Hook_ZwOpenKey)
#pragma alloc_text(PAGE, Hook_ZwSetSecurityObject)
#pragma alloc_text(PAGE, Hook_ZwCreateKey)
#pragma alloc_text(PAGE, Hook_ZwSetValueKey)
#pragma alloc_text(PAGE, Hook_ZwDeleteKey)
#pragma alloc_text(PAGE, Hook_ZwDeleteValueKey)
#pragma alloc_text(PAGE, Hook_ZwOpenSection)
#pragma alloc_text(PAGE, Hook_ZwCreateSection)
#pragma alloc_text(PAGE, Hook_ZwOpenProcess)
#pragma alloc_text(PAGE, Hook_ZwTerminateProcess)
#pragma alloc_text(PAGE, Hook_ZwOpenThread)
#pragma alloc_text(PAGE, Hook_ZwCreateFile)
#pragma alloc_text(PAGE, Hook_ZwOpenFile)
#pragma alloc_text(PAGE, Hook_ZwClose)
#pragma alloc_text(PAGE, Hook_ZwLoadDriver)
#pragma alloc_text(PAGE, Hook_ZwSetSystemInformation)
#pragma alloc_text(PAGE, Hook_ZwQuerySystemInformation)
#pragma alloc_text(PAGE, Hook_ZwReadFile)
#pragma alloc_text(PAGE, Hook_ZwWriteFile)
#endif

//函数原型定义
typedef NTSTATUS (*ZWLOADDRIVER)(
IN PUNICODE_STRING DriverServiceName );

typedef NTSTATUS (*ZWCREATEFILE)(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PLARGE_INTEGER      AllocationSize OPTIONAL,
IN ULONG                FileAttributes,
IN ULONG                ShareAccess,
IN ULONG                CreateDisposition,
IN ULONG                CreateOptions,
IN PVOID                EaBuffer OPTIONAL,
IN ULONG                EaLength );

typedef NTSTATUS (*ZWOPENFILE)(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN ULONG                ShareAccess,
IN ULONG                OpenOptions );

typedef NTSTATUS (*ZWCLOSE)(
IN HANDLE              ObjectHandle );

typedef NTSTATUS (*ZWWRITEFILE)(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PVOID                Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL );

typedef NTSTATUS (*ZWREADFILE)(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
OUT PVOID              Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL );

typedef NTSTATUS (*ZWCREATEPROCESS)(
OUT PHANDLE          ProcessHandle,
IN ACCESS_MASK        DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE            ParentProcess,
IN BOOLEAN            InheritObjectTable,
IN HANDLE            SectionHandle OPTIONAL,
IN HANDLE            DebugPort OPTIONAL,
IN HANDLE            ExceptionPort OPTIONAL);

typedef NTSTATUS (*ZWCREATEPROCESSEX)(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE ParentProcess,
    IN BOOLEAN InheritObjectTable,
    IN HANDLE SectionHandle OPTIONAL,
    IN HANDLE DebugPort OPTIONAL,
    IN HANDLE ExceptionPort OPTIONAL,
    IN HANDLE Unknown );

typedef NTSTATUS (*ZWOPENPROCESS)(
OUT PHANDLE            ProcessHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );

typedef NTSTATUS (*ZWTERMINATEPROCESS)(
IN HANDLE              ProcessHandle OPTIONAL,
IN NTSTATUS            ExitStatus );

typedef NTSTATUS (*ZWCREATETHREAD)(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE              ProcessHandle,
OUT PCLIENT_ID          ClientId,
IN PCONTEXT            ThreadContext,
IN PINITIAL_TEB        InitialTeb,
IN BOOLEAN              CreateSuspended );

typedef NTSTATUS (*ZWTERMINATETHREAD)(
IN HANDLE              ThreadHandle,
IN NTSTATUS            ExitStatus );

typedef NTSTATUS (*ZWOPENTHREAD)(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );

typedef NTSTATUS (*ZWCREATESECTION)(
OUT PHANDLE            SectionHandle,
IN ULONG                DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN PLARGE_INTEGER      MaximumSize OPTIONAL,
IN ULONG                PageAttributess,
IN ULONG                SectionAttributes,
IN HANDLE              FileHandle OPTIONAL );

typedef NTSTATUS (*ZWOPENSECTION)(
OUT PHANDLE            SectionHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes );

//注册表

typedef NTSTATUS (*ZWCREATEKEY) (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN ULONG TitleIndex,
    IN PUNICODE_STRING Class OPTIONAL,
    IN ULONG CreateOptions,
    OUT PULONG Disposition OPTIONAL
);

typedef NTSTATUS (*ZWOPENKEY) (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes
);

typedef NTSTATUS (*ZWSETVALUEKEY)(
    IN HANDLE KeyHandle,
    IN PUNICODE_STRING ValueName,
    IN ULONG TitleIndex OPTIONAL,
    IN ULONG Type,
    IN PVOID Data,
    IN ULONG DataSize
);

typedef NTSTATUS (*ZWSETSECURITYOBJECT)(
IN HANDLE              ObjectHandle,
IN SECURITY_INFORMATION SecurityInformationClass,
IN PSECURITY_DESCRIPTOR DescriptorBuffer);


typedef NTSTATUS (*ZWDELETEKEY)(
    IN HANDLE KeyHandle);
typedef NTSTATUS (*ZWDELETEVALUEKEY)( 
    IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName);


typedef NTSTATUS (*ZWSETSYSTEMINFORMATION)(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN PVOID                SystemInformation,
IN ULONG                SystemInformationLength );

typedef NTSTATUS (*ZWQUERYSYSTEMINFORMATION)(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID              SystemInformation,
IN ULONG                SystemInformationLength,
OUT PULONG              ReturnLength OPTIONAL );
    
//      SDT 原函数地址
static ZWCREATEFILE                OldZwCreateFile;
static ZWOPENFILE                OldZwOpenFile;
static ZWCLOSE                    OldZwClose;
static ZWWRITEFILE                OldZwWriteFile;
static ZWREADFILE                OldZwReadFile;
static ZWTERMINATEPROCESS        OldZwTerminateProcess;
static ZWOPENPROCESS            OldZwOpenProcess;
static ZWOPENTHREAD                OldZwOpenThread;
static ZWCREATESECTION            OldZwCreateSection;
static ZWOPENSECTION            OldZwOpenSection;
static ZWCREATEKEY                OldZwCreateKey;
static ZWSETVALUEKEY            OldZwSetValueKey;
static ZWDELETEKEY                OldZwDeleteKey;
static ZWDELETEVALUEKEY            OldZwDeleteValueKey;
static ZWSETSECURITYOBJECT        OldZwSetSecurityObject;
static ZWOPENKEY                OldZwOpenKey;

static ZWLOADDRIVER                OldZwLoadDriver;

static ZWSETSYSTEMINFORMATION    OldZwSetSystemInformation;
static ZWQUERYSYSTEMINFORMATION    OldZwQuerySystemInformation;
//挂接函数执行体
NTSTATUS Hook_ZwWriteFile(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PVOID                Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL )
{
    NTSTATUS rc;
    rc = OldZwWriteFile(FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key);
    return rc;
}
NTSTATUS Hook_ZwReadFile(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
OUT PVOID              Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL )
{
    NTSTATUS rc;
    rc = OldZwReadFile(FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key);
    return rc;
}


  评论这张
 
阅读(99)| 评论(0)
推荐 转载

历史上的今天

评论

<#--最新日志,群博日志--> <#--推荐日志--> <#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇,下一篇--> <#-- 热度 --> <#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->
 
 
 
 
 
 
 
 
 
 
 
 
 
 

页脚

网易公司版权所有 ©1997-2018