Windows驱动编程之内存读写

#include

NTSTATUS

ZwAllocateVirtualMemory(

IN HANDLE ProcessHandle,

IN OUT PVOID *BaseAddress,

IN ULONG ZeroBits,

IN OUT PSIZE_T RegionSize,

IN ULONG AllocationType,

IN ULONG Protect

);

NTSTATUS ReadWriteProcess()

{

NTSTATUSStatus;

HANDLEhProcess;

CLIENT_IDClientId;

OBJECT_ATTRIBUTESObjAttr;

PVOIDAllocateAddress;

size_tRegionSize;

ClientId.UniqueProcess = (HANDLE)2084;

ClientId.UniqueThread = 0;

memset(&ObjAttr,0,sizeof(OBJECT_ATTRIBUTES));

Status = ZwOpenProcess(&hProcess,PROCESS_ALL_ACCESS,&ObjAttr,&ClientId);

if (!NT_SUCCESS(Status))

{

KdPrint(("error code:%X",Status));

return Status;

}

RegionSize = 0xff;

Status = ZwAllocateVirtualMemory(hProcess,&AllocateAddress,0,&RegionSize,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

if (!NT_SUCCESS(Status))

{

KdPrint(("error code:%X",Status));

return Status;

}

KdPrint(("address:%X,size:%d",AllocateAddress,RegionSize));

ZwClose(hProcess);

return Status;

}

VOID MyUnload(PDRIVER_OBJECT pDriverObject)

{

}

NTSTATUS DriverEntry(PDRIVER_OBJECTpDriverObject,PUNICODE_STRING Reg_Path)

{

ReadWriteProcess();

pDriverObject->DriverUnload = MyUnload;

return STATUS_SUCCESS;

}

  • 发表于:
  • 原文链接http://kuaibao.qq.com/s/20180315B1U3TS00?refer=cp_1026
  • 腾讯「云+社区」是腾讯内容开放平台帐号(企鹅号)传播渠道之一,根据《腾讯内容开放平台服务协议》转载发布内容。
  • 如有侵权,请联系 yunjia_community@tencent.com 删除。

扫码关注云+社区

领取腾讯云代金券