内核驱动（c++）

2026-08-15 15:44:00
发布于：北京
5阅读
0回复
0点赞
#include <ntddk.h>
#include <ntstrsafe.h>

extern "C"
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath);

VOID DriverUnload(PDRIVER_OBJECT DriverObject);

VOID ProcessNotifyCallback(
    PEPROCESS Process,
    HANDLE ProcessId,
    PPS_CREATE_NOTIFY_INFO CreateInfo
);

extern "C"
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    UNREFERENCED_PARAMETER(RegistryPath);

    NTSTATUS status;

    DriverObject->DriverUnload = DriverUnload;

    status = PsSetCreateProcessNotifyRoutineEx(ProcessNotifyCallback, FALSE);
    if (!NT_SUCCESS(status)) {
        DbgPrint("ProcMon: 注册进程回调失败, status=0x%X\n", status);
        return status;
    }

    DbgPrint("ProcMon: 驱动加载成功, 进程监控已启动\n");
    return STATUS_SUCCESS;
}

VOID ProcessNotifyCallback(
    PEPROCESS Process,
    HANDLE ProcessId,
    PPS_CREATE_NOTIFY_INFO CreateInfo
)
{
    UNREFERENCED_PARAMETER(Process);

    if (CreateInfo != NULL) {
        // 进程创建
        UCHAR ImageName[16] = { 0 };
        UCHAR ParentImageName[16] = { 0 };

        PEPROCESS ParentProcess = NULL;
        HANDLE ParentPid = CreateInfo->ParentProcessId;

        if (CreateInfo->ImageFileName != NULL) {
            // 取当前进程名
            PCHAR src = (PCHAR)CreateInfo->ImageFileName->Buffer;
            for (ULONG i = 0; i < CreateInfo->ImageFileName->Length / sizeof(WCHAR) && i < 15; i++) {
                ImageName[i] = (UCHAR)src[i * 2]; // 简单WCHAR→CHAR
            }
        }

        if (ParentPid != NULL) {
            PsLookupProcessByProcessId(ParentPid, &ParentProcess);
            if (ParentProcess != NULL) {
                PCHAR pname = PsGetProcessImageFileName(ParentProcess);
                if (pname != NULL) {
                    RtlStringCbCopyA((NTSTRSAFE_PSTR)ParentImageName, sizeof(ParentImageName), pname);
                }
                ObDereferenceObject(ParentProcess);
            }
        }

        DbgPrint("[ProcMon] + 创建进程  PID=%u  PPID=%u  名称=%s  父进程=%s\n",
            (ULONG)(ULONG_PTR)ProcessId,
            (ULONG)(ULONG_PTR)ParentPid,
            ImageName,
            ParentImageName);
    } else {
        // 进程退出
        UCHAR ImageName[16] = { 0 };
        PCHAR pname = PsGetProcessImageFileName(Process);
        if (pname != NULL) {
            RtlStringCbCopyA((NTSTRSAFE_PSTR)ImageName, sizeof(ImageName), pname);
        }

        DbgPrint("[ProcMon] - 退出进程  PID=%u  名称=%s\n",
            (ULONG)(ULONG_PTR)ProcessId,
            ImageName);
    }
}

VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
    UNREFERENCED_PARAMETER(DriverObject);

    PsSetCreateProcessNotifyRoutineEx(ProcessNotifyCallback, TRUE);
    DbgPrint("ProcMon: 驱动已卸载, 进程监控已停止\n");
}
需使用Visual Studio 2022和Windows Driver Kit (WDK)运行
有帮助，赞一个
去预览
0/2000
全部评论 1

happy
制作不易，点个赞吧

4天前来自北京
0
全部评论 1

热门讨论
