C++使用ZwLoadDriver卸载与加载sys驱动程序

方式为自己注册表模拟写入相关驱动参数，使用nt自导出函数ZwLoadDriver加载驱动

//ZwLoadDriver.h

#pragma once
#ifndef ZWLOADDRIVER_H
#define ZWLOADDRIVER_H
#include <fstream>
#include <iostream>
#include <Windows.h>
#pragma comment(lib, "ntdll.lib")
#define cs                  const_cast
#define sc					static_cast
#define rc					reinterpret_cast
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
typedef struct _UNICODE_STRING {
	USHORT Length;
	USHORT MaximumLength;
#ifdef MIDL_PASS
	[size_is(MaximumLength / 2), length_is((Length) / 2)] USHORT* Buffer;
#else // MIDL_PASS
	_Field_size_bytes_part_opt_(MaximumLength, Length) PWCH   Buffer;
#endif // MIDL_PASS
} UNICODE_STRING;
typedef UNICODE_STRING* PUNICODE_STRING;
typedef const UNICODE_STRING* PCUNICODE_STRING;
//nt自导出函数
extern "C" NTSTATUS NTAPI ZwLoadDriver(PUNICODE_STRING str);
extern "C" NTSTATUS NTAPI ZwUnloadDriver(PUNICODE_STRING str);
extern "C" VOID NTAPI RtlInitUnicodeString(_Out_ PUNICODE_STRING DestinationString, _In_opt_z_ __drv_aliasesMem PCWSTR SourceString);
namespace loader
{
	bool load_driver(uint8_t* driver, int size, const std::wstring path = L"c:/", const std::wstring service = L"cpp.vin");

	bool unload_driver(const std::wstring path = L"c:/", const std::wstring service = L"cpp.vin");
}
#endif // ZWLOADDRIVER_H

//ZwLoadDriver.cpp

#include "ZwLoadDriver.h"
//注册
bool loader::load_driver(uint8_t* driver, int size, const std::wstring path, const std::wstring service)
{
    std::ofstream file((path + service + L".sys").c_str(), std::ios_base::out | std::ios_base::binary);
    file.write(rc< char* >(driver), size);
    file.close();
    HKEY services_key, service_key;
    auto status = RegOpenKeyW(HKEY_LOCAL_MACHINE, L"System\\CurrentControlSet\\Services", &services_key);
    if (status) return false;
    status = RegCreateKeyW(services_key, service.c_str(), &service_key);
    if (status)
    {
        status = RegOpenKeyW(services_key, service.c_str(), &service_key);
        if (status)
        {
            RegCloseKey(services_key);
            return false;
        }

        RegCloseKey(service_key);

        status = RegDeleteKeyW(services_key, service.c_str());
        if (status)
        {
            RegCloseKey(services_key);
            return false;
        }

        status = RegCreateKeyW(services_key, service.c_str(), &service_key);
        if (status)
        {
            RegCloseKey(services_key);
            return false;
        }
    }

    auto service_error = 0, service_type = 1, service_startup_type = 1;
    auto service_group = std::wstring(L"Base");
    auto service_image_path = L"\\??\\" + path + service + L".sys";

    status |= RegSetValueExW(service_key, L"DisplayName", 0, REG_SZ, rc< const BYTE* >(service.c_str()), (service.length() + 1) * sizeof(WCHAR));
    status |= RegSetValueExW(service_key, L"ErrorControl", 0, REG_DWORD, rc< const BYTE* >(&service_error), sizeof(service_error));
    status |= RegSetValueExW(service_key, L"Group", 0, REG_SZ, rc< const BYTE* >(service_group.c_str()), (service_group.length() + 1) * sizeof(WCHAR));
    status |= RegSetValueExW(service_key, L"ImagePath", 0, REG_SZ, rc< const BYTE* >(service_image_path.c_str()), (service_image_path.length() + 1) * sizeof(WCHAR));
    status |= RegSetValueExW(service_key, L"Start", 0, REG_DWORD, rc< const BYTE* >(&service_startup_type), sizeof(service_startup_type));
    status |= RegSetValueExW(service_key, L"Type", 0, REG_DWORD, rc< const BYTE* >(&service_type), sizeof(service_type));

    RegCloseKey(service_key);
    RegCloseKey(services_key);
    if (status) return false;
    auto reg_path = L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\" + service;
    UNICODE_STRING driver_path;
    RtlInitUnicodeString(&driver_path, reg_path.c_str());
    status = ZwLoadDriver(&driver_path);
    return NT_SUCCESS(status);
}
//卸载
bool loader::unload_driver(const std::wstring path, const std::wstring service)
{
    auto reg_path = L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\" + service;
    UNICODE_STRING driver_path;
    RtlInitUnicodeString(&driver_path, reg_path.c_str());
    auto ret_status = ZwUnloadDriver(&driver_path);
    HKEY services_key;
    auto status = RegOpenKeyW(HKEY_LOCAL_MACHINE, L"System\\CurrentControlSet\\Services", &services_key);
    if (status) return false;
    status = RegDeleteKeyW(services_key, service.c_str());
    RegCloseKey(services_key);
    return DeleteFileW((path + service + L".sys").c_str()) && !status && NT_SUCCESS(ret_status);
}

//测试代码

#include <iostream>
#include "ZwLoadDriver.h"
int main()
{
    if (loader::load_driver(driverPtr_h, sizeof(driverPtr_h)))
        std::cout << "driver loaded successfully!" << std::endl;
    else
        std::cout << "driver load failed!" << std::endl;
        
    //卸载
    //loader::unload_driver();
    return 0;
}

×

*转载请注明出处：原文链接：https://cpp.vin/page/69.html