Windows Kernel
Windows Kernel
Heya guys,
just a quick question. It's true that drivers and kernel modules can access all memory and can cross memory boundaries right?
just a quick question. It's true that drivers and kernel modules can access all memory and can cross memory boundaries right?
Yup.
tooshort
tooshort
... not that its wise to do so
Originally Posted by why06
... not that its wise to do so
Code:
NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING theRegistryPath ){
NTSTATUS ntStatus = STATUS_SUCCESS;
UNICODE_STRING DeviceName;
UNICODE_STRING SymbolicLinkNameString;
DriverObject->DriverUnload = OnUnload;
RtlInitUnicodeString (&DeviceName, deviceNameBuffer );
RtlInitUnicodeString (&SymbolicLinkNameString, SymbolicLinkName);
ntStatus = IoCreateDevice ( DriverObject,0, &DeviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &g_DevicePointer);
CheckErrors(ntStatus);
if(ntStatus == STATUS_SUCCESS){
ntStatus = IoCreateSymbolicLink( &SymbolicLinkNameString, &DeviceName);
CheckErrors(ntStatus);
}
for(y = 0; y < IRP_MJ_MAXIMUM_FUNCTION; y++ ){
DriverObject->MajorFunction[y] = OnStubDispatch;
}
DriverObject->MajorFunction[IRP_MJ_WRITE] = WriteNeither;
DriverObject->MajorFunction[IRP_MJ_READ] = ReadNeitherIo;
return STATUS_SUCCESS;
}
I've working I/O handlers and I'm working on the next fase of my driver. I'm going to make something like kernel detective