Repository: G4rb3n/Windows-Driver Branch: master Commit: 270e04686246 Files: 463 Total size: 196.7 MB Directory structure: gitextract_155k5x_t/ ├── MT-Callback/ │ ├── MTDriver_Callback/ │ │ ├── .vs/ │ │ │ └── MTDriver_Callback/ │ │ │ └── v15/ │ │ │ ├── .suo │ │ │ ├── Browse.VC.opendb │ │ │ └── ipch/ │ │ │ └── AutoPCH/ │ │ │ └── 3ada06f9b493e64a/ │ │ │ └── MAIN.ipch │ │ ├── Debug/ │ │ │ ├── MTDriver_Callback/ │ │ │ │ ├── MTDriver_Callback.inf │ │ │ │ ├── MTDriver_Callback.sys │ │ │ │ └── mtdriver_callback.cat │ │ │ ├── MTDriver_Callback.cer │ │ │ ├── MTDriver_Callback.inf │ │ │ ├── MTDriver_Callback.pdb │ │ │ └── MTDriver_Callback.sys │ │ ├── MTDriver_Callback/ │ │ │ ├── Debug/ │ │ │ │ ├── MTDriver.A4EEAE48.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── Inf2Cat.command.1.tlog │ │ │ │ │ ├── MTDriver_Callback.lastbuildstate │ │ │ │ │ ├── inf2cat-expand.13232.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.13232.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.write.1.tlog │ │ │ │ │ ├── inf2cat.read.1.tlog │ │ │ │ │ ├── inf2cat.write.1.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ ├── link.write.1.tlog │ │ │ │ │ ├── signtool.command.1.tlog │ │ │ │ │ ├── signtool.read.1.tlog │ │ │ │ │ ├── signtool.timestamp.1.tlog │ │ │ │ │ ├── signtool.write.1.tlog │ │ │ │ │ ├── stampinf.command.1.tlog │ │ │ │ │ ├── stampinf.read.1.tlog │ │ │ │ │ └── stampinf.write.1.tlog │ │ │ │ ├── MTDriver_Callback.Build.CppClean.log │ │ │ │ ├── MTDriver_Callback.inf │ │ │ │ ├── MTDriver_Callback.log │ │ │ │ ├── main.obj │ │ │ │ └── vc141.pdb │ │ │ ├── MTDriver_Callback.inf │ │ │ ├── MTDriver_Callback.vcxproj │ │ │ ├── MTDriver_Callback.vcxproj.filters │ │ │ ├── MTDriver_Callback.vcxproj.user │ │ │ └── main.c │ │ └── MTDriver_Callback.sln │ └── README.md ├── MT-CheckTime/ │ ├── MTDriver_CheckTime/ │ │ ├── .vs/ │ │ │ └── MTDriver_CheckTime/ │ │ │ └── v15/ │ │ │ ├── .suo │ │ │ ├── Browse.VC.opendb │ │ │ └── ipch/ │ │ │ └── AutoPCH/ │ │ │ └── 756df4b90d1a5cb0/ │ │ │ └── MAIN.ipch │ │ ├── Debug/ │ │ │ ├── MTDriver_CheckTime/ │ │ │ │ ├── MTDriver_CheckTime.inf │ │ │ │ ├── MTDriver_CheckTime.sys │ │ │ │ └── mtdriver_checktime.cat │ │ │ ├── MTDriver_CheckTime.cer │ │ │ ├── MTDriver_CheckTime.inf │ │ │ ├── MTDriver_CheckTime.pdb │ │ │ └── MTDriver_CheckTime.sys │ │ ├── MTDriver_CheckTime/ │ │ │ ├── Debug/ │ │ │ │ ├── MTDriver.3BE854CE.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── Inf2Cat.command.1.tlog │ │ │ │ │ ├── MTDriver_CheckTime.lastbuildstate │ │ │ │ │ ├── inf2cat-expand.18532.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.18532.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.write.1.tlog │ │ │ │ │ ├── inf2cat.read.1.tlog │ │ │ │ │ ├── inf2cat.write.1.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ ├── link.write.1.tlog │ │ │ │ │ ├── signtool.command.1.tlog │ │ │ │ │ ├── signtool.read.1.tlog │ │ │ │ │ ├── signtool.timestamp.1.tlog │ │ │ │ │ ├── signtool.write.1.tlog │ │ │ │ │ ├── stampinf.command.1.tlog │ │ │ │ │ ├── stampinf.read.1.tlog │ │ │ │ │ └── stampinf.write.1.tlog │ │ │ │ ├── MTDriver_CheckTime.Build.CppClean.log │ │ │ │ ├── MTDriver_CheckTime.inf │ │ │ │ ├── MTDriver_CheckTime.log │ │ │ │ ├── main.obj │ │ │ │ └── vc141.pdb │ │ │ ├── MTDriver_CheckTime.inf │ │ │ ├── MTDriver_CheckTime.vcxproj │ │ │ ├── MTDriver_CheckTime.vcxproj.filters │ │ │ ├── MTDriver_CheckTime.vcxproj.user │ │ │ └── main.c │ │ └── MTDriver_CheckTime.sln │ └── README.md ├── MT-Communication/ │ ├── MTApp_Communication/ │ │ ├── .vs/ │ │ │ └── MTApp_Communication/ │ │ │ └── v15/ │ │ │ ├── .suo │ │ │ └── ipch/ │ │ │ ├── 21c0f33d3b0d820f.ipch │ │ │ ├── AutoPCH/ │ │ │ │ └── 84ee152770875a5d/ │ │ │ │ └── COMBASEAPI.ipch │ │ │ └── b9e05a80a8eda86f.ipch │ │ ├── MTApp_Communication/ │ │ │ ├── Debug/ │ │ │ │ ├── MTApp_Co.77C8ADF1.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── MTApp_Communication.lastbuildstate │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ └── link.write.1.tlog │ │ │ │ ├── MTApp_Communication.Build.CppClean.log │ │ │ │ ├── MTApp_Communication.log │ │ │ │ ├── MTApp_Communication.obj │ │ │ │ ├── MTApp_Communication.pch │ │ │ │ ├── pch.obj │ │ │ │ ├── vc141.idb │ │ │ │ └── vc141.pdb │ │ │ ├── MTApp_Communication.cpp │ │ │ ├── MTApp_Communication.vcxproj │ │ │ ├── MTApp_Communication.vcxproj.filters │ │ │ ├── MTApp_Communication.vcxproj.user │ │ │ ├── Release/ │ │ │ │ ├── MTApp_Co.77C8ADF1.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── MTApp_Communication.lastbuildstate │ │ │ │ │ ├── MTApp_Communication.write.1u.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ └── link.write.1.tlog │ │ │ │ ├── MTApp_Communication.Build.CppClean.log │ │ │ │ ├── MTApp_Communication.log │ │ │ │ ├── MTApp_Communication.obj │ │ │ │ ├── MTApp_Communication.pch │ │ │ │ ├── pch.obj │ │ │ │ └── vc141.pdb │ │ │ ├── pch.cpp │ │ │ └── pch.h │ │ └── MTApp_Communication.sln │ ├── MTDriver_Communication/ │ │ ├── .vs/ │ │ │ └── MTDriver_Communication/ │ │ │ └── v15/ │ │ │ ├── .suo │ │ │ └── ipch/ │ │ │ └── AutoPCH/ │ │ │ ├── 174fe7312286265b/ │ │ │ │ └── MAIN.ipch │ │ │ ├── ba5db423596ae06b/ │ │ │ │ └── MAIN.ipch │ │ │ ├── d25739d79f02633b/ │ │ │ │ └── MAIN.ipch │ │ │ └── e8f10dd7b57d38cf/ │ │ │ └── WDM.ipch │ │ ├── MTDriver_Communication/ │ │ │ ├── Debug/ │ │ │ │ ├── MTDriver.F4B8434B.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── Inf2Cat.command.1.tlog │ │ │ │ │ ├── MTDriver_Communication.lastbuildstate │ │ │ │ │ ├── inf2cat-expand.6996.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.6996.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.write.1.tlog │ │ │ │ │ ├── inf2cat.read.1.tlog │ │ │ │ │ ├── inf2cat.read.9.tlog │ │ │ │ │ ├── inf2cat.write.1.tlog │ │ │ │ │ ├── inf2cat.write.9.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ ├── link.write.1.tlog │ │ │ │ │ ├── signtool.command.1.tlog │ │ │ │ │ ├── signtool.read.1.tlog │ │ │ │ │ ├── signtool.timestamp.1.tlog │ │ │ │ │ ├── signtool.write.1.tlog │ │ │ │ │ ├── stampinf.command.1.tlog │ │ │ │ │ ├── stampinf.read.1.tlog │ │ │ │ │ └── stampinf.write.1.tlog │ │ │ │ ├── MTDriver_Communication.Build.CppClean.log │ │ │ │ ├── MTDriver_Communication.inf │ │ │ │ ├── MTDriver_Communication.log │ │ │ │ ├── main.obj │ │ │ │ └── vc141.pdb │ │ │ ├── MTDriver_Communication.inf │ │ │ ├── MTDriver_Communication.vcxproj │ │ │ ├── MTDriver_Communication.vcxproj.filters │ │ │ ├── MTDriver_Communication.vcxproj.user │ │ │ └── main.c │ │ └── MTDriver_Communication.sln │ └── README.md ├── MT-FSDHook/ │ ├── MTDriver_FSDHook/ │ │ ├── Debug/ │ │ │ ├── MTDriver_FSDHook/ │ │ │ │ ├── MTDriver_FSDHook.inf │ │ │ │ ├── MTDriver_FSDHook.sys │ │ │ │ └── mtdriver_fsdhook.cat │ │ │ ├── MTDriver_FSDHook.cer │ │ │ ├── MTDriver_FSDHook.inf │ │ │ ├── MTDriver_FSDHook.pdb │ │ │ └── MTDriver_FSDHook.sys │ │ ├── MTDriver_FSDHook/ │ │ │ ├── Debug/ │ │ │ │ ├── MTDriver_FSDHook.Build.CppClean.log │ │ │ │ ├── MTDriver_FSDHook.inf │ │ │ │ ├── MTDriver_FSDHook.log │ │ │ │ ├── MTDriver_FSDHook.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── Inf2Cat.command.1.tlog │ │ │ │ │ ├── MTDriver_FSDHook.lastbuildstate │ │ │ │ │ ├── inf2cat-expand.8496.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.8496.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.write.1.tlog │ │ │ │ │ ├── inf2cat.read.1.tlog │ │ │ │ │ ├── inf2cat.write.1.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ ├── link.write.1.tlog │ │ │ │ │ ├── signtool.command.1.tlog │ │ │ │ │ ├── signtool.read.1.tlog │ │ │ │ │ ├── signtool.timestamp.1.tlog │ │ │ │ │ ├── signtool.write.1.tlog │ │ │ │ │ ├── stampinf.command.1.tlog │ │ │ │ │ ├── stampinf.read.1.tlog │ │ │ │ │ └── stampinf.write.1.tlog │ │ │ │ ├── main.obj │ │ │ │ └── vc141.pdb │ │ │ ├── MTDriver_FSDHook.inf │ │ │ ├── MTDriver_FSDHook.vcxproj │ │ │ ├── MTDriver_FSDHook.vcxproj.filters │ │ │ ├── MTDriver_FSDHook.vcxproj.user │ │ │ └── main.c │ │ └── MTDriver_FSDHook.sln │ └── README.md ├── MT-InlineHook/ │ ├── MTDriver_InlineHook/ │ │ ├── .vs/ │ │ │ └── MTDriver_InlineHook/ │ │ │ └── v15/ │ │ │ ├── .suo │ │ │ └── ipch/ │ │ │ └── AutoPCH/ │ │ │ └── b78f01da8bea5d01/ │ │ │ └── MAIN.ipch │ │ ├── Debug/ │ │ │ ├── MTDriver_InlineHook/ │ │ │ │ ├── MTDriver_InlineHook.inf │ │ │ │ ├── MTDriver_InlineHook.sys │ │ │ │ └── mtdriver_inlinehook.cat │ │ │ ├── MTDriver_InlineHook.cer │ │ │ ├── MTDriver_InlineHook.inf │ │ │ ├── MTDriver_InlineHook.pdb │ │ │ └── MTDriver_InlineHook.sys │ │ ├── MTDriver_InlineHook/ │ │ │ ├── Debug/ │ │ │ │ ├── MTDriver.C37E8113.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── Inf2Cat.command.1.tlog │ │ │ │ │ ├── MTDriver_InlineHook.lastbuildstate │ │ │ │ │ ├── inf2cat-expand.25376.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.25376.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.26020.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.26020.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.28376.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.28376.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.write.1.tlog │ │ │ │ │ ├── inf2cat.read.1.tlog │ │ │ │ │ ├── inf2cat.read.9.tlog │ │ │ │ │ ├── inf2cat.write.1.tlog │ │ │ │ │ ├── inf2cat.write.9.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ ├── link.write.1.tlog │ │ │ │ │ ├── signtool.command.1.tlog │ │ │ │ │ ├── signtool.read.1.tlog │ │ │ │ │ ├── signtool.timestamp.1.tlog │ │ │ │ │ ├── signtool.write.1.tlog │ │ │ │ │ ├── stampinf.command.1.tlog │ │ │ │ │ ├── stampinf.read.1.tlog │ │ │ │ │ └── stampinf.write.1.tlog │ │ │ │ ├── MTDriver_InlineHook.Build.CppClean.log │ │ │ │ ├── MTDriver_InlineHook.inf │ │ │ │ ├── MTDriver_InlineHook.log │ │ │ │ ├── main.obj │ │ │ │ └── vc141.pdb │ │ │ ├── MTDriver_InlineHook.inf │ │ │ ├── MTDriver_InlineHook.vcxproj │ │ │ ├── MTDriver_InlineHook.vcxproj.filters │ │ │ ├── MTDriver_InlineHook.vcxproj.user │ │ │ ├── Release/ │ │ │ │ ├── MTDriver.C37E8113.tlog/ │ │ │ │ │ ├── MTDriver_InlineHook.lastbuildstate │ │ │ │ │ └── unsuccessfulbuild │ │ │ │ └── MTDriver_InlineHook.log │ │ │ ├── main.c │ │ │ └── x64/ │ │ │ └── Debug/ │ │ │ ├── MTDriver.C37E8113.tlog/ │ │ │ │ ├── MTDriver_InlineHook.lastbuildstate │ │ │ │ └── unsuccessfulbuild │ │ │ └── MTDriver_InlineHook.log │ │ └── MTDriver_InlineHook.sln │ └── README.md ├── MT-Keyboard/ │ ├── MTDriver_Keyboard/ │ │ ├── .vs/ │ │ │ └── MTDriver_Keyboard/ │ │ │ └── v15/ │ │ │ ├── .suo │ │ │ └── ipch/ │ │ │ └── AutoPCH/ │ │ │ ├── 40de891455df8586/ │ │ │ │ └── MAIN.ipch │ │ │ └── a588616c70272a7e/ │ │ │ └── MAIN.ipch │ │ ├── Debug/ │ │ │ ├── MTDriver_Keyboard/ │ │ │ │ ├── MTDriver_Keyboard.inf │ │ │ │ ├── MTDriver_Keyboard.sys │ │ │ │ └── mtdriver_keyboard.cat │ │ │ ├── MTDriver_Keyboard.cer │ │ │ ├── MTDriver_Keyboard.inf │ │ │ ├── MTDriver_Keyboard.pdb │ │ │ └── MTDriver_Keyboard.sys │ │ ├── MTDriver_Keyboard/ │ │ │ ├── Debug/ │ │ │ │ ├── MTDriver.7349ADCE.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── Inf2Cat.command.1.tlog │ │ │ │ │ ├── MTDriver_Keyboard.lastbuildstate │ │ │ │ │ ├── inf2cat-expand.11704.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.11704.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.write.1.tlog │ │ │ │ │ ├── inf2cat.read.1.tlog │ │ │ │ │ ├── inf2cat.write.1.tlog │ │ │ │ │ ├── inf2cat.write.9.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ ├── link.write.1.tlog │ │ │ │ │ ├── signtool.command.1.tlog │ │ │ │ │ ├── signtool.read.1.tlog │ │ │ │ │ ├── signtool.timestamp.1.tlog │ │ │ │ │ ├── signtool.write.1.tlog │ │ │ │ │ ├── stampinf.command.1.tlog │ │ │ │ │ ├── stampinf.read.1.tlog │ │ │ │ │ └── stampinf.write.1.tlog │ │ │ │ ├── MTDriver_Keyboard.Build.CppClean.log │ │ │ │ ├── MTDriver_Keyboard.inf │ │ │ │ ├── MTDriver_Keyboard.log │ │ │ │ ├── main.obj │ │ │ │ └── vc141.pdb │ │ │ ├── MTDriver_Keyboard.inf │ │ │ ├── MTDriver_Keyboard.vcxproj │ │ │ ├── MTDriver_Keyboard.vcxproj.filters │ │ │ ├── MTDriver_Keyboard.vcxproj.user │ │ │ └── main.c │ │ └── MTDriver_Keyboard.sln │ └── README.md ├── MT-KillProcess/ │ ├── MTApp_KillProcess/ │ │ ├── .vs/ │ │ │ └── MTApp_KillProcess/ │ │ │ └── v15/ │ │ │ ├── .suo │ │ │ └── ipch/ │ │ │ ├── 197f399e3100995f.ipch │ │ │ └── be9b370d6639c4ef.ipch │ │ ├── MTApp_KillProcess/ │ │ │ ├── Debug/ │ │ │ │ ├── MTApp_Ki.B8C4470C.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── MTApp_KillProcess.lastbuildstate │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ └── link.write.1.tlog │ │ │ │ ├── MTApp_KillProcess.log │ │ │ │ ├── MTApp_KillProcess.obj │ │ │ │ ├── MTApp_KillProcess.pch │ │ │ │ ├── pch.obj │ │ │ │ ├── vc141.idb │ │ │ │ └── vc141.pdb │ │ │ ├── MTApp_KillProcess.cpp │ │ │ ├── MTApp_KillProcess.vcxproj │ │ │ ├── MTApp_KillProcess.vcxproj.filters │ │ │ ├── MTApp_KillProcess.vcxproj.user │ │ │ ├── Release/ │ │ │ │ ├── MTApp_Ki.B8C4470C.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── MTApp_KillProcess.lastbuildstate │ │ │ │ │ ├── MTApp_KillProcess.write.1u.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ └── link.write.1.tlog │ │ │ │ ├── MTApp_KillProcess.Build.CppClean.log │ │ │ │ ├── MTApp_KillProcess.log │ │ │ │ ├── MTApp_KillProcess.obj │ │ │ │ ├── MTApp_KillProcess.pch │ │ │ │ ├── pch.obj │ │ │ │ └── vc141.pdb │ │ │ ├── pch.cpp │ │ │ └── pch.h │ │ └── MTApp_KillProcess.sln │ ├── MTDriver_KillProcess/ │ │ ├── .vs/ │ │ │ └── MTDriver_KillProcess/ │ │ │ └── v15/ │ │ │ ├── .suo │ │ │ └── ipch/ │ │ │ └── AutoPCH/ │ │ │ └── 40b681dc507195b2/ │ │ │ └── MIAN.ipch │ │ ├── MTDriver_KillProcess/ │ │ │ ├── Debug/ │ │ │ │ ├── MTDriver.6B0AF623.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── Inf2Cat.command.1.tlog │ │ │ │ │ ├── MTDriver_KillProcess.lastbuildstate │ │ │ │ │ ├── inf2cat-expand.7560.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.7560.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.write.1.tlog │ │ │ │ │ ├── inf2cat.read.1.tlog │ │ │ │ │ ├── inf2cat.write.1.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ ├── link.write.1.tlog │ │ │ │ │ ├── signtool.command.1.tlog │ │ │ │ │ ├── signtool.read.1.tlog │ │ │ │ │ ├── signtool.timestamp.1.tlog │ │ │ │ │ ├── signtool.write.1.tlog │ │ │ │ │ ├── stampinf.command.1.tlog │ │ │ │ │ ├── stampinf.read.1.tlog │ │ │ │ │ └── stampinf.write.1.tlog │ │ │ │ ├── MTDriver_KillProcess.Build.CppClean.log │ │ │ │ ├── MTDriver_KillProcess.inf │ │ │ │ ├── MTDriver_KillProcess.log │ │ │ │ ├── mian.obj │ │ │ │ └── vc141.pdb │ │ │ ├── MTDriver_KillProcess.inf │ │ │ ├── MTDriver_KillProcess.vcxproj │ │ │ ├── MTDriver_KillProcess.vcxproj.filters │ │ │ ├── MTDriver_KillProcess.vcxproj.user │ │ │ └── mian.c │ │ └── MTDriver_KillProcess.sln │ └── README.md ├── MT-Test/ │ ├── MTDriver_Test/ │ │ ├── .vs/ │ │ │ └── MTDriver_Test/ │ │ │ └── v15/ │ │ │ ├── .suo │ │ │ └── ipch/ │ │ │ └── AutoPCH/ │ │ │ ├── 6bb95a74bcad4625/ │ │ │ │ └── MAIN.ipch │ │ │ └── 6f99f5a3faddb305/ │ │ │ └── MAIN.ipch │ │ ├── Debug/ │ │ │ ├── MTDriver_Test/ │ │ │ │ ├── MTDriver_Test.inf │ │ │ │ ├── MTDriver_Test.sys │ │ │ │ └── mtdriver_test.cat │ │ │ ├── MTDriver_Test.cer │ │ │ ├── MTDriver_Test.inf │ │ │ ├── MTDriver_Test.pdb │ │ │ └── MTDriver_Test.sys │ │ ├── MTDriver_Test/ │ │ │ ├── Debug/ │ │ │ │ ├── MTDriver_Test.Build.CppClean.log │ │ │ │ ├── MTDriver_Test.inf │ │ │ │ ├── MTDriver_Test.log │ │ │ │ ├── MTDriver_Test.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── Inf2Cat.command.1.tlog │ │ │ │ │ ├── MTDriver_Test.lastbuildstate │ │ │ │ │ ├── inf2cat-expand.10056.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.10056.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.write.1.tlog │ │ │ │ │ ├── inf2cat.read.1.tlog │ │ │ │ │ ├── inf2cat.read.9.tlog │ │ │ │ │ ├── inf2cat.write.1.tlog │ │ │ │ │ ├── inf2cat.write.9.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ ├── link.write.1.tlog │ │ │ │ │ ├── signtool.command.1.tlog │ │ │ │ │ ├── signtool.read.1.tlog │ │ │ │ │ ├── signtool.timestamp.1.tlog │ │ │ │ │ ├── signtool.write.1.tlog │ │ │ │ │ ├── stampinf.command.1.tlog │ │ │ │ │ ├── stampinf.read.1.tlog │ │ │ │ │ └── stampinf.write.1.tlog │ │ │ │ ├── main.obj │ │ │ │ └── vc141.pdb │ │ │ ├── MTDriver_Test.inf │ │ │ ├── MTDriver_Test.vcxproj │ │ │ ├── MTDriver_Test.vcxproj.filters │ │ │ ├── MTDriver_Test.vcxproj.user │ │ │ └── main.c │ │ └── MTDriver_Test.sln │ └── README.md ├── MT-Thread/ │ ├── MTDriver_Thread/ │ │ ├── Debug/ │ │ │ ├── MTDriver_Thread/ │ │ │ │ ├── MTDriver_Thread.inf │ │ │ │ ├── MTDriver_Thread.sys │ │ │ │ └── mtdriver_thread.cat │ │ │ ├── MTDriver_Thread.cer │ │ │ ├── MTDriver_Thread.inf │ │ │ ├── MTDriver_Thread.pdb │ │ │ └── MTDriver_Thread.sys │ │ ├── MTDriver_Thread/ │ │ │ ├── Debug/ │ │ │ │ ├── MTDriver_Thread.Build.CppClean.log │ │ │ │ ├── MTDriver_Thread.inf │ │ │ │ ├── MTDriver_Thread.log │ │ │ │ ├── MTDriver_Thread.tlog/ │ │ │ │ │ ├── CL.command.1.tlog │ │ │ │ │ ├── CL.read.1.tlog │ │ │ │ │ ├── CL.write.1.tlog │ │ │ │ │ ├── Inf2Cat.command.1.tlog │ │ │ │ │ ├── MTDriver_Thread.lastbuildstate │ │ │ │ │ ├── inf2cat-expand.22668.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.22668.write.1.tlog │ │ │ │ │ ├── inf2cat-expand.read.1.tlog │ │ │ │ │ ├── inf2cat-expand.write.1.tlog │ │ │ │ │ ├── inf2cat.read.1.tlog │ │ │ │ │ ├── inf2cat.read.9.tlog │ │ │ │ │ ├── inf2cat.write.1.tlog │ │ │ │ │ ├── inf2cat.write.9.tlog │ │ │ │ │ ├── link.command.1.tlog │ │ │ │ │ ├── link.read.1.tlog │ │ │ │ │ ├── link.write.1.tlog │ │ │ │ │ ├── signtool.command.1.tlog │ │ │ │ │ ├── signtool.read.1.tlog │ │ │ │ │ ├── signtool.timestamp.1.tlog │ │ │ │ │ ├── signtool.write.1.tlog │ │ │ │ │ ├── stampinf.command.1.tlog │ │ │ │ │ ├── stampinf.read.1.tlog │ │ │ │ │ └── stampinf.write.1.tlog │ │ │ │ ├── main.obj │ │ │ │ └── vc141.pdb │ │ │ ├── MTDriver_Thread.inf │ │ │ ├── MTDriver_Thread.vcxproj │ │ │ ├── MTDriver_Thread.vcxproj.filters │ │ │ ├── MTDriver_Thread.vcxproj.user │ │ │ └── main.c │ │ └── MTDriver_Thread.sln │ └── README.md └── README.md ================================================ FILE CONTENTS ================================================ ================================================ FILE: MT-Callback/MTDriver_Callback/.vs/MTDriver_Callback/v15/ipch/AutoPCH/3ada06f9b493e64a/MAIN.ipch ================================================ [File too large to display: 18.1 MB] ================================================ FILE: MT-Callback/MTDriver_Callback/Debug/MTDriver_Callback/MTDriver_Callback.inf ================================================ ; ; MTDriver_Callback.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 02/12/2019,16.47.29.66 CatalogFile=MTDriver_Callback.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Callback Source Disk" ================================================ FILE: MT-Callback/MTDriver_Callback/Debug/MTDriver_Callback.inf ================================================ ; ; MTDriver_Callback.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 02/12/2019,16.47.29.66 CatalogFile=MTDriver_Callback.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Callback Source Disk" ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/Debug/MTDriver.A4EEAE48.tlog/MTDriver_Callback.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17763.0 Debug|Win32|C:\Users\G4rb3n\source\repos\MTDriver_Callback\| ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/Debug/MTDriver.A4EEAE48.tlog/signtool.timestamp.1.tlog ================================================ C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_CALLBACK\DEBUG\MTDRIVER_CALLBACK.SYS|636855580501940413 C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_CALLBACK\DEBUG\MTDRIVER_CALLBACK\MTDRIVER_CALLBACK.CAT|636855580508054059 ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/Debug/MTDriver_Callback.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\main.obj c:\users\g4rb3n\source\repos\mtdriver_callback\debug\mtdriver_callback\mtdriver_callback.cat c:\users\g4rb3n\source\repos\mtdriver_callback\debug\mtdriver_callback.sys c:\users\g4rb3n\source\repos\mtdriver_callback\debug\mtdriver_callback.pdb c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver_callback.inf c:\users\g4rb3n\source\repos\mtdriver_callback\debug\mtdriver_callback.cer c:\users\g4rb3n\source\repos\mtdriver_callback\debug\mtdriver_callback.inf c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\cl.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\inf2cat-expand.7152.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\inf2cat-expand.7152.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\inf2cat-expand.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\inf2cat-expand.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\inf2cat.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\inf2cat.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\inf2cat.read.9.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\inf2cat.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\inf2cat.write.9.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\link.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\link.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\link.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\signtool.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\signtool.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\signtool.timestamp.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\signtool.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\stampinf.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\stampinf.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\debug\mtdriver.a4eeae48.tlog\stampinf.write.1.tlog ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/Debug/MTDriver_Callback.inf ================================================ ; ; MTDriver_Callback.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 02/12/2019,16.47.29.66 CatalogFile=MTDriver_Callback.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Callback Source Disk" ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/Debug/MTDriver_Callback.log ================================================  Building 'MTDriver_Callback' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. Stamping Debug\MTDriver_Callback.inf Stamping [Version] section with DriverVer=02/12/2019,16.47.29.66 main.c c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\main.c(4): warning C4100: “ParentID”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\main.c(26): warning C4100: “pDriver”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\main.c(28): warning C4189: “stats”: 局部变量已初始化但不引用 c:\users\g4rb3n\source\repos\mtdriver_callback\mtdriver_callback\main.c(34): warning C4100: “RegPath”: 未引用的形参 MTDriver_Callback.vcxproj -> C:\Users\G4rb3n\source\repos\MTDriver_Callback\Debug\MTDriver_Callback.sys Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_Callback\Debug\MTDriver_Callback.sys ........................ Signability test complete. Errors: None Warnings: None Catalog generation complete. C:\Users\G4rb3n\source\repos\MTDriver_Callback\Debug\MTDriver_Callback\mtdriver_callback.cat Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_Callback\Debug\MTDriver_Callback\mtdriver_callback.cat ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/MTDriver_Callback.inf ================================================ ; ; MTDriver_Callback.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer= CatalogFile=MTDriver_Callback.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NT$ARCH$ [Standard.NT$ARCH$] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Callback Source Disk" ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/MTDriver_Callback.vcxproj ================================================  Debug Win32 Release Win32 Debug x64 Release x64 Debug ARM Release ARM Debug ARM64 Release ARM64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC} {dd38f7fc-d7bd-488b-9242-7d8754cde80d} v4.5 12.0 Debug Win32 MTDriver_Callback Windows7 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger false ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/MTDriver_Callback.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms {8E41214B-6785-4CFE-B992-037D68949A14} inf;inv;inx;mof;mc; Driver Files Source Files ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/MTDriver_Callback.vcxproj.user ================================================  ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback/main.c ================================================ #include // صCreateProcCallback VOID CreateProcCallback(HANDLE ParentID, HANDLE ProcessID, BOOLEAN Create) { if (Create) { PEPROCESS Process = NULL; NTSTATUS status = PsLookupProcessByProcessId(ProcessID, &Process); // PIDȡ̽ṹĵַ int i; if (NT_SUCCESS(status)) { for (i = 0; i < 3 * PAGE_SIZE; i++) { if (!strncmp("notepad.exe", (PCHAR)Process + i, strlen("notepad.exe"))) // жϽǷΪnotepad.exe { DbgPrint("Proces %s is created!\n", (PCHAR)((ULONG)Process + i)); break; } } } } } //豸жغ NTSTATUS DriverUnload(PDRIVER_OBJECT pDriver) { NTSTATUS stats = PsSetCreateProcessNotifyRoutine(CreateProcCallback, TRUE); return STATUS_SUCCESS; } // ں NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING RegPath) { DbgPrint("Enter the driver\n"); pDriver->DriverUnload = DriverUnload; NTSTATUS stats = PsSetCreateProcessNotifyRoutine(CreateProcCallback, FALSE); // ע̴¼ĻصCreateProcCallback return stats; } ================================================ FILE: MT-Callback/MTDriver_Callback/MTDriver_Callback.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28307.168 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTDriver_Callback", "MTDriver_Callback\MTDriver_Callback.vcxproj", "{A4EEAE48-0740-4A75-85A1-F89BDDD236EC}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|ARM = Release|ARM Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|ARM.ActiveCfg = Debug|ARM {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|ARM.Build.0 = Debug|ARM {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|ARM.Deploy.0 = Debug|ARM {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|ARM64.ActiveCfg = Debug|ARM64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|ARM64.Build.0 = Debug|ARM64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|ARM64.Deploy.0 = Debug|ARM64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|x64.ActiveCfg = Debug|x64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|x64.Build.0 = Debug|x64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|x64.Deploy.0 = Debug|x64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|x86.ActiveCfg = Debug|Win32 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|x86.Build.0 = Debug|Win32 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Debug|x86.Deploy.0 = Debug|Win32 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|ARM.ActiveCfg = Release|ARM {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|ARM.Build.0 = Release|ARM {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|ARM.Deploy.0 = Release|ARM {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|ARM64.ActiveCfg = Release|ARM64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|ARM64.Build.0 = Release|ARM64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|ARM64.Deploy.0 = Release|ARM64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|x64.ActiveCfg = Release|x64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|x64.Build.0 = Release|x64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|x64.Deploy.0 = Release|x64 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|x86.ActiveCfg = Release|Win32 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|x86.Build.0 = Release|Win32 {A4EEAE48-0740-4A75-85A1-F89BDDD236EC}.Release|x86.Deploy.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {ABCDCC59-DC70-40A0-913B-4A3FF99C0E33} EndGlobalSection EndGlobal ================================================ FILE: MT-Callback/README.md ================================================ # MT-Callback ``` . | |-- MTDriver_Callback // 回调函数驱动 | . ``` ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/.vs/MTDriver_CheckTime/v15/ipch/AutoPCH/756df4b90d1a5cb0/MAIN.ipch ================================================ [File too large to display: 14.1 MB] ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/Debug/MTDriver_CheckTime/MTDriver_CheckTime.inf ================================================ ; ; MTDriver_CheckTime.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 04/17/2019,14.50.19.214 CatalogFile=MTDriver_CheckTime.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_CheckTime Source Disk" ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/Debug/MTDriver_CheckTime.inf ================================================ ; ; MTDriver_CheckTime.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 04/17/2019,14.50.19.214 CatalogFile=MTDriver_CheckTime.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_CheckTime Source Disk" ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/Debug/MTDriver.3BE854CE.tlog/MTDriver_CheckTime.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17763.0 Debug|Win32|C:\Users\G4rb3n\source\repos\MTDriver_CheckTime\| ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/Debug/MTDriver.3BE854CE.tlog/signtool.timestamp.1.tlog ================================================ C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_CHECKTIME\DEBUG\MTDRIVER_CHECKTIME.SYS|636910806198743690 C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_CHECKTIME\DEBUG\MTDRIVER_CHECKTIME\MTDRIVER_CHECKTIME.CAT|636910806204054784 ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/Debug/MTDriver_CheckTime.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\main.obj c:\users\g4rb3n\source\repos\mtdriver_checktime\debug\mtdriver_checktime\mtdriver_checktime.cat c:\users\g4rb3n\source\repos\mtdriver_checktime\debug\mtdriver_checktime.sys c:\users\g4rb3n\source\repos\mtdriver_checktime\debug\mtdriver_checktime.pdb c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver_checktime.inf c:\users\g4rb3n\source\repos\mtdriver_checktime\debug\mtdriver_checktime.cer c:\users\g4rb3n\source\repos\mtdriver_checktime\debug\mtdriver_checktime.inf c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\cl.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\inf2cat-expand.12592.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\inf2cat-expand.12592.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\inf2cat-expand.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\inf2cat-expand.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\inf2cat.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\inf2cat.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\inf2cat.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\link.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\link.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\link.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\signtool.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\signtool.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\signtool.timestamp.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\signtool.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\stampinf.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\stampinf.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\debug\mtdriver.3be854ce.tlog\stampinf.write.1.tlog ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/Debug/MTDriver_CheckTime.inf ================================================ ; ; MTDriver_CheckTime.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 04/17/2019,14.50.19.214 CatalogFile=MTDriver_CheckTime.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_CheckTime Source Disk" ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/Debug/MTDriver_CheckTime.log ================================================  Building 'MTDriver_CheckTime' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. Stamping Debug\MTDriver_CheckTime.inf Stamping [Version] section with DriverVer=04/17/2019,14.50.19.214 main.c c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\main.c(14): warning C4100: “dDriver”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\main.c(26): warning C4101: “tickcount”: 未引用的局部变量 c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\main.c(109): warning C4113: “void (__stdcall *)()”和“PKSTART_ROUTINE”的参数列表不同 c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\main.c(100): warning C4100: “RegPath”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\main.c(53): warning C4702: 无法访问的代码 c:\users\g4rb3n\source\repos\mtdriver_checktime\mtdriver_checktime\main.c(75): warning C4715: “CheckTimeLocal”: 不是所有的控件路径都返回值 MTDriver_CheckTime.vcxproj -> C:\Users\G4rb3n\source\repos\MTDriver_CheckTime\Debug\MTDriver_CheckTime.sys Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_CheckTime\Debug\MTDriver_CheckTime.sys ........................ Signability test complete. Errors: None Warnings: None Catalog generation complete. C:\Users\G4rb3n\source\repos\MTDriver_CheckTime\Debug\MTDriver_CheckTime\mtdriver_checktime.cat Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_CheckTime\Debug\MTDriver_CheckTime\mtdriver_checktime.cat ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/MTDriver_CheckTime.inf ================================================ ; ; MTDriver_CheckTime.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer= CatalogFile=MTDriver_CheckTime.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NT$ARCH$ [Standard.NT$ARCH$] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_CheckTime Source Disk" ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/MTDriver_CheckTime.vcxproj ================================================  Debug Win32 Release Win32 Debug x64 Release x64 Debug ARM Release ARM Debug ARM64 Release ARM64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B} {dd38f7fc-d7bd-488b-9242-7d8754cde80d} v4.5 12.0 Debug Win32 MTDriver_CheckTime Windows7 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger false ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/MTDriver_CheckTime.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms {8E41214B-6785-4CFE-B992-037D68949A14} inf;inv;inx;mof;mc; Driver Files Source Files ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/MTDriver_CheckTime.vcxproj.user ================================================  DBG ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime/main.c ================================================ #include #include #define SECOND_OF_DAY 86400 UINT8 DayOfMon[12] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }; ULONG BanedTime = 1568431212; // 2019.9.14 11:20:12 extern POBJECT_TYPE* PsThreadType; PETHREAD pThreadObj = NULL; BOOLEAN TimeSwitch = FALSE; // жغ NTSTATUS DriverUnload(PDRIVER_OBJECT dDriver) { TimeSwitch = TRUE; // ȴ߳˳ KeWaitForSingleObject(pThreadObj, Executive, KernelMode, FALSE, NULL); ObReferenceObject(pThreadObj); return STATUS_SUCCESS; } // Уʱ亯 BOOLEAN CheckTimeLocal() { LARGE_INTEGER snow, now, tickcount; TIME_FIELDS now_fields; // ȡ׼ʱ KeQuerySystemTime(&snow); // תΪʱ ExSystemTimeToLocalTime(&snow, &now); // ꡢ¡աʱ֡ RtlTimeToTimeFields(&now, &now_fields); // ӡ DbgPrint("ǰʱ䣺%d-%d-%d\n", now_fields.Year, now_fields.Month, now_fields.Day); SHORT i, Cyear = 0; ULONG CountDay = 0; // ʱ㷨 for ( i = 1970; i < now_fields.Year; i++) { if ((i % 4 == 0) && (i % 100 != 0) || (i % 400 == 0)) { Cyear++; } } CountDay = Cyear * 366 + (now_fields.Year - 1970 - Cyear) * 365; for ( i = 1; i < now_fields.Month; i++) { if ((i == 2) && (((now_fields.Year % 4 == 0) && (now_fields.Year % 100 != 0)) || (now_fields.Year % 400 == 0))) { CountDay += 29; } else { CountDay += DayOfMon[i - 1]; } CountDay += (now_fields.Day - 1); CountDay = CountDay * SECOND_OF_DAY + (unsigned long)now_fields.Hour * 3600 + (unsigned long)now_fields.Minute * 60 + now_fields.Second; // Աʱ DbgPrint("ʱ %d", CountDay); if (CountDay < BanedTime) { return TRUE; } return FALSE; } } // ʱУ߳ VOID CheckTimeThread() { LARGE_INTEGER SleepTime; SleepTime.QuadPart = -20000000; DbgPrint("Enter The Thread\n"); while (1) { if (TimeSwitch) { break; } if (!CheckTimeLocal()) { DbgPrint("Ч\n"); } KeDelayExecutionThread(KernelMode, FALSE, &SleepTime); } PsTerminateSystemThread(STATUS_SUCCESS); } // ں NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING RegPath) { pDriver->DriverUnload = DriverUnload; // עжغ OBJECT_ATTRIBUTES ObjAddr = { 0 }; HANDLE ThreadHandle = 0; // ʼ InitializeObjectAttributes(&ObjAddr, NULL, OBJ_KERNEL_HANDLE, 0, NULL); // ߳ NTSTATUS status = PsCreateSystemThread(&ThreadHandle, THREAD_ALL_ACCESS, &ObjAddr, NULL, NULL, CheckTimeThread, NULL); if (!NT_SUCCESS(status)) { return STATUS_NOT_SUPPORTED; } // ȡ̶߳ status = ObReferenceObjectByHandle(ThreadHandle, THREAD_ALL_ACCESS, *PsThreadType, KernelMode, &pThreadObj, NULL); if (!NT_SUCCESS(status)) { ZwClose(ThreadHandle); return STATUS_NOT_SUPPORTED; } ZwClose(ThreadHandle); DbgPrint("ʼ\n"); return STATUS_SUCCESS; } ================================================ FILE: MT-CheckTime/MTDriver_CheckTime/MTDriver_CheckTime.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28307.572 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTDriver_CheckTime", "MTDriver_CheckTime\MTDriver_CheckTime.vcxproj", "{3BE854CE-E439-49BD-A25E-9A7DBF85E37B}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|ARM = Release|ARM Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|ARM.ActiveCfg = Debug|ARM {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|ARM.Build.0 = Debug|ARM {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|ARM.Deploy.0 = Debug|ARM {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|ARM64.ActiveCfg = Debug|ARM64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|ARM64.Build.0 = Debug|ARM64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|ARM64.Deploy.0 = Debug|ARM64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|x64.ActiveCfg = Debug|x64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|x64.Build.0 = Debug|x64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|x64.Deploy.0 = Debug|x64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|x86.ActiveCfg = Debug|Win32 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|x86.Build.0 = Debug|Win32 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Debug|x86.Deploy.0 = Debug|Win32 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|ARM.ActiveCfg = Release|ARM {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|ARM.Build.0 = Release|ARM {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|ARM.Deploy.0 = Release|ARM {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|ARM64.ActiveCfg = Release|ARM64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|ARM64.Build.0 = Release|ARM64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|ARM64.Deploy.0 = Release|ARM64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|x64.ActiveCfg = Release|x64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|x64.Build.0 = Release|x64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|x64.Deploy.0 = Release|x64 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|x86.ActiveCfg = Release|Win32 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|x86.Build.0 = Release|Win32 {3BE854CE-E439-49BD-A25E-9A7DBF85E37B}.Release|x86.Deploy.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {0CE446D9-FB40-4E70-A516-BE0CB08E960F} EndGlobalSection EndGlobal ================================================ FILE: MT-CheckTime/README.md ================================================ # MT-Callback ``` . | |-- MTDriver_CheckTime // 本地时间校验驱动 | . ``` ================================================ FILE: MT-Communication/MTApp_Communication/.vs/MTApp_Communication/v15/ipch/AutoPCH/84ee152770875a5d/COMBASEAPI.ipch ================================================ [File too large to display: 37.1 MB] ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication/Debug/MTApp_Co.77C8ADF1.tlog/MTApp_Communication.lastbuildstate ================================================ #TargetFrameworkVersion=v4.0:PlatformToolSet=v141:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Debug|Win32|C:\Users\G4rb3n\source\repos\MTApp_Communication\| ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication/Debug/MTApp_Communication.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\mtapp_communication.pch c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\vc141.idb c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\pch.obj c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\mtapp_communication.obj c:\users\g4rb3n\source\repos\mtapp_communication\debug\mtapp_communication.ilk c:\users\g4rb3n\source\repos\mtapp_communication\debug\mtapp_communication.exe c:\users\g4rb3n\source\repos\mtapp_communication\debug\mtapp_communication.pdb c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\mtapp_co.77c8adf1.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\mtapp_co.77c8adf1.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\mtapp_co.77c8adf1.tlog\cl.write.1.tlog c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\mtapp_co.77c8adf1.tlog\link.command.1.tlog c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\mtapp_co.77c8adf1.tlog\link.read.1.tlog c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\debug\mtapp_co.77c8adf1.tlog\link.write.1.tlog ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication/Debug/MTApp_Communication.log ================================================  MTApp_Communication.cpp MTApp_Communication.vcxproj -> C:\Users\G4rb3n\source\repos\MTApp_Communication\Debug\MTApp_Communication.exe ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication/MTApp_Communication.vcxproj ================================================ Debug Win32 Release Win32 Debug x64 Release x64 15.0 {77C8ADF1-5DCA-4A50-9E75-038C9C59CB11} Win32Proj MTAppCommunication 10.0.17134.0 Application true v141 Unicode Application false v141 true Unicode Application true v141 Unicode Application false v141 true Unicode true true false false Use Level3 Disabled true WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) true pch.h Console true Use Level3 Disabled true _DEBUG;_CONSOLE;%(PreprocessorDefinitions) true pch.h Console true Use Level3 MaxSpeed true true true WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true pch.h Console true true true Use Level3 MaxSpeed true true true NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true pch.h Console true true true Create Create Create Create ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication/MTApp_Communication.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hh;hpp;hxx;hm;inl;inc;ipp;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 头文件 源文件 源文件 ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication/MTApp_Communication.vcxproj.user ================================================  ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication/Release/MTApp_Co.77C8ADF1.tlog/MTApp_Communication.lastbuildstate ================================================ #TargetFrameworkVersion=v4.0:PlatformToolSet=v141:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Release|Win32|C:\Users\G4rb3n\source\repos\MTApp_Communication\| ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication/Release/MTApp_Communication.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\release\mtapp_communication.pch c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\release\vc141.pdb c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\release\pch.obj c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\release\mtapp_co.77c8adf1.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\release\mtapp_co.77c8adf1.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtapp_communication\mtapp_communication\release\mtapp_co.77c8adf1.tlog\cl.write.1.tlog ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication/Release/MTApp_Communication.log ================================================  pch.cpp MTApp_Communication.cpp 正在生成代码 All 4 functions were compiled because no usable IPDB/IOBJ from previous compilation was found. 已完成代码的生成 MTApp_Communication.vcxproj -> C:\Users\G4rb3n\source\repos\MTApp_Communication\Release\MTApp_Communication.exe ================================================ FILE: MT-Communication/MTApp_Communication/MTApp_Communication.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28010.2016 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTApp_Communication", "MTApp_Communication\MTApp_Communication.vcxproj", "{77C8ADF1-5DCA-4A50-9E75-038C9C59CB11}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {77C8ADF1-5DCA-4A50-9E75-038C9C59CB11}.Debug|x64.ActiveCfg = Debug|x64 {77C8ADF1-5DCA-4A50-9E75-038C9C59CB11}.Debug|x64.Build.0 = Debug|x64 {77C8ADF1-5DCA-4A50-9E75-038C9C59CB11}.Debug|x86.ActiveCfg = Debug|Win32 {77C8ADF1-5DCA-4A50-9E75-038C9C59CB11}.Debug|x86.Build.0 = Debug|Win32 {77C8ADF1-5DCA-4A50-9E75-038C9C59CB11}.Release|x64.ActiveCfg = Release|x64 {77C8ADF1-5DCA-4A50-9E75-038C9C59CB11}.Release|x64.Build.0 = Release|x64 {77C8ADF1-5DCA-4A50-9E75-038C9C59CB11}.Release|x86.ActiveCfg = Release|Win32 {77C8ADF1-5DCA-4A50-9E75-038C9C59CB11}.Release|x86.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {EB5A9249-2C27-4541-8D4F-C72029C8C0B6} EndGlobalSection EndGlobal ================================================ FILE: MT-Communication/MTDriver_Communication/.vs/MTDriver_Communication/v15/ipch/AutoPCH/174fe7312286265b/MAIN.ipch ================================================ [File too large to display: 14.4 MB] ================================================ FILE: MT-Communication/MTDriver_Communication/.vs/MTDriver_Communication/v15/ipch/AutoPCH/ba5db423596ae06b/MAIN.ipch ================================================ [File too large to display: 14.9 MB] ================================================ FILE: MT-Communication/MTDriver_Communication/.vs/MTDriver_Communication/v15/ipch/AutoPCH/d25739d79f02633b/MAIN.ipch ================================================ [File too large to display: 13.9 MB] ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/Debug/MTDriver.F4B8434B.tlog/MTDriver_Communication.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Debug|Win32|C:\Users\G4rb3n\source\repos\MTDriver_Communication\| ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/Debug/MTDriver.F4B8434B.tlog/inf2cat.read.9.tlog ================================================ ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/Debug/MTDriver.F4B8434B.tlog/inf2cat.write.9.tlog ================================================ ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/Debug/MTDriver.F4B8434B.tlog/signtool.timestamp.1.tlog ================================================ C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_COMMUNICATION\DEBUG\MTDRIVER_COMMUNICATION.SYS|636727421941735231 C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_COMMUNICATION\DEBUG\MTDRIVER_COMMUNICATION\MTDRIVER_COMMUNICATION.CAT|636727421948198233 ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/Debug/MTDriver_Communication.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\main.obj c:\users\g4rb3n\source\repos\mtdriver_communication\debug\mtdriver_communication\mtdriver_communication.cat c:\users\g4rb3n\source\repos\mtdriver_communication\debug\mtdriver_communication.sys c:\users\g4rb3n\source\repos\mtdriver_communication\debug\mtdriver_communication.pdb c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver_communication.inf c:\users\g4rb3n\source\repos\mtdriver_communication\debug\mtdriver_communication.cer c:\users\g4rb3n\source\repos\mtdriver_communication\debug\mtdriver_communication.inf c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\cl.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\inf2cat-expand.21712.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\inf2cat-expand.21712.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\inf2cat-expand.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\inf2cat-expand.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\inf2cat.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\inf2cat.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\inf2cat.read.9.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\inf2cat.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\inf2cat.write.9.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\link.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\link.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\link.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\signtool.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\signtool.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\signtool.timestamp.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\signtool.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\stampinf.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\stampinf.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\debug\mtdriver.f4b8434b.tlog\stampinf.write.1.tlog ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/Debug/MTDriver_Communication.inf ================================================ ; ; MTDriver_Communication.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 09/17/2018,8.49.52.322 CatalogFile=MTDriver_Communication.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Communication Source Disk" ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/Debug/MTDriver_Communication.log ================================================  Building 'MTDriver_Communication' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. Stamping Debug\MTDriver_Communication.inf Stamping [Version] section with DriverVer=09/17/2018,8.49.52.322 main.c c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\main.c(12): warning C4100: “Device”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\main.c(23): warning C4100: “Device”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\main.c(39): warning C4100: “Device”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\main.c(50): warning C4100: “Driver”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\main.c(52): warning C4101: “status”: 未引用的局部变量 c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\main.c(74): warning C4047: “函数”:“BOOLEAN”与“void *”的间接级别不同 c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\main.c(74): warning C4024: “IoCreateDevice”: 形参和实参 6 的类型不同 c:\users\g4rb3n\source\repos\mtdriver_communication\mtdriver_communication\main.c(61): warning C4100: “RegPath”: 未引用的形参 MTDriver_Communication.vcxproj -> C:\Users\G4rb3n\source\repos\MTDriver_Communication\Debug\MTDriver_Communication.sys Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_Communication\Debug\MTDriver_Communication.sys ........................ Signability test complete. Errors: None Warnings: None Catalog generation complete. C:\Users\G4rb3n\source\repos\MTDriver_Communication\Debug\MTDriver_Communication\mtdriver_communication.cat Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_Communication\Debug\MTDriver_Communication\mtdriver_communication.cat ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/MTDriver_Communication.inf ================================================ ; ; MTDriver_Communication.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer= CatalogFile=MTDriver_Communication.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NT$ARCH$ [Standard.NT$ARCH$] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Communication Source Disk" ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/MTDriver_Communication.vcxproj ================================================  Debug Win32 Release Win32 Debug x64 Release x64 Debug ARM Release ARM Debug ARM64 Release ARM64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A} {dd38f7fc-d7bd-488b-9242-7d8754cde80d} v4.5 12.0 Debug Win32 MTDriver_Communication Windows7 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger false false ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/MTDriver_Communication.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms {8E41214B-6785-4CFE-B992-037D68949A14} inf;inv;inx;mof;mc; Driver Files Source Files ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/MTDriver_Communication.vcxproj.user ================================================  ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication/main.c ================================================ #include // 豸ͷ #define DEVICE_NAME L"\\Device\\MTReadDevice" #define SYM_LINK_NAME L"\\??\\MTRead" PDEVICE_OBJECT pDevice; UNICODE_STRING DeviceName; UNICODE_STRING SymLinkName; // 豸 NTSTATUS DeviceCreate(PDEVICE_OBJECT Device, PIRP pIrp) { pIrp->IoStatus.Status = STATUS_SUCCESS; pIrp->IoStatus.Information = 0; // I/O IoCompleteRequest(pIrp, IO_NO_INCREMENT); DbgPrint("Create Device Success\n"); return STATUS_SUCCESS; } // 豸 NTSTATUS DeviceRead(PDEVICE_OBJECT Device, PIRP pIrp) { // ȡָIRPĶջָ PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp); // ȡջ ULONG length = stack->Parameters.Read.Length; pIrp->IoStatus.Status = STATUS_SUCCESS; pIrp->IoStatus.Information = length; // ջϵȫΪ0xAA memset(pIrp->AssociatedIrp.SystemBuffer, 0xAA, length); IoCompleteRequest(pIrp, IO_NO_INCREMENT); DbgPrint("Read Device Success\n"); return STATUS_SUCCESS; } // 豸رպ NTSTATUS DeviceClose(PDEVICE_OBJECT Device, PIRP pIrp) { // 豸ͬ pIrp->IoStatus.Status = STATUS_SUCCESS; pIrp->IoStatus.Information = 0; IoCompleteRequest(pIrp, IO_NO_INCREMENT); DbgPrint("Close Device Success\n"); return STATUS_SUCCESS; } // жغ NTSTATUS DriverUnload(PDRIVER_OBJECT Driver) { NTSTATUS status; // ɾź豸 IoDeleteSymbolicLink(&SymLinkName); IoDeleteDevice(pDevice); DbgPrint("This Driver Is Unloading...\n"); return STATUS_SUCCESS; } // ں NTSTATUS DriverEntry(PDRIVER_OBJECT Driver, PUNICODE_STRING RegPath) { NTSTATUS status; // ע豸豸豸رպжغ Driver->MajorFunction[IRP_MJ_CREATE] = DeviceCreate; Driver->MajorFunction[IRP_MJ_READ] = DeviceRead; Driver->MajorFunction[IRP_MJ_CLOSE] = DeviceClose; Driver->DriverUnload = DriverUnload; // 豸תΪUnicodeַ RtlInitUnicodeString(&DeviceName, DEVICE_NAME); // 豸 status = IoCreateDevice(Driver, 0, &DeviceName, FILE_DEVICE_UNKNOWN, 0, NULL, &pDevice); if (!NT_SUCCESS(status)) { DbgPrint("Create Device Faild!\n"); return STATUS_UNSUCCESSFUL; } // תΪUnicodeַ RtlInitUnicodeString(&SymLinkName, SYM_LINK_NAME); // 豸 status = IoCreateSymbolicLink(&SymLinkName, &DeviceName); if (!NT_SUCCESS(status)) { DbgPrint("Create SymLink Faild!\n"); IoDeleteDevice(pDevice); return STATUS_UNSUCCESSFUL; } DbgPrint("Initialize Success\n"); // pDeviceԻʽȡ pDevice->Flags = DO_BUFFERED_IO; return STATUS_SUCCESS; } ================================================ FILE: MT-Communication/MTDriver_Communication/MTDriver_Communication.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28010.2016 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTDriver_Communication", "MTDriver_Communication\MTDriver_Communication.vcxproj", "{F4B8434B-9409-4A6A-B85B-7FAD21B0603A}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|ARM = Release|ARM Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|ARM.ActiveCfg = Debug|ARM {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|ARM.Build.0 = Debug|ARM {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|ARM.Deploy.0 = Debug|ARM {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|ARM64.ActiveCfg = Debug|ARM64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|ARM64.Build.0 = Debug|ARM64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|ARM64.Deploy.0 = Debug|ARM64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|x64.ActiveCfg = Debug|x64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|x64.Build.0 = Debug|x64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|x64.Deploy.0 = Debug|x64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|x86.ActiveCfg = Debug|Win32 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|x86.Build.0 = Debug|Win32 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Debug|x86.Deploy.0 = Debug|Win32 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|ARM.ActiveCfg = Release|ARM {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|ARM.Build.0 = Release|ARM {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|ARM.Deploy.0 = Release|ARM {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|ARM64.ActiveCfg = Release|ARM64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|ARM64.Build.0 = Release|ARM64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|ARM64.Deploy.0 = Release|ARM64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|x64.ActiveCfg = Release|x64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|x64.Build.0 = Release|x64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|x64.Deploy.0 = Release|x64 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|x86.ActiveCfg = Release|Win32 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|x86.Build.0 = Release|Win32 {F4B8434B-9409-4A6A-B85B-7FAD21B0603A}.Release|x86.Deploy.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {0FC61223-7825-4C55-94B1-79A4EC35BBDC} EndGlobalSection EndGlobal ================================================ FILE: MT-Communication/README.md ================================================ # MT-Communication ``` . | |-- MTDriver_Communication // 驱动层 | |-- MTApp_Communication // 应用层 | . ``` ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/Debug/MTDriver_FSDHook/MTDriver_FSDHook.inf ================================================ ; ; MTDriver_FSDHook.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 11/21/2018,11.48.58.586 CatalogFile=MTDriver_FSDHook.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_FSDHook Source Disk" ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/Debug/MTDriver_FSDHook.inf ================================================ ; ; MTDriver_FSDHook.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 11/21/2018,11.48.58.586 CatalogFile=MTDriver_FSDHook.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_FSDHook Source Disk" ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/Debug/MTDriver_FSDHook.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\main.obj c:\users\g4rb3n\source\repos\mtdriver_fsdhook\debug\mtdriver_fsdhook\mtdriver_fsdhook.cat c:\users\g4rb3n\source\repos\mtdriver_fsdhook\debug\mtdriver_fsdhook.sys c:\users\g4rb3n\source\repos\mtdriver_fsdhook\debug\mtdriver_fsdhook.pdb c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.inf c:\users\g4rb3n\source\repos\mtdriver_fsdhook\debug\mtdriver_fsdhook.cer c:\users\g4rb3n\source\repos\mtdriver_fsdhook\debug\mtdriver_fsdhook.inf c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\cl.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\inf2cat-expand.14876.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\inf2cat-expand.14876.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\inf2cat-expand.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\inf2cat-expand.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\inf2cat.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\inf2cat.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\inf2cat.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\link.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\link.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\link.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\signtool.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\signtool.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\signtool.timestamp.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\signtool.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\stampinf.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\stampinf.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\debug\mtdriver_fsdhook.tlog\stampinf.write.1.tlog ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/Debug/MTDriver_FSDHook.inf ================================================ ; ; MTDriver_FSDHook.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 11/21/2018,11.48.58.586 CatalogFile=MTDriver_FSDHook.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_FSDHook Source Disk" ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/Debug/MTDriver_FSDHook.log ================================================  Building 'MTDriver_FSDHook' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. Stamping Debug\MTDriver_FSDHook.inf Stamping [Version] section with DriverVer=11/21/2018,11.48.58.586 main.c c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\main.c(25): warning C4100: “pDriver”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_fsdhook\mtdriver_fsdhook\main.c(46): warning C4100: “RegPath”: 未引用的形参 MTDriver_FSDHook.vcxproj -> C:\Users\G4rb3n\source\repos\MTDriver_FSDHook\Debug\MTDriver_FSDHook.sys Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_FSDHook\Debug\MTDriver_FSDHook.sys ........................ Signability test complete. Errors: None Warnings: None Catalog generation complete. C:\Users\G4rb3n\source\repos\MTDriver_FSDHook\Debug\MTDriver_FSDHook\mtdriver_fsdhook.cat Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_FSDHook\Debug\MTDriver_FSDHook\mtdriver_fsdhook.cat ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/Debug/MTDriver_FSDHook.tlog/MTDriver_FSDHook.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Debug|Win32|C:\Users\G4rb3n\source\repos\MTDriver_FSDHook\| ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/Debug/MTDriver_FSDHook.tlog/signtool.timestamp.1.tlog ================================================ C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_FSDHOOK\DEBUG\MTDRIVER_FSDHOOK.SYS|636783689406456107 C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_FSDHOOK\DEBUG\MTDRIVER_FSDHOOK\MTDRIVER_FSDHOOK.CAT|636783689416589573 ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/MTDriver_FSDHook.inf ================================================ ; ; MTDriver_FSDHook.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer= CatalogFile=MTDriver_FSDHook.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NT$ARCH$ [Standard.NT$ARCH$] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_FSDHook Source Disk" ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/MTDriver_FSDHook.vcxproj ================================================  Debug Win32 Release Win32 Debug x64 Release x64 Debug ARM Release ARM Debug ARM64 Release ARM64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79} {dd38f7fc-d7bd-488b-9242-7d8754cde80d} v4.5 12.0 Debug Win32 MTDriver_FSDHook Windows7 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger false false ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/MTDriver_FSDHook.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms {8E41214B-6785-4CFE-B992-037D68949A14} inf;inv;inx;mof;mc; Driver Files Source Files ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/MTDriver_FSDHook.vcxproj.user ================================================  ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook/main.c ================================================ #include #include extern POBJECT_TYPE *IoDriverObjectType; PDRIVER_OBJECT kbdDriver = NULL; typedef NTSTATUS(*POldReadDispatch)(PDEVICE_OBJECT pDevice, PIRP pIrp); POldReadDispatch OldReadDispatch = NULL; // ΢δObReferenceObjectByName() NTSTATUS ObReferenceObjectByName( PUNICODE_STRING ObjectName, ULONG Attributes, PACCESS_STATE AccessState, ACCESS_MASK DesiredAccess, POBJECT_TYPE ObjectType, KPROCESSOR_MODE AccessMode, PVOID ParseContest, PVOID *Object ); //豸жغ NTSTATUS DriverUnload(PDRIVER_OBJECT pDriver) { DbgPrint("The Driver is Unloading...\n"); // жʱ˻ԭ if (kbdDriver != NULL) { kbdDriver->MajorFunction[IRP_MJ_READ] = OldReadDispatch; } return STATUS_SUCCESS; } // Hook NTSTATUS HookDispatch(PDEVICE_OBJECT pDevice,PIRP pIrp) { // лʱúͻᱻãԶúĹܣʾӡһ仰 DbgPrint("----Hook KeyBoard Read----\n"); // ٵûԭDzü return OldReadDispatch(pDevice, pIrp); } // ں NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING RegPath) { pDriver->DriverUnload = DriverUnload; // עжغ UNICODE_STRING kbdName = RTL_CONSTANT_STRING(L"\\Driver\\Kbdclass"); NTSTATUS status = ObReferenceObjectByName(&kbdName, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &kbdDriver); // ȡĶ󣬱kbdDriver if (!NT_SUCCESS(status)) { DbgPrint("Open Keyboard Driver Failed\n"); return status; } else { // ObDereferenceObject(kbdDriver); } OldReadDispatch = (POldReadDispatch)kbdDriver->MajorFunction[IRP_MJ_READ]; // 滻֮ǰȱREADDzַԱ kbdDriver->MajorFunction[IRP_MJ_READ] = HookDispatch; // READDz滻ΪǵHook return status; } ================================================ FILE: MT-FSDHook/MTDriver_FSDHook/MTDriver_FSDHook.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28010.2016 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTDriver_FSDHook", "MTDriver_FSDHook\MTDriver_FSDHook.vcxproj", "{26DB2B77-185C-4D9B-97C8-75AB131F0D79}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|ARM = Release|ARM Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|ARM.ActiveCfg = Debug|ARM {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|ARM.Build.0 = Debug|ARM {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|ARM.Deploy.0 = Debug|ARM {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|ARM64.ActiveCfg = Debug|ARM64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|ARM64.Build.0 = Debug|ARM64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|ARM64.Deploy.0 = Debug|ARM64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|x64.ActiveCfg = Debug|x64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|x64.Build.0 = Debug|x64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|x64.Deploy.0 = Debug|x64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|x86.ActiveCfg = Debug|Win32 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|x86.Build.0 = Debug|Win32 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Debug|x86.Deploy.0 = Debug|Win32 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|ARM.ActiveCfg = Release|ARM {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|ARM.Build.0 = Release|ARM {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|ARM.Deploy.0 = Release|ARM {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|ARM64.ActiveCfg = Release|ARM64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|ARM64.Build.0 = Release|ARM64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|ARM64.Deploy.0 = Release|ARM64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|x64.ActiveCfg = Release|x64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|x64.Build.0 = Release|x64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|x64.Deploy.0 = Release|x64 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|x86.ActiveCfg = Release|Win32 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|x86.Build.0 = Release|Win32 {26DB2B77-185C-4D9B-97C8-75AB131F0D79}.Release|x86.Deploy.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {D418F8F5-9A85-454C-92C0-00D297A651AD} EndGlobalSection EndGlobal ================================================ FILE: MT-FSDHook/README.md ================================================ # MT-FSDHook ``` . | |-- MTDriver_FSDHook // FSD钩子驱动 | . ``` ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/.vs/MTDriver_InlineHook/v15/ipch/AutoPCH/b78f01da8bea5d01/MAIN.ipch ================================================ [File too large to display: 14.7 MB] ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/Debug/MTDriver_InlineHook/MTDriver_InlineHook.inf ================================================ ; ; MTDriver_InlineHook.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 01/04/2019,14.40.3.384 CatalogFile=MTDriver_InlineHook.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_InlineHook Source Disk" ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/Debug/MTDriver_InlineHook.inf ================================================ ; ; MTDriver_InlineHook.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 01/04/2019,14.40.3.384 CatalogFile=MTDriver_InlineHook.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_InlineHook Source Disk" ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Debug/MTDriver.C37E8113.tlog/MTDriver_InlineHook.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17763.0 Debug|Win32|C:\Users\G4rb3n\source\repos\MTDriver_InlineHook\| ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Debug/MTDriver.C37E8113.tlog/inf2cat.read.9.tlog ================================================ ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Debug/MTDriver.C37E8113.tlog/inf2cat.write.9.tlog ================================================ ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Debug/MTDriver.C37E8113.tlog/signtool.timestamp.1.tlog ================================================ C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_INLINEHOOK\DEBUG\MTDRIVER_INLINEHOOK.SYS|636821808048771942 C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_INLINEHOOK\DEBUG\MTDRIVER_INLINEHOOK\MTDRIVER_INLINEHOOK.CAT|636821808059393780 ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Debug/MTDriver_InlineHook.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\main.obj c:\users\g4rb3n\source\repos\mtdriver_inlinehook\debug\mtdriver_inlinehook\mtdriver_inlinehook.cat c:\users\g4rb3n\source\repos\mtdriver_inlinehook\debug\mtdriver_inlinehook.sys c:\users\g4rb3n\source\repos\mtdriver_inlinehook\debug\mtdriver_inlinehook.pdb c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver_inlinehook.inf c:\users\g4rb3n\source\repos\mtdriver_inlinehook\debug\mtdriver_inlinehook.cer c:\users\g4rb3n\source\repos\mtdriver_inlinehook\debug\mtdriver_inlinehook.inf c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\cl.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\inf2cat-expand.4364.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\inf2cat-expand.4364.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\inf2cat-expand.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\inf2cat-expand.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\inf2cat.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\inf2cat.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\inf2cat.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\link.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\link.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\link.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\signtool.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\signtool.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\signtool.timestamp.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\signtool.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\stampinf.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\stampinf.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\debug\mtdriver.c37e8113.tlog\stampinf.write.1.tlog ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Debug/MTDriver_InlineHook.inf ================================================ ; ; MTDriver_InlineHook.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 01/04/2019,14.40.3.384 CatalogFile=MTDriver_InlineHook.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_InlineHook Source Disk" ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Debug/MTDriver_InlineHook.log ================================================  Building 'MTDriver_InlineHook' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. Stamping Debug\MTDriver_InlineHook.inf Stamping [Version] section with DriverVer=01/04/2019,14.40.3.384 main.c c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\main.c(17): warning C4100: “dDriver”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\main.c(75): warning C4100: “PerformanceFrequency”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\main.c(149): warning C4152: 非标准扩展，表达式中的函数/数据指针转换 c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\main.c(152): warning C4152: 非标准扩展，表达式中的函数/数据指针转换 c:\users\g4rb3n\source\repos\mtdriver_inlinehook\mtdriver_inlinehook\main.c(128): warning C4100: “RegPath”: 未引用的形参 MTDriver_InlineHook.vcxproj -> C:\Users\G4rb3n\source\repos\MTDriver_InlineHook\Debug\MTDriver_InlineHook.sys Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_InlineHook\Debug\MTDriver_InlineHook.sys ......................... Signability test complete. Errors: None Warnings: None Catalog generation complete. C:\Users\G4rb3n\source\repos\MTDriver_InlineHook\Debug\MTDriver_InlineHook\mtdriver_inlinehook.cat Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_InlineHook\Debug\MTDriver_InlineHook\mtdriver_inlinehook.cat ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/MTDriver_InlineHook.inf ================================================ ; ; MTDriver_InlineHook.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer= CatalogFile=MTDriver_InlineHook.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NT$ARCH$ [Standard.NT$ARCH$] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_InlineHook Source Disk" ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/MTDriver_InlineHook.vcxproj ================================================  $(WindowsSdkDir)bin $(WDKBinRoot)\x86 $(WDKBinRoot)\x64 Debug Win32 Release Win32 Debug x64 Release x64 Debug ARM Release ARM Debug ARM64 Release ARM64 {C37E8113-596D-4074-A68B-43A372392BD7} {dd38f7fc-d7bd-488b-9242-7d8754cde80d} v4.5 12.0 Debug Win32 MTDriver_InlineHook Windows7 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger false ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/MTDriver_InlineHook.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms {8E41214B-6785-4CFE-B992-037D68949A14} inf;inv;inx;mof;mc; Driver Files Source Files ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/MTDriver_InlineHook.vcxproj.user ================================================  DBG ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Release/MTDriver.C37E8113.tlog/MTDriver_InlineHook.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17763.0 Release|Win32|C:\Users\G4rb3n\source\repos\MTDriver_InlineHook\| ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Release/MTDriver.C37E8113.tlog/unsuccessfulbuild ================================================ ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/Release/MTDriver_InlineHook.log ================================================  Building 'MTDriver_InlineHook' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. C:\Program Files (x86)\Windows Kits\10\build\WindowsDriver.common.targets(482,5): error MSB6004: 指定的任务可执行文件位置“C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\stampinf.exe”无效。 ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/main.c ================================================ #include #include PVOID updatetimeAddr = NULL; PVOID querycounterAddr = NULL; const DWORD g_dwSpeedBase = 100; // ٻ DWORD g_dwSpeed_X = 1000; // ֵ LARGE_INTEGER g_originCounter; LARGE_INTEGER g_returnCounter; // жغ NTSTATUS DriverUnload(PDRIVER_OBJECT dDriver) { return STATUS_SUCCESS; } // ڴдԺ void __declspec(naked) WPOFF() { __asm { cli mov eax, cr0 and eax, not 0x10000 mov cr0, eax ret } } // ȥڴдԺ void __declspec(naked) WPON() { __asm { mov eax, cr0 or eax, 0x10000 mov cr0, eax sti ret } } // KeUpdateSystemTimeıݺ void __declspec(naked) __cdecl updatetimeOriginCode() { __asm { nop nop nop nop nop nop nop nop nop nop nop mov esi, updatetimeAddr add esi, 7 jmp esi } } // KeQueryPerformanceCounterıݺ LARGE_INTEGER __declspec(naked) __stdcall querycounterOriginCode(OUT PLARGE_INTEGER PerformanceFrequency) { __asm { nop nop nop nop nop nop nop nop nop nop nop mov eax, querycounterAddr add eax, 5 jmp eax } } // KeUpdateSystemTimeHook void __declspec(naked) __cdecl fakeupdatetimeAddr() { __asm { mul g_dwSpeed_X // ڵKeUpdateSystemTime֮ǰԲEAX޸ div g_dwSpeedBase // ʵֱ٣EAX * ǰٶֵ / ٶȻ jmp updatetimeOriginCode } } // KeQueryPerformanceCounterHook LARGE_INTEGER __stdcall fakequerycounterAddr(OUT PLARGE_INTEGER PerformanceFrequency) { LARGE_INTEGER realTime; LARGE_INTEGER fakeTime; realTime = querycounterOriginCode(PerformanceFrequency); // ȡǰʱ fakeTime.QuadPart = g_returnCounter.QuadPart + (realTime.QuadPart - g_originCounter.QuadPart) * g_dwSpeed_X / g_dwSpeedBase; // αʱ g_originCounter.QuadPart = realTime.QuadPart; // ԭʼʱ g_returnCounter.QuadPart = fakeTime.QuadPart; // αʱ return fakeTime; } // ں NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING RegPath) { pDriver->DriverUnload = DriverUnload; // עжغ UNICODE_STRING updatetimeName = RTL_CONSTANT_STRING(L"KeUpdateSystemTime"); updatetimeAddr = MmGetSystemRoutineAddress(&updatetimeName); // ȡKeUpdateSystemTimeĵַ UNICODE_STRING querycounterName = RTL_CONSTANT_STRING(L"KeQueryPerformanceCounter"); querycounterAddr = MmGetSystemRoutineAddress(&querycounterName); // ȡKeQueryPerformanceCounterĵַ g_originCounter.QuadPart = 0; g_returnCounter.QuadPart = 0; g_originCounter = KeQueryPerformanceCounter(NULL); g_returnCounter.QuadPart = g_originCounter.QuadPart; // ڱǰȻȡµǰϵͳʱ BYTE updatetimeJmpCode[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 }; // KeUpdateSystemTimeJmpCode BYTE querycounterJmpCode[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 }; // KeQueryPerformanceCounterJmpCode *(DWORD*)(updatetimeJmpCode + 1) = (DWORD)fakeupdatetimeAddr - ((DWORD)updatetimeAddr + 5); // תƫ *(DWORD*)(querycounterJmpCode + 1) = (DWORD)fakequerycounterAddr - ((DWORD)querycounterAddr + 5); // תƫ WPOFF(); // ޸ĵǰ̣systemڴΪд KIRQL Irql = KeRaiseIrqlToDpcLevel(); // жϼ RtlCopyMemory(updatetimeOriginCode, updatetimeAddr, 7); // KeUpdateSystemTimeԭʼǰ5ֽڱݵupdatetimeOriginCode RtlCopyMemory((BYTE*)updatetimeAddr, updatetimeJmpCode, 5); // JmpCodeǵKeUpdateSystemTimeʼַ RtlCopyMemory(querycounterOriginCode, querycounterAddr, 5); // KeQueryPerformanceCounterԭʼǰ5ֽڱݵquerycounterOriginCode RtlCopyMemory((BYTE*)querycounterAddr, querycounterJmpCode, 5); // JmpCodeǵKeQueryPerformanceCounterʼַ KeLowerIrql(Irql); // ԭжϼ WPON(); // ԭڴ return STATUS_SUCCESS; } ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/x64/Debug/MTDriver.C37E8113.tlog/MTDriver_InlineHook.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17763.0 Debug|x64|C:\Users\G4rb3n\source\repos\MTDriver_InlineHook\| ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/x64/Debug/MTDriver.C37E8113.tlog/unsuccessfulbuild ================================================ ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook/x64/Debug/MTDriver_InlineHook.log ================================================  Building 'MTDriver_InlineHook' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. C:\Program Files (x86)\Windows Kits\10\build\WindowsDriver.common.targets(482,5): error MSB6004: 指定的任务可执行文件位置“C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\stampinf.exe”无效。 ================================================ FILE: MT-InlineHook/MTDriver_InlineHook/MTDriver_InlineHook.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28307.168 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTDriver_InlineHook", "MTDriver_InlineHook\MTDriver_InlineHook.vcxproj", "{C37E8113-596D-4074-A68B-43A372392BD7}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|ARM = Release|ARM Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|ARM.ActiveCfg = Debug|ARM {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|ARM.Build.0 = Debug|ARM {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|ARM.Deploy.0 = Debug|ARM {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|ARM64.ActiveCfg = Debug|ARM64 {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|ARM64.Build.0 = Debug|ARM64 {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|ARM64.Deploy.0 = Debug|ARM64 {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|x64.ActiveCfg = Debug|x64 {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|x64.Build.0 = Debug|x64 {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|x64.Deploy.0 = Debug|x64 {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|x86.ActiveCfg = Debug|Win32 {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|x86.Build.0 = Debug|Win32 {C37E8113-596D-4074-A68B-43A372392BD7}.Debug|x86.Deploy.0 = Debug|Win32 {C37E8113-596D-4074-A68B-43A372392BD7}.Release|ARM.ActiveCfg = Release|ARM {C37E8113-596D-4074-A68B-43A372392BD7}.Release|ARM.Build.0 = Release|ARM {C37E8113-596D-4074-A68B-43A372392BD7}.Release|ARM.Deploy.0 = Release|ARM {C37E8113-596D-4074-A68B-43A372392BD7}.Release|ARM64.ActiveCfg = Release|ARM64 {C37E8113-596D-4074-A68B-43A372392BD7}.Release|ARM64.Build.0 = Release|ARM64 {C37E8113-596D-4074-A68B-43A372392BD7}.Release|ARM64.Deploy.0 = Release|ARM64 {C37E8113-596D-4074-A68B-43A372392BD7}.Release|x64.ActiveCfg = Release|x64 {C37E8113-596D-4074-A68B-43A372392BD7}.Release|x64.Build.0 = Release|x64 {C37E8113-596D-4074-A68B-43A372392BD7}.Release|x64.Deploy.0 = Release|x64 {C37E8113-596D-4074-A68B-43A372392BD7}.Release|x86.ActiveCfg = Release|Win32 {C37E8113-596D-4074-A68B-43A372392BD7}.Release|x86.Build.0 = Release|Win32 {C37E8113-596D-4074-A68B-43A372392BD7}.Release|x86.Deploy.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {805C6B16-7191-4A2A-B052-E0F8511C0552} EndGlobalSection EndGlobal ================================================ FILE: MT-InlineHook/README.md ================================================ # MT-InlineHook ``` . | |-- MTDriver_InlineHook // InlineHook钩子驱动 | . ``` ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/.vs/MTDriver_Keyboard/v15/ipch/AutoPCH/40de891455df8586/MAIN.ipch ================================================ [File too large to display: 13.9 MB] ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/.vs/MTDriver_Keyboard/v15/ipch/AutoPCH/a588616c70272a7e/MAIN.ipch ================================================ [File too large to display: 13.9 MB] ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/Debug/MTDriver_Keyboard/MTDriver_Keyboard.inf ================================================ ; ; MTDriver_Keyboard.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 11/21/2018,10.14.27.742 CatalogFile=MTDriver_Keyboard.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Keyboard Source Disk" ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/Debug/MTDriver_Keyboard.inf ================================================ ; ; MTDriver_Keyboard.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 11/21/2018,10.14.27.742 CatalogFile=MTDriver_Keyboard.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Keyboard Source Disk" ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/Debug/MTDriver.7349ADCE.tlog/MTDriver_Keyboard.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Debug|Win32|C:\Users\G4rb3n\Desktop\Windows-Driver\MT_Keyboard\MTDriver_Keyboard\| ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/Debug/MTDriver.7349ADCE.tlog/inf2cat.write.9.tlog ================================================ ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/Debug/MTDriver.7349ADCE.tlog/signtool.timestamp.1.tlog ================================================ C:\USERS\G4RB3N\DESKTOP\WINDOWS-DRIVER\MT_KEYBOARD\MTDRIVER_KEYBOARD\DEBUG\MTDRIVER_KEYBOARD.SYS|636783632698167346 C:\USERS\G4RB3N\DESKTOP\WINDOWS-DRIVER\MT_KEYBOARD\MTDRIVER_KEYBOARD\DEBUG\MTDRIVER_KEYBOARD\MTDRIVER_KEYBOARD.CAT|636783632705836825 ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/Debug/MTDriver_Keyboard.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtdriver_keyboard\mtdriver_keyboard\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtdriver_keyboard\mtdriver_keyboard\debug\main.obj c:\users\g4rb3n\source\repos\mtdriver_keyboard\debug\mtdriver_keyboard\mtdriver_keyboard.cat c:\users\g4rb3n\source\repos\mtdriver_keyboard\debug\mtdriver_keyboard.sys c:\users\g4rb3n\source\repos\mtdriver_keyboard\debug\mtdriver_keyboard.pdb c:\users\g4rb3n\source\repos\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver_keyboard.inf c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\debug\mtdriver_keyboard.cer c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\debug\mtdriver_keyboard.inf c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\main.obj c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\vc141.pdb c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\debug\mtdriver_keyboard.pdb c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\debug\mtdriver_keyboard.sys c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\cl.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\cl.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\cl.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\inf2cat-expand.36912.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\inf2cat-expand.36912.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\inf2cat-expand.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\inf2cat-expand.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\inf2cat.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\inf2cat.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\inf2cat.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\link.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\link.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\link.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\signtool.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\signtool.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\signtool.timestamp.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\signtool.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\stampinf.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\stampinf.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt_keyboard\mtdriver_keyboard\mtdriver_keyboard\debug\mtdriver.7349adce.tlog\stampinf.write.1.tlog ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/Debug/MTDriver_Keyboard.inf ================================================ ; ; MTDriver_Keyboard.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 11/21/2018,10.14.27.742 CatalogFile=MTDriver_Keyboard.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Keyboard Source Disk" ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/Debug/MTDriver_Keyboard.log ================================================  Building 'MTDriver_Keyboard' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. Stamping Debug\MTDriver_Keyboard.inf Stamping [Version] section with DriverVer=11/21/2018,10.14.27.742 main.c MTDriver_Keyboard.vcxproj -> C:\Users\G4rb3n\Desktop\Windows-Driver\MT_Keyboard\MTDriver_Keyboard\Debug\MTDriver_Keyboard.sys Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\Desktop\Windows-Driver\MT_Keyboard\MTDriver_Keyboard\Debug\MTDriver_Keyboard.sys ........................ Signability test complete. Errors: None Warnings: None Catalog generation complete. C:\Users\G4rb3n\Desktop\Windows-Driver\MT_Keyboard\MTDriver_Keyboard\Debug\MTDriver_Keyboard\mtdriver_keyboard.cat Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\Desktop\Windows-Driver\MT_Keyboard\MTDriver_Keyboard\Debug\MTDriver_Keyboard\mtdriver_keyboard.cat ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/MTDriver_Keyboard.inf ================================================ ; ; MTDriver_Keyboard.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer= CatalogFile=MTDriver_Keyboard.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NT$ARCH$ [Standard.NT$ARCH$] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Keyboard Source Disk" ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/MTDriver_Keyboard.vcxproj ================================================  Debug Win32 Release Win32 Debug x64 Release x64 Debug ARM Release ARM Debug ARM64 Release ARM64 {7349ADCE-38C4-4763-9E3A-6637955390D4} {dd38f7fc-d7bd-488b-9242-7d8754cde80d} v4.5 12.0 Debug Win32 MTDriver_Keyboard Windows7 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger false TurnOffAllWarnings false ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/MTDriver_Keyboard.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms {8E41214B-6785-4CFE-B992-037D68949A14} inf;inv;inx;mof;mc; Driver Files Source Files ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/MTDriver_Keyboard.vcxproj.user ================================================  DBG ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard/main.c ================================================ #include #include // 豸չṹ typedef struct _Dev_exten { ULONG Size; // ýṹС PDEVICE_OBJECT FilterDevice; // 豸 PDEVICE_OBJECT TargeDevice; // һ豸 PDEVICE_OBJECT LowDevice; // ײ豸 KSPIN_LOCK IoRequestSpinLock; // KEVENT IoInProgressEvent; // ¼ PIRP pIrp; // IRP } DEV_EXTENSION, *PDEV_EXTENSION; // ΢δObReferenceObjectByName() NTSTATUS ObReferenceObjectByName( PUNICODE_STRING ObjectName, ULONG Attributes, PACCESS_STATE AccessState, ACCESS_MASK DesiredAccess, POBJECT_TYPE ObjectType, KPROCESSOR_MODE AccessMode, PVOID ParseContest, PVOID *Object ); extern POBJECT_TYPE *IoDriverObjectType; // NTSTATUS DeAttach(PDEVICE_OBJECT pdevice) { PDEV_EXTENSION devExt; devExt = (PDEV_EXTENSION)pdevice->DeviceExtension; IoDetachDevice(devExt->TargeDevice); devExt->TargeDevice = NULL; IoDeleteDevice(pdevice); devExt->FilterDevice = NULL; return STATUS_SUCCESS; } //豸жغ NTSTATUS DriverUnload(PDRIVER_OBJECT pDriver) { PDEVICE_OBJECT pDevice; PDEV_EXTENSION devExt; UNREFERENCED_PARAMETER(pDriver); DbgPrint("DriverEntry Unloading...\n"); pDevice = pDriver->DeviceObject; while (pDevice) { DeAttach(pDevice); pDevice = pDevice->NextDevice; } pDriver->DeviceObject = NULL; return STATUS_SUCCESS; } // 豸ͨ÷ַ NTSTATUS GeneralDispatch(PDEVICE_OBJECT pDevice, PIRP pIrp) { NTSTATUS status; DbgPrint("General Diapatch\n"); PDEV_EXTENSION devExt = (PDEV_EXTENSION)pDevice->DeviceExtension; PDEVICE_OBJECT lowDevice = devExt->LowDevice; IoSkipCurrentIrpStackLocation(pIrp); status = IoCallDriver(lowDevice, pIrp); return status; } // IRPɻص NTSTATUS ReadComp(PDEVICE_OBJECT pDevice, PIRP pIrp, PVOID Context) { NTSTATUS status; PIO_STACK_LOCATION stack; ULONG keyNumber; PKEYBOARD_INPUT_DATA myData; stack = IoGetCurrentIrpStackLocation(pIrp); if (NT_SUCCESS(pIrp->IoStatus.Status)) { // ȡ myData = pIrp->AssociatedIrp.SystemBuffer; keyNumber = (ULONG)(pIrp->IoStatus.Information / sizeof(PKEYBOARD_INPUT_DATA)); for (ULONG i = 0; i < keyNumber; i++) { DbgPrint("numkey:%u\n", keyNumber); DbgPrint("sancode:%x\n", myData->MakeCode); DbgPrint("%s\n", myData->Flags ? "Up" : "Down"); if (myData->MakeCode == 0x1f) { myData->MakeCode = 0x20; } } } if (pIrp->PendingReturned) { IoMarkIrpPending(pIrp); } return pIrp->IoStatus.Status; } // IRPַ NTSTATUS ReadDispatch(PDEVICE_OBJECT pDevice, PIRP pIrp) { NTSTATUS status = STATUS_SUCCESS; PDEV_EXTENSION devExt; PDEVICE_OBJECT lowDevice; PIO_STACK_LOCATION stack; if (pIrp->CurrentLocation == 1) { DbgPrint("irp send error..\n"); status = STATUS_INVALID_DEVICE_REQUEST; pIrp->IoStatus.Status = status; pIrp->IoStatus.Information = 0; IoCompleteRequest(pIrp, IO_NO_INCREMENT); return status; } // õ豸չĿ֮Ϊ˻һ豸ָ롣 devExt = pDevice->DeviceExtension; lowDevice = devExt->LowDevice; stack = IoGetCurrentIrpStackLocation(pIrp); // IRPջ IoCopyCurrentIrpStackLocationToNext(pIrp); // IRPɻص IoSetCompletionRoutine(pIrp, ReadComp, pDevice, TRUE, TRUE, TRUE); status = IoCallDriver(lowDevice, pIrp); return status; } // ԴIRPַ NTSTATUS PowerDispatch(PDEVICE_OBJECT pDevice, PIRP pIrp) { PDEV_EXTENSION devExt; devExt = (PDEV_EXTENSION)pDevice->DeviceExtension; PoStartNextPowerIrp(pIrp); IoSkipCurrentIrpStackLocation(pIrp); return PoCallDriver(devExt->TargeDevice, pIrp); } // 弴IRPַ NTSTATUS PnPDispatch(PDEVICE_OBJECT pDevice, PIRP pIrp) { PDEV_EXTENSION devExt; PIO_STACK_LOCATION stack; NTSTATUS status = STATUS_SUCCESS; devExt = (PDEV_EXTENSION)pDevice->DeviceExtension; stack = IoGetCurrentIrpStackLocation(pIrp); switch (stack->MinorFunction) { case IRP_MN_REMOVE_DEVICE : // Ȱȥ IoSkipCurrentIrpStackLocation(pIrp); IoCallDriver(devExt->LowDevice, pIrp); // Ȼ󶨡 IoDetachDevice(devExt->LowDevice); // ɾԼɵ豸 IoDeleteDevice(pDevice); status = STATUS_SUCCESS; break; default : // ͵IRPȫֱ·ɡ IoSkipCurrentIrpStackLocation(pIrp); status = IoCallDriver(devExt->LowDevice, pIrp); } return status; } // ʼչ豸 NTSTATUS DevExtInit(PDEV_EXTENSION devExt, PDEVICE_OBJECT filterDevice, PDEVICE_OBJECT targetDevice, PDEVICE_OBJECT lowDevice) { memset(devExt, 0, sizeof(DEV_EXTENSION)); devExt->FilterDevice = filterDevice; devExt->TargeDevice = targetDevice; devExt->LowDevice = lowDevice; devExt->Size = sizeof(DEV_EXTENSION); KeInitializeSpinLock(&devExt->IoRequestSpinLock); KeInitializeEvent(&devExt->IoInProgressEvent, NotificationEvent, FALSE); return STATUS_SUCCESS; } // 豸󶨵Ŀ豸 NTSTATUS AttachDevice(PDRIVER_OBJECT pDriver, PUNICODE_STRING RegPatch) { UNICODE_STRING kbdName = RTL_CONSTANT_STRING(L"\\Driver\\Kbdclass"); NTSTATUS status = 0; PDEV_EXTENSION devExt; // 豸չ豸 PDEVICE_OBJECT filterDevice; // 豸 PDEVICE_OBJECT targetDevice; // Ŀ豸豸 PDEVICE_OBJECT lowDevice; // ײ豸ijһ豸ϼһ豸ʱһǼӵ豸ϣ豸ջջ PDRIVER_OBJECT kbdDriver; // ڽմ򿪵豸 // ȡĶ󣬱kbdDriver status = ObReferenceObjectByName(&kbdName, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &kbdDriver); if (!NT_SUCCESS(status)) { DbgPrint("Open KeyBoard Driver Failed\n"); return status; } else { // ObDereferenceObject(kbdDriver); } // ȡ豸еĵһ豸 targetDevice = kbdDriver->DeviceObject; // һ̼豸е豸 while (targetDevice) { // һ豸 status = IoCreateDevice(pDriver, sizeof(DEV_EXTENSION), NULL, targetDevice->DeviceType, targetDevice->Characteristics, FALSE, &filterDevice); if (!NT_SUCCESS(status)) { DbgPrint("Create New FilterDevice Failed\n"); filterDevice = targetDevice = NULL; return status; } // 󶨣lowDeviceǰ֮õһ豸 lowDevice = IoAttachDeviceToDeviceStack(filterDevice, targetDevice); if (!lowDevice) { DbgPrint("Attach Faided!\n"); IoDeleteDevice(filterDevice); filterDevice = NULL; return status; } // ʼ豸չ devExt = (PDEV_EXTENSION)filterDevice->DeviceExtension; DevExtInit(devExt, filterDevice, targetDevice, lowDevice); filterDevice->DeviceType = lowDevice->DeviceType; filterDevice->Characteristics = lowDevice->Characteristics; filterDevice->StackSize = lowDevice->StackSize + 1; filterDevice->Flags |= lowDevice->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO | DO_POWER_PAGABLE); // һ豸 targetDevice = targetDevice->NextDevice; } DbgPrint("Create And Attach Finshed...\n"); return status; } // ں NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING RegPath) { ULONG i; NTSTATUS status = STATUS_SUCCESS; pDriver->DriverUnload = DriverUnload; // עжغ for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) { pDriver->MajorFunction[i] = GeneralDispatch; // עͨõIRPַ } pDriver->MajorFunction[IRP_MJ_READ] = ReadDispatch; // עIRPַ pDriver->MajorFunction[IRP_MJ_POWER] = PowerDispatch; // עԴIRPַ pDriver->MajorFunction[IRP_MJ_PNP] = PnPDispatch; // עἴ弴IRPַ AttachDevice(pDriver, RegPath); // 豸 return status; } ================================================ FILE: MT-Keyboard/MTDriver_Keyboard/MTDriver_Keyboard.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28010.2016 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTDriver_Keyboard", "MTDriver_Keyboard\MTDriver_Keyboard.vcxproj", "{7349ADCE-38C4-4763-9E3A-6637955390D4}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|ARM = Release|ARM Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|ARM.ActiveCfg = Debug|ARM {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|ARM.Build.0 = Debug|ARM {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|ARM.Deploy.0 = Debug|ARM {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|ARM64.ActiveCfg = Debug|ARM64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|ARM64.Build.0 = Debug|ARM64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|ARM64.Deploy.0 = Debug|ARM64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|x64.ActiveCfg = Debug|x64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|x64.Build.0 = Debug|x64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|x64.Deploy.0 = Debug|x64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|x86.ActiveCfg = Debug|Win32 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|x86.Build.0 = Debug|Win32 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Debug|x86.Deploy.0 = Debug|Win32 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|ARM.ActiveCfg = Release|ARM {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|ARM.Build.0 = Release|ARM {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|ARM.Deploy.0 = Release|ARM {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|ARM64.ActiveCfg = Release|ARM64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|ARM64.Build.0 = Release|ARM64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|ARM64.Deploy.0 = Release|ARM64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|x64.ActiveCfg = Release|x64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|x64.Build.0 = Release|x64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|x64.Deploy.0 = Release|x64 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|x86.ActiveCfg = Release|Win32 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|x86.Build.0 = Release|Win32 {7349ADCE-38C4-4763-9E3A-6637955390D4}.Release|x86.Deploy.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {3461881D-CAA6-43C3-9442-264E86FE304C} EndGlobalSection EndGlobal ================================================ FILE: MT-Keyboard/README.md ================================================ # MT-Keyboard ``` . | |-- MTDriver_Keyboard // 键盘过滤驱动 | . ``` ================================================ FILE: MT-KillProcess/MTApp_KillProcess/MTApp_KillProcess/Debug/MTApp_Ki.B8C4470C.tlog/MTApp_KillProcess.lastbuildstate ================================================ #TargetFrameworkVersion=v4.0:PlatformToolSet=v141:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Debug|Win32|C:\Users\G4rb3n\source\repos\MTApp_KillProcess\| ================================================ FILE: MT-KillProcess/MTApp_KillProcess/MTApp_KillProcess/Debug/MTApp_KillProcess.log ================================================  pch.cpp MTApp_KillProcess.cpp MTApp_KillProcess.vcxproj -> C:\Users\G4rb3n\source\repos\MTApp_KillProcess\Debug\MTApp_KillProcess.exe ================================================ FILE: MT-KillProcess/MTApp_KillProcess/MTApp_KillProcess/MTApp_KillProcess.vcxproj ================================================ Debug Win32 Release Win32 Debug x64 Release x64 15.0 {B8C4470C-B1EA-4389-882E-08F686CD0F48} Win32Proj MTAppKillProcess 10.0.17134.0 Application true v141 Unicode Application false v141 true Unicode Application true v141 Unicode Application false v141 true Unicode true true false false Use Level3 Disabled true WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) true pch.h Console true Use Level3 Disabled true _DEBUG;_CONSOLE;%(PreprocessorDefinitions) true pch.h Console true Use Level3 MaxSpeed true true true WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true pch.h Console true true true Use Level3 MaxSpeed true true true NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true pch.h Console true true true Create Create Create Create ================================================ FILE: MT-KillProcess/MTApp_KillProcess/MTApp_KillProcess/MTApp_KillProcess.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hh;hpp;hxx;hm;inl;inc;ipp;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 头文件 源文件 源文件 ================================================ FILE: MT-KillProcess/MTApp_KillProcess/MTApp_KillProcess/MTApp_KillProcess.vcxproj.user ================================================  ================================================ FILE: MT-KillProcess/MTApp_KillProcess/MTApp_KillProcess/Release/MTApp_Ki.B8C4470C.tlog/MTApp_KillProcess.lastbuildstate ================================================ #TargetFrameworkVersion=v4.0:PlatformToolSet=v141:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Release|Win32|C:\Users\G4rb3n\source\repos\MTApp_KillProcess\| ================================================ FILE: MT-KillProcess/MTApp_KillProcess/MTApp_KillProcess/Release/MTApp_KillProcess.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\mtapp_killprocess.pch c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\vc141.pdb c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\pch.obj c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\mtapp_killprocess.obj c:\users\g4rb3n\source\repos\mtapp_killprocess\release\mtapp_killprocess.exe c:\users\g4rb3n\source\repos\mtapp_killprocess\release\mtapp_killprocess.pdb c:\users\g4rb3n\source\repos\mtapp_killprocess\release\mtapp_killprocess.ipdb c:\users\g4rb3n\source\repos\mtapp_killprocess\release\mtapp_killprocess.iobj c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\mtapp_ki.b8c4470c.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\mtapp_ki.b8c4470c.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\mtapp_ki.b8c4470c.tlog\cl.write.1.tlog c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\mtapp_ki.b8c4470c.tlog\link.command.1.tlog c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\mtapp_ki.b8c4470c.tlog\link.read.1.tlog c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\mtapp_ki.b8c4470c.tlog\link.write.1.tlog c:\users\g4rb3n\source\repos\mtapp_killprocess\mtapp_killprocess\release\mtapp_ki.b8c4470c.tlog\mtapp_killprocess.write.1u.tlog ================================================ FILE: MT-KillProcess/MTApp_KillProcess/MTApp_KillProcess/Release/MTApp_KillProcess.log ================================================  pch.cpp MTApp_KillProcess.cpp 正在生成代码 All 7 functions were compiled because no usable IPDB/IOBJ from previous compilation was found. 已完成代码的生成 MTApp_KillProcess.vcxproj -> C:\Users\G4rb3n\source\repos\MTApp_KillProcess\Release\MTApp_KillProcess.exe ================================================ FILE: MT-KillProcess/MTApp_KillProcess/MTApp_KillProcess.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28010.2016 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTApp_KillProcess", "MTApp_KillProcess\MTApp_KillProcess.vcxproj", "{B8C4470C-B1EA-4389-882E-08F686CD0F48}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {B8C4470C-B1EA-4389-882E-08F686CD0F48}.Debug|x64.ActiveCfg = Debug|x64 {B8C4470C-B1EA-4389-882E-08F686CD0F48}.Debug|x64.Build.0 = Debug|x64 {B8C4470C-B1EA-4389-882E-08F686CD0F48}.Debug|x86.ActiveCfg = Debug|Win32 {B8C4470C-B1EA-4389-882E-08F686CD0F48}.Debug|x86.Build.0 = Debug|Win32 {B8C4470C-B1EA-4389-882E-08F686CD0F48}.Release|x64.ActiveCfg = Release|x64 {B8C4470C-B1EA-4389-882E-08F686CD0F48}.Release|x64.Build.0 = Release|x64 {B8C4470C-B1EA-4389-882E-08F686CD0F48}.Release|x86.ActiveCfg = Release|Win32 {B8C4470C-B1EA-4389-882E-08F686CD0F48}.Release|x86.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {667A5203-C91D-4C63-B34E-D28608E949BC} EndGlobalSection EndGlobal ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/.vs/MTDriver_KillProcess/v15/ipch/AutoPCH/40b681dc507195b2/MIAN.ipch ================================================ [File too large to display: 13.9 MB] ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/Debug/MTDriver.6B0AF623.tlog/MTDriver_KillProcess.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Debug|Win32|C:\Users\G4rb3n\source\repos\MTDriver_KillProcess\| ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/Debug/MTDriver.6B0AF623.tlog/signtool.timestamp.1.tlog ================================================ C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_KILLPROCESS\DEBUG\MTDRIVER_KILLPROCESS.SYS|636728700106933609 C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_KILLPROCESS\DEBUG\MTDRIVER_KILLPROCESS\MTDRIVER_KILLPROCESS.CAT|636728700113815711 ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/Debug/MTDriver_KillProcess.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mian.obj c:\users\g4rb3n\source\repos\mtdriver_killprocess\debug\mtdriver_killprocess\mtdriver_killprocess.cat c:\users\g4rb3n\source\repos\mtdriver_killprocess\debug\mtdriver_killprocess.sys c:\users\g4rb3n\source\repos\mtdriver_killprocess\debug\mtdriver_killprocess.pdb c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver_killprocess.inf c:\users\g4rb3n\source\repos\mtdriver_killprocess\debug\mtdriver_killprocess.cer c:\users\g4rb3n\source\repos\mtdriver_killprocess\debug\mtdriver_killprocess.inf c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\cl.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\inf2cat-expand.14196.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\inf2cat-expand.14196.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\inf2cat-expand.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\inf2cat-expand.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\inf2cat.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\inf2cat.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\inf2cat.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\link.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\link.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\link.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\signtool.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\signtool.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\signtool.timestamp.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\signtool.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\stampinf.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\stampinf.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\debug\mtdriver.6b0af623.tlog\stampinf.write.1.tlog ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/Debug/MTDriver_KillProcess.inf ================================================ ; ; MTDriver_KillProcess.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 09/18/2018,20.20.9.275 CatalogFile=MTDriver_KillProcess.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_KillProcess Source Disk" ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/Debug/MTDriver_KillProcess.log ================================================  Building 'MTDriver_KillProcess' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. Stamping Debug\MTDriver_KillProcess.inf Stamping [Version] section with DriverVer=09/18/2018,20.20.9.275 mian.c c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\mian.c(13): warning C4100: “Driver”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\mian.c(15): warning C4101: “status”: 未引用的局部变量 c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\mian.c(25): warning C4100: “Device”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\mian.c(57): warning C4100: “Device”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\mian.c(115): warning C4047: “函数”:“BOOLEAN”与“void *”的间接级别不同 c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\mian.c(115): warning C4024: “IoCreateDevice”: 形参和实参 6 的类型不同 c:\users\g4rb3n\source\repos\mtdriver_killprocess\mtdriver_killprocess\mian.c(99): warning C4100: “RegPath”: 未引用的形参 MTDriver_KillProcess.vcxproj -> C:\Users\G4rb3n\source\repos\MTDriver_KillProcess\Debug\MTDriver_KillProcess.sys Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_KillProcess\Debug\MTDriver_KillProcess.sys ........................ Signability test complete. Errors: None Warnings: None Catalog generation complete. C:\Users\G4rb3n\source\repos\MTDriver_KillProcess\Debug\MTDriver_KillProcess\mtdriver_killprocess.cat Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_KillProcess\Debug\MTDriver_KillProcess\mtdriver_killprocess.cat ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/MTDriver_KillProcess.inf ================================================ ; ; MTDriver_KillProcess.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer= CatalogFile=MTDriver_KillProcess.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NT$ARCH$ [Standard.NT$ARCH$] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_KillProcess Source Disk" ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/MTDriver_KillProcess.vcxproj ================================================  Debug Win32 Release Win32 Debug x64 Release x64 Debug ARM Release ARM Debug ARM64 Release ARM64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB} {dd38f7fc-d7bd-488b-9242-7d8754cde80d} v4.5 12.0 Debug Win32 MTDriver_KillProcess Windows7 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger false false ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/MTDriver_KillProcess.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms {8E41214B-6785-4CFE-B992-037D68949A14} inf;inv;inx;mof;mc; Driver Files Source Files ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/MTDriver_KillProcess.vcxproj.user ================================================  ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess/mian.c ================================================ #include // һֵΪ0x800Ŀ #define IOCTL_KILL CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) // 豸ͷ #define DEVICE_NAME L"\\Device\\MTKillDevice" #define SYM_LINK_NAME L"\\??\\MTKill" PDEVICE_OBJECT pDevice; UNICODE_STRING DeviceName; UNICODE_STRING SymLinkName; // жغ NTSTATUS DriverUnload(PDRIVER_OBJECT Driver) { NTSTATUS status; // ɾź豸 IoDeleteSymbolicLink(&SymLinkName); IoDeleteDevice(pDevice); DbgPrint("This Driver Is Unloading...\n"); return STATUS_SUCCESS; } // 豸ú NTSTATUS DeviceApi(PDEVICE_OBJECT Device, PIRP pIrp) { pIrp->IoStatus.Status = STATUS_SUCCESS; pIrp->IoStatus.Information = 0; // I/O IoCompleteRequest(pIrp, IO_NO_INCREMENT); return STATUS_SUCCESS; } // ɱ̺ BOOLEAN KillProcess(LONG pid) { HANDLE ProcessHandle; NTSTATUS status; OBJECT_ATTRIBUTES ObjectAttributes; CLIENT_ID Cid; // ʼObjectAttributesCid InitializeObjectAttributes(&ObjectAttributes, 0, 0, 0, 0); Cid.UniqueProcess = (HANDLE)pid; Cid.UniqueThread = 0; // 򿪽̾ status = ZwOpenProcess(&ProcessHandle, PROCESS_ALL_ACCESS, &ObjectAttributes, &Cid); if (NT_SUCCESS(status)) { DbgPrint("Open Process %d Successful!\n", pid); // ZwTerminateProcess(ProcessHandle, status); // رվ ZwClose(ProcessHandle); return TRUE; } DbgPrint("Open Process %d Failed!\n", pid); return FALSE; } // 豸I/Oƺ NTSTATUS DeviceIoctl(PDEVICE_OBJECT Device, PIRP pIrp) { NTSTATUS status; // ȡIRPϢ PIO_STACK_LOCATION irps = IoGetCurrentIrpStackLocation(pIrp); // ȡĿ ULONG CODE = irps->Parameters.DeviceIoControl.IoControlCode; ULONG info = 0; switch (CODE) { // ƵԼIOCTL_KILL0x800 case IOCTL_KILL: { DbgPrint("Enter the IO \n"); // ȡҪɱĽ̵PID LONG pid = *(PLONG)(pIrp->AssociatedIrp.SystemBuffer); DbgPrint("Get PID : %d\n", pid); if (KillProcess(pid)) { DbgPrint("Kill Successful\n"); } else { DbgPrint("Kill Failed\n"); } status = STATUS_SUCCESS; break; } default: DbgPrint("Unknown CODE!\n"); status = STATUS_UNSUCCESSFUL; break; } // I/O pIrp->IoStatus.Status = status; pIrp->IoStatus.Information = info; IoCompleteRequest(pIrp, IO_NO_INCREMENT); return status; } // ں NTSTATUS DriverEntry(PDRIVER_OBJECT Driver, PUNICODE_STRING RegPath) { NTSTATUS status; // עжغ Driver->DriverUnload = DriverUnload; // ͨѭ豸дرյȺΪͨõDeviceApi for (int i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) { Driver->MajorFunction[i] = DeviceApi; } // ѿƺΪDeviceIoctl Driver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DeviceIoctl; // 豸תΪUnicodeַ RtlInitUnicodeString(&DeviceName, DEVICE_NAME); // 豸 status = IoCreateDevice(Driver, 0, &DeviceName, FILE_DEVICE_UNKNOWN, 0, NULL, &pDevice); if (!NT_SUCCESS(status)) { DbgPrint("Create Device Faild!\n"); return STATUS_UNSUCCESSFUL; } // תΪUnicodeַ RtlInitUnicodeString(&SymLinkName, SYM_LINK_NAME); // 豸 status = IoCreateSymbolicLink(&SymLinkName, &DeviceName); if (!NT_SUCCESS(status)) { DbgPrint("Create SymLink Faild!\n"); IoDeleteDevice(pDevice); return STATUS_UNSUCCESSFUL; } DbgPrint("Initialize Success\n"); // pDeviceԻʽȡ pDevice->Flags = DO_BUFFERED_IO; return STATUS_SUCCESS; } ================================================ FILE: MT-KillProcess/MTDriver_KillProcess/MTDriver_KillProcess.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28010.2016 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTDriver_KillProcess", "MTDriver_KillProcess\MTDriver_KillProcess.vcxproj", "{6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|ARM = Release|ARM Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|ARM.ActiveCfg = Debug|ARM {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|ARM.Build.0 = Debug|ARM {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|ARM.Deploy.0 = Debug|ARM {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|ARM64.ActiveCfg = Debug|ARM64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|ARM64.Build.0 = Debug|ARM64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|ARM64.Deploy.0 = Debug|ARM64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|x64.ActiveCfg = Debug|x64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|x64.Build.0 = Debug|x64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|x64.Deploy.0 = Debug|x64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|x86.ActiveCfg = Debug|Win32 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|x86.Build.0 = Debug|Win32 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Debug|x86.Deploy.0 = Debug|Win32 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|ARM.ActiveCfg = Release|ARM {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|ARM.Build.0 = Release|ARM {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|ARM.Deploy.0 = Release|ARM {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|ARM64.ActiveCfg = Release|ARM64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|ARM64.Build.0 = Release|ARM64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|ARM64.Deploy.0 = Release|ARM64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|x64.ActiveCfg = Release|x64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|x64.Build.0 = Release|x64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|x64.Deploy.0 = Release|x64 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|x86.ActiveCfg = Release|Win32 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|x86.Build.0 = Release|Win32 {6B0AF623-7404-4B6B-B6B5-AE9103DD49EB}.Release|x86.Deploy.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {47823EDF-FF33-41FE-AA66-724BEA55EE3A} EndGlobalSection EndGlobal ================================================ FILE: MT-KillProcess/README.md ================================================ # MT-KillProcess ``` . | |-- MTDriver_KillProcess // 驱动层 | |-- MTApp_KillProcess // 应用层 | . ``` ================================================ FILE: MT-Test/MTDriver_Test/.vs/MTDriver_Test/v15/ipch/AutoPCH/6bb95a74bcad4625/MAIN.ipch ================================================ [File too large to display: 13.9 MB] ================================================ FILE: MT-Test/MTDriver_Test/.vs/MTDriver_Test/v15/ipch/AutoPCH/6f99f5a3faddb305/MAIN.ipch ================================================ [File too large to display: 13.9 MB] ================================================ FILE: MT-Test/MTDriver_Test/Debug/MTDriver_Test/MTDriver_Test.inf ================================================ ; ; MTDriver_Test.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 09/25/2018,19.12.47.901 CatalogFile=MTDriver_Test.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Test Source Disk" ================================================ FILE: MT-Test/MTDriver_Test/Debug/MTDriver_Test.inf ================================================ ; ; MTDriver_Test.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 09/25/2018,19.12.47.901 CatalogFile=MTDriver_Test.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Test Source Disk" ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/Debug/MTDriver_Test.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtdriver_test\mtdriver_test\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtdriver_test\mtdriver_test\debug\main.obj c:\users\g4rb3n\source\repos\mtdriver_test\debug\mtdriver_test\mtdriver_test.cat c:\users\g4rb3n\source\repos\mtdriver_test\debug\mtdriver_test.sys c:\users\g4rb3n\source\repos\mtdriver_test\debug\mtdriver_test.pdb c:\users\g4rb3n\source\repos\mtdriver_test\mtdriver_test\debug\mtdriver_test.inf c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\debug\mtdriver_test.cer c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\debug\mtdriver_test.inf c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\main.obj c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\vc141.pdb c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\debug\mtdriver_test.pdb c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\debug\mtdriver_test.sys c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\cl.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\cl.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\cl.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\inf2cat-expand.13964.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\inf2cat-expand.13964.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\inf2cat-expand.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\inf2cat-expand.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\inf2cat.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\inf2cat.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\inf2cat.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\link.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\link.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\link.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\signtool.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\signtool.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\signtool.timestamp.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\signtool.write.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\stampinf.command.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\stampinf.read.1.tlog c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\debug\mtdriver_test.tlog\stampinf.write.1.tlog ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/Debug/MTDriver_Test.inf ================================================ ; ; MTDriver_Test.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 09/25/2018,19.12.47.901 CatalogFile=MTDriver_Test.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Test Source Disk" ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/Debug/MTDriver_Test.log ================================================  Building 'MTDriver_Test' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. Stamping Debug\MTDriver_Test.inf Stamping [Version] section with DriverVer=09/25/2018,19.12.47.901 main.c c:\users\g4rb3n\desktop\windows-driver\mt-test\mtdriver_test\mtdriver_test\main.c(4): warning C4100: “Driver”: 未引用的形参 MTDriver_Test.vcxproj -> C:\Users\G4rb3n\Desktop\Windows-Driver\MT-Test\MTDriver_Test\Debug\MTDriver_Test.sys Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\Desktop\Windows-Driver\MT-Test\MTDriver_Test\Debug\MTDriver_Test.sys ........................ Signability test complete. Errors: None Warnings: None Catalog generation complete. C:\Users\G4rb3n\Desktop\Windows-Driver\MT-Test\MTDriver_Test\Debug\MTDriver_Test\mtdriver_test.cat Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\Desktop\Windows-Driver\MT-Test\MTDriver_Test\Debug\MTDriver_Test\mtdriver_test.cat ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/Debug/MTDriver_Test.tlog/MTDriver_Test.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Debug|Win32|C:\Users\G4rb3n\Desktop\Windows-Driver\MT-Test\MTDriver_Test\| ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/Debug/MTDriver_Test.tlog/inf2cat.read.9.tlog ================================================ ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/Debug/MTDriver_Test.tlog/inf2cat.write.9.tlog ================================================ ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/Debug/MTDriver_Test.tlog/signtool.timestamp.1.tlog ================================================ C:\USERS\G4RB3N\DESKTOP\WINDOWS-DRIVER\MT-TEST\MTDRIVER_TEST\DEBUG\MTDRIVER_TEST.SYS|636734707700716488 C:\USERS\G4RB3N\DESKTOP\WINDOWS-DRIVER\MT-TEST\MTDRIVER_TEST\DEBUG\MTDRIVER_TEST\MTDRIVER_TEST.CAT|636734707710450468 ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/MTDriver_Test.inf ================================================ ; ; MTDriver_Test.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer= CatalogFile=MTDriver_Test.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NT$ARCH$ [Standard.NT$ARCH$] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Test Source Disk" ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/MTDriver_Test.vcxproj ================================================  Debug Win32 Release Win32 Debug x64 Release x64 Debug ARM Release ARM Debug ARM64 Release ARM64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5} {dd38f7fc-d7bd-488b-9242-7d8754cde80d} v4.5 12.0 Debug Win32 MTDriver_Test Windows7 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger false false ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/MTDriver_Test.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms {8E41214B-6785-4CFE-B992-037D68949A14} inf;inv;inx;mof;mc; Driver Files Source Files ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/MTDriver_Test.vcxproj.user ================================================  DBG ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test/main.c ================================================ #include NTSTATUS DriverUnload(PDRIVER_OBJECT Driver) { DbgPrint("This driver is unloading...\n"); //ӡжϢ return STATUS_SUCCESS; } NTSTATUS DriverEntry(PDRIVER_OBJECT Driver, PUNICODE_STRING RegPath) { Driver->DriverUnload = DriverUnload; // жغ DbgPrint("%ws\n", RegPath->Buffer); // ӡRegPath return STATUS_SUCCESS; } ================================================ FILE: MT-Test/MTDriver_Test/MTDriver_Test.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28010.2016 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTDriver_Test", "MTDriver_Test\MTDriver_Test.vcxproj", "{ED194BC1-4867-4F1F-84DD-884FF7B53FE5}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|ARM = Release|ARM Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|ARM.ActiveCfg = Debug|ARM {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|ARM.Build.0 = Debug|ARM {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|ARM.Deploy.0 = Debug|ARM {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|ARM64.ActiveCfg = Debug|ARM64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|ARM64.Build.0 = Debug|ARM64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|ARM64.Deploy.0 = Debug|ARM64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|x64.ActiveCfg = Debug|x64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|x64.Build.0 = Debug|x64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|x64.Deploy.0 = Debug|x64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|x86.ActiveCfg = Debug|Win32 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|x86.Build.0 = Debug|Win32 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Debug|x86.Deploy.0 = Debug|Win32 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|ARM.ActiveCfg = Release|ARM {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|ARM.Build.0 = Release|ARM {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|ARM.Deploy.0 = Release|ARM {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|ARM64.ActiveCfg = Release|ARM64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|ARM64.Build.0 = Release|ARM64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|ARM64.Deploy.0 = Release|ARM64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|x64.ActiveCfg = Release|x64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|x64.Build.0 = Release|x64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|x64.Deploy.0 = Release|x64 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|x86.ActiveCfg = Release|Win32 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|x86.Build.0 = Release|Win32 {ED194BC1-4867-4F1F-84DD-884FF7B53FE5}.Release|x86.Deploy.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {48965B67-A6F1-4E8B-B9A1-E65B6BCFC910} EndGlobalSection EndGlobal ================================================ FILE: MT-Test/README.md ================================================ # MT-Test ``` . | |-- MTDriver_Test // 演示驱动 | . ``` ================================================ FILE: MT-Thread/MTDriver_Thread/Debug/MTDriver_Thread/MTDriver_Thread.inf ================================================ ; ; MTDriver_Thread.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 11/22/2018,16.2.24.884 CatalogFile=MTDriver_Thread.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Thread Source Disk" ================================================ FILE: MT-Thread/MTDriver_Thread/Debug/MTDriver_Thread.inf ================================================ ; ; MTDriver_Thread.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 11/22/2018,16.2.24.884 CatalogFile=MTDriver_Thread.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Thread Source Disk" ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/Debug/MTDriver_Thread.Build.CppClean.log ================================================ c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\vc141.pdb c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\main.obj c:\users\g4rb3n\source\repos\mtdriver_thread\debug\mtdriver_thread\mtdriver_thread.cat c:\users\g4rb3n\source\repos\mtdriver_thread\debug\mtdriver_thread.sys c:\users\g4rb3n\source\repos\mtdriver_thread\debug\mtdriver_thread.pdb c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.inf c:\users\g4rb3n\source\repos\mtdriver_thread\debug\mtdriver_thread.cer c:\users\g4rb3n\source\repos\mtdriver_thread\debug\mtdriver_thread.inf c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\cl.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\cl.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\cl.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\inf2cat-expand.14480.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\inf2cat-expand.14480.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\inf2cat-expand.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\inf2cat-expand.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\inf2cat.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\inf2cat.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\inf2cat.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\link.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\link.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\link.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\signtool.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\signtool.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\signtool.timestamp.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\signtool.write.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\stampinf.command.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\stampinf.read.1.tlog c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\debug\mtdriver_thread.tlog\stampinf.write.1.tlog ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/Debug/MTDriver_Thread.inf ================================================ ; ; MTDriver_Thread.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer = 11/22/2018,16.2.24.884 CatalogFile=MTDriver_Thread.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NTx86 [Standard.NTx86] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Thread Source Disk" ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/Debug/MTDriver_Thread.log ================================================  Building 'MTDriver_Thread' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform. Stamping Debug\MTDriver_Thread.inf Stamping [Version] section with DriverVer=11/22/2018,16.2.24.884 main.c c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\main.c(9): warning C4100: “pDriver”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\main.c(23): warning C4100: “pContext”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\main.c(47): warning C4100: “TargetEP”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\main.c(76): warning C4100: “RegPath”: 未引用的形参 c:\users\g4rb3n\source\repos\mtdriver_thread\mtdriver_thread\main.c(43): warning C4716: “TestThread”: 必须返回一个值 MTDriver_Thread.vcxproj -> C:\Users\G4rb3n\source\repos\MTDriver_Thread\Debug\MTDriver_Thread.sys Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_Thread\Debug\MTDriver_Thread.sys ........................ Signability test complete. Errors: None Warnings: None Catalog generation complete. C:\Users\G4rb3n\source\repos\MTDriver_Thread\Debug\MTDriver_Thread\mtdriver_thread.cat Done Adding Additional Store Successfully signed: C:\Users\G4rb3n\source\repos\MTDriver_Thread\Debug\MTDriver_Thread\mtdriver_thread.cat ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/Debug/MTDriver_Thread.tlog/MTDriver_Thread.lastbuildstate ================================================ #TargetFrameworkVersion=v4.5:PlatformToolSet=WindowsKernelModeDriver10.0:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17134.0 Debug|Win32|C:\Users\G4rb3n\source\repos\MTDriver_Thread\| ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/Debug/MTDriver_Thread.tlog/inf2cat.read.9.tlog ================================================ ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/Debug/MTDriver_Thread.tlog/inf2cat.write.9.tlog ================================================ ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/Debug/MTDriver_Thread.tlog/signtool.timestamp.1.tlog ================================================ C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_THREAD\DEBUG\MTDRIVER_THREAD.SYS|636784705466978718 C:\USERS\G4RB3N\SOURCE\REPOS\MTDRIVER_THREAD\DEBUG\MTDRIVER_THREAD\MTDRIVER_THREAD.CAT|636784705475336076 ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/MTDriver_Thread.inf ================================================ ; ; MTDriver_Thread.inf ; [Version] Signature="$WINDOWS NT$" Class=System ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer= CatalogFile=MTDriver_Thread.cat [DestinationDirs] DefaultDestDir = 12 [SourceDisksNames] 1 = %DiskName%,,,"" [SourceDisksFiles] [Manufacturer] %ManufacturerName%=Standard,NT$ARCH$ [Standard.NT$ARCH$] [Strings] ManufacturerName="" ;TODO: Replace with your manufacturer name ClassName="" DiskName="MTDriver_Thread Source Disk" ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/MTDriver_Thread.vcxproj ================================================  Debug Win32 Release Win32 Debug x64 Release x64 Debug ARM Release ARM Debug ARM64 Release ARM64 {5143EC61-D683-4DDE-93F4-4B934193E2D5} {dd38f7fc-d7bd-488b-9242-7d8754cde80d} v4.5 12.0 Debug Win32 MTDriver_Thread Windows7 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM Windows10 true WindowsKernelModeDriver10.0 Driver WDM Windows10 false WindowsKernelModeDriver10.0 Driver WDM DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger DbgengKernelDebugger false false ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/MTDriver_Thread.vcxproj.filters ================================================  {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms {8E41214B-6785-4CFE-B992-037D68949A14} inf;inv;inx;mof;mc; Driver Files Source Files ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/MTDriver_Thread.vcxproj.user ================================================  ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread/main.c ================================================ #include #include PETHREAD pThreadObj = NULL; BOOLEAN bTerminated = FALSE; //豸жغ NTSTATUS DriverUnload(PDRIVER_OBJECT pDriver) { DbgPrint("The Driver is Unloading...\n"); // ñ־bTerminatedΪTRUEѭ bTerminated = TRUE; // ȴ߳̽ KeWaitForSingleObject(pThreadObj, Executive, KernelMode, FALSE, NULL); // ObDereferenceObject(pThreadObj); return STATUS_SUCCESS; } // ߳ NTSTATUS TestThread(PVOID pContext) { LARGE_INTEGER inteval; // üʱΪ2s inteval.QuadPart = -20000000; // inteval.QuadPart = 0; while (1) { // ÿ2sӡһϢ DbgPrint("----TestThread----\n"); if (bTerminated) { // ־bTerminatedΪTRUEʱѭ break; } // ߣ൱R3Sleep KeDelayExecutionThread(KernelMode, FALSE, &inteval); } // ֹ߳ PsTerminateSystemThread(STATUS_SUCCESS); } // ̴߳ NTSTATUS CreateThread(PVOID TargetEP) { OBJECT_ATTRIBUTES objAddr = { 0 }; HANDLE threadHandle = 0; NTSTATUS status = STATUS_SUCCESS; // ʼһOBJECT_ATTRIBUTES InitializeObjectAttributes(&objAddr, NULL, OBJ_KERNEL_HANDLE, 0, NULL); // ߳ status = PsCreateSystemThread(&threadHandle, THREAD_ALL_ACCESS, &objAddr, NULL, NULL, TestThread, NULL); if (NT_SUCCESS(status)) { KdPrint(("Thread Created\n")); // ̵ͨ߳Ķ status = ObReferenceObjectByHandle(threadHandle, THREAD_ALL_ACCESS, *PsThreadType, KernelMode, &pThreadObj, NULL); // ͷž ZwClose(threadHandle); if (!NT_SUCCESS(status)) { // ȡʧܣҲñ־ΪTRUE bTerminated = TRUE; } } return status; } // ں NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING RegPath) { pDriver->DriverUnload = DriverUnload; // עжغ NTSTATUS status = status = CreateThread(NULL); // CreateThread߳ return status; } ================================================ FILE: MT-Thread/MTDriver_Thread/MTDriver_Thread.sln ================================================  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28010.2016 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MTDriver_Thread", "MTDriver_Thread\MTDriver_Thread.vcxproj", "{5143EC61-D683-4DDE-93F4-4B934193E2D5}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 Release|ARM = Release|ARM Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|ARM.ActiveCfg = Debug|ARM {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|ARM.Build.0 = Debug|ARM {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|ARM.Deploy.0 = Debug|ARM {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|ARM64.ActiveCfg = Debug|ARM64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|ARM64.Build.0 = Debug|ARM64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|ARM64.Deploy.0 = Debug|ARM64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|x64.ActiveCfg = Debug|x64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|x64.Build.0 = Debug|x64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|x64.Deploy.0 = Debug|x64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|x86.ActiveCfg = Debug|Win32 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|x86.Build.0 = Debug|Win32 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Debug|x86.Deploy.0 = Debug|Win32 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|ARM.ActiveCfg = Release|ARM {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|ARM.Build.0 = Release|ARM {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|ARM.Deploy.0 = Release|ARM {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|ARM64.ActiveCfg = Release|ARM64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|ARM64.Build.0 = Release|ARM64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|ARM64.Deploy.0 = Release|ARM64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|x64.ActiveCfg = Release|x64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|x64.Build.0 = Release|x64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|x64.Deploy.0 = Release|x64 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|x86.ActiveCfg = Release|Win32 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|x86.Build.0 = Release|Win32 {5143EC61-D683-4DDE-93F4-4B934193E2D5}.Release|x86.Deploy.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {7F2E692C-BF6C-4DF5-A3C1-62D8FCA95895} EndGlobalSection EndGlobal ================================================ FILE: MT-Thread/README.md ================================================ # MT-Thread ``` . | |-- MTDriver_Thread // 内核线程驱动 | . ``` ================================================ FILE: README.md ================================================ # Windows-Driver Windows驱动编程 ``` . | |-- MT-Callback // 回调函数 | |-- MT-CheckTime // 本地时间校验驱动 | |-- MT-Communication // 驱动层&应用层通信 | |-- MT-KillProcess // 杀死进程驱动 | |-- MT-Test // 演示驱动 | |-- MT-FSDHook // FSD钩子 | |-- MT-InlineHook // InlineHook钩子 | |-- MT_Keyboard // 键盘过滤驱动 | |-- MT_Thread // 内核线程驱动 | . ```