mirror of
https://github.com/mrexodia/phnt-single-header
synced 2026-06-08 16:10:51 +00:00
Duncan Ogilvie
91 lines
2.5 KiB
C++
91 lines
2.5 KiB
C++
extern "C"
|
|
{
|
|
#include <ntifs.h>
|
|
#include <ntddstor.h>
|
|
#include <mountdev.h>
|
|
#include <ntddvol.h>
|
|
#include <ntstrsafe.h>
|
|
#include <ntimage.h>
|
|
#include <wdm.h>
|
|
#include <stddef.h>
|
|
#include <minwindef.h>
|
|
}
|
|
|
|
#define PHNT_VERSION PHNT_WIN11
|
|
#include <phnt.h>
|
|
|
|
static UNICODE_STRING Win32Device;
|
|
|
|
_Function_class_(DRIVER_UNLOAD)
|
|
_IRQL_requires_(PASSIVE_LEVEL)
|
|
_IRQL_requires_same_
|
|
static void DriverUnload(_In_ PDRIVER_OBJECT DriverObject)
|
|
{
|
|
IoDeleteSymbolicLink(&Win32Device);
|
|
IoDeleteDevice(DriverObject->DeviceObject);
|
|
}
|
|
|
|
_Function_class_(DRIVER_DISPATCH)
|
|
_IRQL_requires_max_(DISPATCH_LEVEL)
|
|
_IRQL_requires_same_
|
|
static NTSTATUS DriverCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
|
|
{
|
|
UNREFERENCED_PARAMETER(DeviceObject);
|
|
Irp->IoStatus.Status = STATUS_SUCCESS;
|
|
Irp->IoStatus.Information = 0;
|
|
IoCompleteRequest(Irp, IO_NO_INCREMENT);
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
_Function_class_(DRIVER_DISPATCH)
|
|
_IRQL_requires_max_(DISPATCH_LEVEL)
|
|
_IRQL_requires_same_
|
|
static NTSTATUS DriverDefaultHandler(_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp)
|
|
{
|
|
UNREFERENCED_PARAMETER(DeviceObject);
|
|
Irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
|
|
Irp->IoStatus.Information = 0;
|
|
IoCompleteRequest(Irp, IO_NO_INCREMENT);
|
|
return STATUS_NOT_SUPPORTED;
|
|
}
|
|
|
|
_Function_class_(DRIVER_INITIALIZE)
|
|
_IRQL_requires_same_
|
|
_IRQL_requires_(PASSIVE_LEVEL)
|
|
extern "C"
|
|
NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
|
|
{
|
|
UNREFERENCED_PARAMETER(RegistryPath);
|
|
|
|
// Set callback functions
|
|
DriverObject->DriverUnload = DriverUnload;
|
|
for (unsigned int i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
|
|
DriverObject->MajorFunction[i] = DriverDefaultHandler;
|
|
DriverObject->MajorFunction[IRP_MJ_CREATE] = DriverCreateClose;
|
|
DriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverCreateClose;
|
|
|
|
// Create a device
|
|
UNICODE_STRING DeviceName;
|
|
RtlInitUnicodeString(&DeviceName, L"\\Device\\MyDriver");
|
|
RtlInitUnicodeString(&Win32Device, L"\\DosDevices\\MyDriver");
|
|
PDEVICE_OBJECT DeviceObject = nullptr;
|
|
auto status = IoCreateDevice(DriverObject,
|
|
0,
|
|
&DeviceName,
|
|
FILE_DEVICE_UNKNOWN,
|
|
FILE_DEVICE_SECURE_OPEN,
|
|
FALSE,
|
|
&DeviceObject);
|
|
if (!NT_SUCCESS(status))
|
|
{
|
|
return status;
|
|
}
|
|
if (!DeviceObject)
|
|
{
|
|
return STATUS_UNEXPECTED_IO_ERROR;
|
|
}
|
|
|
|
DbgPrint("BeingDebugged Offset: 0x%X", (ULONG)offsetof(PEB, BeingDebugged));
|
|
|
|
return STATUS_SUCCESS;
|
|
} |