#include?“ntddk.h“
#include?
#include?
#include?“dbghelp.h“
#include?“Win7x64Drv.h“

typedef?UINT64?（__fastcall?*SCFN）（UINT64UINT64UINT64UINT64）;

NTSTATUS?DriverEntry（PDRIVER_object?pDriverObj?PUNICODE_STRING?pRegistryString）;
NTSTATUS?DispatchCreate（PDEVICE_object?pDevObj?PIRP?pIrp）;
NTSTATUS?DispatchClose（PDEVICE_object?pDevObj?PIRP?pIrp）;
VOID?DriverUnload（PDRIVER_object?pDriverObj）;
NTSTATUS?DispatchIoctl（PDEVICE_object?pDevObj?PIRP?pIrp）;

VOID?test（）
{
	SCFN?scfn;
	UINT64?ret;
	UCHAR?strShellCode[14]=“\x48\x03\xCA\x49\x03\xC8\x49\x03\xC9\x48\x8B\xC1\xC3“;
	/*
	add?rcxrdx
	add?rcxr8
	add?rcxr9
	mov?raxrcx
	ret
	*/
	scfn=ExAllocatePool（NonPagedPool14）;
	memcpy（scfnstrShellCode14）;
	ret=scfn（11223344）;?
	DbgPrint（“[x64Drv]?Inline?ASM?return:?%lld“ret）;
	ExFreePool（scfn）;
}

NTSTATUS?DriverEntry（PDRIVER_object?pDriverObj?PUNICODE_STRING?pRegistryString）
{
	NTSTATUS?status?=?STATUS_SUCCESS;
	UNICODE_STRING?ustrlinkName;
	UNICODE_STRING?ustrDevName;????
	PDEVICE_object?pDevObj;
	dprintf（“[x64Drv]?DriverEntry:?%S\n“pRegistryString->Buffer）;
????//Create?dispatch?points?for?device?control?create?close.
	pDriverObj->MajorFunction[IRP_MJ_CREATE]?=?DispatchCreate;
	pDriverObj->MajorFunction[IRP_MJ_CLOSE]?=?DispatchClose;
	pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL]?=?DispatchIoctl;
	pDriverObj->DriverUnload?=?DriverUnload;
	RtlInitUnicodeString（&ustrDevName?DEVICE_NAME）;
	status?=?IoCreateDevice（pDriverObj?0&ustrDevName?FILE_DEVICE_UNKNOWN0FALSE&pDevObj）;
	dprintf（“[x64Drv]?Device?Name?%S“ustrDevName.Buffer）;
	if（!NT_SUCCESS（status））
	{
		dprintf（“[x64Drv]?IoCreateDevice?=?0x%x\n“?status）;
		return?status;
	}
	RtlInitUnicodeString（&ustrlinkName?link_NAME）;
	status?=?IoCreateSymboliclink（&ustrlinkName?&ustrDevName）;??
	if（!NT_SUCCESS（status））
	{
		dprintf（“[x64Drv]?IoCreateSymboliclink?=?0x%x\n“?status）;
		IoDeleteDevice（pDevObj）;??
		return?status;
	}
	dprintf（“[x64Drv]?Symboliclink:%S“ustrlinkName.Buffer）;
	//test?Begin
	test（）;
	//test?End
	return?STATUS_SUCCESS;
}

VOID?DriverUnload（PDRIVER_object?pDriverObj）
{	
	UNICODE_STRING?strlink;
	RtlInitUnicodeString（&strlink?link_NAME）;
	IoDeleteSymboliclink（&strlink）;
	IoDeleteDevice（pDriverObj->Deviceobject）;
	dprintf（“[x64Drv]?Unloaded\n“）;
}

NTSTATUS?DispatchCreate（PDEVICE_object?pDevObj?PIRP?pIrp）
{
	pIrp->IoStatus.Status?=?STATUS_SUCCESS;
	pIrp->IoStatus.Information?=?0;
	dprintf（“[x64Drv]?IRP_MJ_CREATE\n“）;
	IoCompleteRequest（pIrp?IO_NO_INCREMENT）;
	return?STATUS_SUCCESS;
}

NTSTATUS?DispatchClose（PDEVICE_object?pDevObj?PIRP?pIrp）
{
	pIrp->IoStatus.Status?=?STATUS_SUCCESS;
	pIrp->IoStatus.Information?=?0;
	dprintf（“[x64Drv]?IRP_MJ_CLOSE\n“）;
	IoCompleteRequest（pIrp?IO_NO_INCREMENT）;
	return?STATUS_SUCCESS;
}

NTSTATUS?DispatchIoctl（PDEVICE_object?pDevObj?PIRP?pIrp）
{
	NTSTATUS?status?=?STATUS_INVALID_DEVICE_REQUEST;
	PIO_STACK_LOCATION?

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????目錄???????????0??2014-05-04?17:19??src\
?????文件?????????231??2010-08-10?19:19??src\dbghelp.h
?????文件?????????247??2002-12-08?22:34??src\makefile
?????目錄???????????0??2014-05-04?17:19??src\objfre_win7_amd64\
?????目錄???????????0??2013-12-22?01:44??src\objfre_win7_amd64\amd64\
?????文件?????????103??2011-02-21?02:00??src\sources
?????文件????????3648??2011-02-21?02:25??src\Win7x64Drv.c
?????文件?????????717??2011-02-21?02:00??src\Win7x64Drv.h