extern?“C“
{


#include“KernelInject.h“





	


	//HelloWDM.cpp

	//得到DLL中的指定函數地址?相當于應用層的GetProcAddress函數
	ULONG_PTR?GetDllFunctionAddress（PCCHAR?lpFunctionName?PVOID?baseAddress）
	{
		HANDLE?hSection?=?NULL?hFile?=?NULL;
		SIZE_T?size?=?0;
		NTSTATUS?status;


		////轉換DLL名稱
		//UNICODE_STRING?strDllName;
		//RtlInitUnicodeString（&strDllName?pDllName）;

		//object_ATTRIBUTES??objectAttributes?=?{?0?};


		//IO_STATUS_BLOCK?iosb?=?{?0?};

		////初始化?objectAttributes
		//InitializeobjectAttributes（&objectAttributes?&strDllName?OBJ_KERNEL_HANDLE?NULL?NULL）;

		//__try
		//{
		//	//打開文件
		//	status?=?ZwOpenFile（&hFile?FILE_EXECUTE?|?SYNCHRONIZE?&objectAttributes?&iosb?FILE_SHARE_READ?FILE_SYNCHRONOUS_IO_NONALERT）;
		//	if?（!NT_SUCCESS（status））
		//	{
		//		__leave;
		//	}
		//	objectAttributes.objectName?=?0;

		//	//創建內存塊
		//	status?=?ZwCreateSection（&hSection?SECTION_ALL_ACCESS?&objectAttributes?0?PAGE_READONLY?SEC_IMAGE?hFile）;?//PAGE_READONLY頁面保護屬性，必須結合SEC_IMAGE屬性
		//	if?（!NT_SUCCESS（status））
		//	{
		//		__leave;
		//	}

		//	//內存映射文件
		//	status?=?ZwMapViewOfSection（hSection
		//		OpenProcess（ProcessId）
		//		&baseAddress
		//		0
		//		1024
		//		0
		//		&size
		//		ViewUnmap
		//		MEM_LARGE_PAGES		//針對DLL文件較小是可以用MEM_TOP_DOWN?文件較大比如USER32.DLL時需要用MEM_LARGE_PAGES
		//		PAGE_READWRITE）;
		//}
		//__finally
		//{
		//	DPRINT（“map?dest?process?success!\r\n“）;
		//	if?（hFile?!=?NULL）
		//	{
		//		//關閉文件句柄
		//		ZwClose（hFile）;
		//	}
		//	if?（!NT_SUCCESS（status）?&&?hSection?!=?NULL）
		//	{
		//		//關閉內存塊
		//		ZwClose（hSection）;
		//	}
		//}
		////如果失敗?直接返回
		//if?（!NT_SUCCESS（status））
		//{
		//	return?0;
		//}




		//HANDLE?hSection?hFile;
		//UNICODE_STRING?dllName;
		//PVOID?baseAddress?=?NULL;
		//SIZE_T?size?=?0;
		//NTSTATUS?stat;
		//object_ATTRIBUTES?oa?=?{?sizeof（oa）?0?&dllName?OBJ_CASE_INSENSITIVE?};
		//IO_STATUS_BLOCK?iosb;

		//RtlInitUnicodeString（&dllName?pDllName）;


		////_asm?int?3;
		//stat?=?ZwOpenFile（&hFile?FILE_EXECUTE?|?SYNCHRONIZE?&oa?&iosb
		//	FILE_SHARE_READ?FILE_SYNCHRONOUS_IO_NONALERT）;

		//if?（!NT_SUCCESS（stat））?{
		//	DPRINT（“ZwOpenFile?:?errorcoede:0x%X\n“?stat）;
		//	return?0;
		//}

		//oa.objectName?=?0;

		//stat?=?ZwCreateSection（&hSection?SECTION_ALL_ACCESS?&oa?0?PAGE_EXECUTE
		//	SEC_IMAGE?hFile）;

		//if?（!NT_SUCCESS（stat））?{
		//	return?0;
		//}

		//stat?=?ZwMapViewOfSection（hSection?NtCurrentProcess（）?&baseAddress?0
		//	1000?0?&size?（SECTION_INHERIT）1?MEM_TOP_DOWN?PAGE_READWRITE）;

		//if?（!NT_SUCCESS（stat））?{
		//	return?0;
		//}



		////讀取PE頭信息
		//IMAGE_DOS_HEADER*?dosheader;
		////IMAGE_OPTIONAL_HEADER*?opthdr;
		//PIMAGE_NT_HEADERS32?pNtHdr32?=?NULL;
		//PIMAGE_NT_HEADERS64?pNtHdr64?=?NULL;
		//IMAGE_EXPORT_DIRECTORY*?pExportTable;
		//PULONG?arrayOfFunctionAddresses?arrayOfFunctionNames;
		//PUSHORT?arrayOfFuncti

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????目錄???????????0??2016-11-02?22:23??KernerlInject\
?????目錄???????????0??2016-11-02?22:23??KernerlInject\KernerlInject\
?????目錄???????????0??2016-10-28?20:42??KernerlInject\KernerlInject?Package\
?????文件???????15087??2016-10-28?00:59??KernerlInject\KernerlInject?Package\KernerlInject?Package.vcxproj
?????文件?????????361??2016-10-28?00:59??KernerlInject\KernerlInject?Package\KernerlInject?Package.vcxproj.filters
?????目錄???????????0??2016-10-28?20:42??KernerlInject\KernerlInject?Package\x64\
?????目錄???????????0??2016-10-28?20:42??KernerlInject\KernerlInject?Package\x64\Win7Debug\
?????目錄???????????0??2016-10-28?20:42??KernerlInject\KernerlInject?Package\x64\Win7Debug\KernerlI.6C5A6B13.tlog\
?????文件?????????189??2016-10-28?20:42??KernerlInject\KernerlInject?Package\x64\Win7Debug\KernerlI.6C5A6B13.tlog\KernerlInject?Package.lastbuildstate
?????文件???????????0??2016-10-28?20:42??KernerlInject\KernerlInject?Package\x64\Win7Debug\KernerlI.6C5A6B13.tlog\unsuccessfulbuild
?????文件?????????621??2016-10-28?20:42??KernerlInject\KernerlInject?Package\x64\Win7Debug\KernerlInject?Package.log
?????文件????15794176??2016-11-02?22:23??KernerlInject\KernerlInject.sdf
?????文件????????7792??2016-10-28?00:59??KernerlInject\KernerlInject.sln
?????文件???????59392??2016-11-02?22:23??KernerlInject\KernerlInject.v12.suo
?????文件???????55660??2016-11-02?22:23??KernerlInject\KernerlInject\KernelInject.cpp
?????文件???????86003??2016-10-31?01:56??KernerlInject\KernerlInject\KernelInject.h
?????文件?????????401??2016-10-28?00:59??KernerlInject\KernerlInject\KernerlInject.inf
?????文件???????11312??2016-10-28?22:21??KernerlInject\KernerlInject\KernerlInject.vcxproj
?????文件????????1395??2016-10-28?06:52??KernerlInject\KernerlInject\KernerlInject.vcxproj.filters
?????文件?????????165??2016-10-28?21:16??KernerlInject\KernerlInject\KernerlInject.vcxproj.user
?????目錄???????????0??2016-10-29?21:14??KernerlInject\KernerlInject\Win7Debug\
?????文件???????79130??2016-10-29?11:12??KernerlInject\KernerlInject\Win7Debug\KernelInject.obj
?????文件????????1477??2016-10-29?21:14??KernerlInject\KernerlInject\Win7Debug\KernerlInject.Build.CppClean.log
?????文件?????????418??2016-10-29?21:14??KernerlInject\KernerlInject\Win7Debug\KernerlInject.inf
?????文件????????1760??2016-10-29?21:14??KernerlInject\KernerlInject\Win7Debug\KernerlInject.log
?????目錄???????????0??2016-10-29?21:14??KernerlInject\KernerlInject\Win7Debug\KernerlInject.tlog\
?????文件???????????2??2016-10-29?21:14??KernerlInject\KernerlInject\Win7Debug\KernerlInject.tlog\cl.command.1.tlog
?????文件????????6334??2016-10-29?11:12??KernerlInject\KernerlInject\Win7Debug\KernerlInject.tlog\CL.read.1.tlog
?????文件?????????408??2016-10-29?11:12??KernerlInject\KernerlInject\Win7Debug\KernerlInject.tlog\CL.write.1.tlog
?????文件?????????191??2016-10-29?21:14??KernerlInject\KernerlInject\Win7Debug\KernerlInject.tlog\KernerlInject.lastbuildstate
?????文件????????2010??2016-10-29?11:12??KernerlInject\KernerlInject\Win7Debug\KernerlInject.tlog\link.command.1.tlog
............此處省略54個文件信息