#include?“Cyber02Hide.h“
#include?“..\\inc\common.h“




#define?ULONG??unsigned?long
#define?LONG??long

#define?SYSTEMSERVICE（_function）?KeServiceDescriptorTable.ServiceTablebase[*（PULONG）（（PUCHAR）_function?+?1）]

//add?lizr
LIST_ENTRY?ProcessList;
KSPIN_LOCK?ProcessLock;

LIST_ENTRY?HideFileList;
KSPIN_LOCK?HideFileLock;

extern?PSHORT?NtBuildNumber;
typedef?PVOID???（*PGetProcessPeb）（PEPROCESS?t）;
PGetProcessPeb??g_PsGetProcessPeb?=?NULL;


//VOID?CreateProcessNotifyRoutine?（IN?HANDLE??ParentIdIN?HANDLE??ProcessIdIN?BOOLEAN?Create）;

NTKERNELAPI
NTSTATUS
PsLookupProcessByProcessId（
						???IN??HANDLE?ProcessId
						???OUT?PEPROCESS?*Process
						???）;

//定義一個原函數指針
REALZWCREATEFILE?????????RealZwCreateFile=NULL;
REALZWQUERYDIRECTORYFILE?RealZwQueryDirectoryFile=NULL;

/*----------------------------------------------------------------------------------------------------*/
/*----------------------------------------------------------------------------------------------------*/
/*----------------------------------------------------------------------------------------------------*/
/*-----------------------------------------驅動入口---------------------------------------------------*/
NTSTATUS?
DriverEntry（IN?PDRIVER_object?Driverobject
			IN?PUNICODE_STRING?RegistryPath）
{
	UNICODE_STRING				nameString?linkString;?
	PDEVICE_object				deviceobject;?
	NTSTATUS					status;
	WCHAR						wBuffer[200];?

	//DbgPrint（“HelloThis?is?DriverEntry!\n“）;

	Driverobject->MajorFunction[IRP_MJ_CREATE]?????????=?
	Driverobject->MajorFunction[IRP_MJ_CLOSE]??????????=?DriverDispatch;
	Driverobject->MajorFunction[IRP_MJ_DEVICE_CONTROL]?=?DriverIoControl;
	Driverobject->DriverUnload?????????????????????????=?DriverUnload;?

??????//建立與上層通信的設備
	RtlInitUnicodeString（&nameString?L“\\Device\\Cyber02Hide“）;?

	status?=?IoCreateDevice（
				Driverobject?
				0										//無設備擴展
				&nameString?
				FILE_DEVICE_FILEMON?
				0?
				TRUE?
				&deviceobject?
				）;?

	if?（!NT_SUCCESS（?status?））?
		return?status;?

	RtlInitUnicodeString（&linkString?L“\\DosDevices\\Cyber02HideCD1“）;

	status?=?IoCreateSymboliclink?（&linkString?&nameString）;?

	if?（!NT_SUCCESS（?status?））?
	{?
		IoDeleteDevice?（Driverobject->Deviceobject）;?
		return?status;?
	}?

	InitializeListHead（&ProcessList）;
	KeInitializeSpinLock（&ProcessLock）;
	InitializeListHead（&HideFileList）;
	KeInitializeSpinLock（&HideFileLock）;

	AddProcess（PsGetCurrentProcessId（））;
	deviceobject->Flags?&=?~DO_DEVICE_INITIALIZING;
	deviceobject->Flags?|=?DO_DIRECT_IO;
????return?STATUS_SUCCESS;
}

/*----------------------------------------------------------------------------------------------------*/
/*----------------------------------------------------------------------------------------------------*/
/*----------------------------------------------------------------------------------------------------*/

NTSTATUS
DriverDispat

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件????????806??2012-02-01?19:07??11.驅動級文件隱藏技術\driver\buildchk.log

?????文件??????24439??2012-02-01?19:05??11.驅動級文件隱藏技術\driver\Cyber02Hide.c

?????文件???????3459??2012-02-01?18:51??11.驅動級文件隱藏技術\driver\Cyber02Hide.dsp

?????文件????????530??2012-02-01?19:04??11.驅動級文件隱藏技術\driver\Cyber02Hide.dsw

?????文件???????4597??2010-05-27?15:01??11.驅動級文件隱藏技術\driver\Cyber02Hide.h

?????文件??????50176??2012-02-21?21:20??11.驅動級文件隱藏技術\driver\Cyber02Hide.ncb

?????文件?????670208??2012-02-21?21:20??11.驅動級文件隱藏技術\driver\Cyber02Hide.opt

?????文件???????1544??2012-02-01?18:51??11.驅動級文件隱藏技術\driver\Cyber02Hide.plg

?????文件???????7040??2010-05-27?17:20??11.驅動級文件隱藏技術\driver\Cyber02Hide.sys

?????文件??????19456??2012-02-01?18:51??11.驅動級文件隱藏技術\driver\Debug\vc70.idb

?????文件??????36864??2012-02-01?18:51??11.驅動級文件隱藏技術\driver\Debug\vc70.pdb

?????文件????????267??2003-02-04?12:23??11.驅動級文件隱藏技術\driver\MAKEFILE

?????文件?????779124??2004-07-17?22:56??11.驅動級文件隱藏技術\driver\ntifs.h

?????文件????????241??2012-02-01?19:01??11.驅動級文件隱藏技術\driver\obj\_objects.mac

?????文件??????54985??2012-02-01?19:05??11.驅動級文件隱藏技術\driver\objchk\i386\cyber02hide.obj

?????文件??????44373??2012-02-01?18:59??11.驅動級文件隱藏技術\driver\objchk\i386\protect.obj

?????文件?????????78??2012-02-01?19:01??11.驅動級文件隱藏技術\driver\Sources

?????文件??????84992??2012-02-01?19:05??11.驅動級文件隱藏技術\driver\sys\i386\Protect.pdb

?????文件???????6400??2012-02-01?19:05??11.驅動級文件隱藏技術\driver\sys\i386\Protect.sys

?????文件??????36664??2012-02-21?21:04??11.驅動級文件隱藏技術\exe\exe.aps

?????文件???????1421??2012-02-21?21:13??11.驅動級文件隱藏技術\exe\exe.clw

?????文件???????2021??2010-05-25?16:30??11.驅動級文件隱藏技術\exe\exe.cpp

?????文件???????4236??2012-01-29?20:53??11.驅動級文件隱藏技術\exe\exe.dsp

?????文件????????529??2010-05-25?16:30??11.驅動級文件隱藏技術\exe\exe.dsw

?????文件???????1291??2010-05-25?16:30??11.驅動級文件隱藏技術\exe\exe.h

?????文件?????132096??2012-02-21?21:13??11.驅動級文件隱藏技術\exe\exe.ncb

?????文件?????670208??2012-02-21?21:13??11.驅動級文件隱藏技術\exe\exe.opt

?????文件????????744??2012-02-21?21:04??11.驅動級文件隱藏技術\exe\exe.plg

?????文件???????5861??2012-02-21?21:04??11.驅動級文件隱藏技術\exe\exe.rc

?????文件???????8840??2012-02-01?18:43??11.驅動級文件隱藏技術\exe\exeDlg.cpp

............此處省略40個文件信息