#include?“KeInject.h“


//全局變量?
PDEVICE_EXTENSION?gDevExt=NULL;

///此列表用于保存創建的進程句柄，在創建線程時會使用
KIRQL?oldirql_g;
KSPIN_LOCK	lock;
LIST_ENTRY??list;

VOID?InitList（）
{
	InitializeListHead（&list）;
	KeInitializeSpinLock（&lock）;
}
int?IsHandleExist（HANDLE?hProcess）
{
	int?exist=0;
	PHANDLENODE?node;
	HANDLE?handle;
	if（IsListEmpty（&list））
	{
		DbgPrint（“\n“）;
		return?0;
	}
	KeAcquireSpinLock（&lock&oldirql_g）;
	for（?node=（PHANDLENODE）（list.Flink）;?node!=（PHANDLENODE）&list;?node=（PHANDLENODE）（node->ListEntry.Flink）?）
	{
		handle?=?node->handle;
		if（hProcess==handle）
		{
			exist=1;
			break;
		}
	}
	KeReleaseSpinLock（&lockoldirql_g）;
	if（exist==1）
		DbgPrint（“\n“hProcess）;
	else
		DbgPrint（“\n“hProcess）;
	return?exist;
}

void?InsertHandle（HANDLE?hProcess）
{
	PHANDLENODE?node;
	node?=?（PHANDLENODE）ExAllocatePoolWithTag（NonPagedPoolsizeof（HANDLENODE）?‘HAND‘）;

	node->handle=hProcess;

	KeAcquireSpinLock（&lock&oldirql_g）;
	InsertHeadList（&list&node->ListEntry）;
	KeReleaseSpinLock（&lockoldirql_g）;
}
void?RemoveHandle（HANDLE?hProcess）
{
	PHANDLENODE?node;
	HANDLE?handle;

	KeAcquireSpinLock（&lock&oldirql_g）;
	for（?node=（PHANDLENODE）（list.Flink）;?node!=（PHANDLENODE）&list;?node=（PHANDLENODE）（node->ListEntry.Flink）?）
	{
		handle=node->handle;
		if（hProcess==handle）
		{
			ExFreePool（
				RemoveHeadList（node->ListEntry.blink）
				）;
			break;
		}
	}
	KeReleaseSpinLock（&lockoldirql_g）;
}
void?ClearHandle（）
{
	PHANDLENODE?node;

	KeAcquireSpinLock（&lock&oldirql_g）;
	while（!IsListEmpty（&list））
	{
		ExFreePool（
			RemoveHeadList（&list）
			）;
	}
	KeReleaseSpinLock（&lockoldirql_g）;
}


//獲取操作系統版本
WIN_VER_DETAIL?GetWindowsVersion（）
{
	UNICODE_STRING?ustrFuncName?=?{?0?};?
	RTL_OSVERSIONINFOEXW?osverinfo?=?{?sizeof（osverinfo）?};?
	PFN_RtlGetVersion?pfnRtlGetVersion?=?NULL;?

	RtlInitUnicodeString（&ustrFuncName?L“RtlGetVersion“）;?
	pfnRtlGetVersion?=?（PFN_RtlGetVersion）MmGetSystemRoutineAddress（&ustrFuncName）;?
	//判斷XP前后版本，調用不同的函數獲得版本號
	if?（pfnRtlGetVersion）
	{?
		pfnRtlGetVersion（（PRTL_OSVERSIONINFOW）&osverinfo）;?
	}?
	else?
	{
		PsGetVersion（&osverinfo.dwMajorVersion?&osverinfo.dwMinorVersion?&osverinfo.dwBuildNumber?NULL）;
	}
	//根據獲得的版本號情況，返回結果
	if?（osverinfo.dwMajorVersion?==?5?&&?osverinfo.dwMinorVersion?==?0）
	{
		return?WINDOWS_VERSION_2K;
	}?
	else?if?（osverinfo.dwMajorVersion?==?5?&&?osverinfo.dwMinorVersion?==?1）?
	{
		return?WINDOWS_VERSION_XP;
	}
	else?if?（osverinfo.dwMajorVersion?==?5?&&?osverinfo.dwMinorVersion?==?2）
	{
		if?（osverinfo.wServicePackMajor==0）
		{?
			return?WINDOWS_VERSION_2K3;
		}?
		else?
		{
			return?WINDOWS_VERSION_2K3_SP1_SP2;
		}
	}?
	else?if?（osverinfo.dwMajorVersion?==?6?&&?osverinfo.dwMinorVersion?==?0）?
	{
		return?WINDOWS_VERSION_VISTA;
	}
	return?WINDOWS_VERSION_NONE;
}

//得到DLL中的指定函數地址?相當于應用層的GetProcAddress函數
DWORD?GetDllF

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件???????1554??2014-08-19?14:25??KeinjectCtl\Debug\cl.command.1.tlog

?????文件??????15216??2014-08-19?14:25??KeinjectCtl\Debug\CL.read.1.tlog

?????文件???????1030??2014-08-19?14:25??KeinjectCtl\Debug\CL.write.1.tlog

?????文件???????2505??2014-08-19?14:23??KeinjectCtl\Debug\KeinjectCtl.Build.CppClean.log

?????文件????????406??2014-08-19?14:23??KeinjectCtl\Debug\KeinjectCtl.exe.embed.manifest

?????文件????????472??2014-08-19?14:23??KeinjectCtl\Debug\KeinjectCtl.exe.embed.manifest.res

?????文件????????381??2014-08-19?14:25??KeinjectCtl\Debug\KeinjectCtl.exe.intermediate.manifest

?????文件?????????76??2014-08-19?14:25??KeinjectCtl\Debug\KeinjectCtl.lastbuildstate

?????文件???????2758??2014-08-19?14:25??KeinjectCtl\Debug\KeinjectCtl.log

?????文件??????32768??2014-08-19?14:25??KeinjectCtl\Debug\KeinjectCtl.obj

?????文件????1245184??2014-08-19?14:23??KeinjectCtl\Debug\KeinjectCtl.pch

?????文件??????????0??2014-08-19?14:23??KeinjectCtl\Debug\KeinjectCtl.write.1.tlog

?????文件????????212??2014-08-19?14:23??KeinjectCtl\Debug\KeinjectCtl_manifest.rc

?????文件??????????2??2014-08-19?14:25??KeinjectCtl\Debug\link-cvtres.read.1.tlog

?????文件??????????2??2014-08-19?14:25??KeinjectCtl\Debug\link-cvtres.write.1.tlog

?????文件??????????2??2014-08-19?14:25??KeinjectCtl\Debug\link.3948-cvtres.read.1.tlog

?????文件??????????2??2014-08-19?14:25??KeinjectCtl\Debug\link.3948-cvtres.write.1.tlog

?????文件??????????2??2014-08-19?14:25??KeinjectCtl\Debug\link.3948.read.1.tlog

?????文件??????????2??2014-08-19?14:25??KeinjectCtl\Debug\link.3948.write.1.tlog

?????文件???????1846??2014-08-19?14:25??KeinjectCtl\Debug\link.command.1.tlog

?????文件???????3490??2014-08-19?14:25??KeinjectCtl\Debug\link.read.1.tlog

?????文件???????1092??2014-08-19?14:25??KeinjectCtl\Debug\link.write.1.tlog

?????文件????????436??2014-08-19?14:25??KeinjectCtl\Debug\mt.command.1.tlog

?????文件????????390??2014-08-19?14:25??KeinjectCtl\Debug\mt.read.1.tlog

?????文件????????390??2014-08-19?14:25??KeinjectCtl\Debug\mt.write.1.tlog

?????文件????????624??2014-08-19?14:23??KeinjectCtl\Debug\rc.command.1.tlog

?????文件????????362??2014-08-19?14:23??KeinjectCtl\Debug\rc.read.1.tlog

?????文件????????370??2014-08-19?14:23??KeinjectCtl\Debug\rc.write.1.tlog

?????文件??????11783??2014-08-19?14:23??KeinjectCtl\Debug\stdafx.obj

?????文件?????379904??2014-08-19?14:25??KeinjectCtl\Debug\vc100.idb

............此處省略73個文件信息