Skip to content

Instantly share code, notes, and snippets.

@joshfinley
Created May 17, 2022 16:34
Show Gist options
  • Save joshfinley/5531e31e348d62d7b60e9232aab1fe6d to your computer and use it in GitHub Desktop.
Save joshfinley/5531e31e348d62d7b60e9232aab1fe6d to your computer and use it in GitHub Desktop.
#include <ntddk.h>
CONST WCHAR g_wzDeviceName[] = L"\\Device\\DriverDeviceName";
CONST WCHAR g_wzDosDeviceName[] = L"\\DosDevices\\DriverDosDeviceName";
UNICODE_STRING g_usDeviceName = { 0 };
UNICODE_STRING g_usDeviceLink = { 0 };
PDEVICE_OBJECT g_pDevObj = NULL;
VOID DriverUnload(
IN PDRIVER_OBJECT DriverObject
);
NTSTATUS DispatchNotImplemented(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
);
NTSTATUS DeviceControl(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
);
NTSTATUS DriverENtry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
UNREFERENCED_PARAMETER(RegistryPath);
ULONG i = 0;
NTSTATUS status = STATUS_INTERNAL_ERROR;
KdPrint(("HypervisorExplorer DriverEntry called\n"));
RtlInitUnicodeString(&g_usDeviceName, g_wzDeviceName);
status = IoCreateDevice(
DriverObject,
0,
&g_usDeviceName,
FILE_DEVICE_UNKNOWN,
0,
FALSE,
&g_pDevObj
);
if (!NT_SUCCESS(status))
{
KdPrint(("Failed to create device object (0x%08X)\n", status));
// Check if the device object was actually created
if (g_pDevObj != NULL)
{
IoDeleteDevice(g_pDevObj);
}
return status;
}
RtlInitUnicodeString(&g_usDeviceLink, g_wzDosDeviceName);
status = IoCreateSymbolicLink(&g_usDeviceLink, &g_usDeviceName);
if (!NT_SUCCESS(status))
{
KdPrint(("Failed to create symbolic link (0x%08X)\n", status));
IoDeleteDevice(g_pDevObj);
return status;
}
for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
{
DriverObject->MajorFunction[i] = DispatchNotImplemented;
}
}
NTSTATUS DispatchNotImplemented(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
{
UNREFERENCED_PARAMETER(DeviceObject);
Irp->IoStatus.Information = 0;
Irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
VOID DriverUnload(
IN PDRIVER_OBJECT DriverObject
)
{
UNICODE_STRING usDeviceLink = { 0 };
RtlInitUnicodeString(&usDeviceLink, g_wzDosDeviceName);
// delete symbolic link
IoDeleteSymbolicLink(&usDeviceLink);
// delete device object
IoDeleteDevice(DriverObject->DeviceObject);
}
NTSTATUS DeviceControl(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
{
UNREFERENCED_PARAMETER(DeviceObject);
PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(Irp);
NTSTATUS status = STATUS_INTERNAL_ERROR;
ULONG ioctl = pStack->Parameters.DeviceIoControl.IoControlCode;
switch (ioctl)
{
case
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment