～技术宅真可怕～ » 讨论
Kernel Driver的编译与调试

#include "Test1.h"

#include <ntddk.h>

#include <wdm.h>

#include <stdlib.h>

#include <ntstrsafe.h>  



NTSTATUS make_page_writable()

{

    // Hardcoded values for address and size

    PVOID address = (PVOID)0x7FF75C38576A;  // replace with the actual address you want

    ULONG size = 4096;                // replace with the actual size you want



    // Create a memory descriptor list to map read-only (RX) memory as read-write

    auto mdl = IoAllocateMdl(address, size, FALSE, FALSE, NULL);

    if (mdl == NULL)

    {

        return STATUS_INSUFFICIENT_RESOURCES;

    }



    // Make memory pages resident in RAM and make sure they won't get paged out

    MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);



    // Map the physical page described by mdl to the virtual memory

    auto RWMapping = MmMapLockedPagesSpecifyCache(mdl, KernelMode, MmNonCached, NULL, FALSE, NormalPagePriority);

    if (RWMapping == NULL) 

    {

        MmUnlockPages(mdl);

        IoFreeMdl(mdl);

        return STATUS_INTERNAL_ERROR;

    }



    // Set new mapping page protection to read-write

    auto status = MmProtectMdlSystemAddress(mdl, PAGE_READWRITE);

    if (!NT_SUCCESS(status)) 

    {

        MmUnmapLockedPages(RWMapping, mdl);

        MmUnlockPages(mdl);

        IoFreeMdl(mdl);

        return status;

    }



    // Cleanup

    MmUnmapLockedPages(RWMapping, mdl);

    MmUnlockPages(mdl);

    IoFreeMdl(mdl);



    return STATUS_SUCCESS;

}



VOID UnloadDriver(_In_ PDRIVER_OBJECT DriverObject) {

    UNREFERENCED_PARAMETER(DriverObject);

    KdPrint(("Driver unloaded.\n"));

}



extern "C"

{

    DRIVER_INITIALIZE DriverEntry;

    _Use_decl_annotations_

        NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)

    {

        UNREFERENCED_PARAMETER(RegistryPath);

        // Set our unload function

        DriverObject->DriverUnload = UnloadDriver;



        return STATUS_SUCCESS;

    }

}