Delphi Dünyası Facebook'ta

Duyurular

Kodbank İndir

! CODEBANK 2012 !

İNDİRMEK&DETAYLI BİLGİ ALMAK İÇİN BURAYI TIKLAYINIZ.

« önceki sonraki »
Sayfa: [1]   Aşağı git

Gönderen Konu: Delphi ile ... ( driver, rootkit, ... )  (Okunma sayısı 1737 defa)

0 Üye ve 1 Ziyaretçi konuyu incelemekte.

Çevrimdışı mrigi

  • Delphi 1 Level 3
  • ***
  • İleti: 23
  • Rep: +0/-0
  • "imkansız" üşenmekten başka bir şey değildir.
Delphi ile ... ( driver, rootkit, ... )
« : 23 Aralık 2009 22:09:13 »
link

incelemenizi tavsiye ederim.
Kayıtlı

Çevrimdışı mrigi

  • Delphi 1 Level 3
  • ***
  • İleti: 23
  • Rep: +0/-0
  • "imkansız" üşenmekten başka bir şey değildir.
Ynt: Delphi ile ... ( driver, rootkit, ... )
« Yanıtla #1 : 30 Aralık 2009 23:52:22 »
Kod:  (Unknown Language)
  1. //
  2. // first of all this is unit not program
  3. // we need some exports to be working e.g. _DriverEntry - see below
  4. //
  5. unit driver;
  6.  
  7. interface
  8.  
  9. //
  10. // the most important unit is DDDK which source is in inc directory
  11. // it contains everything we need to work with kernel functions
  12. //
  13. uses DDDK;
  14.  
  15.  
  16. //
  17. // this is the must, when one say you can name your driver entry with your name
  18. // in DDK, you have to leave _DriverEntry name of entry in DDDK unless you know
  19. // what you are dealing with
  20. //
  21. function _DriverEntry(DriverObject:PDriverObject;RegistryPath:PUnicodeString):NTSTATUS; stdcall;
  22.  
  23.  
  24. implementation
  25.  
  26. //
  27. // unload is called when driver is being unloaded, if we do not implement unload
  28. // function them our driver can't be unloaded dynamically
  29. //
  30. procedure DriverUnload(DriverObject:PDriverObject); stdcall;
  31. begin
  32.  DbgPrint('DriverUnload(DriverObject:0x%.8X)',[DriverObject]);
  33.  DbgPrint('DriverUnload(-)',[]);
  34. end;
  35.  
  36.  
  37. //
  38. // DriverEntry is common driver entry point
  39. //
  40. function _DriverEntry(DriverObject:PDriverObject;RegistryPath:PUnicodeString):NTSTATUS; stdcall;
  41. begin
  42.  DbgPrint('DriverEntry(DriverObject:0x%.8X;RegistryPath:0x%.8X)',[DriverObject,RegistryPath]);
  43.  
  44.  DriverObject^.DriverUnload:=@DriverUnload;
  45.  
  46.  Result:=STATUS_SUCCESS;
  47.  DbgPrint('DriverEntry(-):0x%.8X',[Result]);
  48. end;
  49.  
  50. end.

Kod:  (Unknown Language)
  1. //
  2. // hook1 is basic driver with unload support, logs every action too DebugView
  3. // enjoy your first lesson
  4. //
  5. unit hook1;
  6.  
  7. interface
  8.  
  9. //
  10. // the most important unit is DDDK which source is in inc directory
  11. // it contains everything we need to work with kernel functions
  12. //
  13. uses DDDK;
  14.  
  15. const
  16.  DeviceName='\Device\hook1';
  17.  DosDeviceName='\DosDevices\hook1';
  18.  
  19.  
  20. //
  21. // this is the must, when one say you can name your driver entry with your name
  22. // in DDK, you have to leave _DriverEntry name of entry in DDDK unless you know
  23. // what you are dealing with
  24. //
  25. function _DriverEntry(ADriverObject:PDriverObject;ARegistryPath:PUnicodeString):NTSTATUS; stdcall;
  26.  
  27. function Hook1Create(ADeviceObject:PDeviceObject;AIrp:PIrp):NTSTATUS; stdcall;
  28. function Hook1Close(ADeviceObject:PDeviceObject;AIrp:PIrp):NTSTATUS; stdcall;
  29. function Hook1DeviceControl(ADeviceObject:PDeviceObject;AIrp:PIrp):NTSTATUS; stdcall;
  30. procedure Hook1Unload(ADriverObject:PDriverObject); stdcall;
  31.  
  32.  
  33. implementation
  34.  
  35. var
  36. // dos device name is global variable because we use it in unload too,
  37. // we can always make another RtlInitUnicodeString if we don't like global vars
  38.  DosDevName:TUnicodeString;
  39.  
  40.  
  41. //
  42. // create function is called everytime CreateFile is called on our device
  43. //
  44. function Hook1Create(ADeviceObject:PDeviceObject;AIrp:PIrp):NTSTATUS; stdcall;
  45. begin
  46.  DbgMsg('hook1.pas: Hook1Create(ADeviceObject:0x%.8X,AIrp:0x%.8X)',[ADeviceObject,AIrp]);
  47.  
  48.  Result:=STATUS_SUCCESS;
  49.  AIrp^.IoStatus.Status:=Result;
  50.  IoCompleteRequest(AIrp,IO_NO_INCREMENT);
  51.  
  52.  DbgMsg('hook1.pas: Hook1Create(-):0x%.8X)',[Result]);
  53. end;
  54.  
  55.  
  56. //
  57. // close function is called everytime CloseHandle is called on our device
  58. // close is associated with IRP_MJ_CLOSE and it is NOT executed in the context
  59. // of the CloseHandle caller, if we want to make some cleanup in that context
  60. // we rather associate cleanup function with IRP_MJ_CLEANUP
  61. //
  62.  


                      Delphi Driver Development Kit v0.0.4
                      ====================================
                      by The Hacker Defender Project team


Instructions
------------

To get .sys driver you have to run compile.but at first and then build.bat.
compile.bat runs Delphi part of the work creating .obj. build.bat then converts
this object file to MS supported format of OMF using OMF2D 1.02 written
by EliCZ and then MS linker link.exe is used to assemble final .sys.

As you can notice making drivers in Delphi is not supported by default so
several hacks are made to make it working. One of these hacks is ignoring
some linker errors and so that we receive some other errors and warnigs during
linking. Final .sys is working well so don't take these warnings seriously
but of course if you make your own driver there can be lot of other warnings
and errors you should care about.

In samples directory you've got some of our samples. Each example includes its
own compile and build scripts. To compile debug version run compile.debug.bat
instead of compile.bat.


Versions
--------

0.0.4 - Third release comes with few more supported functions and hook3 from
        Driver coding tutorial.


0.0.3 - Third release comes with more supported functions, types, constants
        exports and also with new example - hook2 from Driver coding tutorial.
      x some functions are quite messy written in Delphi, if you know there is
        a chance to improve the code and make it more clear and elegant, let us
        know


0.0.2 - Second release comes with major changes in design. There are two
        samples now including hook1 from Driver coding tutorial.
      + unit DDDK.pas for easy driver coding, you only need to add uses DDDK
        in your source to get easy access to all supported functions
       

0.0.1 - This is very first release of DDDK. It is just proof of concept showing
        the possibility of making working Delphi driver. However, this version
        comes with working implementation of DbgPrint which can be very useful
        where it comes to the driver coding.



visit our site http://www.hxdef.org (http://hxdef.net.ru,
http://hxdef.czweb.org, http://rootkit.host.sk)
Kayıtlı

Çevrimdışı mrigi

  • Delphi 1 Level 3
  • ***
  • İleti: 23
  • Rep: +0/-0
  • "imkansız" üşenmekten başka bir şey değildir.
Ynt: Delphi ile ... ( driver, rootkit, ... ) - Unit DDDK
« Yanıtla #2 : 30 Aralık 2009 23:56:01 »
Kod:  (Unknown Language)
  1. //
  2. // all DDDK drivers should include this unit
  3. // this unit exports all currently supported kernel function, structures and constants
  4. //
  5. unit DDDK;
  6.  
  7. interface
  8.  
  9. const
  10.  NtKernel='ntoskrnl.exe';
  11.  
  12.  STATUS_SUCCESS=0;
  13.  STATUS_UNSUCCESSFUL            = $C0000001;
  14.  STATUS_NOT_IMPLEMENTED         = $C0000002;
  15.  STATUS_INVALID_INFO_CLASS      = $C0000003;
  16.  STATUS_INFO_LENGTH_MISMATCH    = $C0000004;
  17.  STATUS_ACCESS_VIOLATION        = $C0000005;
  18.  STATUS_IN_PAGE_ERROR           = $C0000006;
  19.  STATUS_PAGEFILE_QUOTA          = $C0000007;
  20.  STATUS_INVALID_HANDLE          = $C0000008;
  21.  STATUS_BAD_INITIAL_STACK       = $C0000009;
  22.  STATUS_BAD_INITIAL_PC          = $C000000A;
  23.  STATUS_INVALID_CID             = $C000000B;
  24.  STATUS_TIMER_NOT_CANCELED      = $C000000C;
  25.  STATUS_INVALID_PARAMETER       = $C000000D;
  26.  STATUS_NO_SUCH_DEVICE          = $C000000E;
  27.  STATUS_NO_SUCH_FILE            = $C000000F;
  28.  STATUS_INVALID_DEVICE_REQUEST  = $C0000010;
  29.  
  30.  IRP_MJ_CREATE                  = $00;
  31.  IRP_MJ_CREATE_NAMED_PIPE       = $01;
  32.  IRP_MJ_CLOSE                   = $02;
  33.  IRP_MJ_READ                    = $03;
  34.  IRP_MJ_WRITE                   = $04;
  35.  IRP_MJ_QUERY_INFORMATION       = $05;
  36.  IRP_MJ_SET_INFORMATION         = $06;
  37.  IRP_MJ_QUERY_EA                = $07;
  38.  IRP_MJ_SET_EA                  = $08;
  39.  IRP_MJ_FLUSH_BUFFERS           = $09;
  40.  IRP_MJ_QUERY_VOLUME_INFORMATION= $0A;
  41.  IRP_MJ_SET_VOLUME_INFORMATION  = $0B;
  42.  IRP_MJ_DIRECTORY_CONTROL       = $0C;
  43.  IRP_MJ_FILE_SYSTEM_CONTROL     = $0D;
  44.  IRP_MJ_DEVICE_CONTROL          = $0E;
  45.  IRP_MJ_INTERNAL_DEVICE_CONTROL = $0F;
  46.  IRP_MJ_SHUTDOWN                = $10;
  47.  IRP_MJ_LOCK_CONTROL            = $11;
  48.  IRP_MJ_CLEANUP                 = $12;
  49.  IRP_MJ_CREATE_MAILSLOT         = $13;
  50.  IRP_MJ_QUERY_SECURITY          = $14;
  51.  IRP_MJ_SET_SECURITY            = $15;
  52.  IRP_MJ_POWER                   = $16;
  53.  IRP_MJ_SYSTEM_CONTROL          = $17;
  54.  IRP_MJ_DEVICE_CHANGE           = $18;
  55.  IRP_MJ_QUERY_QUOTA             = $19;
  56.  IRP_MJ_SET_QUOTA               = $1A;
  57.  IRP_MJ_PNP                     = $1B;
  58.  IRP_MJ_PNP_POWER               = IRP_MJ_PNP;
  59.  IRP_MJ_MAXIMUM_FUNCTION        = $1B;
  60.  
  61.  DO_BUFFERED_IO                 = $00000004;
  62.  DO_EXCLUSIVE                   = $00000008;
  63.  DO_DIRECT_IO                   = $00000010;
  64.  DO_MAP_IO_BUFFER               = $00000020;
  65.  DO_DEVICE_INITIALIZING         = $00000080;
  66.  DO_SHUTDOWN_REGISTERED         = $00000800;
  67.  DO_BUS_ENUMERATED_DEVICE       = $00001000;
  68.  DO_POWER_PAGABLE               = $00002000;
  69.  DO_POWER_INRUSH                = $00004000;
  70.  
  71.  
  72.  FILE_DEVICE_BEEP               = $00000001;
  73.  FILE_DEVICE_CD_ROM             = $00000002;
  74.  FILE_DEVICE_CD_ROM_FILE_SYSTEM = $00000003;
  75.  FILE_DEVICE_CONTROLLER         = $00000004;
  76.  FILE_DEVICE_DATALINK           = $00000005;
  77.  FILE_DEVICE_DFS                = $00000006;
  78.  FILE_DEVICE_DISK               = $00000007;
  79.  FILE_DEVICE_DISK_FILE_SYSTEM   = $00000008;
  80.  FILE_DEVICE_FILE_SYSTEM        = $00000009;
  81.  FILE_DEVICE_INPORT_PORT        = $0000000A;
  82.  FILE_DEVICE_KEYBOARD           = $0000000B;
  83.  FILE_DEVICE_MAILSLOT           = $0000000C;
  84.  FILE_DEVICE_MIDI_IN            = $0000000D;
  85.  FILE_DEVICE_MIDI_OUT           = $0000000E;
  86.  FILE_DEVICE_MOUSE              = $0000000F;
  87.  FILE_DEVICE_MULTI_UNC_PROVIDER = $00000010;
  88.  FILE_DEVICE_NAMED_PIPE         = $00000011;
  89.  FILE_DEVICE_NETWORK            = $00000012;
  90.  FILE_DEVICE_NETWORK_BROWSER    = $00000013;
  91.  FILE_DEVICE_NETWORK_FILE_SYSTEM= $00000014;
  92.  FILE_DEVICE_NULL               = $00000015;
  93.  FILE_DEVICE_PARALLEL_PORT      = $00000016;
  94.  FILE_DEVICE_PHYSICAL_NETCARD   = $00000017;
  95.  FILE_DEVICE_PRINTER            = $00000018;
  96.  FILE_DEVICE_SCANNER            = $00000019;
  97.  FILE_DEVICE_SERIAL_MOUSE_PORT  = $0000001A;
  98.  FILE_DEVICE_SERIAL_PORT        = $0000001B;
  99.  FILE_DEVICE_SCREEN             = $0000001C;
  100.  FILE_DEVICE_SOUND              = $0000001D;
  101.  FILE_DEVICE_STREAMS            = $0000001E;
  102.  FILE_DEVICE_TAPE               = $0000001F;
  103.  FILE_DEVICE_TAPE_FILE_SYSTEM   = $00000020;
  104.  FILE_DEVICE_TRANSPORT          = $00000021;
  105.  FILE_DEVICE_UNKNOWN            = $00000022;
  106.  FILE_DEVICE_VIDEO              = $00000023;
  107.  FILE_DEVICE_VIRTUAL_DISK       = $00000024;
  108.  FILE_DEVICE_WAVE_IN            = $00000025;
  109.  FILE_DEVICE_WAVE_OUT           = $00000026;
  110.  FILE_DEVICE_8042_PORT          = $00000027;
  111.  FILE_DEVICE_NETWORK_REDIRECTOR = $00000028;
  112.  FILE_DEVICE_BATTERY            = $00000029;
  113.  FILE_DEVICE_BUS_EXTENDER       = $0000002A;
  114.  FILE_DEVICE_MODEM              = $0000002B;
  115.  FILE_DEVICE_VDM                = $0000002C;
  116.  FILE_DEVICE_MASS_STORAGE       = $0000002D;
  117.  FILE_DEVICE_SMB                = $0000002E;
  118.  FILE_DEVICE_KS                 = $0000002F;
  119.  FILE_DEVICE_CHANGER            = $00000030;
  120.  FILE_DEVICE_SMARTCARD          = $00000031;
  121.  FILE_DEVICE_ACPI               = $00000032;
  122.  FILE_DEVICE_DVD                = $00000033;
  123.  FILE_DEVICE_FULLSCREEN_VIDEO   = $00000034;
  124.  FILE_DEVICE_DFS_FILE_SYSTEM    = $00000035;
  125.  FILE_DEVICE_DFS_VOLUME         = $00000036;
  126.  FILE_DEVICE_SERENUM            = $00000037;
  127.  FILE_DEVICE_TERMSRV            = $00000038;
  128.  FILE_DEVICE_KSEC               = $00000039;
  129.  FILE_DEVICE_FIPS               = $0000003A;
  130.  
  131.  
  132.  EVENT_INCREMENT                = 1;
  133.  IO_NO_INCREMENT                = 0;
  134.  IO_CD_ROM_INCREMENT            = 1;
  135.  IO_DISK_INCREMENT              = 1;
  136.  IO_KEYBOARD_INCREMENT          = 6;
  137.  IO_MAILSLOT_INCREMENT          = 2;
  138.  IO_MOUSE_INCREMENT             = 6;
  139.  IO_NAMED_PIPE_INCREMENT        = 2;
  140.  IO_NETWORK_INCREMENT           = 2;
  141.  IO_PARALLEL_INCREMENT          = 1;
  142.  IO_SERIAL_INCREMENT            = 2;
  143.  IO_SOUND_INCREMENT             = 8;
  144.  IO_VIDEO_INCREMENT             = 1;
  145.  SEMAPHORE_INCREMENT            = 1;
  146.  
  147.  
  148.  MAXIMUM_FILENAME_LENGTH        = 256;
  149.  
  150.  FILE_REMOVABLE_MEDIA           = $00000001;
  151.  FILE_READ_ONLY_DEVICE          = $00000002;
  152.  FILE_FLOPPY_DISKETTE           = $00000004;
  153.  FILE_WRITE_ONCE_MEDIA          = $00000008;
  154.  FILE_REMOTE_DEVICE             = $00000010;
  155.  FILE_DEVICE_IS_MOUNTED         = $00000020;
  156.  FILE_VIRTUAL_VOLUME            = $00000040;
  157.  FILE_AUTOGENERATED_DEVICE_NAME = $00000080;
  158.  FILE_DEVICE_SECURE_OPEN        = $00000100;
  159.  FILE_CHARACTERISTIC_PNP_DEVICE = $00000800;
  160.  
  161.  
  162.  FileBasicInformation           = 4;
  163.  FileStandardInformation        = 5;
  164.  FilePositionInformation        = 14;
  165.  FileEndOfFileInformation       = 20;
  166.  
  167.  FileFsVolumeInformation        = 1;
  168.  FileFsLabelInformation         = 2;
  169.  FileFsSizeInformation          = 3;
  170.  FileFsDeviceInformation        = 4;
  171.  FileFsAttributeInformation     = 5;
  172.  FileFsControlInformation       = 6;
  173.  FileFsFullSizeInformation      = 7;
  174.  FileFsObjectIdInformation      = 8;
  175.  FileFsDriverPathInformation    = 9;
  176.  FileFsMaximumInformation       = 10;
  177.  
  178.  BusRelations                   = 0;
  179.  EjectionRelations              = 1;
  180.  PowerRelations                 = 2;
  181.  RemovalRelations               = 3;
  182.  TargetDeviceRelation           = 4;
  183.  SingleBusRelations             = 5;
  184.  
  185.  BusQueryDeviceID               = 0;            // <Enumerator>\<Enumerator-specific device id>
  186.  BusQueryHardwareIDs            = 1;            // Hardware ids
  187.  BusQueryCompatibleIDs          = 2;            // compatible device ids
  188.  BusQueryInstanceID             = 3;            // persistent id for this instance of the device
  189.  BusQueryDeviceSerialNumber     = 4;            // serial number for this device
  190.  
  191.  
  192.  DeviceTextDescription          = 0;            // DeviceDesc property
  193.  DeviceTextLocationInformation  = 1;            // DeviceLocation property
  194.  
  195.  DeviceUsageTypeUndefined       = 0;
  196.  DeviceUsageTypePaging          = 1;
  197.  DeviceUsageTypeHibernation     = 2;
  198.  DeviceUsageTypeDumpFile        = 3;
  199.  
  200.  PowerSystemUnspecified         = 0;
  201.  PowerSystemWorking             = 1;
  202.  PowerSystemSleeping1           = 2;
  203.  PowerSystemSleeping2           = 3;
  204.  PowerSystemSleeping3           = 4;
  205.  PowerSystemHibernate           = 5;
  206.  PowerSystemShutdown            = 6;
  207.  PowerSystemMaximum             = 7;
  208.  
  209.  PowerActionNone                = 0;
  210.  PowerActionReserved            = 1;
  211.  PowerActionSleep               = 2;
  212.  PowerActionHibernate           = 3;
  213.  PowerActionShutdown            = 4;
  214.  PowerActionShutdownReset       = 5;
  215.  PowerActionShutdownOff         = 6;
  216.  PowerActionWarmEject           = 7;
  217.  
  218.  PowerDeviceUnspecified         = 0;
  219.  PowerDeviceD0                  = 1;
  220.  PowerDeviceD1                  = 2;
  221.  PowerDeviceD2                  = 3;
  222.  PowerDeviceD3                  = 4;
  223.  PowerDeviceMaximum             = 5;
  224.  
  225.  SystemPowerState               = 0;
  226.  DevicePowerState               = 1;
  227.  
  228.  Executive                      = 0;
  229.  FreePage                       = 1;
  230.  PageIn                         = 2;
  231.  PoolAllocation                 = 3;
  232.  DelayExecution                 = 4;
  233.  Suspended                      = 5;
  234.  UserRequest                    = 6;
  235.  WrExecutive                    = 7;
  236.  WrFreePage                     = 8;
  237.  WrPageIn                       = 9;
  238.  WrPoolAllocation               = 10;
  239.  WrDelayExecution               = 11;
  240.  WrSuspended                    = 12;
  241.  WrUserRequest                  = 13;
  242.  WrEventPair                    = 14;
  243.  WrQueue                        = 15;
  244.  WrLpcReceive                   = 16;
  245.  WrLpcReply                     = 17;
  246.  WrVirtualMemory                = 18;
  247.  WrPageOut                      = 19;
  248.  WrRendezvous                   = 20;
  249.  Spare2                         = 21;
  250.  Spare3                         = 22;
  251.  Spare4                         = 23;
  252.  Spare5                         = 24;
  253.  Spare6                         = 25;
  254.  WrKernel                       = 26;
  255.  MaximumWaitReason              = 27;
  256.  
  257.  KernelMode                     = 0;
  258.  UserMode                       = 1;
  259.  MaximumMode                    = 2;
  260.  
  261.  NonPagedPool                   = 0;
  262.  PagedPool                      = 1;
  263.  NonPagedPoolMustSucceed        = 2;
  264.  DontUseThisType                = 3;
  265.  NonPagedPoolCacheAligned       = 4;
  266.  PagedPoolCacheAligned          = 5;
  267.  NonPagedPoolCacheAlignedMustS  = 6;
  268.  MaxPoolType                    = 7;
  269.  
  270. //
  271. // types are very important,
  272. // because we want to code drivers in Delphi we use we use Delphi style
  273. // of types, but also we want to have some code compatibility so we implement
  274. // also WinAPI (C) style of types
  275. //
  276. type
  277.  LONG=Integer;
  278.  PLONG=^LONG;
  279.  ULONG=Cardinal;
  280.  PULONG=^ULONG;
  281.  NTSTATUS=ULONG;
  282.  LCID=ULONG;
  283.  TDeviceType=ULONG;
  284.  DEVICE_TYPE=TDeviceType;
  285.  TKProcessorMode=Byte;
  286.  KPROCESSOR_MODE=TKProcessorMode;
  287.  TKIrql=Byte;
  288.  KIRQL=TKIRQL;
  289.  PEThread=Pointer;
  290.  PEProcess=Pointer;
  291.  PKThread=Pointer;                              //PKTHREAD
  292.  PHandle=^THandle;
  293.  TAccessMask=ULONG;
  294.  
  295.  PUnicodeString=^TUnicodeString;
  296.  TUnicodeString=packed record
  297.   Length:Word;
  298.   MaximumLength:Word;
  299.   Buffer:PWideChar;
  300.  end;
  301.  UNICODE_STRING=TUnicodeString;
  302.  PUNICODE_STRING=^UNICODE_STRING;
  303.  
  304.  PLargeInteger=^TLargeInteger;
  305.  TLargeInteger=packed record
  306.   LowPart:Cardinal;
  307.   HighPart:Integer;
  308.  end;
  309.  
  310.  PObjectAttributes=^TObjectAttributes;
  311.  TObjectAttributes=packed record
  312.   Length:Cardinal;
  313.   RootDirectory:THandle;
  314.   ObjectName:PUnicodeString;
  315.   Attributes:Cardinal;
  316.   SecurityDescriptor:Pointer;
  317.   SecurityQualityOfService:Pointer;
  318.  end;
  319.  OBJECT_ATTRIBUTES=^TObjectAttributes;
  320.  POBJECT_ATTRIBUTES=^OBJECT_ATTRIBUTES;
  321.  
  322.  PClientId=^TClientId;
  323.  TClientId=packed record
  324.   UniqueProcess:Cardinal;
  325.   UniqueThread:Cardinal;
  326.  end;
  327.  CLIENT_ID=TClientId;
  328.  PCLIENT_ID=^CLIENT_ID;
  329.  
  330.  PDriverObject=^TDriverObject;
  331.  PDeviceObject=^TDeviceObject;
  332.  PIrp=^TIrp;
  333.  
  334.  PListEntry=^TListEntry;
  335.  TListEntry=packed record
  336.   Flink:PListEntry;
  337.   BLink:PListEntry;
  338.  end;
  339.  LIST_ENTRY=TListEntry;
  340.  PLIST_ENTRY=^LIST_ENTRY;
  341.  PRLIST_ENTRY=PLIST_ENTRY;
  342.  
  343.  
  344.  PKDeviceQueueEntry=^TKDeviceQueueEntry;
  345.  TKDeviceQueueEntry=packed record
  346.   DeviceListEntry:TListEntry;
  347.   SortKey:Cardinal;
  348.   Inserted:LongBool;
  349.  end;
  350.  KDEVICE_QUEUE_ENTRY=TKDeviceQueueEntry;
  351.  PKDEVICE_QUEUE_ENTRY=^KDEVICE_QUEUE_ENTRY;
  352.  PRKDEVICE_QUEUE_ENTRY=PKDEVICE_QUEUE_ENTRY;
  353.  
  354.  PWaitContextBlock=^TWaitContextBlock;
  355.  TWaitContextBlock=packed record
  356.   WaitQueueEntry:TKDeviceQueueEntry;
  357.   DeviceRoutine:Pointer;                        //PDRIVER_CONTROL
  358.   DeviceContext:Pointer;
  359.   NumberOfMapRegisters:Cardinal;
  360.   DeviceObject:Pointer;
  361.   CurrentIrp:Pointer;
  362.   BufferChainingDpc:Pointer;                    //PKDPC
  363.  end;
  364.  WAIT_CONTEXT_BLOCK=TWaitContextBlock;
  365.  PWAIT_CONTEXT_BLOCK=^WAIT_CONTEXT_BLOCK;
  366.  
  367.  TKSpinLock=Pointer;                            //ULONG_PTR
  368.  PKSpinLock=^TKSpinLock;
  369.  KSPIN_LOCK=TKSpinLock;
  370.  PKSPIN_LOCK=^KSPIN_LOCK;
  371.  
  372.  TDeviceObjectUnionQueue=packed record
  373.   case Byte of
  374.    0:(ListEntry:TListEntry);
  375.    1:(Wcb:TWaitContextBlock);
  376.  end;
  377.  
  378.  PDevObjExtension=^TDevObjExtension;
  379.  TDevObjExtension=packed record
  380.   wType:Word;
  381.   Size:Word;
  382.   DeviceObject:PDeviceObject;
  383.  end;
  384.  DEVOBJ_EXTENSION=TDevObjExtension;
  385.  PDEVOBJ_EXTENSION=^DEVOBJ_EXTENSION;
  386.  
  387.  PKDeviceQueue=^TKDeviceQueue;
  388.  TKDeviceQueue=packed record
  389.   wType:Word;
  390.   Size:Word;
  391.   DeviceListHead:TListEntry;
  392.   Lock:TKSpinLock;
  393.   Busy:LongBool;
  394.  end;
  395.  KDEVICE_QUEUE=TKDeviceQueue;
  396.  PKDEVICE_QUEUE=^KDEVICE_QUEUE;
  397.  
  398.  PKApc=^TKApc;
  399.  TKApc=packed record
  400.   wType:Word;
  401.   Size:Word;
  402.   Spare0:Cardinal;
  403.   Thread:PKThread;
  404.   ApcListEntry:TListEntry;
  405.   KernelRoutine:Pointer;                        //PKKERNEL_ROUTINE
  406.   RundownRoutine:Pointer;                       //PKRUNDOWN_ROUTINE
  407.   NormalRoutine:Pointer;                        //PKNORMAL_ROUTINE
  408.   NormalContext:Pointer;
  409.   SystemArgument1:Pointer;
  410.   SystemArgument2:Pointer;
  411.   ApcStateIndex:Byte;
  412.   ApcMode:TKProcessorMode;
  413.   Inserted:WordBool;
  414.  end;
  415.  KAPC=TKApc;
  416.  PRKAPC=PKApc;
  417.  
  418.  PKDpc=^TKDpc;
  419.  TKDpc=packed record
  420.   wType:Word;
  421.   Number:Byte;
  422.   Importance:Byte;
  423.   DpcListEntry:TListEntry;
  424.   DeferredRoutine:Pointer;                      //PKDEFERRED_ROUTINE
  425.   DeferredContext:Pointer;
  426.   SystemArgument1:Pointer;
  427.   SystemArgument2:Pointer;
  428.   Lock:Pointer;                                 //PULONG_PTR
  429.  end;
  430.  KDPC=TKDpc;
  431.  PRKDPC=PKDPC;
  432.  
  433.  PDispatcherHeader=^TDispatcherHeader;
  434.  TDispatcherHeader=packed record
  435.   bType:Byte;
  436.   bAbsolute:Byte;
  437.   Size:Byte;
  438.   Inserted:Byte;
  439.   SignalState:Cardinal;
  440.   WaitListHead:TListEntry
  441.  end;
  442.  DISPATCHER_HEADER=TDispatcherHeader;
  443.  
  444.  PKEvent=^TKEvent;
  445.  TKEvent=packed record
  446.   Header:TDispatcherHeader;
  447.  end;
  448.  KEVENT=TKEvent;
  449.  PRKEVENT=PKEVENT;
  450.  
  451.  TDeviceObject=packed record
  452.   wType:Word;
  453.   Size:Word;
  454.   ReferenceCount:Integer;
  455.   DriverObject:PDriverObject;
  456.   NextDevice:PDeviceObject;
  457.   AttachedDevice:PDeviceObject;
  458.   CurrentIrp:PIrp;
  459.   Timer:Pointer;                                //PIO_TIMER
  460.   Flags:Cardinal;
  461.   Characteristics:Cardinal;
  462.   DoNotUse1:Pointer;
  463.   DeviceExtension:Pointer;
  464.   DeviceType:TDeviceType;
  465.   StackSize:Byte;
  466.   Queue:TDeviceObjectUnionQueue;
  467.   AlignmentRequirement:Cardinal;
  468.   DeviceQueue:TKDeviceQueue;
  469.   Dpc:TKDpc;
  470.  
  471.   ActiveThreadCount:Cardinal;
  472.   SecurityDescriptor:Pointer;                   //PSECURITY_DESCRIPTOR
  473.   DeviceLock:TKEvent;
  474.  
  475.   SectorSize:Word;
  476.   Spare1:Word;
  477.  
  478.   DeviceObjectExtension:PDevObjExtension;
  479.   Reserved:Pointer;
  480.  end;
  481.  DEVICE_OBJECT=TDeviceObject;
  482.  PDEVICE_OBJECT=^DEVICE_OBJECT;
  483.  
  484.  TIrpUnionAssociatedIrp=packed record
  485.   case Byte of
  486.    0:(MasterIrp:PIrp);
  487.    1:(IrpCount:Cardinal);
  488.    2:(SystemBuffer:Pointer);
  489.  end;
  490.  
  491.  PIoStatusBlock=^TIoStatusBlock;
  492.  TIoStatusBlock=packed record
  493.   Status:NTSTATUS;
  494.   Information:Cardinal;                         //ULONG_PTR
  495.  end;
  496.  IO_STATUS_BLOCK=TIoStatusBlock;
  497.  PIO_STATUS_BLOCK=^IO_STATUS_BLOCK;
  498.  
  499.  
  500.  TIrpUnionOverlayStructAsynchronousParameters=packed record
  501.   UserApcRoutine:Pointer;                       //PIO_APC_ROUTINE
  502.   UserApcContext:Pointer;
  503.  end;
  504.  
  505.  TIrpUnionOverlay=packed record
  506.   case Byte of
  507.    0:(AsynchronousParameters:TIrpUnionOverlayStructAsynchronousParameters);
  508.    1:(AllocationSize:TLargeInteger);
  509.  end;
  510.  
  511.  TIrpUnionTailStructOverlayUnion1=packed record
  512.   case Byte of
  513.    0:(DeviceQueueEntry:TKDeviceQueueEntry);
  514.    1:(DriverContext:array[0..3] of Pointer);
  515.  end;
  516.  
  517.  TIrpUnionTailStructOverlayStruct1Union1=packed record
  518.   case Byte of
  519.    0:(CurrentStackLocation:Pointer);            //PIO_STACK_LOCATION
  520.    1:(PacketType:Cardinal);
  521.  end;
  522.  
  523.  TIrpUnionTailStructOverlayStruct1=packed record
  524.   ListEntry:TListEntry;
  525.   u1:TIrpUnionTailStructOverlayStruct1Union1;
  526.  end;
  527.  
  528.  TIrpUnionTailStructOverlay=packed record
  529.   u1:TIrpUnionTailStructOverlayUnion1;
  530.   Thread:PEThread;
  531.   AuxiliaryBuffer:PChar;
  532.   s1:TIrpUnionTailStructOverlayStruct1;
  533.   OriginalFileObject:Pointer;                   //PFILE_OBJECT
  534.  end;
  535.  
  536.  TIrpUnionTail=packed record
  537.   case Byte of
  538.    0:(Overlay:TIrpUnionTailStructOverlay);
  539.    1:(Apc:TKApc);
  540.    2:(CompletionKey:Pointer);
  541.  end;
  542.  
  543.  TIrp=packed record
  544.   wType:Word;
  545.   Size:Word;
  546.   MdlAddress:Pointer;                           //PMDL
  547.   Flags:Cardinal;
  548.   AssociatedIrp:TIrpUnionAssociatedIrp;
  549.   ThreadListEntry:TListEntry;
  550.   IoStatus:TIoStatusBlock;
  551.   RequestorMode:TKProcessorMode;
  552.   PendingReturned:Boolean;
  553.   StackCount:Byte;
  554.   CurrentLocation:Byte;
  555.   Cancel:Boolean;
  556.   CancelIrql:TKIrql;
  557.   ApcEnvironment:Byte;
  558.   AllocationFlags:Byte;
  559.   UserIosb:PIoStatusBlock;
  560.   UserEvent:PKEvent;
  561.   Overlay:TIrpUnionOverlay;
  562.   CancelRoutine:Pointer;                        //PDRIVER_CANCEL
  563.   UserBuffer:Pointer;
  564.   Tail:TIrpUnionTail;
  565.  end;
  566.  IRP=TIrp;
  567.  
  568.  
  569.  TDriverObject=packed record
  570.   wType:Word;
  571.   Size:Word;
  572.   DeviceObject:PDeviceObject;
  573.   Flags:Cardinal;
  574.   DriverStart:Pointer;
  575.   DriverSize:Cardinal;
  576.   DriverSection:Pointer;
  577.   DriverExtension:Pointer;                      //PDRIVER_EXTENSION
  578.   DriverName:TUnicodeString;
  579.   HardwareDatabase:PUnicodeString;
  580.   FastIoDispatch:Pointer;                       //PFAST_IO_DISPATCH
  581.   DriverInit:Pointer;                           //PDRIVER_INITIALIZE
  582.   DriverStartIo:Pointer;                        //PDRIVER_STARTIO
  583.   DriverUnload:Pointer;                         //PDRIVER_UNLOAD
  584.   MajorFunction:array[0..IRP_MJ_MAXIMUM_FUNCTION] of Pointer;   //PDRIVER_DISPATCH
  585.  end;
  586.  PDRIVER_OBJECT=PDriverObject;
  587.  DRIVER_OBJECT=TDriverObject;
  588.  
  589.  PFileObject=^TFileObject;
  590.  TFileObject=packed record
  591.   wType:Word;
  592.   Size:Word;
  593.   DeviceObject:PDeviceObject;
  594.   DoNotUser1:Pointer;
  595.   FsContext:Pointer;
  596.   FsContext2:Pointer;
  597.   SectionObjectPointer:Pointer;                 //PSECTION_OBJECT_POINTERS
  598.   PrivateCacheMap:Pointer;
  599.   FinalStatus:NTSTATUS;
  600.   RelatedFileObject:PFileObject;
  601.   LockOperation:Boolean;
  602.   DeletePending:Boolean;
  603.   ReadAccess:Boolean;
  604.   WriteAccess:Boolean;
  605.   DeleteAccess:Boolean;
  606.   SharedRead:Boolean;
  607.   SharedWrite:Boolean;
  608.   SharedDelete:Boolean;
  609.   Flags:Cardinal;
  610.   FileName:TUnicodeString;
  611.   CurrentByteOffset:TLargeInteger;
  612.   Waiters:Cardinal;
  613.   Busy:Cardinal;
  614.   LastLock:Pointer;
  615.   Lock:TKEvent;
  616.   Event:TKEvent;
  617.   CompletionContext:Pointer;                    //PIO_COMPLETION_CONTEXT
  618.  end;
  619.  FILE_OBJECT=TFileObject;
  620.  PFILE_OBJECT=^FILE_OBJECT;
  621.  
  622.  TFileInformationClass=Cardinal;
  623.  TFsInformationClass=Cardinal;
  624.  TDeviceRelationType=Cardinal;
  625.  TBusQueryIdType=Cardinal;
  626.  TDeviceTextType=Cardinal;
  627.  TDeviceUsageNotificationType=Cardinal;
  628.  TSystemPowerState=Cardinal;
  629.  TPowerAction=Cardinal;
  630.  TDevicePowerState=Cardinal;
  631.  TPowerStateType=Cardinal;
  632.  TKWaitReason=Cardinal;
  633.  TPoolType=Cardinal;
  634.  
  635.  PPowerState=^TPowerState;
  636.  TPowerState=packed record
  637.   case Byte of
  638.    0:(SystemState:TSystemPowerState);
  639.    1:(DeviceState:TDevicePowerState);
  640.  end;
  641.  POWER_STATE=TPowerState;
  642.  PPOWER_STATE=^POWER_STATE;
  643.  
  644.  TIoStackLocationUnionParametersStructCreate=packed record
  645.   SecurityContext:Pointer;                      //PIO_SECURITY_CONTEXT
  646.   Options:Cardinal;
  647.   FileAttributes:Word;
  648.   ShareAccess:Word;
  649.   EaLength:Cardinal;
  650.  end;
  651.  
  652.  TIoStackLocationUnionParametersStructRead=packed record
  653.   Length:Cardinal;
  654.   Key:Cardinal;
  655.   ByteOffset:TLargeInteger;
  656.  end;
  657.  
  658.  TIoStackLocationUnionParametersStructWrite=packed record
  659.   Length:Cardinal;
  660.   Key:Cardinal;
  661.   ByteOffset:TLargeInteger;
  662.  end;
  663.  
  664.  TIoStackLocationUnionParametersStructQueryFile=packed record
  665.   Length:Cardinal;
  666.   FileInformationClass:TFileInformationClass;
  667.  end;
  668.  
  669.  TIoStackLocationUnionParametersStructSetFile=packed record
  670.   Length:Cardinal;
  671.   FileInformationClass:TFileInformationClass;
  672.   FileObject:PFileObject;
  673.   case Byte of
  674.    0:(ReplaceIfExists:Boolean;
  675.       AdvanceOnly:Boolean);
  676.    1:(CluserCount:Cardinal);
  677.    2:(DeleteHandle:THandle);
  678.  end;
  679.  
  680.  TIoStackLocationUnionParametersStructQueryVolume=packed record
  681.   Length:Cardinal;
  682.   FsInformationClass:TFsInformationClass;
  683.  end;
  684.  
  685.  TIoStackLocationUnionParametersStructDeviceIoControl=packed record
  686.   OutputBufferLength:Cardinal;
  687.   InputBufferLength:Cardinal;
  688.   IoControlCode:Cardinal;
  689.   Type3InputBuffer:Pointer;
  690.  end;
  691.  
  692.  TIoStackLocationUnionParametersStructMountVolume=packed record
  693.   DoNotUse1:Pointer;
  694.   DeviceObject:PDeviceObject;
  695.  end;
  696.  
  697.  TIoStackLocationUnionParametersStructVerifyVolume=packed record
  698.   DoNotUse1:Pointer;
  699.   DeviceObject:PDeviceObject;
  700.  end;
  701.  
  702.  TIoStackLocationUnionParametersStructScsi=packed record
  703.   Srn:Pointer;                                  //_SCSI_REQUEST_BLOCK *
  704.  end;
  705.  
  706.  TIoStackLocationUnionParametersStructQueryDeviceRelations=packed record
  707.   drType:TDeviceRelationType;
  708.  end;
  709.  
  710.  TIoStackLocationUnionParametersStructQueryInterface=packed record
  711.   InterfaceType:Pointer;                        //CONST GUID *
  712.   Size:Word;
  713.   Version:Word;
  714.   pInterface:Pointer;                           //PINTERFACE
  715.   InterfaceSpecificData:Pointer;
  716.  end;
  717.  
  718.  TIoStackLocationUnionParametersStructDeviceCapabilities=packed record
  719.   Capabilities:Pointer;                         //PDEVICE_CAPABILITIES
  720.  end;
  721.  
  722.  TIoStackLocationUnionParametersStructFilterResourceRequirements=packed record
  723.   IoResourceRequirementList:Pointer;            //PIO_RESOURCE_REQUIREMENTS_LIST
  724.  end;
  725.  
  726.  TIoStackLocationUnionParametersStructReadWriteConfig=packed record
  727.   WhichSpace:Cardinal;
  728.   Buffer:Pointer;
  729.   Offset:Cardinal;
  730.   Length:Cardinal;
  731.  end;
  732.  
  733.  TIoStackLocationUnionParametersStructSetLock=packed record
  734.   Lock:LongBool;
  735.  end;
  736.  
  737.  TIoStackLocationUnionParametersStructQueryId=packed record
  738.   IdType:TBusQueryIdType;
  739.  end;
  740.  
  741.  TIoStackLocationUnionParametersStructQueryDeviceText=packed record
  742.   DeviceTextType:TDeviceTextType;
  743.   LocaleId:LCID;
  744.  end;
  745.  
  746.  TIoStackLocationUnionParametersStructUsageNotification=packed record
  747.   InPath:Boolean;
  748.   Reserved:array[0..2] of Boolean;
  749.   dunType:TDeviceUsageNotificationType;
  750.  end;
  751.  
  752.  TIoStackLocationUnionParametersStructWaitWake=packed record
  753.   PowerState:TSystemPowerState;
  754.  end;
  755.  
  756.  TIoStackLocationUnionParametersStructPowerSequence=packed record
  757.   PowerSequence:Pointer;                        //PPOWER_SEQUENCE
  758.  end;
  759.  
  760.  TIoStackLocationUnionParametersStructPower=packed record
  761.   SystemContext:Cardinal;
  762.   psType:TPowerStateType;
  763.   State:TPowerState;
  764.   ShutdownType:TPowerAction;
  765.  end;
  766.  
  767.  TIoStackLocationUnionParametersStructStartDevice=packed record
  768.   AllocatedResources:Pointer;                   //PCM_RESOURCE_LIST
  769.   AllocatedResourcesTranslated:Pointer;         //PCM_RESOURCE_LIST
  770.  end;
  771.  
  772.  TIoStackLocationUnionParametersStructWMI=packed record
  773.   ProviderId:Pointer;                           //ULONG_PTR
  774.   DataPath:Pointer;
  775.   BufferSize:Cardinal;
  776.   Buffer:Cardinal;
  777.  end;
  778.  
  779.  TIoStackLocationUnionParametersStructOthers=packed record
  780.   Argument1:Pointer;
  781.   Argument2:Pointer;
  782.   Argument3:Pointer;
  783.   Argument4:Pointer;
  784.  end;
  785.  
  786.  TIoStackLocationUnionParameters=packed record
  787.   case Byte of
  788.    00:(Create:TIoStackLocationUnionParametersStructCreate);
  789.    01:(Read:TIoStackLocationUnionParametersStructRead);
  790.    02:(Write:TIoStackLocationUnionParametersStructWrite);
  791.    03:(QueryFile:TIoStackLocationUnionParametersStructQueryFile);
  792.    04:(SetFile:TIoStackLocationUnionParametersStructSetFile);
  793.    05:(QueryVolume:TIoStackLocationUnionParametersStructQueryVolume);
  794.    06:(DeviceIoControl:TIoStackLocationUnionParametersStructDeviceIoControl);
  795.    07:(MountVolume:TIoStackLocationUnionParametersStructMountVolume);
  796.    08:(VerifyVolume:TIoStackLocationUnionParametersStructVerifyVolume);
  797.    09:(Scsi:TIoStackLocationUnionParametersStructScsi);
  798.    10:(QueryDeviceRelations:TIoStackLocationUnionParametersStructQueryDeviceRelations);
  799.    11:(QueryInterface:TIoStackLocationUnionParametersStructQueryInterface);
  800.    12:(DeviceCapabilities:TIoStackLocationUnionParametersStructDeviceCapabilities);
  801.    13:(FilterResourceRequirements:TIoStackLocationUnionParametersStructFilterResourceRequirements);
  802.    14:(ReadWriteConfig:TIoStackLocationUnionParametersStructReadWriteConfig);
  803.    15:(SetLock:TIoStackLocationUnionParametersStructSetLock);
  804.    16:(QueryId:TIoStackLocationUnionParametersStructQueryId);
  805.    17:(QueryDeviceText:TIoStackLocationUnionParametersStructQueryDeviceText);
  806.    18:(UsageNotification:TIoStackLocationUnionParametersStructUsageNotification);
  807.    19:(WaitWake:TIoStackLocationUnionParametersStructWaitWake);
  808.    20:(PowerSequence:TIoStackLocationUnionParametersStructPowerSequence);
  809.    21:(Power:TIoStackLocationUnionParametersStructPower);
  810.    22:(StartDevice:TIoStackLocationUnionParametersStructStartDevice);
  811.    23:(WMI:TIoStackLocationUnionParametersStructWMI);
  812.    24:(Others:TIoStackLocationUnionParametersStructOthers);
  813.  end;
  814.  
  815.  PIoStackLocation=^TIoStackLocation;
  816.  TIoStackLocation=packed record
  817.   MajorFunction:Byte;
  818.   MinorFunction:Byte;
  819.   Flags:Byte;
  820.   Control:Byte;
  821.   Parameters:TIoStackLocationUnionParameters;
  822.   DeviceObject:PDeviceObject;
  823.   FileObject:PFileObject;
  824.   CompletionRoutine:Pointer;                    //PIO_COMPLETION_ROUTINE
  825.   Context:Pointer;
  826.  end;
  827.  IO_STACK_LOCATION=TIoStackLocation;
  828.  PIO_STACK_LOCATION=^IO_STACK_LOCATION;
  829.  
  830.  PServiceDescriptorEntry=^TServiceDescriptorEntry;
  831.  TServiceDescriptorEntry=packed record
  832.   ServiceTableBase:PULONG;
  833.   ServiceCounterTableBase:PULONG;
  834.   NumberOfServices:ULONG;
  835.   ParamTableBase:PByte;
  836.  end;
  837.  SERVICE_DESCRIPTOR_ENTRY=TServiceDescriptorEntry;
  838.  PSERVICE_DESCRIPTOR_ENTRY=^SERVICE_DESCRIPTOR_ENTRY;
  839.  
  840.  PKMutant=^TKMutant;
  841.  TKMutant=packed record
  842.   Header:TDispatcherHeader;
  843.   MutantListEntry:TListEntry;
  844.   OwnerThread:PKThread;
  845.   Abandoned:Boolean;
  846.   ApcDisable:Byte;
  847.   Alignment0:Word;
  848.  end;
  849.  TKMutex=TKMutant;
  850.  PKMutex=^TKMutex;
  851.  
  852. function KeServiceDescriptorTable:PServiceDescriptorEntry;
  853.  
  854. procedure IoCompleteRequest(Irp:PIrp;PriorityBoost:Integer); stdcall;
  855. function  IoCreateDevice(DriverObject:PDriverObject;DeviceExtensionSize:Cardinal;DeviceName:PUnicodeString;DeviceType:TDeviceType;DeviceCharacteristics:Cardinal;Reserved:Boolean;var DeviceObject:PDeviceObject):NTSTATUS; stdcall;
  856. procedure IoDeleteDevice(DeviceObject:PDeviceObject); stdcall;
  857. function  IoCreateSymbolicLink(SymbolicLinkName,DeviceName:PUnicodeString):NTSTATUS; stdcall;
  858. function  IoDeleteSymbolicLink(SymbolicLinkName:PUnicodeString):NTSTATUS; stdcall;
  859. procedure RtlInitUnicodeString(DestinationString:PUnicodeString;SourceString:PWideChar); stdcall;
  860. function  InterlockedExchange(Target:PLONG;Value:LONG):LONG; stdcall;
  861. function  ZwOpenProcess(ProcessHandle:PHandle;DesiredAccess:TAccessMask;ObjectAttributes:PObjectAttributes;ClientId:PClientId):NTSTATUS; stdcall;
  862. procedure ProbeForRead(Address:Pointer;Length:Cardinal;Alignment:Cardinal); stdcall;
  863. procedure ExFreePool(P:Pointer); stdcall;
  864. function  KeWaitForSingleObject(SObject:Pointer;WaitReason:TKWaitReason;WaitMode:TKProcessorMode;Alertable:LongBool;Timeout:PLargeInteger):NTSTATUS; stdcall;
  865. function  KeWaitForMutexObject(SObject:Pointer;WaitReason:TKWaitReason;WaitMode:TKProcessorMode;Alertable:LongBool;Timeout:PLargeInteger):NTSTATUS; stdcall;
  866. function  ExAllocatePool(PoolType:TPoolType;NumberOfBytes:Cardinal):Pointer; stdcall;
  867. function  ExAllocatePoolWithQuota(PoolType:TPoolType;NumberOfBytes:Cardinal):Pointer; stdcall;
  868. function  ExAllocatePoolWithTag(PoolType:TPoolType;NumberOfBytes:Cardinal;Tag:ULONG):Pointer; stdcall;
  869. procedure KeInitializeMutex(Mutex:PKMutex;Level:Cardinal); stdcall;
  870. function  KeReleaseMutex(Mutex:PKMutex;Wait:LongBool):LONG; stdcall;
  871.  
  872.  
  873. function  IoGetCurrentIrpStackLocation(Irp:PIrp):PIoStackLocation; stdcall;
  874.  
  875. function ZwOpenProcessAddr:Pointer;
  876.  
  877. function NT_SUCCESS(AStatus:NTSTATUS):Boolean;
  878.  
  879. function DbgPrint(Format:PChar;Args:array of const):NTSTATUS; stdcall;
  880. function DbgMsg(Format:PChar;Args:array of const):NTSTATUS; stdcall;
  881.  
  882. implementation
  883.  
  884. function  krnlDbgPrint(Format:PChar;Args:array of const):NTSTATUS; stdcall; external NtKernel name 'DbgPrint';
  885.  
  886. function  krnlIoCreateDevice(DriverObject:PDriverObject;DeviceExtensionSize:Cardinal;DeviceName:PUnicodeString;DeviceType:TDeviceType;DeviceCharacteristics:Cardinal;Reserved:Boolean;var DeviceObject:PDeviceObject):NTSTATUS; stdcall; external NtKernel name 'IoCreateDevice';
  887. procedure krnlIoCompleteRequest(Irp:PIrp;PriorityBoost:Integer); stdcall; external NtKernel name 'IoCompleteRequest';
  888. procedure krnlIoDeleteDevice(DeviceObject:PDeviceObject); stdcall; external NtKernel name 'IoDeleteDevice';
  889. function  krnlIoCreateSymbolicLink(SymbolicLinkName,DeviceName:PUnicodeString):NTSTATUS; stdcall; external NtKernel name 'IoCreateSymbolicLink';
  890. function  krnlIoDeleteSymbolicLink(SymbolicLinkName:PUnicodeString):NTSTATUS; stdcall; external NtKernel name 'IoDeleteSymbolicLink';
  891. procedure krnlRtlInitUnicodeString(DestinationString:PUnicodeString;SourceString:PWideChar); stdcall; external NtKernel name 'RtlInitUnicodeString';
  892. function  krnlInterlockedExchange(Target:PLONG;Value:LONG):LONG; register; external NtKernel name 'InterlockedExchange';
  893. function  krnlZwOpenProcess(ProcessHandle:PHandle;DesiredAccess:TAccessMask;ObjectAttributes:PObjectAttributes;ClientId:PClientId):NTSTATUS; stdcall; external NtKernel name 'ZwOpenProcess';
  894. procedure krnlKeServiceDescriptorTable; external NtKernel name 'KeServiceDescriptorTable';
  895. procedure krnlProbeForRead(Address:Pointer;Length:Cardinal;Alignment:Cardinal); stdcall; external NtKernel name 'ProbeForRead';
  896. procedure krnlExFreePool(P:Pointer); stdcall; external NtKernel name 'ExFreePool';
  897. function  krnlKeWaitForSingleObject(SObject:Pointer;WaitReason:TKWaitReason;WaitMode:TKProcessorMode;Alertable:LongBool;Timeout:PLargeInteger):NTSTATUS; stdcall; external NtKernel name 'KeWaitForSingleObject';
  898. function  krnlExAllocatePool(PoolType:TPoolType;NumberOfBytes:Cardinal):Pointer; stdcall; external NtKernel name 'ExAllocatePool';
  899. function  krnlExAllocatePoolWithQuota(PoolType:TPoolType;NumberOfBytes:Cardinal):Pointer; stdcall; external NtKernel name 'ExAllocatePoolWithQuota';
  900. function  krnlExAllocatePoolWithTag(PoolType:TPoolType;NumberOfBytes:Cardinal;Tag:ULONG):Pointer; stdcall; external NtKernel name 'ExAllocatePoolWithTag';
  901. procedure krnlKeInitializeMutex(Mutex:PKMutex;Level:Cardinal); stdcall; external NtKernel name 'KeInitializeMutex';
  902. function  krnlKeReleaseMutex(Mutex:PKMutex;Wait:LongBool):LONG; stdcall; external NtKernel name 'KeReleaseMutex';
  903.  
  904. procedure IoCompleteRequest(Irp:PIrp;PriorityBoost:Integer); stdcall; begin krnlIoCompleteRequest(Irp,PriorityBoost); end;
  905. function  IoCreateDevice(DriverObject:PDriverObject;DeviceExtensionSize:Cardinal;DeviceName:PUnicodeString;DeviceType:TDeviceType;DeviceCharacteristics:Cardinal;Reserved:Boolean;var DeviceObject:PDeviceObject):NTSTATUS; stdcall; begin  Result:=krnlIoCreateDevice(DriverObject,DeviceExtensionSize,DeviceName,DeviceType,DeviceCharacteristics,Reserved,DeviceObject); end;
  906. procedure IoDeleteDevice(DeviceObject:PDeviceObject); stdcall; begin krnlIoDeleteDevice(DeviceObject); end;
  907. function  IoCreateSymbolicLink(SymbolicLinkName,DeviceName:PUnicodeString):NTSTATUS; stdcall; begin Result:=krnlIoCreateSymbolicLink(SymbolicLinkName,DeviceName); end;
  908. function  IoDeleteSymbolicLink(SymbolicLinkName:PUnicodeString):NTSTATUS; stdcall; begin Result:=krnlIoDeleteSymbolicLink(SymbolicLinkName); end;
  909. procedure RtlInitUnicodeString(DestinationString:PUnicodeString;SourceString:PWideChar); stdcall; begin krnlRtlInitUnicodeString(DestinationString,SourceString); end;
  910. function  InterlockedExchange(Target:PLONG;Value:LONG):LONG; assembler; asm mov ecx,Target mov edx,Value call krnlInterlockedExchange end;
  911. function  ZwOpenProcess(ProcessHandle:PHandle;DesiredAccess:TAccessMask;ObjectAttributes:PObjectAttributes;ClientId:PClientId):NTSTATUS; stdcall; begin Result:=krnlZwOpenProcess(ProcessHandle,DesiredAccess,ObjectAttributes,ClientId); end;
  912. procedure ProbeForRead(Address:Pointer;Length:Cardinal;Alignment:Cardinal); stdcall; begin krnlProbeForRead(Address,Length,Alignment); end;
  913. procedure ExFreePool(P:Pointer); stdcall; begin krnlExFreePool(P); end;
  914. function  KeWaitForSingleObject(SObject:Pointer;WaitReason:TKWaitReason;WaitMode:TKProcessorMode;Alertable:LongBool;Timeout:PLargeInteger):NTSTATUS; stdcall; begin Result:=krnlKeWaitForSingleObject(SObject,WaitReason,WaitMode,Alertable,Timeout) end;
  915. function  KeWaitForMutexObject(SObject:Pointer;WaitReason:TKWaitReason;WaitMode:TKProcessorMode;Alertable:LongBool;Timeout:PLargeInteger):NTSTATUS; stdcall; begin Result:=krnlKeWaitForSingleObject(SObject,WaitReason,WaitMode,Alertable,Timeout) end;
  916. function  ExAllocatePool(PoolType:TPoolType;NumberOfBytes:Cardinal):Pointer; stdcall; begin Result:=krnlExAllocatePool(PoolType,NumberOfBytes); end;
  917. function  ExAllocatePoolWithQuota(PoolType:TPoolType;NumberOfBytes:Cardinal):Pointer; stdcall; begin Result:=krnlExAllocatePoolWithQuota(PoolType,NumberOfBytes); end;
  918. function  ExAllocatePoolWithTag(PoolType:TPoolType;NumberOfBytes:Cardinal;Tag:ULONG):Pointer; stdcall; begin Result:=krnlExAllocatePoolWithTag(PoolType,NumberOfBytes,Tag); end;
  919. procedure KeInitializeMutex(Mutex:PKMutex;Level:Cardinal); stdcall; begin krnlKeInitializeMutex(Mutex,Level); end;
  920. function  KeReleaseMutex(Mutex:PKMutex;Wait:LongBool):LONG; stdcall; begin Result:=krnlKeReleaseMutex(Mutex,Wait); end;
  921.  
  922. //
  923. // this is 3 times ugly (take care while reading):
  924. // messy Zw* function addressing, @krnlZw* points to jmp ntoskrnl.Zw* instruction
  925. // which is jmp [IAT.ntoskrnl.Zw*] and so that we move our pointer 2 bytes right (jmp instruction is 2 byte long)
  926. // to the pointer itself and dereference it twice to make it real pointer to Zw* function
  927. //
  928. function  ZwOpenProcessAddr:Pointer; begin Result:=PPointer(PPointer(Cardinal(@krnlZwOpenProcess)+2)^)^; end;
  929.  
  930. //
  931. // this is just ugly (weird):
  932. // somehow we don't know how to import data structure in Delphi, we need KeSDT import
  933. // so we import it as a procedure krnlKeServiceDescriptorTable and make this function to return
  934. // a pointer to that table
  935. //
  936. function  KeServiceDescriptorTable:PServiceDescriptorEntry; begin Result:=PPointer(@krnlKeServiceDescriptorTable)^; end;
  937.  
  938. //
  939. // this is a must (but still ugly):
  940. // we do not have #define in Delphi, we have to rewrite non-statical #define asa function
  941. //
  942. function  IoGetCurrentIrpStackLocation(Irp:PIrp):PIoStackLocation; stdcall; begin Result:=Irp^.Tail.Overlay.s1.u1.CurrentStackLocation; end;
  943.  
  944.  
  945. function NT_SUCCESS(AStatus:NTSTATUS):Boolean;
  946. begin
  947.  Result:=Integer(AStatus)>=0;
  948. end;
  949.  
  950.  
  951. {$IFDEF DEBUG}
  952. //
  953. // our Delphi implementation of DbgPrint
  954. // very useful function for coding kernel driver
  955. // and the must is to have variable number of arguments like in original
  956. // DbgPrint call
  957. // this implementation is very ugly, it is because we don't know how to
  958. // code similar convetion as C language has for this type of functions
  959. //
  960. function DbgPrint(Format:PChar;Args:array of const):NTSTATUS;
  961. var
  962.  LI,LJ:Integer;
  963.  LArgs:array[0..31] of Cardinal;
  964. begin
  965.  LJ:=0;
  966.  //we fill our local arguments array
  967.  for LI:=0 to High(Args) do
  968.  begin
  969.   with Args[LI] do
  970.   begin
  971.    case VType of
  972.     vtInteger:LArgs[LJ]:=VInteger;
  973.     vtBoolean:LArgs[LJ]:=Cardinal(VBoolean);
  974.     vtChar:LArgs[LJ]:=Cardinal(VChar);
  975.     vtString:LArgs[LJ]:=Cardinal(PChar(VString));
  976.     vtPChar:LArgs[LJ]:=Cardinal(VPChar);
  977.     vtPointer:LArgs[LJ]:=Cardinal(VPointer);
  978.     vtAnsiString:LArgs[LJ]:=Cardinal(PChar(VAnsiString));
  979.     vtCurrency:LArgs[LJ]:=Cardinal(VCurrency);
  980.     vtVariant:LArgs[LJ]:=Cardinal(VVariant);
  981.     else LArgs[LJ]:=$DEADBEEF;
  982.    end;
  983.   end;
  984.   Inc(LJ);
  985.  end;
  986.  
  987.  LJ:=High(Args);
  988.  //and we simulate the calling convetion using lowlevel
  989.  asm
  990.   lea eax,LArgs
  991.   mov ecx,LJ
  992.   jmp @cmp_args_end
  993.  @args_loop:
  994.   push dword ptr [eax+4*ecx]
  995.   dec ecx
  996.  @cmp_args_end:
  997.   cmp ecx,-001h
  998.   jnz @args_loop
  999.  @make_call:
  1000.   push Format
  1001.   call krnlDbgPrint
  1002.  
  1003.   mov ecx,LJ
  1004.   shl ecx,002h
  1005.   add ecx,008h
  1006.   add esp,ecx
  1007.   mov Result,eax
  1008.  end
  1009. end;
  1010.  
  1011. function DbgMsg(Format:PChar;Args:array of const):NTSTATUS;
  1012. begin
  1013.  Result:=DbgPrint(Format,Args);
  1014. end;
  1015.  
  1016. {$ELSE}
  1017.  
  1018. function DbgPrint(Format:PChar;Args:array of const):NTSTATUS; assembler;
  1019. asm
  1020. end;
  1021.  
  1022. function DbgMsg(Format:PChar;Args:array of const):NTSTATUS; assembler;
  1023. asm
  1024. end;
  1025.  
  1026. {$ENDIF}
  1027.  
  1028. end.
  1029.  
Kayıtlı
Sayfa: [1]   Yukarı git
« önceki sonraki »