二級C++實例(一個特別的驅動加載方式)

字號:

大家一起倆研究下看看,好像有時候會藍屏,跟分頁有關
    typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE
    {
    UNICODE_STRING ModuleName;
    } SYSTEM_LOAD_AND_CALL_IMAGE, *PSYSTEM_LOAD_AND_CALL_IMAGE;
    #define SystemLoadAndCallImage 38
    bool load_sysfile()
    {
    SYSTEM_LOAD_AND_CALL_IMAGE GregsImage;
    WCHAR daPath[] = L"\\??\\C:\\MIGBOT.SYS";
    RtlInitUnicodeString = (RTLINITUNICODESTRING)
    GetProcAddress( GetModuleHandle("ntdll.dll")
    ,"RtlInitUnicodeString"
    )
    ZwSetSystemInformation = (ZWSETSYSTEMINFORMATION)
    GetProcAddress(
    GetModuleHandle("ntdll.dll")
     ,"ZwSetSystemInformation" )
    RtlInitUnicodeString(
    &(GregsImage.ModuleName)
    ,daPath
    );
    ZwSetSystemInformation(SystemLoadAndCallImage,
    ,sizeof(SYSTEM_LOAD_AND_CALL_IMAGE))))
    return true;
    }