Windows驱动开发(一) MDL驱动读写

使用MDL驱动读写应该是最常见的读写内存方式

不多说 直接上代码

typedef struct  TongL_Process
{
    ULONG pid;						//进程ID
    ULONG64 Address;				//内存地址
    ULONG64 buf;					//缓冲区指针
    ULONG Size;						//内存大小
}TongL_PROCESS, * PTongL_PROCESS;

读：

		PTongL_PROCESS pInputData = (PTongL_PROCESS)InputData;
		Status = PsLookupProcessByProcessId((HANDLE)pInputData->pid, &process);
		if (NT_SUCCESS(Status) && MmIsAddressValid((PVOID)pInputData->buf) && process != NULL)
		{
			PMDL mdl = IoAllocateMdl((PVOID)pInputData->buf, pInputData->Size, 0, 0, NULL);
			if (!mdl) break;
			MmBuildMdlForNonPagedPool(mdl);
			unsigned char* Map = (unsigned char*)MmMapLockedPages(mdl, KernelMode);
			if (!Map)
			{
				IoFreeMdl(mdl);
				break;
			}
			TargetAddress = (PVOID)pInputData->Address;
			TargetSize = pInputData->Size;
			if (PsGetCurrentProcess() != process)
			{
				KeStackAttachProcess(process, &apc);
				attach = TRUE;
			}
			__try {
				if (MmIsAddressValid(TargetAddress))
				{
					RtlCopyMemory(Map, TargetAddress, TargetSize);
					KeLowerIrql(KeRaiseIrqlToDpcLevel());
				}
			}
			__except (1) {
				DbgPrint("无法访问地址.\n");
			}
			if (attach) KeUnstackDetachProcess(&apc);
			MmUnmapLockedPages((PVOID)Map, mdl);
			IoFreeMdl(mdl);
		}
		break;

写：

		PTongL_PROCESS pInputData = (PTongL_PROCESS)InputData;
		Status = PsLookupProcessByProcessId((HANDLE)pInputData->pid, &process);
		if (NT_SUCCESS(Status) && MmIsAddressValid((PVOID)pInputData->buf) && process != NULL)
		{
			PMDL mdl = IoAllocateMdl((PVOID)pInputData->buf, pInputData->Size, 0, 0, NULL);
			if (!mdl) break;
			MmBuildMdlForNonPagedPool(mdl);
			unsigned char* Map = (unsigned char*)MmMapLockedPages(mdl, KernelMode);
			if (!Map)
			{
				IoFreeMdl(mdl);
				break;
			}
			TargetAddress = (PVOID)pInputData->Address;
			TargetSize = pInputData->Size;
			if (PsGetCurrentProcess() != process)
			{
				KeStackAttachProcess(process, &apc);
				attach = TRUE;
			}
			__try {
				if (MmIsAddressValid(TargetAddress))
				{
					cr0 = __readcr0();
					cr0 &= 0xfffffffffffeffff;
					__writecr0(cr0);
					_disable();
					RtlCopyMemory(TargetAddress, Map, TargetSize);
					KeLowerIrql(KeRaiseIrqlToDpcLevel());
					cr0 = __readcr0();
					cr0 |= 0x10000;
					_enable();
					__writecr0(cr0);
				}
			}
			__except (1) {
				DbgPrint("无法访问地址.\n");
			}
			if (attach) KeUnstackDetachProcess(&apc);
			MmUnmapLockedPages((PVOID)Map, mdl);
			IoFreeMdl(mdl);
		}
		break;

这篇好文章是转载于：学新通技术网