C++ Win32 API 加载驱动到内核空间

Question

是否有用于在内核空间中加载和执行内核模式程序的 Win32/本机 API 函数？ (.sys,.exe)

Answer 1

据我所知，没有。 您不能那样做（那将是一个很大的安全问题）。 您必须正确注册驱动程序并让Windows加载它。

后者可以使用DIFxAPI来完成，您应该在MSDN上阅读它，因为它太复杂了，无法在此处简单地回答。

您应该寻找的核心功能是DriverPackageInstall 。

Answer 2

首先，您使用OpenSCManager()获得服务管理器的句柄。

然后您使用 SERVICE_KERNEL_DRIVER & SERVICE_DEMAND_START 调用CreateService() ，这将加载驱动程序。

这是一个很好的函数示例，它通过错误检查为您完成所有工作：

BOOL LoadNTDriver(WCHAR* lpszDriverName, WCHAR* lpszDriverPath)
{
    WCHAR szDriverImagePath[256];

    GetFullPathName(lpszDriverPath, 256, szDriverImagePath, NULL);
    BOOL bRet = FALSE;

    SC_HANDLE hServiceMgr = NULL;
    SC_HANDLE hServiceDDK = NULL;

    hServiceMgr = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);

    if (hServiceMgr == NULL)
    {

        printf("OpenSCManager() Faild %d ! \n", GetLastError());
        bRet = FALSE;
        goto BeforeExit;
    }
    else
    {
        printf("OpenSCManager() ok ! \n");
    }

    hServiceDDK = CreateService(hServiceMgr,
        lpszDriverName, 
        lpszDriverName,
        SERVICE_ALL_ACCESS,
        SERVICE_KERNEL_DRIVER,
        SERVICE_DEMAND_START,
        SERVICE_ERROR_IGNORE,
        szDriverImagePath,
        NULL,
        NULL,
        NULL,
        NULL,
        NULL);

    DWORD dwRtn;

    if (hServiceDDK == NULL)
    {
        dwRtn = GetLastError();
        if (dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_EXISTS)
        {
            printf("CrateService() Faild %d ! \n", dwRtn);
            bRet = FALSE;
            goto BeforeExit;
        }
        else
        {
            printf("CrateService() Faild Service is ERROR_IO_PENDING or ERROR_SERVICE_EXISTS! \n");
        }

        hServiceDDK = OpenService(hServiceMgr, lpszDriverName, SERVICE_ALL_ACCESS);
        if (hServiceDDK == NULL)
        {
            dwRtn = GetLastError();
            printf("OpenService() Faild %d ! \n", dwRtn);
            bRet = FALSE;
            goto BeforeExit;
        }
        else
        {
            printf("OpenService() ok ! \n");
        }
    }
    else
    {
        printf("CrateService() ok ! \n");
    }

    bRet = StartService(hServiceDDK, NULL, NULL);
    if (!bRet)
    {
        DWORD dwRtn = GetLastError();
        if (dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_ALREADY_RUNNING)
        {
            printf("StartService() Faild %d ! \n", dwRtn);
            bRet = FALSE;
            goto BeforeExit;
        }
        else
        {
            if (dwRtn == ERROR_IO_PENDING)
            {
                printf("StartService() Faild ERROR_IO_PENDING ! \n");
                bRet = FALSE;
                goto BeforeExit;
            }
            else
            {
                printf("StartService() Faild ERROR_SERVICE_ALREADY_RUNNING ! \n");
                bRet = TRUE;
                goto BeforeExit;
            }
        }
    }
    bRet = TRUE;

BeforeExit:
    if (hServiceDDK)
    {
        CloseServiceHandle(hServiceDDK);
    }
    if (hServiceMgr)
    {
        CloseServiceHandle(hServiceMgr);
    }
    return bRet;
}

来源： https : //github.com/roycncn/PUBG-wall-hacking-user-mode/blob/master/MapESP/LoadDriver.hpp