韩国游戏的NP源代码

#include<ntddk.h> #include"wmimmc.h" #include"Process.h" #include"hook.h" /* 文件:wmimmc.c 作者:堕落天才 时间:2007.4.28 */ /////////////////////////////////////////////////////////// /* 函数:DriverEntry 说明:驱动入口 作者:堕落天才 时间:2007.4.28 */ NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath) { NTSTATUS status; UNICODE_STRING SymbolicLinkName; UNICODE_STRING DeviceName; PDEVICE_OBJECT pDeviceObject; PEPROCESS CurrentProc; RtlInitUnicodeString(&DeviceName,NT_DEVICE_NAME); RtlInitUnicodeString(&SymbolicLinkName,DOS_DEVICE_NAME); status = IoCreateDevice(DriverObject, 0x444,//sizeof(DEVICE_EXTENSION)?? &DeviceName, 0x8402, 0x100, FALSE, &pDeviceObject); if(NT_SUCCESS(status)){ status = IoCreateSymbolicLink(&SymbolicLinkName,&DeviceName); DriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = DriverObject->MajorFunction[IRP_MJ_CREATE] = DriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = OnDispatch; DriverObject->DriverUnload = OnUnload; } if(!NT_SUCCESS(status)){ if(pDeviceObject!=NULL){ IoDeleteDevice(pDeviceObject); } IoDeleteSymbolicLink(&SymbolicLinkName); return status; } pIopm = MmAllocateNonCachedMemory(IOPM_SIZE); if(pIopm!=NULL){ //未知代码 } //未知代码 return 0x9A; } ////////////////////////////////////////////////////////////// /* 函数:DispatchIoControl 说明: 作者:堕落天才 时间:2007.4.28 */ NTSTATUS DispatchIoControl(ULONG unknown, BOOLEAN IsMyRequest, PVOID inputBuffer, ULONG inputBufferLength, PVOID outputBuffer, ULONG outputBufferLength, ULONG IoControlCode, PIO_STATUS_BLOCK pIrpStatus, PDEVICE_OBJECT DeviceObject) { pIrpStatus->Status = STATUS_SUCCESS; pIrpStatus->Information = 0; ExAcquireFastMutex(&ControlMutex); //未知代码 return STATUS_SUCCESS; } /////////////////////////////////////////////////////////////////////// /* 函数:OnDispatch 说明: 作者:堕落天才 时间:2007.4.28 */ NTSTATUS OnDispatch(IN PDEVICE_OBJECT DeviceObject,IN PIRP pIrp) { ULONG outputBufferLength; ULONG IoControlCode; PIO_STACK_LOCATION IrpStack; PVOID outputBuffer; PVOID inputBuffer; ULONG inputBufferLength; ULONG unknown; IrpStack = IoGetCurrentIrpStackLocation(pIrp); inputBuffer = pIrp->AssociatedIrp.SystemBuffer; outputBuffer = pIrp->AssociatedIrp.SystemBuffer; inputBufferLength = IrpStack->Parameters.DeviceIoControl.InputBufferLength; outputBufferLength = IrpStack->Parameters.DeviceIoControl.OutputBufferLength; IoControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode; pIrp->IoStatus.Status = STATUS_SUCCESS; pIrp->IoStatus.Information = 0; switch(IrpStack->MajorFunction){ case IRP_MJ_DEVICE_CONTROL: if((IoControlCode & 3) == 3){ __asm{ mov edx,pIrp mov eax,[edx + 0x3C] mov outputBuffer,eax } // outputBuffer = pIrp->**(+3Ch) } __asm{ mov edx,IrpStack mov eax,[edx + 0x18] mov unknown,eax } DispatchIoControl(unknown,//(IrpStack+18h) TRUE, inputBuffer, inputBufferLength, outputBuffer, outputBufferLength, IoControlCode, &pIrp->IoStatus, DeviceObject); break; } IoCompleteRequest(pIrp,IO_NO_INCREMENT); return STATUS_SUCCESS; } ////////////////////////////////////////////////////////////////////////////////// /* 函数:OnUnload 说明: 作者:堕落天才 时间:2007.4.28 */ VOID OnUnload(IN PDRIVER_OBJECT DriverObject) { UNICODE_STRING SymbolicLinkName; if(pMem6270!=NULL){ ExFreePoolWithTag(pMem6270,0); } PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine,1); Ke386QueryIoAccessMap(1,pIopm); *((char*)(pIopm + 8)) = cOldPort40; *((char*)(pIopm + 12)) = cOldPort60; Ke386SetIoAccessMap(1,pIopm); if(pIopm != NULL){ MmFreeNonCachedMemory(pIopm,IOPM_SIZE); } RtlInitUnicodeString(&SymbolicLinkName,DOS_DEVICE_NAME); IoDeleteSymbolicLink(&SymbolicLinkName); IoDeleteDevice(DriverObject->DeviceObject); } ///////////////////////////////////////////////////////////////////////////// /* 函数:SetupEProcParam 说明:初始化EProcess结构里面的各种偏移 作者:堕落天才 时间:2007.4.28 */ ULONG SetupEProcParam() { ULONG nVersion; ULONG nSystemPID; PEPROCESS pSystemProcess; ULONG offset; pSystemProcess = IoGetCurrentProcess(); nSystemPID = (ULONG)PsGetCurrentProcessId(); SystemEProc = pSystemProcess; SystemPID = nSystemPID; if(*((PULONG)((ULONG)pSystemProcess + PidOFFSET)) != nSystemPID){ for(offset = 0x84; offset < 0x200; offset++){ if(*((PULONG)((ULONG)pSystemProcess + offset)) == nSystemPID){ PidOFFSET = offset; FlinkOFFSET = offset + 4; break; } } } if(SystemVersion == 0x0A){ //win2K DebugPortOFFSET = 0x120; }else if(SystemVersion == 0x28){//win9X ? DebugPortOFFSET = 0; }else{ //winXP/2003 DebugPortOFFSET = PidOFFSET + 0x38; } if(SystemVersion == 0x1E && PidOFFSET == 0x94){ //winNT4.0 unknown16624 -= 0x10; unknown16634 -= 0x10; unknown1662c -= 0x10; unknown1663c -= 0x10; } if(*((PULONG)((ULONG)pSystemProcess + DebugPortOFFSET)) != 0){ DebugPortOFFSET = 0; } unknown162dc += 1; for(offset = 0; offset < 0x400; offset ++){ if(!strncmp("System",(char*)((ULONG)pSystemProcess + offset),6)){ return offset; } } nVersion = SystemVersion; if(nVersion <= 0x28){ switch(pVersionIndex[nVersion]){ case 0: offset = 0x154; break; case 1: offset = 0x154; break; case 2: offset = 0x174; break; case 3: offset = 0x1FC; break; case 4: offset = 0x1DC; break; case 5: offset = 0; break; } }else{ offset = 0; } return offset; } /////////////////////////////////////////////////////////////////////////////////