Windows 7 驱动程序挂钩
我的问题是关于 Windows 7 的驱动程序开发。
我需要拦截对驱动程序的系统调用。理论上，在这种情况下，建议创建一个过滤器驱动程序，但在我的情况下，驱动程序不会公开与过滤器兼容的接口。准确地说，它是一个 Vista/7 显示微型端口驱动程序。
显示驱动程序作为标准 WDM 驱动程序加载。在其 DriverEntry 中，预计会调用 DxgkInitialize 系统例程（我猜是由 win32k.sys 导出的）。我的目标是拦截这个电话。
谁能建议我任何有用的资源，我可以找到有关如何实现这一目标的信息？
胜利的关键可能是将驱动程序可执行文件导入部分中的 DxgkInitialize 替换为我的函数的地址。问题是，这应该在加载可执行文件之后完成（映射+必要时重新定位+准备好所有导入表条目），但是驱动程序的入口点之前调用。
我考虑了以下选项：
- 将可执行文件映射到系统内存中并手动“准备”它（即执行加载程序的工作）。然后修补所需的函数并运行入口点。
- 经过一些努力，
ZwSetSystemInformation可以用于模块加载（？） - 也许可以修补导出
DxgkInitialize的模块的export 部分。这样加载器就会自动将每个加载的模块重定向到我手中。
提前致谢。
My question is regarding driver development for Windows 7.
I need to intercept system calls to a driver. Theoretically in such cases it's recommended to create a filter driver, however in my case the driver doesn't expose a filter-compatible interface. It's a Vista/7 display miniport driver to be exact.
Display driver is loaded as a standard WDM driver. In its DriverEntry it's expected to call a DxgkInitialize system routine (exported by win32k.sys I guess). My goal is to intercept this call.
Can anyone suggest me any useful source I can find information about how to achieve this?
The key to the victory is probably replacing the DxgkInitialize within the driver executable import section with the address of my function. The problem is that this should be done after the executable is loaded (mapped + relocated if necessary + all the import table entries are prepared), but before the driver's entry point is invoked.
I thought about the following options:
- Map the executable into the system memory and "prepare" it manually (i.e. do the work of the loader). Then patch the needed function(s) and run the entry point.
- With some effort
ZwSetSystemInformationcan be used for module loading (?) - Maybe patch the export section of the module that exports
DxgkInitialize. So that the loader automatically will redirect every loaded module into my hands.
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
你没有为此提供商业理由，所以我不愿意说一些严厉的话。但如果涉及挂钩调用，您应该重新考虑您的技术方法。
我采取的步骤可能包括：
谁导出
DxgkInitialize？不要猜测win32k，查一下。 （我不会给你答案）。也许您可以轻松地挂钩被调用者而不是调用者。在加载驱动程序模块时但在初始化之前，我是否有任何回调？查找
PsSetLoadImageNotifyRoutine。也许它会为您提供一个适当的时间段来修补驱动程序 IAT（如果您不知道导入地址表是什么，请重新考虑挂钩）。我从评论中看到您主要对“监视展示活动”感兴趣。我不确定在您不完全控制的计算机上是否允许这样做。但为了解决这个问题，让我们假设这是合法的。
根据您想要获得的分辨率，您不需要驱动程序。哎呀，你几乎不需要一个 DLL。查找窗口挂钩 用于部分解决方案和可访问性回调。
You don't provide a business reason for this, so I'd hesitate to say something harsh. But you should reconsider your technological approach if it involves hooking calls.
The steps I'd take would probably include:
Who exports
DxgkInitialize? Don't guess win32k, look it up. (I won't give you the answer). Maybe you can easily hook the callee and not the caller.Do I have any callbacks of when a driver module is loaded but before it's inited? Lookup
PsSetLoadImageNotifyRoutine. Maybe it will provide you an appropiate timeslot to patch the drivers IAT (if you don't know what an Import Address table is, reconsider hooking).I see from the comments that you're primarily interested on "spying on display activities". I'm not sure that's precisely allowed on computers you don't fully control. But lets assume for the sake of the question that this is legal.
Depending on the resolution you want to get, you don't need a driver. Heck, you barely need a DLL. Look up Window hooks for partial solutions and accessibility callbacks.