企业官网建设流程全解析

保护进程的驱动：

#include <ntifs.h> #include <ntddk.h> #define DEVICE_NAME L"\\Device\\ProcessProtector" #define SYMBOLIC_LINK_NAME L"\\DosDevices\\ProcessProtector" #define IOCTL_SET_PROCESS_ID CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) // 全局变量定义 HANDLE g_StopProcessEvent = NULL; HANDLE id = 99999; //填写进程ID static PDEVICE_OBJECT g_DeviceObject = NULL; static KSPIN_LOCK g_SpinLock; static FAST_MUTEX g_Mutex; // 进程关闭通知回调函数声明 VOID mProcessCloseNotification( HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create); VOID UnloadDriver(PDRIVER_OBJECT DriverObject); NTSTATUS DispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp); NTSTATUS DispatchClose(PDEVICE_OBJECT DeviceObject, PIRP Irp); NTSTATUS CompleteIrp(PIRP Irp, NTSTATUS status, ULONG_PTR info); NTSTATUS DispatchDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp); // 驱动卸载函数 VOID UnloadDriver(PDRIVER_OBJECT DriverObject) { UNREFERENCED_PARAMETER(DriverObject); KdPrint(("ProcessProtector: Driver unloading\n")); // 移除进程通知回调 PsSetCreateProcessNotifyRoutine(mProcessCloseNotification, TRUE); ZwClose(g_StopProcessEvent); g_StopProcessEvent = NULL; KdPrint(("ProcessProtector: Driver unloaded successfully\n")); } // 驱动入口点 NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { NTSTATUS status; OBJECT_ATTRIBUTES objAttr; UNICODE_STRING deviceName = { 0 }; UNICODE_STRING symbolicLinkName = { 0 }; UNREFERENCED_PARAMETER(RegistryPath); KdPrint(("ProcessProtector: DriverEntry called\n")); // 初始化同步对象 KeInitializeSpinLock(&g_SpinLock); ExInitializeFastMutex(&g_Mutex); // 创建设备对象 RtlInitUnicodeString(&deviceName, DEVICE_NAME); RtlInitUnicodeString(&symbolicLinkName, SYMBOLIC_LINK_NAME); UNREFERENCED_PARAMETER(RegistryPath); // 初始化对象属性结构体 InitializeObjectAttributes(&objAttr, NULL, OBJ_KERNEL_HANDLE, NULL, NULL); // 创建停止事件对象，用于控制进程关闭 status = ZwCreateEvent( &g_StopProcessEvent, EVENT_ALL_ACCESS, // 使用完整访问权限 &objAttr, NotificationEvent, // 通知事件类型 FALSE // 初始状态为非 signaled 状态 ); if (!NT_SUCCESS(status)) { KdPrint(("DriverEntry: Failed to create event, status = 0x%08X\n", status)); return status; } status = IoCreateDevice( DriverObject, 0, &deviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &g_DeviceObject ); if (!NT_SUCCESS(status)) { KdPrint(("ProcessProtector: Failed to create device (0x%08X)\n", status)); return status; } // 设置IO缓冲方式（推荐使用缓冲IO，更安全） g_DeviceObject->Flags |= DO_BUFFERED_IO; // 创建符号链接 status = IoCreateSymbolicLink(&symbolicLinkName, &deviceName); if (!NT_SUCCESS(status)) { KdPrint(("ProcessProtector: Failed to create symbolic link (0x%08X)\n", status)); IoDeleteDevice(g_DeviceObject); return status; } // 注册驱动卸载函数 DriverObject->DriverUnload = UnloadDriver; DriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreate; DriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchClose; DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchDeviceControl; // 注册进程创建/终止通知回调函数 status = PsSetCreateProcessNotifyRoutine(mProcessCloseNotification, FALSE); if (!NT_SUCCESS(status)) { KdPrint(("DriverEntry: Failed to register process notify routine, status = 0x%08X\n", status)); // 如果注册失败，需要清理已创建的事件对象 ZwClose(g_StopProcessEvent); g_StopProcessEvent = NULL; return status; } KdPrint(("DriverEntry: Driver is loaded successfully\n")); return STATUS_SUCCESS; } // 进程关闭通知回调函数实现 VOID mProcessCloseNotification( HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create) { // 只处理进程终止事件（Create = FALSE） if (!Create) { KdPrint(("ProcessCloseNotification: Process %p is closing\n", ProcessId)); // 检查是否是需要阻止关闭的进程ID // 注意：这里使用了硬编码的PID 3892，实际应用中可能需要配置 if (ProcessId == id) { KdPrint(("ProcessCloseNotification: Blocking process %p from closing\n", ProcessId)); ZwWaitForSingleObject(g_StopProcessEvent, FALSE, NULL); ExReleaseFastMutex(&g_Mutex); } } } // 创建设备处理函数 NTSTATUS DispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp) { UNREFERENCED_PARAMETER(DeviceObject); KdPrint(("ProcessProtector: Device opened\n")); return CompleteIrp(Irp, STATUS_SUCCESS, 0); } // 关闭设备处理函数 NTSTATUS DispatchClose(PDEVICE_OBJECT DeviceObject, PIRP Irp) { UNREFERENCED_PARAMETER(DeviceObject); KdPrint(("ProcessProtector: Device closed\n")); return CompleteIrp(Irp, STATUS_SUCCESS, 0); } // IRP完成辅助函数 NTSTATUS CompleteIrp(PIRP Irp, NTSTATUS status, ULONG_PTR info) { Irp->IoStatus.Status = status; Irp->IoStatus.Information = info; IoCompleteRequest(Irp, IO_NO_INCREMENT); return status; } NTSTATUS DispatchDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) { PIO_STACK_LOCATION irpStack; PVOID inputBuffer; ULONG inputBufferLength; ULONG ioControlCode; NTSTATUS status = STATUS_SUCCESS; ULONG_PTR info = 0; UNREFERENCED_PARAMETER(DeviceObject); irpStack = IoGetCurrentIrpStackLocation(Irp); inputBuffer = Irp->AssociatedIrp.SystemBuffer; inputBufferLength = irpStack->Parameters.DeviceIoControl.InputBufferLength; ioControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode; switch (ioControlCode) { case IOCTL_SET_PROCESS_ID: { if (inputBufferLength < sizeof(HANDLE)) { HANDLE newProcessId = *(PHANDLE)inputBuffer; id = newProcessId; status = PsSetCreateProcessNotifyRoutine(mProcessCloseNotification, FALSE); if (!NT_SUCCESS(status)) { KdPrint(("DriverEntry: Failed to register process notify routine, status = 0x%08X\n", status)); // 如果注册失败，需要清理已创建的事件对象 ZwClose(g_StopProcessEvent); g_StopProcessEvent = NULL; return status; } } } } }

用户模式输入进程id程序：

#define _CRT_SECURE_NO_WARNINGS #include <windows.h> #include <stdio.h> #include <string.h> // IOCTL定义（必须与驱动程序中保持一致） #define IOCTL_SET_PROCESS_ID CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) // 驱动设备名 #define DRIVER_DEVICE_NAME "\\\\.\\ProcessProtector" int main() { DWORD processId = (DWORD)8360; HANDLE hDevice = CreateFile( DRIVER_DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); DWORD bytesReturned = 0; scanf_s("%lu", &processId); bool result = DeviceIoControl( hDevice, IOCTL_SET_PROCESS_ID, &processId, sizeof(DWORD), NULL, 0, &bytesReturned, NULL ); if (result == FALSE) { DWORD error = GetLastError(); printf("DeviceIoControl 失败，错误代码: %lu\n", error); switch (error) { case ERROR_INVALID_FUNCTION: printf("驱动不支持此操作。请检查驱动版本。\n"); break; case ERROR_INVALID_PARAMETER: printf("无效的参数。请检查进程ID是否正确。\n"); break; case ERROR_IO_DEVICE: printf("驱动程序I/O错误。\n"); break; default: printf("未知驱动程序错误。\n"); break; } } }