22.DriverBase-ObReferenceObjectByHandle通过Ring3句柄获得Ring0对象

ObReferenceObjectByHandle

#include "Driver.h"

#pragma INITCODE
extern "C" NTSTATUS DriverEntry (
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath    )
{
NTSTATUS status;
pDriverObject->DriverUnload = HelloDDKUnload;
pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = HelloDDKDeviceIOControl;
status = CreateDevice(pDriverObject);
return status;
}

#pragma PAGEDCODE
NTSTATUS CreateDevice (IN PDRIVER_OBJECT    pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt;

//创建设备名称
UNICODE_STRING devName;
RtlInitUnicodeString(&devName,L"\\Device\\Handle2Object");

//创建设备
status = IoCreateDevice( pDriverObject,
sizeof(DEVICE_EXTENSION),
&(UNICODE_STRING)devName,
FILE_DEVICE_UNKNOWN,
0, TRUE,
&pDevObj );
if (!NT_SUCCESS(status))
return status;

pDevObj->Flags |= DO_DIRECT_IO;
pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice = pDevObj;
pDevExt->ustrDeviceName = devName;

//创建符号链接
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName,L"\\??\\Handle2ObjectLink");
pDevExt->ustrSymLinkName = symLinkName;
status = IoCreateSymbolicLink( &symLinkName,&devName );
if (!NT_SUCCESS(status))
{
IoDeleteDevice( pDevObj );
return status;
}
return STATUS_SUCCESS;
}

#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT  pNextObj;
KdPrint(("Enter DriverUnload\n"));
pNextObj = pDriverObject->DeviceObject;
while (pNextObj != NULL)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pNextObj->DeviceExtension;

//删除符号链接
UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
IoDeleteSymbolicLink(&pLinkName);
pNextObj = pNextObj->NextDevice;
IoDeleteDevice( pDevExt->pDevice );
}
}

#pragma PAGEDCODE
NTSTATUS HelloDDKDeviceIOControl(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp)
{
NTSTATUS status = STATUS_SUCCESS;
KdPrint(("Enter HelloDDKDeviceIOControl\n"));

//得到当前堆栈
PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
//得到输入缓冲区大小
ULONG cbin = stack->Parameters.DeviceIoControl.InputBufferLength;
//得到输出缓冲区大小
ULONG cbout = stack->Parameters.DeviceIoControl.OutputBufferLength;
//得到IOCTL码
ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;

ULONG info = 0;

switch (code)
{                       // process request
case IOCTL_TEST1:
{
KdPrint(("IOCTL_TEST1\n"));
HANDLE hUserEvent= *(HANDLE*)pIrp->AssociatedIrp.SystemBuffer;
PKEVENT pEvent;
// 由事件句柄得到内核事件数据结构
status = ObReferenceObjectByHandle(hUserEvent,EVENT_MODIFY_STATE,*ExEventObjectType,KernelMode,(PVOID*)&pEvent,NULL);// 参看MSDN
// 设置事件
KeSetEvent(pEvent,IO_NO_INCREMENT,FALSE);
// 减小引用计数
ObDereferenceObject(pEvent);
break;
}

default:
status = STATUS_INVALID_VARIANT;
}

// 完成IRP
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = info;  // bytes xfered
IoCompleteRequest( pIrp, IO_NO_INCREMENT );
KdPrint(("Leave HelloDDKDeviceIOControl\n"));

return status;
}

#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp)
{
KdPrint(("Enter HelloDDKDispatchRoutine\n"));
NTSTATUS status = STATUS_SUCCESS;
// 完成IRP
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = 0; // bytes xfered
IoCompleteRequest( pIrp, IO_NO_INCREMENT );
KdPrint(("Leave HelloDDKDispatchRoutine\n"));
return status;
}

// Handle2ObjectRing3.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>
#include <process.h>

#define IOCTL_TEST1 CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_BUFFERED,FILE_ANY_ACCESS)
unsigned __stdcall ThreadProc(PVOID lp)
{
HANDLE hEvent = *(HANDLE*)lp;
WaitForSingleObject(hEvent,INFINITE);
return 0;
}

int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hDevice =
CreateFileA("\\\\.\\Handle2ObjectLink",
GENERIC_READ | GENERIC_WRITE,
0,      // share mode none
NULL,   // no security
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL );     // no template
if (INVALID_HANDLE_VALUE == hDevice)
{
printf("fail:%d",GetLastError());
system("pause");
return 1;
}
// 创建用户模式同步事件
HANDLE hEvent = CreateEvent(NULL,FALSE,FALSE,NULL);
HANDLE hThread = (HANDLE)_beginthreadex(NULL,0,ThreadProc,&hEvent,0,NULL);
DWORD dwOutPut;
DeviceIoControl(hDevice,IOCTL_TEST1,&hEvent,sizeof(hEvent),NULL,0,&dwOutPut,NULL);
WaitForSingleObject(hThread,INFINITE);
CloseHandle(hDevice);
CloseHandle(hThread);
CloseHandle(hEvent);
system("pause");
return 0;
}