Kernel_Based_ProcessMemory_Editor/routine.cpp at main · lastime1650/Kernel_Based_ProcessMemory_Editor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
#include "helper.hpp"


#define IOCTL_TEST \
    CTL_CODE( \
        FILE_DEVICE_UNKNOWN, \
        0x800, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS \
    )


NTSTATUS IoctlRoutine(
    _In_ PDEVICE_OBJECT device_object,
    _Inout_ PIRP irp
)
{
    UNREFERENCED_PARAMETER(
        device_object
    );


    PIO_STACK_LOCATION stack =
        IoGetCurrentIrpStackLocation(
            irp
        );


    NTSTATUS status =
        STATUS_INVALID_DEVICE_REQUEST;

    ULONG_PTR information =
        0;


    switch (
        stack->Parameters.DeviceIoControl.IoControlCode
        )
    {
    case IOCTL_TEST:
    {
        //
        // METHOD_BUFFERED:
        //
        // Input / Output:
        // irp->AssociatedIrp.SystemBuffer
        //

        PVOID buffer =
            irp->AssociatedIrp.SystemBuffer;

        ULONG input_size =
            stack->Parameters.DeviceIoControl
            .InputBufferLength;

        ULONG output_size =
            stack->Parameters.DeviceIoControl
            .OutputBufferLength;


        UNREFERENCED_PARAMETER(
            buffer
        );

        UNREFERENCED_PARAMETER(
            input_size
        );

        UNREFERENCED_PARAMETER(
            output_size
        );


        status =
            STATUS_SUCCESS;

        break;
    }


    default:
    {
        status =
            STATUS_INVALID_DEVICE_REQUEST;

        break;
    }
    }


    irp->IoStatus.Status =
        status;

    irp->IoStatus.Information =
        information;


    IoCompleteRequest(
        irp,
        IO_NO_INCREMENT
    );


    return status;
}