#include #include "WINDOWS.h" #include "..\dbgmsg.h" typedef long NTSTATUS; #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) #define NT_INFORMATION(Status) ((((ULONG)(Status)) >> 30) == 1) #define NT_WARNING(Status) ((((ULONG)(Status)) >> 30) == 2) #define NT_ERROR(Status) ((((ULONG)(Status)) >> 30) == 3) typedef struct _UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; }UNICODE_STRING; VOID (_stdcall *RtlInitUnicodeString)( IN OUT UNICODE_STRING *DestinationString, IN PCWSTR SourceString ); NTSTATUS (_stdcall *ZwSetSystemInformation)( IN DWORD functionCode, IN OUT PVOID driverName, IN LONG driverNameLength ); typedef struct _DRIVER_NAME { UNICODE_STRING name; }DRIVER_NAME; #define LOAD_DRIVER_IMAGE_CODE 38 NTSTATUS loadDriver(char *binaryPath) { DRIVER_NAME DriverName; const char dllName[] = "ntdll.dll"; HANDLE ntHandle = NULL; DBG_TRACE(__FUNCTION__,"Acquiring function pointers"); ntHandle = (void *) GetModuleHandle(dllName); if (ntHandle == NULL) { DBG_TRACE(__FUNCTION__,"Failed to get module handle for ntdll.dll :/"); return -1; } RtlInitUnicodeString = (void *) GetProcAddress ( GetModuleHandle(dllName), "RtlInitUnicodeString" ); ZwSetSystemInformation = (void *)GetProcAddress (GetModuleHandle(dllName), "ZwSetSystemInformation" ); printf("RtlInitUnicodeString == 0x%08x\n",RtlInitUnicodeString); printf("ZwSetSystemInformation == 0x%08x\n",ZwSetSystemInformation); if (RtlInitUnicodeString == NULL) { DBG_TRACE(__FUNCTION__,"GetProcAddress() failed to load RtlInitUnicodeString"); return -1; } DBG_TRACE(__FUNCTION__,"Got &RtlInitUnicodeString!"); RtlInitUnicodeString(&(DriverName).name,binaryPath); if (ZwSetSystemInformation == NULL) { DBG_TRACE(__FUNCTION__,"GetProcAddress() failed to load ZwSetSystemInformation"); return -1; } DBG_TRACE(__FUNCTION__,"Got &ZwSetSystemInformation !"); return ZwSetSystemInformation( LOAD_DRIVER_IMAGE_CODE, &DriverName, sizeof(DRIVER_NAME) ); } void main() { //WCHAR binaryPath[] = L"C:\\srv3.sys"; char binaryPath[] = "D:\\srv3.sys"; NTSTATUS status; DWORD s = 0; status = loadDriver(binaryPath); s = GetLastError(); printf("%d %x\n",s,status); if (NT_SUCCESS(status)) puts("success"); else if (NT_WARNING(status)) puts("status == iNFO"); else if (NT_ERROR(status)) puts("status == error :/ "); else printf("status = %d, unrecognized\n",status); }