driver_comm.cpp

#include "stdafx.h"

// ============================================
// EtwTi-FluctuationMonitor v3.0
// 驱动通信模块实现
// ============================================

// ============================================
// 服务管理函数
// ============================================

// 检查驱动服务是否已存在
bool IsDriversMonServiceExists() {
    SC_HANDLE hSCManager = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CONNECT);
    if (hSCManager == NULL) {
        return false;
    }

    SC_HANDLE hService = OpenService(hSCManager, DRIVERS_MON_SERVICE_NAME, SERVICE_QUERY_STATUS);
    CloseServiceHandle(hSCManager);

    if (hService == NULL) {
        return false;
    }

    CloseServiceHandle(hService);
    return true;
}

// 加载驱动
bool LoadDriversMonDriver(const wchar_t* driverPath) {
    SC_HANDLE hSCManager = NULL;
    SC_HANDLE hService = NULL;
    bool result = false;

    // 打开服务管理器
    hSCManager = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CREATE_SERVICE);
    if (hSCManager == NULL) {
        printf("[!] Failed to open SC manager. Error: %d\n", GetLastError());
        return false;
    }

    // 检查服务是否已存在
    hService = OpenService(hSCManager, DRIVERS_MON_SERVICE_NAME, SERVICE_START | SERVICE_QUERY_STATUS);
    if (hService != NULL) {
        // 服务已存在，检查是否正在运行
        SERVICE_STATUS status;
        if (QueryServiceStatus(hService, &status)) {
            if (status.dwCurrentState == SERVICE_RUNNING) {
                printf("[+] DriversMon service is already running\n");
                result = true;
            }
            else {
                // 启动服务
                if (StartService(hService, 0, NULL)) {
                    printf("[+] DriversMon service started\n");
                    result = true;
                }
                else {
                    DWORD err = GetLastError();
                    if (err == ERROR_SERVICE_ALREADY_RUNNING) {
                        printf("[+] DriversMon service is already running\n");
                        result = true;
                    }
                    else {
                        printf("[!] Failed to start DriversMon service. Error: %d\n", err);
                    }
                }
            }
        }
        CloseServiceHandle(hService);
        CloseServiceHandle(hSCManager);
        return result;
    }

    // 服务不存在，创建新服务
    wchar_t fullPath[MAX_PATH];
    if (driverPath == NULL) {
        // 获取当前目录下的驱动路径
        GetCurrentDirectoryW(MAX_PATH, fullPath);
        wcscat_s(fullPath, MAX_PATH, L"\\drivers_mon.sys");
    }
    else {
        wcscpy_s(fullPath, MAX_PATH, driverPath);
    }

    printf("[*] Creating DriversMon service with path: %S\n", fullPath);

    hService = CreateService(
        hSCManager,
        DRIVERS_MON_SERVICE_NAME,
        DRIVERS_MON_SERVICE_NAME,
        SERVICE_START | DELETE | SERVICE_QUERY_STATUS,
        SERVICE_KERNEL_DRIVER,
        SERVICE_DEMAND_START,
        SERVICE_ERROR_NORMAL,
        fullPath,
        NULL, NULL, NULL, NULL, NULL
    );

    if (hService == NULL) {
        DWORD err = GetLastError();
        printf("[!] Failed to create DriversMon service. Error: %d\n", err);
        CloseServiceHandle(hSCManager);
        return false;
    }

    printf("[+] DriversMon service created\n");

    // 启动服务
    if (StartService(hService, 0, NULL)) {
        printf("[+] DriversMon service started\n");
        result = true;
    }
    else {
        DWORD err = GetLastError();
        if (err == ERROR_SERVICE_ALREADY_RUNNING) {
            printf("[+] DriversMon service is already running\n");
            result = true;
        }
        else {
            printf("[!] Failed to start DriversMon service. Error: %d\n", err);
        }
    }

    CloseServiceHandle(hService);
    CloseServiceHandle(hSCManager);
    return result;
}

// 卸载驱动
bool UnloadDriversMonDriver() {
    SC_HANDLE hSCManager = NULL;
    SC_HANDLE hService = NULL;
    bool result = false;

    hSCManager = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CONNECT);
    if (hSCManager == NULL) {
        return false;
    }

    hService = OpenService(hSCManager, DRIVERS_MON_SERVICE_NAME, SERVICE_STOP | DELETE | SERVICE_QUERY_STATUS);
    if (hService == NULL) {
        CloseServiceHandle(hSCManager);
        return true; // 服务不存在
    }

    // 停止服务
    SERVICE_STATUS status;
    if (ControlService(hService, SERVICE_CONTROL_STOP, &status)) {
        printf("[+] DriversMon service stopped\n");
    }

    // 删除服务
    if (DeleteService(hService)) {
        printf("[+] DriversMon service deleted\n");
        result = true;
    }

    CloseServiceHandle(hService);
    CloseServiceHandle(hSCManager);
    return result;
}

// ============================================
// 设备通信函数
// ============================================

// 打开驱动设备
HANDLE OpenDriversMonDevice() {
    // 使用符号链接名称，而不是服务名称
    // 符号链接: \??\DriversMonDevice -> 用户态访问: \\.\DriversMonDevice
    HANDLE hDevice = CreateFileW(
        L"\\\\.\\" L"DriversMonDevice",
        GENERIC_READ | GENERIC_WRITE,
        0,
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL
    );

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[!] Failed to open DriversMon device. Error: %d\n", GetLastError());
    }

    return hDevice;
}

// 关闭驱动设备
void CloseDriversMonDevice(HANDLE hDevice) {
    if (hDevice != INVALID_HANDLE_VALUE && hDevice != NULL) {
        CloseHandle(hDevice);
    }
}

// 读取驱动事件
bool ReadDriverEvent(HANDLE hDevice, PVOID buffer, ULONG bufferSize, PULONG bytesReturned) {
    DWORD returned = 0;
    BOOL result = DeviceIoControl(
        hDevice,
        IOCTL_DRIVERS_MON_GET_EVENT,
        NULL, 0,
        buffer, bufferSize,
        &returned,
        NULL
    );

    if (bytesReturned != NULL) {
        *bytesReturned = returned;
    }

    return result && returned > 0;
}

// 设置驱动过滤器
bool SetDriverFilter(HANDLE hDevice, ULONG filterFlags) {
    DWORD returned = 0;
    BOOL result = DeviceIoControl(
        hDevice,
        IOCTL_DRIVERS_MON_SET_FILTER,
        &filterFlags, sizeof(filterFlags),
        NULL, 0,
        &returned,
        NULL
    );

    return result;
}