Question

我需要检测驱动程序或系统中是否初始化了一个驱动程序......我有变量＆＃34; DEVICE_OBJECT＆＃34;获取此信息。研究了＆＃34; DEVICE_OBJECT＆＃34;和＆＃34; DRIVER_OBJECT＆＃34;提取此信息但未成功。有没有人有关于如何做的任何提示？

Answer 1

NTSTATUS
IopInitializeDeviceNodeService(PDEVICE_NODE DeviceNode, BOOLEAN BootDriverOnly)
{
   NTSTATUS Status;
   ULONG ServiceStart;
   RTL_QUERY_REGISTRY_TABLE QueryTable[2];

   if (DeviceNode->ServiceName.Buffer == NULL)
   {
      return STATUS_UNSUCCESSFUL;
   }

   /*
    * Get service start value
    */

   RtlZeroMemory(QueryTable, sizeof(QueryTable));
   QueryTable[0].Name = L"Start";
   QueryTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT;
   QueryTable[0].EntryContext = &ServiceStart;
   Status = RtlQueryRegistryValues(RTL_REGISTRY_SERVICES,
      DeviceNode->ServiceName.Buffer, QueryTable, NULL, NULL);
   if (!NT_SUCCESS(Status))
   {
      DPRINT("RtlQueryRegistryValues() failed (Status %x)\n", Status);
      return Status;
   }

司机开始类型属性

1 个答案: