#include <ntddk.h>
#include <wdmsec.h>
#define control_device_object_symbol L"\\?\\cdosym_ssdt"
const GUID ssdt_hook_uuid = { 0xd47bf014L,0x7b37,0x11e7,{0xba,0x6f,0x00,0x0c,0x29,0xf3,0x4e,0xca} };
PDEVICE_OBJECT gdo = NULL;//for IoCreateDeviceSecure use<global device object>
ULONG g_index = 0;
NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING regPath)
{
DbgBreakPoint();
NTSTATUS status;
ULONG i;
ULONG index;
UNICODE_STRING sddl = RTL_CONSTANT_STRING(L"D:P(A;;GA;;;WD)");
UNICODE_STRING control_device_object = RTL_CONSTANT_STRING(L"\\Device\\cdo_ssdt");
UNICODE_STRING control_device_symbol = RTL_CONSTANT_STRING(control_device_object_symbol);
status = IoCreateDeviceSecure(driver, 0, &control_device_object, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &sddl, (LPCGUID)&ssdt_hook_uuid, &gdo);
if (!NT_SUCCESS(status))
{
DbgPrint(" [-] IoCreateDeviceSecure error.\n");
return status;
}
status = IoDeleteSymbolicLink(&control_device_symbol);
status = IoCreateSymbolicLink(&control_device_symbol, &control_device_object);
if (!NT_SUCCESS(status))
{
DbgPrint(" [-] IoCreateSymbolicLink error while status=0x%X.\n",status);
IoDeleteDevice(gdo);
return status;
}
}
Here are parts of the code.
Each time when i debug it in windbg, status was set to 0xC000003A after IoCreateSymbolicLink(which means path not found).
I've checked IoCreateDeviceSecure() and IoDeleteSymbolicLink()'s return value,they're STATUS_SUCCESS)
Since i delete the symbolic name before i create the same one ,why kernel still tells me path not found?
By the way,does the "path" refers to the symbolic name path or others?
Thanks for any help :)
User contributions licensed under CC BY-SA 3.0