//FilterDriver.c

 //2016.07.15

 #include "ntddk.h"

 NTKERNELAPI

 NTSTATUS

 ObReferenceObjectByName(

     IN PUNICODE_STRING ObjectName,

     IN ULONG Attributes,

     IN PACCESS_STATE PassedAccessState OPTIONAL,

     IN ACCESS_MASK DesiredAccess OPTIONAL,

     IN POBJECT_TYPE ObjectType,

     IN KPROCESSOR_MODE AccessMode,

     IN OUT PVOID ParseContext OPTIONAL,

     OUT PVOID *Object

     );

 extern POBJECT_TYPE *IoDriverObjectType; 

 //global

 PDRIVER_OBJECT g_FilterDriverObject;

 PDRIVER_DISPATCH gfn_OrigReadCompleteRoutine;

 //我们的驱动分发函数

 NTSTATUS FilterReadCompleteRoutine(

     __in struct _DEVICE_OBJECT *DeviceObject,

      __inout struct _IRP *Irp)

 {

     KdPrint(("IRP_MJ_DEVICE_CONTROL coming."));

     //处理完毕后，要调用原分发例程

     return gfn_OrigReadCompleteRoutine(DeviceObject, Irp);

 }

 //驱动卸载函数

 VOID UnFilterDriverRoutine(__in struct _DRIVER_OBJECT *DriverObject)

 {

     //此内存可读时，恢复

     if (MmIsAddressValid(gfn_OrigReadCompleteRoutine))

     {

         KdPrint(("UnFilterDriverRoutine Success."));

         //卸载时恢复原分发例程

         g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = gfn_OrigReadCompleteRoutine;

     }

 }

 //过滤函数

 NTSTATUS FilterDriverQuery()

 {

     NTSTATUS Status;

     UNICODE_STRING usObjectName;

     RtlInitUnicodeString (&usObjectName, L"\\Driver\\XueTr");

     //根据驱动名称获得驱动对象

     Status = ObReferenceObjectByName (

         &usObjectName,

         OBJ_CASE_INSENSITIVE,    //大小写不敏感

         NULL,

         ,    //访问权限，0是所有权限

         *IoDriverObjectType,

         KernelMode,    //处理器模式

         NULL,

         (PVOID*)&g_FilterDriverObject

         );

     if (!NT_SUCCESS(Status))

     {

         KdPrint(("Filter Failed!"));

         return Status;

     }

     KdPrint(("0x%X", g_FilterDriverObject));    //打印驱动对象地址

     //保存原分发例程，并修改为我们的函数

     gfn_OrigReadCompleteRoutine = g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL];

     g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = (PDRIVER_DISPATCH)FilterReadCompleteRoutine;

     ObDereferenceObject(g_FilterDriverObject);    //清除引用计数

     return STATUS_SUCCESS;

 }

 //驱动程序入口函数

 NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)

 {

     pDriverObject->DriverUnload = UnFilterDriverRoutine;

     FilterDriverQuery ();

     return STATUS_SUCCESS;

 }

 //EnumDriver.c

 //2016.07.17

 #include <ntddk.h>

 typedef struct _LDR_DATA_TABLE_ENTRY{

     LIST_ENTRY InLoadOrderLinks;            //链表 保存了所有已经读取到内存中的驱动地址

     LIST_ENTRY InMemoryOrderLinks;            //链表 保存了已经安装，但没启动(没执行DriverEntry)的驱动地址

     LIST_ENTRY InInitializationOrderLinks;    //链表 保存了已经安装，同时也启动了(执行了DriverEntry)的驱动地址

     PVOID DllBase;

     PVOID EntryPoint;

     ULONG SizeOfImage;

     UNICODE_STRING FullDllName;

     UNICODE_STRING BaseDllName;

     ULONG Flags;

     USHORT LoadCount;

     USHORT TlsIndex;

     LIST_ENTRY HashLinks;

     PVOID SectionPointer;

     ULONG CheckSum;

     ULONG TimeDateStamp;

     PVOID LoadedImports;

     PVOID EntryPointActivationContext;

     PVOID PatchInformation;

 }LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

 VOID MyDriverUnload(PDRIVER_OBJECT pDriverObject)

 {

     //

     KdPrint(("Unload EnumDriver.sys Success."));

 }

 VOID EnumDriver(PDRIVER_OBJECT pDriverObject)

 {

     PLDR_DATA_TABLE_ENTRY pLdrDataTableEntry, pTempLdrDataTableEntry;

     PLIST_ENTRY pList;

     int i = ;

     pLdrDataTableEntry = (PLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection;

     if (!MmIsAddressValid(pLdrDataTableEntry))

     {

         return;

     }

     pList = &pLdrDataTableEntry->InLoadOrderLinks;

     while (pList != pLdrDataTableEntry->InLoadOrderLinks.Blink)

     {

         //ToDo

         pTempLdrDataTableEntry = (PLDR_DATA_TABLE_ENTRY)pList;

         i++;

         if(MmIsAddressValid(pTempLdrDataTableEntry))

         {

             if (MmIsAddressValid(&pTempLdrDataTableEntry->BaseDllName) && MmIsAddressValid(&pTempLdrDataTableEntry->BaseDllName))

                 KdPrint(("%d:%wZ\t%wZ", i, &pTempLdrDataTableEntry->BaseDllName, &pTempLdrDataTableEntry->FullDllName));

         }

         pList = pList->Flink;

     }

 }

 NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)

 {

     pDriverObject->DriverUnload = MyDriverUnload;

     EnumDriver(pDriverObject);

     return STATUS_SUCCESS;

 }