Treiber installieren, starten, stoppen, deinstallieren

[Neotracer64]

Ich habe noch eine Quick&Dirty Variante gefunden. Leider lässt sich der Treiber ohne Neustart nicht mehr entladen.

Und geklappt hat es auch noch nicht, da ich wahrscheinlich zu blöd bin C++ in Delphi zu übersetzen. Ich habs trotzdem ma versucht:

Original C-Code:

Zitat:

//----------------------------------------------------------------
// load a sys file as a driver using undocumented method
//----------------------------------------------------------------
bool load_sysfile()
{
SYSTEM_LOAD_AND_CALL_IMAGE GregsImage;

WCHAR daPath[] = L"\\??\\C:\\HELLOWORLD.SYS";

//////////////////////////////////////////////////////////////
// get DLL entry points
//////////////////////////////////////////////////////////////
if( !(RtlInitUnicodeString = (RTLINITUNICODESTRING)
GetProcAddress( GetModuleHandle("ntdll.dll")
,"RtlInitUnicodeString"
)))
{
return false;
}

if(!(ZwSetSystemInformation = (ZWSETSYSTEMINFORMATION)
GetProcAddress(
GetModuleHandle("ntdll.dll")
,"ZwSetSystemInformation" )))
{
return false;
}

RtlInitUnicodeString(
&(GregsImage.ModuleName)
,daPath
);

if(
!NT_SUCCESS(
ZwSetSystemInformation(
SystemLoadAndCallImage
,&GregsImage
,sizeof(SYSTEM_LOAD_AND_CALL_IMAGE))))
{
return false;
}

return true;
}

Delphi-Quellcode:

uses ...JwaNative, JwaNTStatus;
...
function load_sysfile: boolean;
var
  GregsImage: SYSTEM_LOAD_AND_CALL_IMAGE;
  daPath: PWideChar;
begin
  daPath := 'HelloWorld.sys';
  RtlInitUnicodeString(@GregsImage.ModuleName,daPath);
  if ZwSetSystemInformation(SystemLoadAndCallImage,@GregsImage,sizeof(SYSTEM_LOAD_AND_CALL_IMAGE))= STATUS_SUCCESS 
    Then result := True 
    Else result := false;
end;

Es kommt leider immer false raus