[代码原创，思路非原创]VB版使用ZwSetSystemInformation加载驱动

Tesla.Angela

用ZwSetSystemInformation加载驱动算是老技巧了，不过网上的代码都是C语言的，我一时无聊，就把它转成VB了。
相信不少人都使用陈辉写的驱动加载模块吧？某些时候用用这个也不错。

1. 
   
2. Private Type UNICODE_STRING
   
3.     Length As Integer
   
4.     MaxLength As Integer
   
5.     pBuffer As Long
   
6. End Type
   
7. Private Type SYSTEM_LOAD_AND_CALL_IMAGE
   
8.     ImageName As UNICODE_STRING
   
9. End Type
   
10. Private Declare Function RtlInitUnicodeString Lib "NTDLL.DLL" (ByRef DestinationString As UNICODE_STRING, ByVal SourceString As Long) As Long
    
11. Private Declare Function ZwSetSystemInformation Lib "NTDLL.DLL" (ByVal SystemInformationClass As Long, ByVal pSystemInformation As Long, ByVal SystemInformationLength As Long) As Long
    
12. Private Function NT_SUCCESS(ByVal Status As Long) As Boolean
    
13.     NT_SUCCESS = (Status >= 0)
    
14. End Function
    
15. Sub Main()
    
16.     Dim ustr As SYSTEM_LOAD_AND_CALL_IMAGE
    
17.     Call RtlInitUnicodeString(ustr.ImageName, StrPtr("\??\c:\_root_.sys"))
    
18.     If (NT_SUCCESS(ZwSetSystemInformation(38, VarPtr(ustr), Len(ustr))) = True) Then
    
19.         MsgBox "Load Driver Success!", , ""
    
20.     Else
    
21.         MsgBox "Load Driver Error!", , ""
    
22.     End If
    
23. End Sub
    

复制代码

Tesla.Angela

沙发自己坐。
VB.NET没有指针（连VarPtr都没有），修改一下声明估计可以移植到VB.NET上：

1. 
   
2. Private Type UNICODE_STRING
   
3.     Dim Length As Short
   
4.     Dim MaxLength As Short
   
5.     Dim pBuffer As Integer
   
6. End Type
   
7. Private Declare Function RtlInitUnicodeString Lib "NTDLL.DLL" (ByRef DestinationString As UNICODE_STRING, ByRef SourceString As String) As Integer
   
8. Private Declare Function ZwSetSystemInformation Lib "NTDLL.DLL" (ByVal SystemInformationClass As Integer, ByRef pSystemInformation As SYSTEM_LOAD_AND_CALL_IMAGE, ByVal SystemInformationLength As Integer) As Integer
   

复制代码

重装了系统，不想再安装几乎有4GB的VS2008了。

oopww

有什么优点吗！？

Tesla.Angela

回复 4# oopww


不用写注册表，不使用NtLoadDriver。

oopww

360呢？！！！！回复 5# Tesla.Angela