Detect Driver

#include "drvCommon.h"
#include "IRPUtils.h"
#include "Ioctl.h"

#include "QueryMng.h"
#include "ProcessDetector.h"
#include "FileDetector.h"

////////////////////////////////////////////////////////////////////////////////////

/*Name and symbolic link need to provide access to driver from User Mode*/
//The name of current driver
UNICODE_STRING gDeviceName;
PCWSTR gDeviceNameStr       = L"\\Device\\DetectDriver";
//The symbolic link of driver location
UNICODE_STRING gSymbolicLinkName;
PCWSTR gSymbolicLinkNameStr = L"\\DosDevices\\DetectDriver";

//The object associated with the driver
PDEVICE_OBJECT gDeviceObject = NULL;

/*QueryMng used for dispatching IOCTL queries*/
utils::QueryMng gQueryMng;

/*ProcessDetector used for detecting hidden process*/
DetectDriver::ProcessDetector gProcessDetector;

/*ProcessDetector used for detecting hidden process*/
DetectDriver::FileDetector gFileDetector;

////////////////////////////////////////////////////////////////////////////////////

extern "C" 
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath);

VOID     DriverUnload(IN PDRIVER_OBJECT DriverObject);
NTSTATUS DeviceControlRoutine( IN PDEVICE_OBJECT fdo, IN PIRP Irp );
NTSTATUS DeviceCloseHandleRoutine(IN PDEVICE_OBJECT fdo,IN PIRP Irp);
NTSTATUS DeviceOpenHandleRoutine(IN PDEVICE_OBJECT fdo,IN PIRP Irp);
NTSTATUS Initialize();
VOID     Uninitialize();

////////////////////////////////////////////////////////////////////////////////////

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,
                     IN PUNICODE_STRING RegistryPath)
{
    DbgPrint("\t------DETECT DRIVER START------\n");

    libcpp_init();

    /* Start Driver initialization */

    RtlInitUnicodeString(&gDeviceName,       gDeviceNameStr);
    RtlInitUnicodeString(&gSymbolicLinkName, gSymbolicLinkNameStr);

    NTSTATUS status;
    status = IoCreateDevice(DriverObject,     // pointer on DriverObject
                            0,                // additional size of memory, for device extension
                            &gDeviceName,     // pointer to UNICODE_STRING
                            FILE_DEVICE_NULL, // Device type
                            0,                // Device characteristic
                            FALSE,            // "Exclusive" device
                            &gDeviceObject);  // pointer do device object
    if (status != STATUS_SUCCESS)
        return STATUS_FAILED_DRIVER_ENTRY;

    status = IoCreateSymbolicLink(&gSymbolicLinkName,&gDeviceName);
    if (status != STATUS_SUCCESS)
        return STATUS_FAILED_DRIVER_ENTRY;

    // Register IRP handlers
    PDRIVER_DISPATCH *mj_func;
    mj_func = DriverObject->MajorFunction;
    DriverObject->DriverUnload = DriverUnload;

    mj_func[IRP_MJ_DEVICE_CONTROL] = DeviceControlRoutine;
    mj_func[IRP_MJ_CREATE]           = DeviceOpenHandleRoutine;
    mj_func[IRP_MJ_CLOSE]           = DeviceCloseHandleRoutine;

    /* Driver initialization are done */
    return Initialize();
}
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
{    
    Uninitialize();

    IoDeleteSymbolicLink(&gSymbolicLinkName);
    IoDeleteDevice(gDeviceObject);

    libcpp_exit();

    DbgPrint("\t------DETECT DRIVER EXIT------\n");
    
    return;
}
NTSTATUS Initialize()
{
    try
    {
		gProcessDetector.Initialize(gQueryMng);
        gFileDetector.Initialize(gQueryMng);
    }
    catch(const std::exception& ex)
    {
		DbgPrint("-DetectDriver- Initialize() std::exception: %s\n",ex.what());
    }
    return STATUS_SUCCESS;
}
VOID Uninitialize()
{
    try
    {
        gProcessDetector.Cleanup(gQueryMng);
        gFileDetector.Cleanup(gQueryMng);
    }
    catch(const std::exception& ex)
    {
		DbgPrint("-DetectDriver- Uninitialize() std::exception: %s\n",ex.what());
	}
}
NTSTATUS DeviceControlRoutine( IN PDEVICE_OBJECT fdo, IN PIRP pIrp )
{
    /*
    * Query manager process all IRP.
    * IRP will be completed by Query manager.        
    */
    return gQueryMng.ProcessIrp(pIrp);    
}
// DeviceOpenHandleRoutine: process IRP_MJ_CREATE call.
NTSTATUS DeviceOpenHandleRoutine(IN PDEVICE_OBJECT fdo,IN PIRP Irp)
{
    DbgPrint("-DetectDriver- IRP_MJ_CREATE\n");

    return utils::CompleteIrp(Irp,STATUS_SUCCESS,0);
}
// DeviceCloseHandleRoutine: process IRP_MJ_CLOSE call.
NTSTATUS DeviceCloseHandleRoutine(IN PDEVICE_OBJECT fdo,IN PIRP Irp)
{
    DbgPrint("-DetectDriver- IRP_MJ_CLOSE\n");

    return utils::CompleteIrp(Irp,STATUS_SUCCESS,0);
}