环境：win7 32 ,材料: ntoskrnl.exe , spldr.sys spsys.sys
看到一个文件叫spldr.sys,loader for security processor,一个加载器。于是就进去看看如何实现的。在spldr.sys 里面看到字符串
SystemRoot\system32\drivers\spsys.sys ，应该就是要加载这个驱动了。再看字符串的引用位置，发现调用ZwSetSystemInformation,应该就是通过这个函数来加载驱动的。下面是调用情况（详情请参考spldr.sys）:
DRIVER_OBJECT DriverObject; UNICODE_STRING RegistryPath; NTSTATUS Load() { #define SystemUnloadGdiDriver 0x1b #define SystemLoadGdiDriverInSystemSpace 0x36 typedef NTSTATUS (*n_DriverEntry)(PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPathy); typedef struct _LOAD_GDI_DRIVER_INFORMATION { UNICODE_STRING DriverPath={0}; //the driver path ULONG DriverStart; //the DriverStart in _driver_object struct PVOID DriverInfo; //os use this DriverInfo to manage the loaded gdi drivers,DriverInfo should be a struct which contains info of the loaded gdi driver PVOID DriverEntry; //address of DriverEntry of the loaded driver PVOID ExportDirectory; //address of export directory of the loaded driver ULONG SizeOfImage; //size of the loaded driver image }LOAD_GDI_DRIVER_INFORMATION,*PLOAD_GDI_DRIVER_INFORMATION; NTSTATUS status=STATUS_SUCCESS; LOAD_GDI_DRIVER_INFORMATION LoadGdiDriverInfo={0}; RtlInitUnicodeString(&LoadGdiDriverInfo.DriverPath,L"\\SystemRoot\\system32\\drivers\\spsys.sys"); status=ZwSetSystemInformation(SystemLoadGdiDriverInSystemSpace,&LoadGdiDriverInfo,sizeof(LOAD_GDI_DRIVER_INFORMATION)); if(status>=0) { //the driver image is loaded into the system space //and then call the driver's DriverEntry //part of DriverObject and RegistryPath should be filled before pass to DriverEntry status=((n_DriverEntry)LoadGdiDriverInfo.DriverEntry) (&DriverObject,&RegistryPath); if(!status) { //the DriverEntry fails //unload the loaded gdi driver ZwSetSystemInformation(SystemUnloadGdiDriver,LoadGdiDriverInfo.DriverInfo,0x4); } } return status; }
