fix remove func
This commit is contained in:
@@ -3,8 +3,7 @@
|
||||
#include "utils.h"
|
||||
#include "kernel_function.h"
|
||||
|
||||
#pragma warning(disable : 4309)
|
||||
#pragma warning(disable : 4838)
|
||||
#pragma warning(disable : 4309 4838)
|
||||
|
||||
PFILE_OBJECT file_obj{ 0 };
|
||||
PDEVICE_OBJECT device_obj{ 0 };
|
||||
@@ -39,6 +38,8 @@ namespace comm_win7
|
||||
return status;
|
||||
};
|
||||
|
||||
uintptr_t beep_trampoline = NULL;
|
||||
|
||||
auto comm_install_hook() -> BOOL
|
||||
{
|
||||
auto drv_obj = device_obj->DriverObject;
|
||||
@@ -47,7 +48,7 @@ namespace comm_win7
|
||||
|
||||
orign_maj_function = drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL];
|
||||
|
||||
auto beep_trampoline = utils::get_beep_trampoline_ptr();
|
||||
beep_trampoline = utils::get_beep_trampoline_ptr();
|
||||
if (!beep_trampoline)
|
||||
return FALSE;
|
||||
|
||||
@@ -73,6 +74,15 @@ namespace comm_win7
|
||||
{
|
||||
drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] =
|
||||
(PDRIVER_DISPATCH)orign_maj_function;
|
||||
|
||||
if (!beep_trampoline)
|
||||
return FALSE;
|
||||
|
||||
char nullcode[12]{ 0 };
|
||||
auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
|
||||
if (!NT_SUCCESS(status))
|
||||
return FALSE;
|
||||
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
|
||||
Reference in New Issue
Block a user