#include "io_ctl.h" UNICODE_STRING g_usDeviceName = RTL_CONSTANT_STRING(L"\\Device\\dump_Test"); UNICODE_STRING g_usSymbolicName = RTL_CONSTANT_STRING(L"\\??\\_dump_"); auto io_ctl::init_device_and_symbolic(PDRIVER_OBJECT drv_obj) -> NTSTATUS { auto dispatch_create_close = [](PDEVICE_OBJECT devcie_object, PIRP irp) { UNREFERENCED_PARAMETER(devcie_object); irp->IoStatus.Information = 0; irp->IoStatus.Status = 0; IoCompleteRequest(irp, IO_NO_INCREMENT); return STATUS_SUCCESS; }; NTSTATUS status{ 0 }; PDEVICE_OBJECT dev_obj{ 0 }; while (1) { status = IoCreateDevice(drv_obj, NULL, &g_usDeviceName, FILE_DEVICE_UNKNOWN, NULL, NULL, &dev_obj); if (!NT_SUCCESS(status)) { DbgPrintEx(77, 0, "[+] failed io create dev!!\n"); break; } status = IoCreateSymbolicLink(&g_usSymbolicName, &g_usDeviceName); if (!NT_SUCCESS(status)) { DbgPrintEx(77, 0, "[+] failed io create link!!\n"); break; } break; } drv_obj->MajorFunction[IRP_MJ_CLOSE] = dispatch_create_close; drv_obj->MajorFunction[IRP_MJ_CREATE] = dispatch_create_close; drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = dispatch_device_io; return status; } auto io_ctl::dispatch_device_io(PDEVICE_OBJECT devcie_object, PIRP irp) -> NTSTATUS { UNREFERENCED_PARAMETER(devcie_object); NTSTATUS status{ 0 }; irp->IoStatus.Information = 0; irp->IoStatus.Status = status; IoCompleteRequest(irp, IO_NO_INCREMENT); return status; }