#define SYSTEMSERVICE(_func) \
 
  KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_func+1)]
 
#define SYSCALL_INDEX(_Function) *(PULONG)((PUCHAR)_Function+1)
 
#define HOOK_SYSCALL(_Function, _Hook, _Orig )       \
 
        _Orig = (PVOID) InterlockedExchange( (PLONG) \
 
        &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)
 
#define UNHOOK_SYSCALL(_Func, _Hook, _Orig )  \
 
        InterlockedExchange((PLONG)           \
 
        &MappedSystemCallTable[SYSCALL_INDEX(_Func)], (LONG) _Hook)

HOOK_SYSCALL(API, NuestraFuncion, Direccióninicial);

UNHOOK_SYSCALL(API, Direccióninicial, NuestraFuncion);

__asm
 
      {
 
            push eax
 
            mov  eax, CR0
 
            and  eax, 0FFFEFFFFh
 
            mov  CR0, eax
 
            pop  eax
 
      }
 

__asm
 
      {
 
            push eax
 
            mov  eax, CR0
 
            or   eax, NOT 0FFFEFFFFh
 
            mov  CR0, eax
 
            pop  eax
 
      }
 

// Declarations
 
#pragma pack(1)
 
typedef struct ServiceDescriptorEntry {
 
        unsigned int *ServiceTableBase;
 
        unsigned int *ServiceCounterTableBase;
 
        unsigned int NumberOfServices;
 
        unsigned char *ParamTableBase;
 
} SSDT_Entry;
 
#pragma pack()
 
__declspec(dllimport) SSDT_Entry KeServiceDescriptorTable;
 
 
 
PMDL  g_pmdlSystemCall;
 
PVOID *MappedSystemCallTable;
 
// Code
 
// save old system call locations
 
 
 
// Map the memory into our domain to change the permissions on // the MDL
 
g_pmdlSystemCall = MmCreateMdl(NULL,
 
                   KeServiceDescriptorTable.ServiceTableBase,
 
                   KeServiceDescriptorTable.NumberOfServices*4);
 
if(!g_pmdlSystemCall)
 
   return STATUS_UNSUCCESSFUL;
 
MmBuildMdlForNonPagedPool(g_pmdlSystemCall);
 
// Change the flags of the MDL
 
g_pmdlSystemCall->MdlFlags = g_pmdlSystemCall->MdlFlags |
 
                             MDL_MAPPED_TO_SYSTEM_VA;
 
 
 
MappedSystemCallTable = MmMapLockedPages(g_pmdlSystemCall, KernelMode);
 

if(g_pmdlSystemCall)
   {
      MmUnmapLockedPages(MappedSystemCallTable, g_pmdlSystemCall);
      IoFreeMdl(g_pmdlSystemCall);
   }

#include "ntddk.h"
 
typedef struct ServiceDescriptorEntry {
        unsigned int *ServiceTableBase;
        unsigned int *ServiceCounterTableBase;
        unsigned int NumberOfServices;
        unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
__declspec(dllimport)  ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
 
#define SYSTEMSERVICE(_function)  KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
 
typedef DWORD (ULONG);
PMDL  g_pmdlSystemCall;
PVOID *MappedSystemCallTable;
 
#define SYSCALL_INDEX(_Function) *(PULONG)((PUCHAR)_Function+1)
 
#define HOOK_SYSCALL(_Function, _Hook, _Orig )  \
       _Orig = (PVOID) InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)
 
#define UNHOOK_SYSCALL(_Function, _Hook, _Orig )  \
       InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)
 
//Declaramos la API para poder trabajar con ella.
NTSYSAPI NTSTATUS NTAPI ZwOpenProcess (OUT PHANDLE ProcessHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes,IN PCLIENT_ID ClientId OPTIONAL);
 
 
typedef NTSTATUS (*TypZwOpenProc)(OUT PHANDLE ProcessHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes,IN PCLIENT_ID ClientId OPTIONAL);
TypZwOpenProc ZwOpenProcessIni;
 
NTSTATUS NewZwOpenProcess(OUT PHANDLE ProcessHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes,IN PCLIENT_ID ClientId OPTIONAL)
{
   HANDLE PID;
 
   __try //Utilizamos el bloque try para evitar BSOD
   {
		PID = ClientId->UniqueProcess;
	}
 
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		return STATUS_INVALID_PARAMETER;
	}
 
	DbgPrint("PID: 0x%x",PID);
 
	//Verificamos el pid
	if (PID == (HANDLE)1234) return STATUS_ACCESS_DENIED; //Retornamos acceso denegado
	else return ZwOpenProcessIni(ProcessHandle, DesiredAccess,ObjectAttributes, ClientId); //Llamamos a la API nativa y retornamos el resultado correcto
}
 
VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
{
   DbgPrint("Descargando driver...");
 
   //Unhookeamos
   UNHOOK_SYSCALL( ZwOpenProcess, ZwOpenProcessIni, NewZwOpenProcess );
 
   //Eliminamos la MDL
   if(g_pmdlSystemCall)
   {
      MmUnmapLockedPages(MappedSystemCallTable, g_pmdlSystemCall);
      IoFreeMdl(g_pmdlSystemCall);
   }
}
 
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING theRegistryPath)
{
   DriverObject->DriverUnload  = OnUnload; 
 
   DbgPrint("Driver cargado");
   ZwOpenProcessIni =(TypZwOpenProc)(SYSTEMSERVICE(ZwOpenProcess));
 
   //Creamos la MDL para deshabilitar la protección de memoria
   g_pmdlSystemCall = MmCreateMdl(NULL, KeServiceDescriptorTable.ServiceTableBase, KeServiceDescriptorTable.NumberOfServices*4);
   if(!g_pmdlSystemCall)
      return STATUS_UNSUCCESSFUL;
 
   MmBuildMdlForNonPagedPool(g_pmdlSystemCall);
 
   g_pmdlSystemCall->MdlFlags = g_pmdlSystemCall->MdlFlags | MDL_MAPPED_TO_SYSTEM_VA;
 
   MappedSystemCallTable = MmMapLockedPages(g_pmdlSystemCall, KernelMode);
 
 
   DbgPrint("Hookeando...");
   HOOK_SYSCALL( ZwOpenProcess, NewZwOpenProcess, ZwOpenProcessIni );
 
   return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
	//Codigo
}
 

void Salir(PDRIVER_OBJECT DriverObject)
{
    //Codigo de salida
}
 
NTSTATUS DriverEntry( PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    DriverObject->DriverUnload=Salir;
    return STATUS_SUCCESS;
}
 

#include <ntddk.h>
 
void Salir(PDRIVER_OBJECT DriverObject)
{
    DbgPrint("Adiós");
}
 
NTSTATUS DriverEntry( PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    DriverObject->DriverUnload=Salir;
	DbgPrint("Hola mundo!!!");
	return STATUS_SUCCESS;
}

NTSTATUS Control(PDEVICE_OBJECT DeviceObject,PIRP Irp)
{
	//Codigo
}
 
NTSTATUS DriverEntry( PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    DriverObject->DriverUnload=Salir;
    for(i=0;i<IRP_MJ_MAXIMUM_FUNCTION;i++)
    DriverObject->MajorFunction[i]=Control;
 
	return STATUS_SUCESS;
}

//Variables globales
const WCHAR   	Device[]=L"\\device\\driver5";
const WCHAR		sLink[]=L"\\??\\midriver5";
UNICODE_STRING	Dev,lnk;
//Fin variables globales
 
NTSTATUS DriverEntry( PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
	NTSTATUS		s;
	unsigned int 	i;
 
    DriverObject->DriverUnload=Salir;
    for(i=0;i<IRP_MJ_MAXIMUM_FUNCTION;i++)
    DriverObject->MajorFunction[i]=Control;
 
    RtlInitUnicodeString(&Dev,Device);
    RtlInitUnicodeString(&lnk,sLink);
    s=IoCreateDevice(DriverObject,0,&Dev,FILE_DEVICE_UNKNOWN,0,0,&DriverObject->DeviceObject);
 
	if (NT_SUCCESS(s))
    {
		s=IoCreateSymbolicLink(&lnk,&Dev);
		if(!NT_SUCCESS(s))
	    {
			IoDeleteDevice(DriverObject->DeviceObject);
			DbgPrint("Error Link");
		}else
		DbgPrint("Cargado");
	}else
		DbgPrint("Error IoCreate");
 
	return  s;
}
 

NTSTATUS Control(PDEVICE_OBJECT DeviceObject,PIRP Irp)
{
    NTSTATUS            s=STATUS_SUCCESS;
    PIO_STACK_LOCATION  Stack;
	unsigned int    escritos;
	char *iBuffer;
    char *oBuffer;
    char *Mensaje = "Hola desde el kernel!";
    unsigned int Tam = sizeof("Hola desde el kernel!");
 
    Stack=IoGetCurrentIrpStackLocation(Irp);
 
	switch(Stack->Parameters.DeviceIoControl.IoControlCode)
    {
		case Escribe:
			DbgPrint("Funcion escribir llamada");
		    DbgPrint("Asociando buffers...");
		    iBuffer = oBuffer = Irp->AssociatedIrp.SystemBuffer;
		    if(oBuffer && oBuffer)
		    {
				DbgPrint("OK");
		       if(Stack->Parameters.DeviceIoControl.InputBufferLength !=0)
			   {
					DbgPrint("Datos desde modo usuario: %s",iBuffer);
 
					if(Stack->Parameters.DeviceIoControl.OutputBufferLength>= Tam)
		            {
						DbgPrint("Enviando datos...");
		                RtlCopyMemory(oBuffer, Mensaje, Tam);
						Irp->IoStatus.Information = Tam;
		                s = STATUS_SUCCESS;
		            }else{
						DbgPrint("NO ENVIAMOS LOS DATOS");
						Irp->IoStatus.Information = 0;
		                s = STATUS_BUFFER_TOO_SMALL;
		            }
		       }
		    }
			else DbgPrint("ERROR");
			break;
	}
	Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return s;
}

Stack=IoGetCurrentIrpStackLocation(Irp);

iBuffer = oBuffer = Irp->AssociatedIrp.SystemBuffer;

RtlCopyMemory(oBuffer, Mensaje, Tam);
Irp->IoStatus.Information = Tam;

Irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return s;

#include <stdio.h>
#include <windows.h>
#include <winioctl.h>
 
#define Escribe CTL_CODE(FILE_DEVICE_UNKNOWN, 0x00000001, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
 
int main()
{
	DWORD a;
	HANDLE hDevice = CreateFile("\\\\.\\midriver5",GENERIC_READ | GENERIC_WRITE ,FILE_SHARE_READ | FILE_SHARE_WRITE,0,OPEN_EXISTING,FILE_FLAG_OVERLAPPED,0);
	char    iBuffer[30];
	char    oBuffer[1024];
 
    if (hDevice!=INVALID_HANDLE_VALUE)
    {
		printf("Conectado");
		strcpy(iBuffer,"Hola desde Modo Usuario!!!");
		if(DeviceIoControl(hDevice,(DWORD)Escribe,iBuffer,(DWORD)sizeof(iBuffer),(LPVOID)oBuffer,(DWORD)sizeof(oBuffer),&a,NULL)==true)
		{
			printf("\n%d Bytes\n%s\n%s",a,iBuffer,oBuffer);
		}else
		printf("0x%08x",GetLastError());
	}
 
	system("pause");
	return 0;
}