подгрузка драйвера

есть вот такой код но он неработает, драйвер подписан так что все должно быть норм...

что не так?

Код (C):

1. #include <windows.h>
2. #include <stdio.h>
3. #define SE_LOAD_DRIVER_PRIVILEGE 10L
4. #define _CRT_SECURE_NO_WARNINGS
5. typedef struct _LSA_UNICODE_STRING {
6.     USHORT Length;
7.     USHORT MaximumLength;
8.     PVOID Buffer;
9. } LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
10. typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;
11. typedef DWORD(CALLBACK* RTLANSISTRINGTOUNICODESTRING)(PVOID, PVOID, DWORD);
12. RTLANSISTRINGTOUNICODESTRING RtlAnsiStringToUnicodeString;
13. typedef DWORD(CALLBACK* RTLFREEUNICODESTRING)(PVOID);
14. RTLFREEUNICODESTRING RtlFreeUnicodeString;
15. typedef DWORD(CALLBACK* ZWLOADDRIVER)(PVOID);
16. ZWLOADDRIVER ZwLoadDriver;
17.  
18. int LoadDriver(char * szDrvName, char * szDrvPath)
19. {
20.  
21.     char szSubKey[MAX_PATH], szDrvFullPath[MAX_PATH];
22.     LSA_UNICODE_STRING buf1;
23.     LSA_UNICODE_STRING buf2;
24.     int iBuffLen;
25.     HKEY hkResult;
26.     char val0[8] = "WinDrv";
27.     //val0[8] = '\0';
28.     char val1[4];
29.     val1[0] = 1;
30.     val1[1] = 0;
31.     val1[2] = 0;
32.     val1[3] = 0;
33.     char val2[4];
34.     val2[0] = 1;
35.     val2[1] = 0;
36.     val2[2] = 0;
37.     val2[3] = 0;
38.     char val3[4];
39.     val3[0] = 3;
40.     val3[1] = 0;
41.     val3[2] = 0;
42.     val3[3] = 0;
43.     DWORD dwOK;
44.     iBuffLen = wsprintfA(szSubKey, "System\\CurrentControlSet\\Services\\%s", szDrvName);
45.     szSubKey[iBuffLen] = 0;
46.     dwOK = RegCreateKeyA(HKEY_LOCAL_MACHINE, (LPCSTR)szSubKey, &hkResult);
47.     if (dwOK != ERROR_SUCCESS)
48.         return false;
49.     iBuffLen = wsprintfA(szSubKey, "%s", "WinDrv");
50.     szSubKey[iBuffLen] = 0;
51.     dwOK = RegSetValueExA(hkResult, (LPCSTR)"DisplayName", 0, 1, (BYTE*)szSubKey, iBuffLen);
52.     dwOK = RegSetValueExA(hkResult, "Type", 0, 4, (BYTE*)val1, 4);
53.     dwOK = RegSetValueExA(hkResult, "ErrorControl", 0, 4, (BYTE*)val2, 4);
54.     dwOK = RegSetValueExA(hkResult, "Start", 0, 4, (BYTE*)val3, 4);
55.     GetFullPathNameA((LPCSTR)szDrvPath, MAX_PATH, (LPSTR)szDrvFullPath, NULL);
56.  
57.     iBuffLen = wsprintfA(szSubKey, "\\??\\%s", szDrvFullPath);
58.     szSubKey[iBuffLen] = 0;
59.     dwOK = RegSetValueExA(hkResult, (LPCSTR)"ImagePath", 0, 1, (BYTE*)szSubKey, iBuffLen);
60.     if (dwOK != ERROR_SUCCESS)
61.         return false;
62.     RegCloseKey(hkResult);
63.     iBuffLen = wsprintfA(szSubKey, "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\%s", szDrvName);
64.     szSubKey[iBuffLen] = 0;
65.     buf2.Buffer = (PVOID)szSubKey;
66.     buf2.Length = iBuffLen;
67.     RtlAnsiStringToUnicodeString(&buf1, &buf2, 1);
68.     dwOK = ZwLoadDriver(&buf1);
69.     RtlFreeUnicodeString(&buf1);
70.     iBuffLen = wsprintfA(szSubKey, "%s%s\\Enum", "System\\CurrentControlSet\\Services\\", szDrvName);
71.     szSubKey[iBuffLen] = 0;
72.     RegDeleteKeyA(HKEY_LOCAL_MACHINE, (LPCSTR)szSubKey);
73.     iBuffLen = wsprintfA(szSubKey, "%s%s\\Security", "System\\CurrentControlSet\\Services\\", szDrvName);
74.     szSubKey[iBuffLen] = 0;
75.     RegDeleteKeyA(HKEY_LOCAL_MACHINE, (LPCSTR)szSubKey);
76.     iBuffLen = wsprintfA(szSubKey, "%s%s", "System\\CurrentControlSet\\Services\\", szDrvName);
77.     szSubKey[iBuffLen] = 0;
78.     RegDeleteKeyA(HKEY_LOCAL_MACHINE, (LPCSTR)szSubKey);
79.     iBuffLen = wsprintfA(szSubKey, "\\\\.\\%s", szDrvName);
80.     szSubKey[iBuffLen] = 0;
81.     return true;
82. }
83.  
84. BOOLEAN GetPrivilege(ULONG PrivilegeValue, BOOLEAN Enable)
85. {
86.     BOOLEAN OldVal;
87.     typedef DWORD(WINAPI *pRtlAdjustPrivilege)(ULONG, BOOLEAN, BOOLEAN, PBOOLEAN);
88.     pRtlAdjustPrivilege RtlAdjustPrivilege = (pRtlAdjustPrivilege)GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlAdjustPrivilege");
89.  
90.     if (RtlAdjustPrivilege)
91.         return (RtlAdjustPrivilege(PrivilegeValue, Enable, FALSE, &OldVal) == 0);
92.     else
93.         return FALSE;
94. }
95. int entry()
96. {
97.     GetPrivilege(SE_LOAD_DRIVER_PRIVILEGE, TRUE);
98.  
99.     HMODULE hNtdll = NULL;
100.     hNtdll = LoadLibrary("ntdll.dll");
101.     if (!hNtdll)
102.     {
103.  
104.         return false;
105.     }
106.     RtlAnsiStringToUnicodeString = (RTLANSISTRINGTOUNICODESTRING)
107.         GetProcAddress(hNtdll, "RtlAnsiStringToUnicodeString");
108.     RtlFreeUnicodeString = (RTLFREEUNICODESTRING)
109.         GetProcAddress(hNtdll, "RtlFreeUnicodeString");
110.     ZwLoadDriver = (ZWLOADDRIVER)
111.         GetProcAddress(hNtdll, "ZwLoadDriver");
112.     if (LoadDriver("WinDrv", "C:\\Users\\Admin\\Desktop\\drv1.sys") == false) return false;
113.     return true;
114.     return 0;
115. }

 

Как именно "не работает"?
Сам по себе дров работает, если стартануть иначе (через sc create.. ) ?

 

нате вам тру-код, хакиры

Код (Text):

1.  
2. sc create MyDriver1 type= kernel binPath= D:\MyDriver1.sys
3. sc start MyDriver1
4. sc stop MyDriver1
5. sc delete MyDriver1
6.