Unit DriverCommands;

{
  Tento soubor implementuje rutiny pro praci s ovladacem
  syscallmon.sys. Jedna se o instalaci, nacteni do jadra,
  a ziskani informaci o jednom probehlem systemovem
  volani.

  Ovladac nelze dynamicky uvolnit z pameti, tudiz tento soubor
  disponuje pouze rutinou pro jeho odinstalovani.
}

Interface

Uses
  Windows;

Type
  // Polozka obsahujici informace o jednom probehlem systemovem
  // volani
  PSYSCALL_RECORD = ^SYSCALL_RECORD;
  SYSCALL_RECORD = Record
    Reserved : Int64;
    PID : THandle;
    TID : THandle;
    ServiceIndex : DWORD;
    Status : DWORD;
    Time : FILETIME;
    end;


Function SyscallmonDriverInit:Boolean;
Procedure SyscallmonDriverFinit;
Function SyscallmonDriverLoad:Boolean;
Function SyscallmonDriverStart:Boolean;
Function SyscallmonDriverStop:Boolean;
Function SyscallmonDriverGetEvent(SR:PSYSCALL_RECORD):Boolean;

Implementation

Uses
  SysUtils, Driver;

Const
  // Kody pozadavku IOCTL, ktere ovladac umi obsluhovat
  IOCTL_SYSCALLMON_GET_EVENT = $c07fc004;
  IOCTL_SYSCALLMON_START = $c07fc008;
  IOCTL_SYSCALLMON_STOP = $c07fc00C;

  IOCTL_START_INDEX = 0;
  IOCTL_STOP_INDEX = 1;
  IOCTL_GET_EVENT_INDEX = 2;

Function SyscallmonDriverInit:Boolean;
{
  Nainstaluje ovladac syscallmon.sys a inicializuje knihovnu pro
  praci s ovladaci, aby pracovala prave s timto ovladacem.
}
begin
Result := DriverInit('syscallmon', ExtractFilePath(ParamStr(0)) + 'syscallmon.sys', 'syscallmon', [IOCTL_SYSCALLMON_START, IOCTL_SYSCALLMON_STOP, IOCTL_SYSCALLMON_GET_EVENT]);
end;

Procedure SyscallmonDriverFinit;
{
  Odinstaluje ovladac syscallmon.sys.
}
begin
DriverFinit;
end;

Function SyscallmonDriverLoad:Boolean;
{
  Nacte ovladac szscallmon.szs do jadra a pripoji se k jeho
  komunikacnimu yariyeni.
}
begin
Result := DriverLoad;
If Result Then
  Result := DriverConnect;
end;

Function SyscallmonDriverStart:Boolean;
{
  Posle ovladaci syscallmon.sys pozadavek IOCTL, ktery mu
  prikazuje zahajit zaznamenavani systemovych volani.
}
begin
Result := DriverIOCTL(IOCTL_START_INDEX, Nil, 0, Nil, 0);
end;

Function SyscallmonDriverStop:Boolean;
{
  Posle ovladaci syscallmon.sys pozadavek na zastaveni zaznamenavani
  systemovych volani.
}
begin
Result := DriverIOCTL(IOCTL_STOP_INDEX, Nil, 0, Nil, 0);
end;

Function SyscallmonDriverGetEvent(SR:PSYSCALL_RECORD):Boolean;
{
  Posle ovladaci syscallmon.sys pozadavek na vraceni zaznamu o jednom
  systemovem volani. Obsah tohoto zaznamu se spravce I/O operaci
  pokusi zapsat na adresu v promenne SR.
}
begin
Result := DriverIOCTL(IOCTL_GET_EVENT_INDEX, Nil, 0, SR, SizeOf(SYSCALL_RECORD));
end;

End.
