windows 驱动中使用ksecdd.sys 支持的加密操作

最新推荐文章于 2025-09-06 11:55:51 发布

原创最新推荐文章于 2025-09-06 11:55:51 发布 · 1.5k 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

windows inners 专栏收录该内容

40 篇文章

订阅专栏

本文介绍了如何在驱动程序中利用CNG (Cryptographic Next Generation) API创建SHA1哈希，包括函数声明、内存管理以及关键步骤的详细代码示例，适合对驱动开发中加密操作感兴趣的开发者参考。

参考：关于 cng 介绍，链接：About CNG - Win32 apps | Microsoft Docs

使用 cng 创建hash 例子，链接：Creating a Hash with CNG - Win32 apps | Microsoft Docs

上面是介绍如何在应用层使用加密操作，实际上在驱动中和应用层的接口是通用的。下面介绍如何修改一下，方便在驱动编程中使用其提供的接口。

1，首先，各类函数声明，变量的定义等在bcrypt.h 头文件中，所以应该要"#include<bcrypt.h>"

2,其次，程序链接的时候需要用到静态库 ksecdd.lib,这个也需要导入。需要在工程配置中设置：

项目属性>链接器>输入>附加依赖项中添加 ksecdd.lib 的全路径(我的是：C:\Program Files (x86)\Windows Kits\10\lib\10.0.19041.0\km\x64\ksecdd.lib )

如下图：

编译后的驱动文件的导入表如下图：

下面是上面例子修改后

NTSTATUS SHA1(PVOID data,ULONG length,PVOID result)
{
    BCRYPT_ALG_HANDLE       hAlg = NULL;
    BCRYPT_HASH_HANDLE      hHash = NULL;
    NTSTATUS                status = STATUS_UNSUCCESSFUL;
    ULONG                   cbData = 0, cbHash = 0,cbHashObject = 0;
    PBYTE                   pbHashObject = NULL;
    PBYTE                   pbHash = NULL;
    ULONG                   i = 0;

    UNREFERENCED_PARAMETER(data);
    UNREFERENCED_PARAMETER(length);
    UNREFERENCED_PARAMETER(result);

    //open an algorithm handle
    if (!NT_SUCCESS(status = BCryptOpenAlgorithmProvider(
        &hAlg,
        BCRYPT_SHA256_ALGORITHM,
        NULL,
        0)))
    {
        DbgPrint("**** Error 0x%x returned by BCryptOpenAlgorithmProvider\n", status);
        goto Cleanup;
    }

    //calculate the size of the buffer to hold the hash object
    if (!NT_SUCCESS(status = BCryptGetProperty(
        hAlg,
        BCRYPT_OBJECT_LENGTH,
        (PBYTE)&cbHashObject,
        sizeof(ULONG),
        &cbData,
        0)))
    {
        DbgPrint("**** Error 0x%x returned by BCryptGetProperty\n", status);
        goto Cleanup;
    }

    //allocate the hash object on the heap
    pbHashObject = (PBYTE)ExAllocatePool(NonPagedPool,cbHashObject);
    if (NULL == pbHashObject)
    {
        DbgPrint("**** memory allocation failed\n");
        goto Cleanup;
    }

    //calculate the length of the hash
    if (!NT_SUCCESS(status = BCryptGetProperty(
        hAlg,
        BCRYPT_HASH_LENGTH,
        (PBYTE)&cbHash,
        sizeof(ULONG),
        &cbData,
        0)))
    {
        DbgPrint("**** Error 0x%x returned by BCryptGetProperty\n", status);
        goto Cleanup;
    }

    //allocate the hash buffer on the heap
    pbHash = (PBYTE)ExAllocatePool(NonPagedPool,cbHash);
    if (NULL == pbHash)
    {
        DbgPrint("**** memory allocation failed\n");
        goto Cleanup;
    }

    //create a hash
    if (!NT_SUCCESS(status = BCryptCreateHash(
        hAlg,
        &hHash,
        pbHashObject,
        cbHashObject,
        NULL,
        0,
        0)))
    {
        DbgPrint("**** Error 0x%x returned by BCryptCreateHash\n", status);
        goto Cleanup;
    }


    //hash some data
    if (!NT_SUCCESS(status = BCryptHashData(
        hHash,
        (PBYTE)rgbMsg,
        sizeof(rgbMsg),
        0)))
    {
        DbgPrint("**** Error 0x%x returned by BCryptHashData\n", status);
        goto Cleanup;
    }

    //close the hash
    if (!NT_SUCCESS(status = BCryptFinishHash(
        hHash,
        pbHash,
        cbHash,
        0)))
    {
        DbgPrint("**** Error 0x%x returned by BCryptFinishHash\n", status);
        goto Cleanup;
    }
    else
    {
        //打印 'abc'  的sha1 摘要数据
        while (i < cbHash)
        {
            DbgPrint("%x ", (pbHash[i++]));
        }
    }

    DbgPrint("Success!\n");

Cleanup:

    if (hAlg)
    {
        BCryptCloseAlgorithmProvider(hAlg, 0);
    }

    if (hHash)
    {
        BCryptDestroyHash(hHash);
    }

    if (pbHashObject)
    {
       ExFreePool(pbHashObject);
    }

    if (pbHash)
    {
        ExFreePool(pbHash);
    }
    return status;
}