Driver patching / filter driver

[cAtA]

If you know what to patch, patch it.
If is a signed driver you'll get an annoying message when you'll reinstall it.
But the only operation you have to do to make work after patching is to correct header CRC.

See below how to do it:

unit UpdateCRC;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls;

type
TForm1 = class(TForm)
Edit1: TEdit;
Button1: TButton;
OpenDialog1: TOpenDialog;
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;

var
Form1: TForm1;
oldsum:dword;
ImageHlpHandle: THandle;
CheckSumMappedFile: function(BaseAddress: Pointer; FileLength: DWORD;
var HeaderSum: DWORD; var CheckSum: DWORD): PImageNtHeaders; stdcall;

implementation

{$R *.dfm}
function CalcChecksum(const FileHandle: THandle): DWORD;
var
Size: DWORD;
H: THandle;
M: Pointer;
//OldSum: DWORD;
begin
Size := GetFileSize(FileHandle, nil);
H := CreateFileMapping(FileHandle, nil, PAGE_READONLY, 0, Size, nil);
if H = 0 then
RaiseLastOSError;
try
M := MapViewOfFile(H, FILE_MAP_READ, 0, 0, Size);
if M = nil then
RaiseLastOSError;
try
Win32Check(CheckSumMappedFile(M, Size, OldSum, Result) <> nil);
finally
UnmapViewOfFile(M);
end;
finally
CloseHandle(H);
end;
end;

procedure UpdateChecksum(const FileHandle: THandle;CRC:dword);
var
DosHeader:PImageDosHeader;
NtHeader:PImageNtHeaders;
_lfanew:dword;
Size: DWORD;
H: THandle;
M: Pointer;
begin
Size := GetFileSize(FileHandle, nil);
H := CreateFileMapping(FileHandle, nil, PAGE_READWRITE, 0, Size, nil);
if H = 0 then
RaiseLastOSError;
try
M := MapViewOfFile(H,FILE_MAP_ALL_ACCESS, 0, 0, Size);
if M = nil then
RaiseLastOSError;
try
with PImageDosHeader(M)^ do begin
if not e_magic = IMAGE_DOS_SIGNATURE then begin
ShowMessage('unrecognized file format');
exit;
end;
NTHeader := PIMAGENTHEADERS(dword(M) + _lfanew);
end;
with NTHeader^ do begin
if Signature <> IMAGE_NT_SIGNATURE then begin
ShowMessage('Not a PE (WIN32 Executable');
exit;
end;
NTheader.OptionalHeader.CheckSum:=CRC;
end;
finally
UnmapViewOfFile(M);
end;
finally
CloseHandle(H);
end;
end;

procedure TForm1.Button1Click(Sender: TObject);
var
FileName:string;
hFile:dword;
CheckSum:dword;
begin
ImageHlpHandle := LoadLibrary('imagehlp.dll');
if ImageHlpHandle = 0 then begin
ShowMessage('Can''t load imagehlp.dll');
exit;
end;
CheckSumMappedFile := GetProcAddress(ImageHlpHandle, 'CheckSumMappedFile');
if @CheckSumMappedFile = nil then begin
ShowMessage('Can''t find function');
exit;
end;
OpenDialog1.InitialDir:='C:\a';
if OpenDialog1.Execute then begin
FileName:=OpenDialog1.FileName;
Edit1.Text:=FileName;
hFile:=FileOpen(FileName,fmOpenReadWrite);
CheckSum := CalcChecksum(hFile);
ShowMessage(Format('CRC=%X, old=%X',[checksum,oldsum]));
UpdateChecksum(hFile,CheckSum);
CheckSum := CalcChecksum(hFile);
ShowMessage(Format('CRC=%X, old=%X',[checksum,oldsum]));
FileClose(hFile);
end;

end;

end.