关闭

驱动开发之二:尝试挂接file system

标签: fileobjectstringattributessysteminclude
3122人阅读 评论(2) 收藏 举报
分类:

hookfilesystem.c

代码
//尝试挂接file system

 


#include "Hookfilesystem.h"


HANDLE        hFileHandle;
OBJECT_ATTRIBUTES        ObjectAttrib;
PDEVICE_OBJECT        pFileDeviceObject;


struct _DRIVER_OBJECT *pDeviceObject;


PDRIVER_DISPATCH RealCreateDispatch;


NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject ,IN PUNICODE_STRING RegistryPath)
{
        UNICODE_STRING        uninameString,unilinkString;
        NTSTATUS        ntStatus;
        PDEVICE_OBJECT        pDeviceObject;
       
        RtlInitUnicodeString(&uninameString,L"//Device//Shadow3");
       
        ntStatus = IoCreateDevice(DriverObject,
        0,
        &uninameString,
        FILE_DEVICE_UNKNOWN,
        0,
        TRUE,
        &pDeviceObject
        );
                                                                                                               
        if(!NT_SUCCESS(ntStatus))        //如果创建设备失败,则直接退出
                return ntStatus;
               
        //创建Win32可见的符号连接
        RtlInitUnicodeString( &unilinkString, L"//DosDevices//shadow3" );
       
        ntStatus = IoCreateSymbolicLink(&unilinkString ,&uninameString);
        if(!NT_SUCCESS(ntStatus))
        {
                return ntStatus;       
        }
       
        //设置Dispatch
        DriverObject->MajorFunction[IRP_MJ_CREATE] = DriverDispatch;
        DriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverDispatch;
        //设置Unload
        DriverObject->DriverUnload = DriverUnload;
        //Hook File System
        HookFileSystem();
       
        return 0;       
}


NTSTATUS
DriverDispatch(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    )
{
               
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest (Irp,IO_NO_INCREMENT);
    return Irp->IoStatus.Status;
}


void DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
                UNICODE_STRING uniNameString;
               
                RtlInitUnicodeString(&uniNameString, L"//DosDevices//shadow3");
                IoDeleteSymbolicLink(&uniNameString);        //删除win32可见
                IoDeleteDevice(pDriverObject->DeviceObject);        //删除设备
               
                return ;
}


void HookFileSystem(void)
{
        UNICODE_STRING uniDeviceName;
        NTSTATUS        Ntstatus;
        IO_STATUS_BLOCK IoStatusBlock;
        PVOID pFileObject;
       
        RtlInitUnicodeString(&uniDeviceName ,L"//DosDevices//C://");
       
        InitializeObjectAttributes(&ObjectAttrib ,&uniDeviceName ,OBJ_CASE_INSENSITIVE, NULL, NULL);
        //打开一个设备
        Ntstatus = ZwCreateFile(
                                &hFileHandle,
                                SYNCHRONIZE|FILE_ANY_ACCESS,
                                &ObjectAttrib,
                                &IoStatusBlock,
                                0,
                                0,
                                FILE_SHARE_READ|FILE_SHARE_WRITE,
                                FILE_OPEN,
                                FILE_SYNCHRONOUS_IO_NONALERT|FILE_DIRECTORY_FILE,
                                0,
                                0
                                );
                                                       
        if(!NT_SUCCESS(Ntstatus))
        {
                DbgPrint("ZwCreateFile Failed,ntstatus:%ld/n",Ntstatus);       
                return;
        }
       
        //通过文件句柄得到与之向对应的文件对象
        Ntstatus = ObReferenceObjectByHandle(hFileHandle,FILE_READ_DATA,0,0,&pFileObject,NULL);
        if(!NT_SUCCESS(Ntstatus))
        {
                ZwClose(hFileHandle);
                DbgPrint("ObReferenceObjectByHandle Failed,ntstatus:%ld/n",Ntstatus);       
                return;
        }
       
        //在通过该文件对象查找相对应的文件设备
        pFileDeviceObject = IoGetRelatedDeviceObject(pFileObject);
        //文件对象引用计数器减一
        ObDereferenceObject(pFileObject);
        ZwClose(hFileHandle);
       
        if(pFileDeviceObject==NULL)
        {
                DbgPrint("Get File Object Failed/n");               
                return ;
        }
       
        pDeviceObject = pFileDeviceObject->DriverObject;
       
        if(pDeviceObject->MajorFunction[IRP_MJ_CREATE] == HookCreateDispatch)
        {
                DbgPrint("already hook IRP_MJ_CREATE/n");       
                return ;
        }
       
        //保存IRP_MJ_CREATE处理的地址
        RealCreateDispatch = pDeviceObject->MajorFunction[IRP_MJ_CREATE];
       
        //Hook Create DisPatch
        pDeviceObject->MajorFunction[IRP_MJ_CREATE] = HookCreateDispatch;
       
        return;       
}


NTSTATUS
HookCreateDispatch(   
                IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    )
{
        // DbgPrint("hook success/r/n");
        PIO_STACK_LOCATION        pIocurrentstack;
        PFILE_OBJECT pFileObject;
       
        DbgPrint("DeviceName:%S/r/n",DeviceObject->DriverObject->DriverName.Buffer);
       
       
        pIocurrentstack = IoGetCurrentIrpStackLocation(Irp);
       
        pFileObject = pIocurrentstack->FileObject;
       
        DbgPrint("FileName:%S/r/n",pFileObject->FileName.Buffer);
       
        _asm
        {
                push Irp
                push DeviceObject
                call RealCreateDispatch       
        }
       
        return 0;       
}

 

hookfilesystem.h

 

代码
#ifndef _INCLUDE_
#define _INCLUDE_

 


#include <ntddk.h>


NTSTATUS
DriverDispatch(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    );
   
void DriverUnload(IN PDRIVER_OBJECT DriverObject);


void HookFileSystem(void);


NTSTATUS
HookCreateDispatch(   
                IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    );


#endif

0
0

查看评论
* 以上用户言论只代表其个人观点,不代表CSDN网站的观点或立场
    个人资料
    • 访问:187191次
    • 积分:2331
    • 等级:
    • 排名:第16610名
    • 原创:33篇
    • 转载:37篇
    • 译文:0篇
    • 评论:107条
    最新评论