驱动开发之二:尝试挂接file system

转载 2006年06月15日 11:18:00

hookfilesystem.c

代码
//尝试挂接file system

 


#include "Hookfilesystem.h"


HANDLE        hFileHandle;
OBJECT_ATTRIBUTES        ObjectAttrib;
PDEVICE_OBJECT        pFileDeviceObject;


struct _DRIVER_OBJECT *pDeviceObject;


PDRIVER_DISPATCH RealCreateDispatch;


NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject ,IN PUNICODE_STRING RegistryPath)
{
        UNICODE_STRING        uninameString,unilinkString;
        NTSTATUS        ntStatus;
        PDEVICE_OBJECT        pDeviceObject;
       
        RtlInitUnicodeString(&uninameString,L"//Device//Shadow3");
       
        ntStatus = IoCreateDevice(DriverObject,
        0,
        &uninameString,
        FILE_DEVICE_UNKNOWN,
        0,
        TRUE,
        &pDeviceObject
        );
                                                                                                               
        if(!NT_SUCCESS(ntStatus))        //如果创建设备失败,则直接退出
                return ntStatus;
               
        //创建Win32可见的符号连接
        RtlInitUnicodeString( &unilinkString, L"//DosDevices//shadow3" );
       
        ntStatus = IoCreateSymbolicLink(&unilinkString ,&uninameString);
        if(!NT_SUCCESS(ntStatus))
        {
                return ntStatus;       
        }
       
        //设置Dispatch
        DriverObject->MajorFunction[IRP_MJ_CREATE] = DriverDispatch;
        DriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverDispatch;
        //设置Unload
        DriverObject->DriverUnload = DriverUnload;
        //Hook File System
        HookFileSystem();
       
        return 0;       
}


NTSTATUS
DriverDispatch(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    )
{
               
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest (Irp,IO_NO_INCREMENT);
    return Irp->IoStatus.Status;
}


void DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
                UNICODE_STRING uniNameString;
               
                RtlInitUnicodeString(&uniNameString, L"//DosDevices//shadow3");
                IoDeleteSymbolicLink(&uniNameString);        //删除win32可见
                IoDeleteDevice(pDriverObject->DeviceObject);        //删除设备
               
                return ;
}


void HookFileSystem(void)
{
        UNICODE_STRING uniDeviceName;
        NTSTATUS        Ntstatus;
        IO_STATUS_BLOCK IoStatusBlock;
        PVOID pFileObject;
       
        RtlInitUnicodeString(&uniDeviceName ,L"//DosDevices//C://");
       
        InitializeObjectAttributes(&ObjectAttrib ,&uniDeviceName ,OBJ_CASE_INSENSITIVE, NULL, NULL);
        //打开一个设备
        Ntstatus = ZwCreateFile(
                                &hFileHandle,
                                SYNCHRONIZE|FILE_ANY_ACCESS,
                                &ObjectAttrib,
                                &IoStatusBlock,
                                0,
                                0,
                                FILE_SHARE_READ|FILE_SHARE_WRITE,
                                FILE_OPEN,
                                FILE_SYNCHRONOUS_IO_NONALERT|FILE_DIRECTORY_FILE,
                                0,
                                0
                                );
                                                       
        if(!NT_SUCCESS(Ntstatus))
        {
                DbgPrint("ZwCreateFile Failed,ntstatus:%ld/n",Ntstatus);       
                return;
        }
       
        //通过文件句柄得到与之向对应的文件对象
        Ntstatus = ObReferenceObjectByHandle(hFileHandle,FILE_READ_DATA,0,0,&pFileObject,NULL);
        if(!NT_SUCCESS(Ntstatus))
        {
                ZwClose(hFileHandle);
                DbgPrint("ObReferenceObjectByHandle Failed,ntstatus:%ld/n",Ntstatus);       
                return;
        }
       
        //在通过该文件对象查找相对应的文件设备
        pFileDeviceObject = IoGetRelatedDeviceObject(pFileObject);
        //文件对象引用计数器减一
        ObDereferenceObject(pFileObject);
        ZwClose(hFileHandle);
       
        if(pFileDeviceObject==NULL)
        {
                DbgPrint("Get File Object Failed/n");               
                return ;
        }
       
        pDeviceObject = pFileDeviceObject->DriverObject;
       
        if(pDeviceObject->MajorFunction[IRP_MJ_CREATE] == HookCreateDispatch)
        {
                DbgPrint("already hook IRP_MJ_CREATE/n");       
                return ;
        }
       
        //保存IRP_MJ_CREATE处理的地址
        RealCreateDispatch = pDeviceObject->MajorFunction[IRP_MJ_CREATE];
       
        //Hook Create DisPatch
        pDeviceObject->MajorFunction[IRP_MJ_CREATE] = HookCreateDispatch;
       
        return;       
}


NTSTATUS
HookCreateDispatch(   
                IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    )
{
        // DbgPrint("hook success/r/n");
        PIO_STACK_LOCATION        pIocurrentstack;
        PFILE_OBJECT pFileObject;
       
        DbgPrint("DeviceName:%S/r/n",DeviceObject->DriverObject->DriverName.Buffer);
       
       
        pIocurrentstack = IoGetCurrentIrpStackLocation(Irp);
       
        pFileObject = pIocurrentstack->FileObject;
       
        DbgPrint("FileName:%S/r/n",pFileObject->FileName.Buffer);
       
        _asm
        {
                push Irp
                push DeviceObject
                call RealCreateDispatch       
        }
       
        return 0;       
}

 

hookfilesystem.h

 

代码
#ifndef _INCLUDE_
#define _INCLUDE_

 


#include <ntddk.h>


NTSTATUS
DriverDispatch(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    );
   
void DriverUnload(IN PDRIVER_OBJECT DriverObject);


void HookFileSystem(void);


NTSTATUS
HookCreateDispatch(   
                IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    );


#endif

相关文章推荐

驱动开发之二:尝试挂接file system

hookfilesystem.c 代码 //尝试挂接file system   #include "Hookfilesystem.h" HANDLE ...

驱动开发之二 --- 输入输出控制 【译文】

驱动开发之二 --- 输入输出控制 【译文】 理论: 这是驱动开发的第二篇,在上篇中讲述了如何创建一个简单的设备驱动程序,为了突出重点,有些细节的东西略过了,这些将在本篇中进行详细介绍...

用户故事驱动开发系列之二:用户故事的妙处

敏用户故事驱动开发系列之二:用户故事的妙处   本文是用户故事驱动开发系列的第二篇,在于探讨用户故事的妙处。   传统IEEE 830需求模式         我们还在上大学时,那时课本上是...

尝试使用espresso实现Android的测试驱动开发

Android测试驱动开发

linux驱动开发之字符设备框架 - file_operations

在上一节中介绍了字符设备的重要结构体 cdev,以及和 cdev 相关的一些操作函数,比如cdev_alloc()、 cdev_init() 等,但是和 cdev_init() 密切相关的一个参数 f...

实验驱动开发与响应式编程 ---- File Watcher的技术实现

File Watcher,是由wenzhe本人开发的一个文件监控工具(见:File Watcher,不只是一个工具),关于它的具体需求以及需求分析过程,请参加wenzhe本人的另一篇文章: 基于领域特...

【Discuz】打开网站提示Oops! System file lost: class/class_mysqli.php无法进入论坛与输入密码错误多次被禁止尝试

一、打开网站提示Oops! System file lost: class/class_mysqli.php无法进入论坛 打开Discuz工程,出现Oops! System file lost: cl...

Windows 驱动开发资源链接

0 https://msdn.microsoft.com/zh-cn/library/ff554845(v=VS.85).aspx 使用 WDK 示例 http://www.micr...
内容举报
返回顶部
收藏助手
不良信息举报
您举报文章:驱动开发之二:尝试挂接file system
举报原因:
原因补充:

(最多只允许输入30个字)