hook zwwritefile并得到写文件的路径

在这上面忙活了几天，终于不蓝屏了

//HookNtWriteFile

HookZwWriteFile(
IN HANDLE FileHandle, 
IN HANDLE Event OPTIONAL, 
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 
IN PVOID ApcContext OPTIONAL, 
OUT PIO_STATUS_BLOCK IoStatusBlock, 
IN PVOID Buffer, 
IN ULONG Length, 
IN PLARGE_INTEGER ByteOffset OPTIONAL, 
IN PULONG Key OPTIONAL 
)
{
if (TurnOnFileMon==1)//如果功能开启的话
{
PDEVICE_EXTENSION deviceExtension;//设备扩展
char ansiProcessName[PROCNAMELEN];
//UNICODE_STRING *volumeDosName;
WCHAR DelFullName[1024];
PCWSTR WriteFileName;
PFILE_OBJECT fileobj;
FILE_INFORMATION_CLASS FileInformationClass = FileNameInformation ;
if ( FileHandle != NULL)
{
NTSTATUS nts = STATUS_UNSUCCESSFUL;
//得到进程路径和进程名
UNICODE_STRING UniProcessPath,volumeDosName;
ANSI_STRING AnsiProcessPath,ansiProcessName1;
ANSI_STRING ansipath,apathpre;
UNICODE_STRING unipath,upathpre;
PCWSTR ProcessPath = GetCurrentProcessFileName();//进程路径
RtlInitUnicodeString(&UniProcessPath,ProcessPath);
RtlUnicodeStringToAnsiString(&AnsiProcessPath,&UniProcessPath,TRUE);
  
GetProcessName(ansiProcessName); //进程名
RtlInitAnsiString(&ansiProcessName1,ansiProcessName);

//KdPrint(("%s(%s)修改文件 \r\n",ansiProcessName,AnsiProcessPath.Buffer));
//  IO_STATUS_BLOCK iosb ={ 0,0 };
//  ANSI_STRING    ansiUndeleteFileName ;//
 // UNICODE_STRING usFileName ={ 0,0,0 }; //

if(NT_SUCCESS(ObReferenceObjectByHandle(FileHandle,GENERIC_READ,NULL,KernelMode,&fileobj,NULL)))
{
WriteFileName=fileobj->FileName.Buffer;
RtlInitUnicodeString(&unipath,WriteFileName);
RtlUnicodeStringToAnsiString(&ansipath,&unipath,TRUE);
if (wcscmp(WriteFileName,PreWriteFileName)!=0)
{
volumeDosName.Buffer = ExAllocatePool( PagedPool, 16);
volumeDosName.MaximumLength=8;
//RtlVolumeDeviceToDosName(fileobj-> DeviceObject, &volumeDosName); 
IoVolumeDeviceToDosName(fileobj->DeviceObject, &volumeDosName );
RtlInitUnicodeString(&upathpre,volumeDosName.Buffer);
RtlUnicodeStringToAnsiString(&apathpre,&upathpre,TRUE);
KdPrint(("%s(%s)修改文件  %s(%s) \r\n",ansiProcessName,AnsiProcessPath.Buffer,apathpre.Buffer,ansipath.Buffer));
ExFreePool(volumeDosName.Buffer);
}

//wcscpy(PreWriteFileName,WriteFileName);
//PreWriteFileName=WriteFileName;


ObDereferenceObject(fileobj);
RtlFreeAnsiString(&apathpre);
RtlFreeAnsiString(&ansipath);


}

//KdPrint(("%s(%s)修改文件 %s\r\n",ansiProcessName,AnsiProcessPath.Buffer,ansipath.Buffer));
/*
POBJECT_NAME_INFORMATION wFilePath;

if (NT_SUCCESS(ObReferenceObjectByHandle(FileHandle,0,NULL,KernelMode,&fileobj,NULL)))//获取文件对象
{            
if (IoQueryFileDosDeviceName(fileobj,&wFilePath)==STATUS_SUCCESS)  //获取文件对象所对应的文件Dos设备名称,即是全路径
{    
wcscpy(fullUniName.Buffer,wFilePath->Name.Buffer);
ExFreePool(wFilePath);  //IoQueryFileDosDeviceName获取的OBJECT_NAME_INFORMATION 需要手动释放    
}
ObDereferenceObject(fileobj);  //放弃对FileObject的引用
}
*/



RtlFreeAnsiString(&AnsiProcessPath);
  /*
  {

ANSI_STRING apath;
UNICODE_STRING upath;

ANSI_STRING apathpre;
UNICODE_STRING upathpre;
转换路径的结束




ObReferenceObjectByHandle(FileHandle,GENERIC_READ,*IoFileObjectType,KernelMode,(PVOID *)&fileobj,NULL);
WriteFileName=fileobj->FileName.Buffer;

// 此处转换 路径
RtlInitUnicodeString(&upath,WriteFileName);
RtlUnicodeStringToAnsiString(&apath,&upath,TRUE);


volumeDosName = ExAllocatePool( PagedPool, 512*2+2*sizeof(ULONG));
volumeDosName->MaximumLength = 512*2;
memset(volumeDosName,0,volumeDosName->MaximumLength); 

//IoVolumeDeviceToDosName(pFileObject->DeviceObject, &DosName);
if (wcscmp(WriteFileName,PreWriteFileName)!=0){
IoVolumeDeviceToDosName( ((PFILE_OBJECT)fileobj)->DeviceObject, volumeDosName );
if  (volumeDosName!=NULL)//应该是这里会蓝屏

{
// 此处转换 盘符
RtlInitUnicodeString(&upathpre,volumeDosName->Buffer);
RtlUnicodeStringToAnsiString(&apathpre,&upathpre,TRUE);


KdPrint(("%s(%s)修改文件:%s%s \r\n",aProcessName,aProcessPath.Buffer,apathpre.Buffer,apath.Buffer));

//填写设备扩展
deviceExtension=(PDEVICE_EXTENSION)g_pDriverObject->DeviceExtension;


strcpy(deviceExtension->ProcName,aProcessName);
strcpy(deviceExtension->ProcFullPath,aProcessPath.Buffer);
strcpy(deviceExtension->FilePre,apathpre.Buffer);
strcpy(deviceExtension->FilePath,apath.Buffer);

//通知应用层可以来取了
KeSetEvent(deviceExtension->FileEvent,0,FALSE);
KeClearEvent(deviceExtension->FileEvent);


PreWriteFileName=WriteFileName;
}
}
ExFreePool(volumeDosName);
ObDereferenceObject(fileobj);
  }*/
}
}

return RealZwWriteFile(
  FileHandle, 
  Event OPTIONAL, 
  ApcRoutine OPTIONAL, 
  ApcContext OPTIONAL, 
  IoStatusBlock, 
  Buffer, 
  Length, 
  ByteOffset OPTIONAL, 
  Key OPTIONAL 
  );
}