Hook Npfs驱动对象Dispatch过滤创建和打开管道

通过Hook Npfs对象的Dispatch的IRP回调函数，达到过滤命名管道的需求，这种方式测试了WinXPsp3-win10_1909 都非常稳定！
效果图：

代码：

#include <ntifs.h>
#include <ntstrsafe.h>
#include <ntddkbd.h>


// Propertys
// ==============================================================================
extern POBJECT_TYPE* IoDriverObjectType;

NTKERNELAPI UCHAR* NTAPI PsGetProcessImageFileName(PEPROCESS process);

NTSTATUS ObReferenceObjectByName(
	PUNICODE_STRING ObjectName,
	ULONG Attributes,
	PACCESS_STATE AccessState,
	ACCESS_MASK DesiredAccess,
	POBJECT_TYPE ObjectType,
	KPROCESSOR_MODE AccessMode,
	PVOID ParseContext,
	PVOID* Object
);

#define DELAY_ONE_MICROSECOND (-10)
#define DELAY_ONE_MILLISECOND (DELAY_ONE_MICROSECOND*1000)
#define DELAY_ONE_SECOND (DELAY_ONE_MILLISECOND*1000);


// The Target Driver Object Name 
#define TARGET_DRIVER_NAME L"\\FileSystem\\Npfs"
PDRIVER_OBJECT g_pNpfs = NULL;

BOOLEAN IsHooked = FALSE;

PDRIVER_DISPATCH g_OriginalCreate = NULL;
PDRIVER_DISPATCH g_OriginalCreateNamedPipe = NULL;

NTSTATUS MyCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(Irp);
	DbgPrint("Openning NamedPipe:%wZ\n", &pStack->FileObject->FileName);
	return g_OriginalCreate(DeviceObject,Irp);
}

NTSTATUS MyCreateNamedPipe(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(Irp);
	DbgPrint("Creating NamedPipe:%wZ\n", &pStack->FileObject->FileName);

	return g_OriginalCreateNamedPipe(DeviceObject, Irp);
}

// 卸载函数
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
	if (g_pNpfs)
	{
		InterlockedExchangePointer(&g_pNpfs->MajorFunction[IRP_MJ_CREATE], g_OriginalCreate);
		InterlockedExchangePointer(&g_pNpfs->MajorFunction[IRP_MJ_CREATE_NAMED_PIPE], g_OriginalCreateNamedPipe);
		ObDereferenceObject(g_pNpfs);
		DbgPrint("Restore hook!\n");
	}
	KdPrint(("Driver unloaded!!!\n"));
}

//
NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT pDriverObject, _In_ PUNICODE_STRING RegistryPath)
{

	NTSTATUS status;
	KdPrint(("Enter DriverEntry!!\n"));

	pDriverObject->DriverUnload = DriverUnload;

	UNICODE_STRING uniNtNameString = {0};
	RtlInitUnicodeString(&uniNtNameString, TARGET_DRIVER_NAME);
	status = ObReferenceObjectByName(&uniNtNameString, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &g_pNpfs);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("Couldn't get the NPFS driver object \n"));
		return STATUS_UNSUCCESSFUL;
	}
	else
	{
		// Start Hooking
		g_OriginalCreate = InterlockedExchangePointer(&g_pNpfs->MajorFunction[IRP_MJ_CREATE],MyCreate);
		g_OriginalCreateNamedPipe = InterlockedExchangePointer(&g_pNpfs->MajorFunction[IRP_MJ_CREATE_NAMED_PIPE],MyCreateNamedPipe);
		DbgPrint("Hook: HOOK driver object! Success\n");
	}

	return status;
}