之前写的方法,都比较不正规,这次采用设备过滤器来拦截命名管道的创建和打开,下面是效果图
代码:
#include "ntifs.h"
typedef struct
{
PDEVICE_OBJECT LowerDeviceObject;
}DEVICE_EXTENSION,*PDEVICE_EXTENSION;
PDEVICE_OBJECT g_MyFilterDevice = NULL;
void DriverUnload(PDRIVER_OBJECT DriverObject)
{
DbgPrint("Npfs Filter Driver Unloadiang\n");
if (g_MyFilterDevice)
{
IoDetachDevice(((PDEVICE_EXTENSION)DriverObject->DeviceObject->DeviceExtension)->LowerDeviceObject);
IoDeleteDevice(g_MyFilterDevice);
g_MyFilterDevice = NULL;
}
}
NTSTATUS CommonDispath(PDEVICE_OBJECT Device, PIRP Irp)
{
// Only thing to do with this routine is passing the Irp to Next Level
IoCopyCurrentIrpStackLocationToNext(Irp);
return IoCallDriver(((PDEVICE_EXTENSION)Device->DeviceExtension)->LowerDeviceObject, Irp);
}
NTSTATUS FilterCreateNamedPipeCompletion(PDEVICE_OBJECT Device, PIRP Irp, PVOID Context)
{
UNREFERENCED_PARAMETER(Device);
UNREFERENCED_PARAMETER(Context);
if (Irp->IoStatus.Status == STATUS_SUCCESS)
{
DbgPrint("FilterCreateNamedPipeCompletion success\n");
}
if (Irp->PendingReturned)
{
IoMarkIrpPending(Irp);
}
return Irp->IoStatus.Status;
}
NTSTATUS FilterCreateRoutine(PDEVICE_OBJECT Device, PIRP Irp)
{
IoCopyCurrentIrpStackLocationToNext(Irp);
PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(Irp);
DbgPrint("Openning NamedPipe:%wZ\n", &Stack->FileObject->FileName);
return IoCallDriver(((PDEVICE_EXTENSION)Device->DeviceExtension)->LowerDeviceObject, Irp);
}
NTSTATUS FilterCreateNamedPipeRoutine(PDEVICE_OBJECT Device, PIRP Irp)
{
IoCopyCurrentIrpStackLocationToNext(Irp);
// Do what we want here.
// Set an CompletionRoutine when the IRP finished and returned from the actual Deivce.
// so that we can gain the result of our interested content.
//IoSetCompletionRoutine(Irp, FilterCreateNamedPipeCompletion, NULL, TRUE, FALSE, FALSE);
PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(Irp);
DbgPrint("Creating NamedPipe:%wZ\n",&Stack->FileObject->FileName);
return IoCallDriver(((PDEVICE_EXTENSION)Device->DeviceExtension)->LowerDeviceObject, Irp);
}
NTSTATUS InitAttachDevice(PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING TargetName = RTL_CONSTANT_STRING(L"\\Device\\NamedPipe");
// 1st, we need to create our filter device object.
// 2st, using IoCraeteDevice to Attach our DeviceObject to NPFS DeviceObject
NTSTATUS Status = STATUS_UNSUCCESSFUL;
do
{
Status = IoCreateDevice(DriverObject, sizeof(DEVICE_EXTENSION), NULL, FILE_DEVICE_UNKNOWN, 0, FALSE, &g_MyFilterDevice);
if (!NT_SUCCESS(Status))
{
DbgPrint("IoCreateDevice Failed! Status:0x%08x\n", Status);
break;
}
g_MyFilterDevice->Flags |= DO_BUFFERED_IO;
g_MyFilterDevice->Flags &= ~DO_DEVICE_INITIALIZING;
RtlZeroMemory(g_MyFilterDevice->DeviceExtension, sizeof(DEVICE_EXTENSION));
Status = IoAttachDevice(g_MyFilterDevice, &TargetName, &((PDEVICE_EXTENSION)g_MyFilterDevice->DeviceExtension)->LowerDeviceObject);
if (!NT_SUCCESS(Status))
{
IoDeleteDevice(g_MyFilterDevice);
g_MyFilterDevice = NULL;
DbgPrint("IoAttachDevice Failed! Status:0x%08x\n", Status);
break;
}
} while (0);
return Status;
}
EXTERN_C_START
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
UNREFERENCED_PARAMETER(RegistryPath);
NTSTATUS Status = STATUS_UNSUCCESSFUL;
for (int i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
{
DriverObject->MajorFunction[i] = CommonDispath;
}
DriverObject->MajorFunction[IRP_MJ_CREATE_NAMED_PIPE] = FilterCreateNamedPipeRoutine;
DriverObject->MajorFunction[IRP_MJ_CREATE] = FilterCreateRoutine;
DriverObject->DriverUnload = DriverUnload;
Status = InitAttachDevice(DriverObject);
if (!NT_SUCCESS(Status))
{
DbgPrint("InitAttachDevice Failed! Status:0x%08x\n",Status);
return Status;
}
return STATUS_SUCCESS;
}
EXTERN_C_END