ATAPI（磁盘端口驱动）级文件保护简单实现

最新推荐文章于 2024-05-23 17:01:09 发布

iiprogram

最新推荐文章于 2024-05-23 17:01:09 发布

阅读量1.2k

点赞数

分类专栏： windows底层核心編程文章标签：磁盘 object io

本文链接：https://blog.csdn.net/iiprogram/article/details/2349093

版权

windows底层核心編程专栏收录该内容

743 篇文章 19 订阅

订阅专栏

define IoGetIrpStackLocation( Irp , Level) (/
(Irp)->Tail.Overlay.CurrentStackLocation + Level )
BOOL IfIrpHasFobj(PIRP pIrp , LPCWSTR FileName)
{
ULONG i , j ;
PIO_STACK_LOCATION irpStack ;
PVOID NamePool ;

for ( i = 0 ; i < (ULONG)(pIrp->StackCount - pIrp->CurrentLocation + 1) ; i ++)
{
irpStack = IoGetIrpStackLocation(pIrp , i );
if (irpStack->FileObject)
{
if (irpStack->FileObject->FileName.Buffer)
{
NamePool = ExAllocatePool(NonPagedPool , irpStack->FileObject->FileName.Length + 2);
if (NamePool)
{
KDMSG(("%ws" , irpStack->FileObject->FileName.Buffer));
RtlCopyMemory(NamePool ,
irpStack->FileObject->FileName.Buffer ,
irpStack->FileObject->FileName.Length + 2);
_wcsupr((wchar_t*)NamePool);
if (wcsstr((wchar_t*)NamePool , FileName))
{
ExFreePool(NamePool);
return TRUE ;
}

ExFreePool(NamePool);
}

}
}

}
return FALSE ;
}

NTSTATUS ProxyAtapiScsi(PDEVICE_OBJECT devobj , PIRP pIrp)
{
NTSTATUS stat ;
if (IfIrpHasFobj(pIrp , L"123.TXT"))
{
pIrp->IoStatus.Status = 0xc0000001;
pIrp->IoStatus.Information = 0 ;

IoCompleteRequest(pIrp , IO_NO_INCREMENT);
return 0xc0000001;
}

__asm
{
push pIrp
push devobj
call OldAtapiScsiDispatch
mov stat ,eax
}
return stat ;
}