文件加密标识 －隐藏文件头的黑客代码

//This module hooks:
// IRP_MJ_READ, IRP_MJ_WRITE, IRP_MJ_QUERY_INFORMATION,
// IRP_MJ_SET_INFORMATION, IRP_MJ_DIRECTORY_CONTROL,
// FASTIO_QUERY_STANDARD_INFO FASTIO_QUERY_BASIC_INFO FASTIO_READ(WRITE)
//to hide first N bytes of given file

extern "C" {
#include <ntddk.h>
}
#pragma hdrstop("InterceptIO.pch")

/
// Undocumented structures missing in ntddk.h

typedef struct _FILE_INTERNAL_INFORMATION { // Information Class 6
    LARGE_INTEGER FileId;
} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;

typedef struct _FILE_EA_INFORMATION { // Information Class 7
    ULONG EaInformationLength;
} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;

typedef struct _FILE_ACCESS_INFORMATION { // Information Class 8
    ACCESS_MASK GrantedAccess;
} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;

typedef struct _FILE_MODE_INFORMATION { // Information Class 16
    ULONG Mode;
} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;

typedef struct _FILE_ALLOCATION_INFORMATION { // Information Class 19
    LARGE_INTEGER AllocationSize;
} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;

typedef struct _FILE_DIRECTORY_INFORMATION {
    ULONG NextEntryOffset;
    ULONG FileIndex;
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    LARGE_INTEGER EndOfFile;
    LARGE_INTEGER AllocationSize;
    ULONG FileAttributes;
    ULONG FileNameLength;
    WCHAR FileName[1];
} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;

typedef struct _FILE_ALL_INFORMATION { // Information Class 18
    FILE_BASIC_INFORMATION BasicInformation;
    FILE_STANDARD_INFORMATION StandardInformation;
    FILE_INTERNAL_INFORMATION InternalInformation;
    FILE_EA_INFORMATION EaInformation;
    FILE_ACCESS_INFORMATION AccessInformation;
    FILE_POSITION_INFORMATION PositionInformation;
    FILE_MODE_INFORMATION ModeInformation;
    FILE_ALIGNMENT_INFORMATION AlignmentInformation;
    FILE_NAME_INFORMATION NameInformation;
} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;

typedef struct tag_QUERY_DIRECTORY
{
    ULONG Length;
    PUNICODE_STRING FileName;
    FILE_INFORMATION_CLASS FileInformationClass;
    ULONG FileIndex;
} QUERY_DIRECTORY, *PQUERY_DIRECTORY;

#pragma pack(push, 4)

typedef struct tag_FQD_SmallCommonBlock
{
    ULONG NextEntryOffset;
    ULONG FileIndex;
} FQD_SmallCommonBlock, *PFQD_SmallCommonBlock;

typedef struct tag_FQD_FILE_ATTR
{
    TIME CreationTime;
    TIME LastAccessTime;
    TIME LastWriteTime;
    TIME ChangeTime;
    LARGE_INTEGER EndOfFile;
    LARGE_INTEGER AllocationSize;
    ULONG FileAttributes;
} FQD_FILE_ATTR, *PFQD_FILE_ATTR;

typedef struct tag_FQD_CommonBlock
{
    FQD_SmallCommonBlock SmallCommonBlock;
    FQD_FILE_ATTR FileAttr;
    ULONG FileNameLength;
} FQD_CommonBlock, *PFQD_CommonBlock;

typedef struct _KFILE_DIRECTORY_INFORMATION
{
    FQD_CommonBlock CommonBlock;
   
    WCHAR FileName[ANYSIZE_ARRAY];
} KFILE_DIRECTORY_INFORMATION, *PKFILE_DIRECTORY_INFORMATION;

typedef struct _KFILE_FULL_DIR_INFORMATION
{
    FQD_CommonBlock CommonBlock;
   
    ULONG EaSize;
    WCHAR FileName[ANYSIZE_ARRAY];
} KFILE_FULL_DIR_INFORMATION, *PKFILE_FULL_DIR_INFORMATION;

typedef struct _KFILE_BOTH_DIR_INFORMATION
{
    FQD_CommonBlock CommonBlock;
   
    ULONG EaSize;
    USHORT ShortFileNameLength;
    WCHAR ShortFileName[12];
    WCHAR FileName[ANYSIZE_ARRAY];
} KFILE_BOTH_DIR_INFORMATION, *PKFILE_BOTH_DIR_INFORMATION;

#pragma pack(pop)

/
// Global variables
PDRIVER_OBJECT pDriverObject;
PDRIVER_DISPATCH OldReadDisp, OldWriteDisp, OldQueryDisp, OldSetInfoDisp, OldDirCtlDisp;
PFAST_IO_READ OldFastIoReadDisp;
PFAST_IO_WRITE OldFastIoWriteDisp;
PFAST_IO_QUERY_STANDARD_INFO OldFastIoQueryStandartInfoDisp;

//Size of our file's Invisible Part (in bytes)
ULONG InvisiblePartSize = 10;
//File, part of which we want to hide
wchar_t OurFileName[] = L"testing.fil";

//Size of OurFileName in bytes, excluding null terminator
ULONG OurFileNameLen = sizeof(OurFileName) - sizeof(wchar_t);


/
// Functions

//Function returns true if FN matches OurFileName
bool ThisIsOurFile(PUNICODE_STRING FN)
{
    return ((FN->Buffer) &&
        (FN->Length >= OurFileNameLen) &&
        _wcsnicmp((wchar_t*)((char*)FN->Buffer + FN->Length - OurFileNameLen),
        OurFileName, OurFileNameLen/2)==0);
}

//Structure used to track IRPs which completion must be handled
struct s_ComplRtnTrack
{
    PIO_COMPLETION_ROUTINE CompletionRoutine;
    PVOID Context;
    //When CompletionRoutine is called, flags corresponds to InvokeOn*
    UCHAR Control;
    PIO_STACK_LOCATION CISL;
    FILE_INFORMATION_CLASS FileInformationClass;
    PVOID Buffer;
};

//Function set new CompletionRoutine, InvokeOnSuccess flag,
//and copies original fields to Context
void HookIrpCompletion(PIO_STACK_LOCATION CISL,
                      PIO_COMPLETION_ROUTINE CompletionRoutine,
                      PVOID Buffer,
                      FILE_INFORMATION_CLASS FileInformationClass)
{
    s_ComplRtnTrack* NewContext =
        (s_ComplRtnTrack*)ExAllocatePool(NonPagedPool, sizeof(s_ComplRtnTrack));
    NewContext->CompletionRoutine = CISL->CompletionRoutine;
    NewContext->Context = CISL->Context;
    NewContext->Control = CISL->Control;
    NewContext->CISL = CISL;
    //Since CISL.Parameters unavailabile in IrpCompletion handler,
    //let's save all necessary data in Context structure
    NewContext->FileInformationClass = FileInformationClass;
    NewContext->Buffer = Buffer;
    CISL->CompletionRoutine = CompletionRoutine;
    CISL->Context = NewContext;
    CISL->Control |= SL_INVOKE_ON_SUCCESS;
}

//Function handles IRP completion
NTSTATUS NewComplRtn (
                      IN PDEVICE_OBJECT DeviceObject,
                      IN PIRP Irp,
                      s_ComplRtnTrack* CXT)
{
    //Handle different types of IRP
    switch (CXT->CISL->MajorFunction)
    {
    case IRP_MJ_QUERY_INFORMATION:
        _asm int 3;
        //ThisIsOurFile is already tested
        switch (CXT->FileInformationClass)
        {
            //In all cases modify CurrentByteOffset and/or size (EndOfFile)
            //to hide first InvisiblePartSize bytes
        case FilePositionInformation:
            ((PFILE_POSITION_INFORMATION)CXT->Buffer)->CurrentByteOffset.QuadPart -= InvisiblePartSize;
            break;
        case FileEndOfFileInformation:
            ((PFILE_END_OF_FILE_INFORMATION)CXT->Buffer)->EndOfFile.QuadPart -= InvisiblePartSize;
            break;
        case FileStandardInformation:
            ((PFILE_STANDARD_INFORMATION)CXT->Buffer)->EndOfFile.QuadPart -= InvisiblePartSize;
            break;
        case FileAllocationInformation:
            ((PFILE_ALLOCATION_INFORMATION)CXT->Buffer)->AllocationSize.QuadPart -= InvisiblePartSize;
            break;
        case FileAllInformation:
            ((PFILE_ALL_INFORMATION)CXT->Buffer)->PositionInformation.CurrentByteOffset.QuadPart -= InvisiblePartSize;
            ((PFILE_ALL_INFORMATION)CXT->Buffer)->StandardInformation.EndOfFile.QuadPart -= InvisiblePartSize;
            break;
        }
        case IRP_MJ_DIRECTORY_CONTROL:
            //Get a pointer to first directory entries
            PFQD_SmallCommonBlock pQueryDirWin32 = (PFQD_SmallCommonBlock)CXT->Buffer;
            //Cycle through directory entries
            while (1)
            {
                PWCHAR pFileName = 0;
                ULONG dwFileNameLength = 0;
                switch (CXT->FileInformationClass)
                {
                    //In all cases get pointer to FileName and FileNameLength
                case FileDirectoryInformation:
                    dwFileNameLength = ((PKFILE_DIRECTORY_INFORMATION)pQueryDirWin32)->CommonBlock.FileNameLength;
                    pFileName = ((PKFILE_DIRECTORY_INFORMATION)pQueryDirWin32)->FileName;
                    break;
                case FileFullDirectoryInformation:
                    dwFileNameLength = ((PKFILE_FULL_DIR_INFORMATION)pQueryDirWin32)->CommonBlock.FileNameLength;
                    pFileName = ((PKFILE_FULL_DIR_INFORMATION)pQueryDirWin32)->FileName;
                    break;
                case FileBothDirectoryInformation:
                    dwFileNameLength = ((PKFILE_BOTH_DIR_INFORMATION)pQueryDirWin32)->CommonBlock.FileNameLength;
                    pFileName = ((PKFILE_BOTH_DIR_INFORMATION)pQueryDirWin32)->FileName;
                    break;
                }
                //_asm int 3;
                //Is this file that we want?
                if ((dwFileNameLength == OurFileNameLen) &&
                    _wcsnicmp(pFileName, OurFileName, OurFileNameLen/2)==0)
                {
                    //_asm int 3;
                    //Hide first InvisiblePartSize bytes
                    ((PFQD_CommonBlock)pQueryDirWin32)->FileAttr.EndOfFile.QuadPart -= InvisiblePartSize;
                    break;
                }
                //Quit if no more directory entries
                if (!pQueryDirWin32->NextEntryOffset) break;
                //Continue with next directory entry
                pQueryDirWin32 = (PFQD_SmallCommonBlock)((CHAR*)pQueryDirWin32 + pQueryDirWin32->NextEntryOffset);
            }
           
    }
    //If appropriate Control flag was set,...
    if (
        ((CXT->Control == SL_INVOKE_ON_SUCCESS)&&(NT_SUCCESS(Irp->IoStatus.Status)))
        || ((CXT->Control == SL_INVOKE_ON_ERROR)&&(NT_ERROR(Irp->IoStatus.Status)))
        || ((CXT->Control == SL_INVOKE_ON_CANCEL)&&(Irp->IoStatus.Status == STATUS_CANCELLED)) )
        //...call original CompletionRoutine
        return CXT->CompletionRoutine(
        DeviceObject,
        Irp,
        CXT->Context);
    else return STATUS_SUCCESS;
}

//Filename IRP handler deal with
#define FName &(CISL->FileObject->FileName)

//Function handles IRP_MJ_READ and IRP_MJ_WRITE
NTSTATUS NewReadWriteDisp (
                          IN PDEVICE_OBJECT DeviceObject,
                          IN PIRP Irp)
{
    //_asm int 3;
    PIO_STACK_LOCATION CISL = IoGetCurrentIrpStackLocation(Irp);
    if (CISL->FileObject &&
        //Don't mess with swaping
        !(Irp->Flags & IRP_PAGING_IO) && !(Irp->Flags & IRP_SYNCHRONOUS_PAGING_IO))
    {
        if (ThisIsOurFile(FName))
        {
            //_asm int 3;
            CISL->Parameters.Write.ByteOffset.QuadPart += InvisiblePartSize;
            //Write and Read has the same structure, thus handled together
        }
    }
    //Call corresponding original handler
    switch (CISL->MajorFunction)
    {
    case IRP_MJ_READ:
        return OldReadDisp(DeviceObject, Irp);
    case IRP_MJ_WRITE:
        return OldWriteDisp(DeviceObject, Irp);
    }
}

//Function handles IRP_MJ_QUERY_INFORMATION
NTSTATUS NewQueryDisp (
                      IN PDEVICE_OBJECT DeviceObject,
                      IN PIRP Irp)
{
    //_asm int 3;
    PIO_STACK_LOCATION CISL = IoGetCurrentIrpStackLocation(Irp);
    if ((CISL->MajorFunction == IRP_MJ_QUERY_INFORMATION) &&
        ThisIsOurFile(FName))
    {
        //_asm int 3;
        switch (CISL->Parameters.QueryFile.FileInformationClass)
        {
            //Information types that contains file size or current offset
        case FilePositionInformation:
        case FileEndOfFileInformation:
        case FileStandardInformation:
        case FileAllocationInformation:
        case FileAllInformation:
            //_asm int 3;
            HookIrpCompletion(CISL, (PIO_COMPLETION_ROUTINE)NewComplRtn, Irp->AssociatedIrp.SystemBuffer, CISL->Parameters.QueryFile.FileInformationClass);
        }
    }
    //Call original handler
    return OldQueryDisp(DeviceObject, Irp);
}

//Function handles IRP_MJ_SET_INFORMATION
NTSTATUS NewSetInfoDisp (
                        IN PDEVICE_OBJECT DeviceObject,
                        IN PIRP Irp)
{
    //_asm int 3;
    PIO_STACK_LOCATION CISL = IoGetCurrentIrpStackLocation(Irp);
    if (CISL->FileObject && ThisIsOurFile(FName))
    {
        //_asm int 3;
        switch (CISL->Parameters.QueryFile.FileInformationClass)
        {
            //Information types that contains file size or current offset.
            //In all cases modify CurrentByteOffset and/or size (EndOfFile)
            //to hide first InvisiblePartSize bytes
        case FilePositionInformation:
            ((PFILE_POSITION_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->CurrentByteOffset.QuadPart += InvisiblePartSize;
            break;
        case FileEndOfFileInformation:
            ((PFILE_END_OF_FILE_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart += InvisiblePartSize;
            break;
        case FileStandardInformation:
            ((PFILE_STANDARD_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart += InvisiblePartSize;
            break;
        case FileAllocationInformation:
            //_asm int 3;
            ((PFILE_ALLOCATION_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->AllocationSize.QuadPart += InvisiblePartSize;
            break;
        case FileAllInformation:
            ((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->PositionInformation.CurrentByteOffset.QuadPart += InvisiblePartSize;
            ((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->StandardInformation.EndOfFile.QuadPart += InvisiblePartSize;
            break;
        }
    }
    //Call original handler
    return OldSetInfoDisp(DeviceObject, Irp);
}

//Function handles IRP_MJ_DIRECTORY_CONTROL
NTSTATUS NewDirCtlDisp (
                        IN PDEVICE_OBJECT DeviceObject,
                        IN PIRP Irp)
{
    void *pBuffer;
    PIO_STACK_LOCATION CISL = IoGetCurrentIrpStackLocation(Irp);
    //_asm int 3;
    if ((CISL->MajorFunction == IRP_MJ_DIRECTORY_CONTROL) &&
        (CISL->MinorFunction == IRP_MN_QUERY_DIRECTORY))
    {
        //Handle both ways of passing user supplied buffer
        if (Irp->MdlAddress)
            pBuffer = MmGetSystemAddressForMdl(Irp->MdlAddress);
        else
            pBuffer = Irp->UserBuffer;
        HookIrpCompletion(CISL, (PIO_COMPLETION_ROUTINE)NewComplRtn, pBuffer, ((PQUERY_DIRECTORY)(&CISL->Parameters))->FileInformationClass);
    }
    //Call original handler
    return OldDirCtlDisp(DeviceObject, Irp);
}

#undef FName

//Function handles FastIoRead
BOOLEAN NewFastIoRead(
                      IN PFILE_OBJECT FileObject,
                      IN PLARGE_INTEGER FileOffset,
                      IN ULONG Length,
                      IN BOOLEAN Wait,
                      IN ULONG LockKey,
                      OUT PVOID Buffer,
                      OUT PIO_STATUS_BLOCK IoStatus,
                      IN PDEVICE_OBJECT DeviceObject
                      )
{
    LARGE_INTEGER NewFileOffset;
    //_asm int 3;
    if ((FileObject) && (ThisIsOurFile(&FileObject->FileName)))
    {
        //_asm int 3;
        //Modify FileOffset to hide first InvisiblePartSize bytes
        NewFileOffset.QuadPart = FileOffset->QuadPart + InvisiblePartSize;
        return OldFastIoReadDisp(FileObject, &NewFileOffset, Length, Wait, LockKey, Buffer,
            IoStatus, DeviceObject);
    }
    //Call original handler
    return OldFastIoReadDisp(FileObject, FileOffset, Length, Wait, LockKey, Buffer,
        IoStatus, DeviceObject);
}

//Function handles FastIoWrite
BOOLEAN NewFastIoWrite(
                      IN PFILE_OBJECT FileObject,
                      IN PLARGE_INTEGER FileOffset,
                      IN ULONG Length,
                      IN BOOLEAN Wait,
                      IN ULONG LockKey,
                      OUT PVOID Buffer,
                      OUT PIO_STATUS_BLOCK IoStatus,
                      IN PDEVICE_OBJECT DeviceObject
                      )
{
    LARGE_INTEGER NewFileOffset;
    //_asm int 3;
    if ((FileObject) && (ThisIsOurFile(&FileObject->FileName)))
    {
        //_asm int 3;
        //Modify FileOffset to hide first InvisiblePartSize bytes
        NewFileOffset.QuadPart = FileOffset->QuadPart + InvisiblePartSize;
        return OldFastIoWriteDisp(FileObject, &NewFileOffset, Length, Wait, LockKey, Buffer,
            IoStatus, DeviceObject);
    }
    return OldFastIoWriteDisp(FileObject, FileOffset, Length, Wait, LockKey, Buffer,
        IoStatus, DeviceObject);
}

//Function handles FastIoQueryStandartInfo
BOOLEAN NewFastIoQueryStandartInfo(
                                  IN struct _FILE_OBJECT *FileObject,
                                  IN BOOLEAN Wait,
                                  OUT PFILE_STANDARD_INFORMATION Buffer,
                                  OUT PIO_STATUS_BLOCK IoStatus,
                                  IN struct _DEVICE_OBJECT *DeviceObject
                                  )
{
    //Call original handler
    BOOLEAN status = OldFastIoQueryStandartInfoDisp(FileObject, Wait, Buffer, IoStatus, DeviceObject);
    if ((FileObject) && (ThisIsOurFile(&FileObject->FileName)))
    {
        //_asm int 3;
        //Modify EndOfFile to hide first InvisiblePartSize bytes
        Buffer->EndOfFile.QuadPart -= InvisiblePartSize;
    }
    return status;
}

extern "C"
NTSYSAPI
NTSTATUS
NTAPI
ObReferenceObjectByName(
                        IN PUNICODE_STRING ObjectPath,
                        IN ULONG Attributes,
                        IN PACCESS_STATE PassedAccessState OPTIONAL,
                        IN ACCESS_MASK DesiredAccess OPTIONAL,
                        IN POBJECT_TYPE ObjectType,
                        IN KPROCESSOR_MODE AccessMode,
                        IN OUT PVOID ParseContext OPTIONAL,
                        OUT PVOID *ObjectPtr
                        );

extern "C" PVOID IoDriverObjectType;

//Function hooks given dispatch function (MajorFunction)
VOID InterceptFunction(UCHAR MajorFunction,
                      PDRIVER_OBJECT pDriverObject,
                      OPTIONAL PDRIVER_DISPATCH *OldFunctionPtr,
                      OPTIONAL PDRIVER_DISPATCH NewFunctionPtr)
{
    PDRIVER_DISPATCH *TargetFn;
   
    TargetFn = &(pDriverObject->MajorFunction[MajorFunction]);
    //hook only if handler exists
    if (*TargetFn)
    {
        if (OldFunctionPtr) *OldFunctionPtr = *TargetFn;
        if (NewFunctionPtr) *TargetFn = NewFunctionPtr;
    }
}

//Function hooks given driver's dispatch functions
NTSTATUS Intercept(PWSTR pwszDeviceName)
{
    UNICODE_STRING DeviceName;
    NTSTATUS status;
    KIRQL OldIrql;
   
    _asm int 3;
   
    pDriverObject = NULL;
    RtlInitUnicodeString(&DeviceName, pwszDeviceName);
    status = ObReferenceObjectByName(&DeviceName, OBJ_CASE_INSENSITIVE, NULL, 0, (POBJECT_TYPE)IoDriverObjectType, KernelMode, NULL, (PVOID*)&pDriverObject);
    if (pDriverObject)
    {
        //Raise IRQL to avoid context switch
        //when some pointer is semi-modified
        KeRaiseIrql(HIGH_LEVEL, &OldIrql);
        //hook dispatch functions
        InterceptFunction(IRP_MJ_READ, pDriverObject, &OldReadDisp, NewReadWriteDisp);
        InterceptFunction(IRP_MJ_WRITE, pDriverObject, &OldWriteDisp, NewReadWriteDisp);
        InterceptFunction(IRP_MJ_QUERY_INFORMATION, pDriverObject, &OldQueryDisp, NewQueryDisp);
        InterceptFunction(IRP_MJ_SET_INFORMATION, pDriverObject, &OldSetInfoDisp, NewSetInfoDisp);
        InterceptFunction(IRP_MJ_DIRECTORY_CONTROL, pDriverObject, &OldDirCtlDisp, NewDirCtlDisp);
        //hook FastIo dispatch functions if FastIo table exists
        if (pDriverObject->FastIoDispatch)
        {
            //It would be better to copy FastIo table to avoid
            //messing with kernel memory protection, but it works as it is
            OldFastIoReadDisp = pDriverObject->FastIoDispatch->FastIoRead;
            pDriverObject->FastIoDispatch->FastIoRead = NewFastIoRead;
            OldFastIoWriteDisp = pDriverObject->FastIoDispatch->FastIoWrite;
            pDriverObject->FastIoDispatch->FastIoWrite = NewFastIoWrite;
            OldFastIoQueryStandartInfoDisp = pDriverObject->FastIoDispatch->FastIoQueryStandardInfo;
            pDriverObject->FastIoDispatch->FastIoQueryStandardInfo = NewFastIoQueryStandartInfo;
        }
        KeLowerIrql(OldIrql);
    }
   
    return status;
}

//Function cancels hooking
VOID UnIntercept()
{
    KIRQL OldIrql;
    if (pDriverObject)
    {
        KeRaiseIrql(HIGH_LEVEL, &OldIrql);
        InterceptFunction(IRP_MJ_READ, pDriverObject, NULL, OldReadDisp);
        InterceptFunction(IRP_MJ_WRITE, pDriverObject, NULL, OldWriteDisp);
        InterceptFunction(IRP_MJ_QUERY_INFORMATION, pDriverObject, NULL, OldQueryDisp);
        InterceptFunction(IRP_MJ_SET_INFORMATION, pDriverObject, NULL, OldSetInfoDisp);
        InterceptFunction(IRP_MJ_DIRECTORY_CONTROL, pDriverObject, NULL, OldDirCtlDisp);
        if (pDriverObject->FastIoDispatch)
        {
            pDriverObject->FastIoDispatch->FastIoRead = OldFastIoReadDisp;
            pDriverObject->FastIoDispatch->FastIoWrite = OldFastIoWriteDisp;
            pDriverObject->FastIoDispatch->FastIoQueryStandardInfo = OldFastIoQueryStandartInfoDisp;
        }
        KeLowerIrql(OldIrql);
        ObDereferenceObject(pDriverObject);
    }
}