HOOK ntfs 禁止格式化

最新推荐文章于 2020-11-09 14:12:18 发布

stecdeng

最新推荐文章于 2020-11-09 14:12:18 发布

阅读量1.2k

点赞数

分类专栏： windows内核驱动相关文章标签： hook object access null system file

本文链接：https://blog.csdn.net/stecdeng/article/details/7612842

版权

windows内核驱动相关专栏收录该内容

14 篇文章 1 订阅

订阅专栏

if(bHooked == FALSE)
{
RtlInitUnicodeString (&HookDriverName, L" \\FileSystem\\Ntfs");
//获得\Driver\VolSnap驱动对象
status = ObReferenceObjectByName (
&HookDriverName,
OBJ_CASE_INSENSITIVE,
0,
0,
*IoDriverObjectType,
KernelMode,
0,
(PVOID*)&diskdrvobj
);
if (NT_SUCCESS (status) && pgOldFileControl == NULL)
{
pgOldFileControl = (PDRIVER_DISPATCH) InterlockedExchange( ( PLONG)&(diskdrvobj->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL]), (LONG)&DispatchMyfileControl);
ObDereferenceObject(diskdrvobj);
DbgPrint("Hook: HOOK driver object! Success\n");
bHooked = TRUE;
}else

HOOK NTFS 禁止格式化

// 禁止格式化
NTSTATUS DispatchMyfileControl ( IN PDEVICE_OBJECT pDeviceObject, IN PIRP Irp)
{
PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation( Irp );

if(IrpSp->Parameters.FileSystemControl.FsControlCode == FSCTL_LOCK_VOLUME ||
IrpSp->Parameters.FileSystemControl.FsControlCode == FSCTL_DISMOUNT_VOLUME)
{
PIRP NewIrp = NULL;
PIO_STACK_LOCATION NewIrpSp = NULL;
KEVENT event;
IO_STATUS_BLOCK ioStatus;
NTSTATUS status;
PDEVICE_OBJECT QuerryDev = NULL;

QuerryDev = IrpSp->FileObject->Vpb->RealDevice;
if(QuerryDev == NULL)
{
_asm int 3;
}

Irp->IoStatus.Information = 0;
Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;
}
return pgOldFileControl(pDeviceObject,Irp);
}