android 文件过滤驱动,自己写的Xuetr工具驱动读写过滤驱动，并奉献上源码

[C] 纯文本查看 复制代码#include

/*

First Driver

*/

//未文档化的函数->通过名字获取设备对象

NTKERNELAPI

NTSTATUS

ObReferenceObjectByName(

IN PUNICODE_STRING ObjectName,

IN ULONG Attributes,

IN PACCESS_STATE PassedAccessState OPTIONAL,

IN ACCESS_MASK DesiredAccess OPTIONAL,

IN POBJECT_TYPE ObjectType OPTIONAL,

IN KPROCESSOR_MODE AccessMode,

IN OUT PVOID ParseContext OPTIONAL,

OUT PVOID *Object

);

extern POBJECT_TYPE *IoDriverObjectType;

PDRIVER_OBJECT g_FilterDriverObject;

//保存以前的驱动请求例程

PDRIVER_DISPATCH g_OrigReadCompeleteRoutine;

//驱动过滤例程

NTSTATUS FilterReadCompeleteRoutine(__in struct _DEVICE_OBJECT *DeviceObject,__inout struct _IRP *Irp)

{

KdPrint(("拦截到数据读取！"));

return g_OrigReadCompeleteRoutine(DeviceObject, Irp);

}

//卸载HOOK函数

NTSTATUS UnfilterDriverRoutinue()

{

//检测地址是否有效(可读可写)

if (MmIsAddressValid(g_FilterDriverObject))

{

//写回原例程

g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = g_OrigReadCompeleteRoutine;

}

return STATUS_SUCCESS;

}

//驱动过滤函数->配合 ObReferenceObjectByna