HOOK ObjectType 干涉文件访问

前几日在网上看到MJ0011大虾写的一篇《ObjectType HOOK干涉注册表操作(bypass icesword,gmer,NIAP,etc.)》的文章，感觉很有兴趣。MJ大虾的文章给出的代码主要是干涉注册表的。而ObjectType 可以干涉的不只是注册表，所以就想到用同样的方法去干涉文件的访问，举一反三嘛。

然后问题就出现了

用Windbg跟了一下，发现在pNewParseProcedure函数中出了问题。
本来是想通过ObjectName->Buffer得到打开的文件名，然后看其中有没有2.TXT这个字符串进行过滤的。但是我用Windbg看了看ObjectName->Buffer，貌似找不到我打开文件的文件名。

1. #include <ntddk.h>
2. #define MAX_PATH 266
3. #define NUMBER_HASH_BUCKETS 37
4. #define LINK_NAME L"\\DosDevices\\StopOpenLink"
5. #define DEVICE_NAME L"\\Device\\StopLinkName"
6. PVOID pOldParseProcedure = NULL;
7. 
   
8. 
   
9. typedef struct _OBJECT_DIRECTORY_ENTRY {
10.     struct _OBJECT_DIRECTORY_ENTRY *ChainLink;
11.     PVOID Object;
12. } OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY;
13. 
    
14. typedef struct _OBJECT_DIRECTORY {
15.     struct _OBJECT_DIRECTORY_ENTRY *HashBuckets[ NUMBER_HASH_BUCKETS ];
16.     struct _OBJECT_DIRECTORY_ENTRY **LookupBucket;
17.     BOOLEAN LookupFound;
18.     USHORT SymbolicLinkUsageCount;
19.     struct _DEVICE_MAP *DeviceMap;
20. } OBJECT_DIRECTORY, *POBJECT_DIRECTORY;
21. 
    
22. typedef struct _DEVICE_MAP {
23.     ULONG ReferenceCount;
24.     POBJECT_DIRECTORY DosDevicesDirectory;
25.     ULONG DriveMap;
26.     UCHAR DriveType[ 32 ];
27. } DEVICE_MAP, *PDEVICE_MAP;
28. 
    
29. 
    
30. typedef struct _OBJECT_TYPE_INITIALIZER {
31.   USHORT Length;
32.   BOOLEAN UseDefaultObject;
33.   BOOLEAN CaseInsensitive;
34.   ULONG InvalidAttributes;
35.   GENERIC_MAPPING GenericMapping;
36.   ULONG ValidAccessMask;
37.   BOOLEAN SecurityRequired;
38.   BOOLEAN MaintainHandleCount;
39.   BOOLEAN MaintainTypeList;
40.   POOL_TYPE PoolType;
41.   ULONG DefaultPagedPoolCharge;
42.   ULONG DefaultNonPagedPoolCharge;
43.   PVOID DumpProcedure;
44.   PVOID OpenProcedure;
45.   PVOID CloseProcedure;
46.   PVOID DeleteProcedure;
47.   PVOID ParseProcedure;
48.   PVOID SecurityProcedure;
49.   PVOID QueryNameProcedure;
50.   PVOID OkayToCloseProcedure;
51. } OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;
52. 
    
53. 
    
54. typedef struct _OBJECT_TYPE {
55.   ERESOURCE Mutex;
56.   LIST_ENTRY TypeList;
57.   UNICODE_STRING Name; // Copy from object header for convenience
58.   PVOID DefaultObject;
59.   ULONG Index;
60.   ULONG TotalNumberOfObjects;
61.   ULONG TotalNumberOfHandles;
62.   ULONG HighWaterNumberOfObjects;
63.   ULONG HighWaterNumberOfHandles;
64.   OBJECT_TYPE_INITIALIZER TypeInfo;
65. #ifdef POOL_TAGGING
66.   ULONG Key;
67. #endif //POOL_TAGGING
68. } OBJECT_TYPE, *POBJECT_TYPE;
69. typedef struct _OBJECT_CREATE_INFORMATION {
70.   ULONG Attributes;
71.   HANDLE RootDirectory;
72.   PVOID ParseContext;
73.   KPROCESSOR_MODE ProbeMode;
74.   ULONG PagedPoolCharge;
75.   ULONG NonPagedPoolCharge;
76.   ULONG SecurityDescriptorCharge;
77.   PSECURITY_DESCRIPTOR SecurityDescriptor;
78.   PSECURITY_QUALITY_OF_SERVICE SecurityQos;
79.   SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
80. } OBJECT_CREATE_INFORMATION, *POBJECT_CREATE_INFORMATION;
81. 
    
82. 
    
83. 
    
84. typedef struct _OBJECT_HEADER {
85.   LONG PointerCount;
86.   union {
87.     LONG HandleCount;
88.     PSINGLE_LIST_ENTRY SEntry;
89.   };
90.   POBJECT_TYPE Type;
91.   UCHAR NameInfoOffset;
92.   UCHAR HandleInfoOffset;
93.   UCHAR QuotaInfoOffset;
94.   UCHAR Flags;
95.   union
96.   {
97.     POBJECT_CREATE_INFORMATION ObjectCreateInfo;
98.     PVOID QuotaBlockCharged;
99.   };
100.   
101.   PSECURITY_DESCRIPTOR SecurityDescriptor;
102.   QUAD Body;
103. } OBJECT_HEADER, *POBJECT_HEADER;
104. POBJECT_TYPE pObHeader= NULL;
105. NTSTATUS pNewParseProcedure(POBJECT_DIRECTORY RootDirectory,
106.             POBJECT_TYPE ObjectType,
107.             PACCESS_STATE AccessState,
108.             KPROCESSOR_MODE AccessCheckMode,
109.             ULONG Attributes,
110.             PUNICODE_STRING ObjectName,
111.             PUNICODE_STRING RemainingName,
112.             PVOID ParseContext ,
113.             PSECURITY_QUALITY_OF_SERVICE SecurityQos ,
114.             PVOID *Object)
115. {
116.   NTSTATUS ntStatus = STATUS_SUCCESS;
117.   WCHAR wOpenName[MAX_PATH];
118.   RtlCopyMemory(wOpenName,ObjectName->Buffer,ObjectName->MaximumLength);
119.   
120.   if (wcsstr(wOpenName,L"2.TXT"))
121.   {
122.     return STATUS_OBJECT_NAME_NOT_FOUND;
123.   }
124.   __asm
125.   {
126.       push eax
127.       push Object
128.       push SecurityQos
129.       push ParseContext
130.       push RemainingName
131.       push ObjectName
132.       push Attributes
133.       movzx eax, AccessCheckMode
134.       push eax
135.       push AccessState
136.       push ObjectType
137.       push RootDirectory
138.       call pOldParseProcedure
139.       
140.       mov ntStatus, eax
141.       pop eax
142.       
143.   }
144.   return ntStatus;
145. 
     
146. }
147. 
     
148. 
     
149. NTSTATUS InstallHook()
150. {
151.   NTSTATUS  ntStatus;
152.   HANDLE hFile;
153.   UNICODE_STRING StName;
154.   OBJECT_ATTRIBUTES obAttrib;
155.   IO_STATUS_BLOCK ioStaBlock;
156.   PVOID pObject = NULL;
157. 
     
158.   KdPrint(("it start now!\n"));
159.   RtlInitUnicodeString(&StName,L"\\DosDevices\\C:\\1.txt");
160.   InitializeObjectAttributes(&obAttrib,&StName,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE ,\
161.     0,NULL);
162.   ntStatus = ZwOpenFile(&hFile,GENERIC_ALL,&obAttrib,&ioStaBlock,\
163.     0,FILE_NON_DIRECTORY_FILE);
164.   if (!NT_SUCCESS(ntStatus))
165.   {
166.     KdPrint(("File Not Open\n"));
167.     return ntStatus;
168.   }
169.   KdPrint(("File Open\n"));
170.   ntStatus = ObReferenceObjectByHandle(hFile,GENERIC_ALL,NULL,KernelMode,&pObject,NULL);
171.   if (!NT_SUCCESS(ntStatus))
172.   {
173.     KdPrint(("Object Not Open\n"));
174.     return ntStatus;
175.   }
176.   KdPrint(("Object Open\n"));
177.   __asm
178.   {
179.     cli;
180.     mov eax, cr0;
181.     and eax, not 10000h;
182.     mov cr0, eax;
183.   }
184.   __asm
185.   {
186.     push eax;
187.     mov eax,pObject;
188.     mov eax,[eax-10h];
189.     mov pObHeader,eax;
190.     pop eax;
191.   }
192.   pOldParseProcedure = pObHeader->TypeInfo.ParseProcedure;
193.   if (!MmIsAddressValid(pOldParseProcedure))
194.   {
195.     ObDereferenceObject(pObject);
196.     ntStatus = ZwClose(hFile);
197.     return ntStatus;
198.   }
199. 
     
200.   pObHeader->TypeInfo.ParseProcedure = pNewParseProcedure;
201.   __asm
202.   {
203.     mov eax, cr0;
204.     or eax, 10000h;
205.     mov cr0, eax;
206.     sti;
207.   }
208.   ntStatus = ZwClose(hFile);
209.   return ntStatus;
210. }
211. 
     
212. NTSTATUS soDispatch(IN PDEVICE_OBJECT pDeviceObject,IN PIRP pIrp)
213. {
214.   NTSTATUS ntStatus = STATUS_SUCCESS;
215.   PIO_STACK_LOCATION pIrpSt = NULL;
216.   pIrpSt = IoGetCurrentIrpStackLocation(pIrp);
217. 
     
218.   ntStatus = pIrp->IoStatus.Status;
219.   IoCompleteRequest(pIrp,IO_NO_INCREMENT);
220.   return ntStatus;
221. }
222. void soUnload(IN PDRIVER_OBJECT  DriverObject)
223. {
224.   UNICODE_STRING uTempString;
225.   
226.   __asm
227.   {
228.     cli;
229.     mov eax, cr0
230.     and eax, not 10000h
231.     mov cr0, eax
232.   }
233.   pObHeader->TypeInfo.ParseProcedure = pOldParseProcedure;
234.   __asm
235.   {
236.     mov eax, cr0;
237.     or eax, 10000h
238.     mov cr0, eax;
239.     sti;
240.   }
241.   RtlInitUnicodeString(&uTempString,LINK_NAME);
242.   IoDeleteSymbolicLink(&uTempString);
243.   IoDeleteDevice(DriverObject->DeviceObject);
244. }
245. 
     
246. 
     
247. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath )
248. {
249.   NTSTATUS ntStatus = STATUS_SUCCESS;
250.   UNICODE_STRING uLinkName;
251.   UNICODE_STRING uDeviceName;
252.   PDEVICE_OBJECT ObDevice;
253. 
     
254.   RtlInitUnicodeString(&uDeviceName,DEVICE_NAME);
255.   ntStatus = IoCreateDevice(DriverObject,0,&uDeviceName,FILE_DEVICE_UNKNOWN,0,FALSE,&ObDevice);
256.   if (!NT_SUCCESS(ntStatus))
257.   {
258.     return ntStatus;
259.   }
260.   RtlInitUnicodeString(&uLinkName,LINK_NAME);
261.   ntStatus = IoCreateSymbolicLink(&uLinkName,&uDeviceName);
262.   if (!NT_SUCCESS(ntStatus))
263.   {
264.     return ntStatus;
265.   }
266.   DriverObject->MajorFunction[IRP_MJ_CREATE] = soDispatch;
267.   DriverObject->MajorFunction[IRP_MJ_CLOSE] = soDispatch;
268.   DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = soDispatch;
269. 
     
270.   DriverObject->DriverUnload = soUnload;
271.   InstallHook();
272. 
     
273.   return ntStatus;
274. 
     
275. }

复制代码

实在没办法了上论坛请教各位。请各位赐教！