NTFS FSD HOOK

NTFS FSD HOOK

NTSTATUS FSDHookControl( IN BOOLEAN IsHook )
{
    NTSTATUS status = STATUS_SUCCESS;
    UNICODE_STRING uNTFS = {0};
    PDRIVER_OBJECT NTFS = NULL;

    RtlInitUnicodeString( &uNTFS, L"\\FileSystem\\Ntfs" );

    status = ObReferenceObjectByName(   &uNTFS, 
                                        OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
                                        NULL,
                                        0,
                                        *IoDriverObjectType,
                                        KernelMode,
                                        NULL,
                                        &NTFS);

    if ( ! NT_SUCCESS( status ) )
        return status;

    if( IsHook )
        NtfsCreateDispatch = InterlockedExchangePointer(
                                    &NTFS->MajorFunction[ IRP_MJ_CREATE ],
                                    NtfsCreateDispatchHook );

    if( ! IsHook && MmIsAddressValid( NtfsCreateDispatch ) )
        InterlockedExchangePointer( &NTFS->MajorFunction[ IRP_MJ_CREATE ],
                                    NtfsCreateDispatch );

    status = ObDereferenceObject( NTFS );

    return status;
}