NTFS FSD HOOK

最新推荐文章于 2020-05-12 10:23:14 发布

Lycorisradiata_77

最新推荐文章于 2020-05-12 10:23:14 发布

阅读量577

点赞数

分类专栏： Kernel 文章标签： kernel-C

本文链接：https://blog.csdn.net/zl11984/article/details/51178373

版权

Kernel 专栏收录该内容

2 篇文章 0 订阅

订阅专栏

NTFS FSD HOOK

NTSTATUS FSDHookControl( IN BOOLEAN IsHook )
{
    NTSTATUS status = STATUS_SUCCESS;
    UNICODE_STRING uNTFS = {0};
    PDRIVER_OBJECT NTFS = NULL;

    RtlInitUnicodeString( &uNTFS, L"\\FileSystem\\Ntfs" );

    status = ObReferenceObjectByName(   &uNTFS, 
                                        OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
                                        NULL,
                                        0,
                                        *IoDriverObjectType,
                                        KernelMode,
                                        NULL,
                                        &NTFS);

    if ( ! NT_SUCCESS( status ) )
        return status;

    if( IsHook )
        NtfsCreateDispatch = InterlockedExchangePointer(
                                    &NTFS->MajorFunction[ IRP_MJ_CREATE ],
                                    NtfsCreateDispatchHook );

    if( ! IsHook && MmIsAddressValid( NtfsCreateDispatch ) )
        InterlockedExchangePointer( &NTFS->MajorFunction[ IRP_MJ_CREATE ],
                                    NtfsCreateDispatch );

    status = ObDereferenceObject( NTFS );

    return status;
}