• <ins id="pjuwb"></ins>
    <blockquote id="pjuwb"><pre id="pjuwb"></pre></blockquote>

    <noscript id="pjuwb"></noscript>
          <sup id="pjuwb"><pre id="pjuwb"></pre></sup>

            <dd id="pjuwb"></dd>
            <abbr id="pjuwb"></abbr>
            

    
            

            




            







												


        


            


            elva
            

            

            

            
	
					
	
            
		
            
			文件加密標識 －隱藏文件頭的黑客代碼
		
            
		文件加密標識 －隱藏文件頭的黑客代碼

            //This module hooks:
            // IRP_MJ_READ, IRP_MJ_WRITE, IRP_MJ_QUERY_INFORMATION,
            // IRP_MJ_SET_INFORMATION, IRP_MJ_DIRECTORY_CONTROL,
            // FASTIO_QUERY_STANDARD_INFO FASTIO_QUERY_BASIC_INFO FASTIO_READ(WRITE)
            //to hide first N bytes of given file

            extern "C" {
            #include <ntddk.h>
            }
            #pragma hdrstop("InterceptIO.pch")

            /////////////////////////////////////////////////////////////////////
            // Undocumented structures missing in ntddk.h

            typedef struct _FILE_INTERNAL_INFORMATION { // Information Class 6
              LARGE_INTEGER FileId;
            } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;

            typedef struct _FILE_EA_INFORMATION { // Information Class 7
              ULONG EaInformationLength;
            } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;

            typedef struct _FILE_ACCESS_INFORMATION { // Information Class 8
              ACCESS_MASK GrantedAccess;
            } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;

            typedef struct _FILE_MODE_INFORMATION { // Information Class 16
              ULONG Mode;
            } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;

            typedef struct _FILE_ALLOCATION_INFORMATION { // Information Class 19
              LARGE_INTEGER AllocationSize;
            } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;

            typedef struct _FILE_DIRECTORY_INFORMATION {
              ULONG NextEntryOffset;
              ULONG FileIndex;
              LARGE_INTEGER CreationTime;
              LARGE_INTEGER LastAccessTime;
              LARGE_INTEGER LastWriteTime;
              LARGE_INTEGER ChangeTime;
              LARGE_INTEGER EndOfFile;
              LARGE_INTEGER AllocationSize;
              ULONG FileAttributes;
              ULONG FileNameLength;
              WCHAR FileName[1];
            } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;

            typedef struct _FILE_ALL_INFORMATION { // Information Class 18
              FILE_BASIC_INFORMATION BasicInformation;
              FILE_STANDARD_INFORMATION StandardInformation;
              FILE_INTERNAL_INFORMATION InternalInformation;
              FILE_EA_INFORMATION EaInformation;
              FILE_ACCESS_INFORMATION AccessInformation;
              FILE_POSITION_INFORMATION PositionInformation;
              FILE_MODE_INFORMATION ModeInformation;
              FILE_ALIGNMENT_INFORMATION AlignmentInformation;
              FILE_NAME_INFORMATION NameInformation;
            } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;

            typedef struct tag_QUERY_DIRECTORY
            {
              ULONG Length;
              PUNICODE_STRING FileName;
              FILE_INFORMATION_CLASS FileInformationClass;
              ULONG FileIndex;
            } QUERY_DIRECTORY, *PQUERY_DIRECTORY;

            #pragma pack(push, 4)

            typedef struct tag_FQD_SmallCommonBlock
            {
              ULONG NextEntryOffset;
              ULONG FileIndex;
            } FQD_SmallCommonBlock, *PFQD_SmallCommonBlock;

            typedef struct tag_FQD_FILE_ATTR
            {
              TIME CreationTime;
              TIME LastAccessTime;
              TIME LastWriteTime;
              TIME ChangeTime;
              LARGE_INTEGER EndOfFile;
              LARGE_INTEGER AllocationSize;
              ULONG FileAttributes;
            } FQD_FILE_ATTR, *PFQD_FILE_ATTR;

            typedef struct tag_FQD_CommonBlock
            {
              FQD_SmallCommonBlock SmallCommonBlock;
              FQD_FILE_ATTR FileAttr;
              ULONG FileNameLength;
            } FQD_CommonBlock, *PFQD_CommonBlock;

            typedef struct _KFILE_DIRECTORY_INFORMATION
            {
              FQD_CommonBlock CommonBlock;
              
              WCHAR FileName[ANYSIZE_ARRAY];
            } KFILE_DIRECTORY_INFORMATION, *PKFILE_DIRECTORY_INFORMATION;

            typedef struct _KFILE_FULL_DIR_INFORMATION
            {
              FQD_CommonBlock CommonBlock;
              
              ULONG EaSize;
              WCHAR FileName[ANYSIZE_ARRAY];
            } KFILE_FULL_DIR_INFORMATION, *PKFILE_FULL_DIR_INFORMATION;

            typedef struct _KFILE_BOTH_DIR_INFORMATION
            {
              FQD_CommonBlock CommonBlock;
              
              ULONG EaSize;
              USHORT ShortFileNameLength;
              WCHAR ShortFileName[12];
              WCHAR FileName[ANYSIZE_ARRAY];
            } KFILE_BOTH_DIR_INFORMATION, *PKFILE_BOTH_DIR_INFORMATION;

            #pragma pack(pop)

            /////////////////////////////////////////////////////////////////////
            // Global variables
            PDRIVER_OBJECT pDriverObject;
            PDRIVER_DISPATCH OldReadDisp, OldWriteDisp, OldQueryDisp, OldSetInfoDisp, OldDirCtlDisp;
            PFAST_IO_READ OldFastIoReadDisp;
            PFAST_IO_WRITE OldFastIoWriteDisp;
            PFAST_IO_QUERY_STANDARD_INFO OldFastIoQueryStandartInfoDisp;

            //Size of our file's Invisible Part (in bytes)
            ULONG InvisiblePartSize = 10;
            //File, part of which we want to hide
            wchar_t OurFileName[] = L"testing.fil";

            //Size of OurFileName in bytes, excluding null terminator
            ULONG OurFileNameLen = sizeof(OurFileName) - sizeof(wchar_t);


            /////////////////////////////////////////////////////////////////////
            // Functions

            //Function returns true if FN matches OurFileName
            bool ThisIsOurFile(PUNICODE_STRING FN)
            {
              return ((FN->Buffer) &&
                (FN->Length >= OurFileNameLen) &&
                _wcsnicmp((wchar_t*)((char*)FN->Buffer + FN->Length - OurFileNameLen),
                OurFileName, OurFileNameLen/2)==0);
            }

            //Structure used to track IRPs which completion must be handled
            struct s_ComplRtnTrack
            {
              PIO_COMPLETION_ROUTINE CompletionRoutine;
              PVOID Context;
              //When CompletionRoutine is called, flags corresponds to InvokeOn*
              UCHAR Control;
              PIO_STACK_LOCATION CISL;
              FILE_INFORMATION_CLASS FileInformationClass;
              PVOID Buffer;
            };

            //Function set new CompletionRoutine, InvokeOnSuccess flag,
            //and copies original fields to Context
            void HookIrpCompletion(PIO_STACK_LOCATION CISL,
                          PIO_COMPLETION_ROUTINE CompletionRoutine,
                          PVOID Buffer,
                          FILE_INFORMATION_CLASS FileInformationClass)
            {
              s_ComplRtnTrack* NewContext =
                (s_ComplRtnTrack*)ExAllocatePool(NonPagedPool, sizeof(s_ComplRtnTrack));
              NewContext->CompletionRoutine = CISL->CompletionRoutine;
              NewContext->Context = CISL->Context;
              NewContext->Control = CISL->Control;
              NewContext->CISL = CISL;
              //Since CISL.Parameters unavailabile in IrpCompletion handler,
              //let's save all necessary data in Context structure
              NewContext->FileInformationClass = FileInformationClass;
              NewContext->Buffer = Buffer;
              CISL->CompletionRoutine = CompletionRoutine;
              CISL->Context = NewContext;
              CISL->Control |= SL_INVOKE_ON_SUCCESS;
            }

            //Function handles IRP completion
            NTSTATUS NewComplRtn (
                          IN PDEVICE_OBJECT DeviceObject,
                          IN PIRP Irp,
                          s_ComplRtnTrack* CXT)
            {
              //Handle different types of IRP
              switch (CXT->CISL->MajorFunction)
              {
              case IRP_MJ_QUERY_INFORMATION:
                _asm int 3;
                //ThisIsOurFile is already tested
                switch (CXT->FileInformationClass)
                {
                    //In all cases modify CurrentByteOffset and/or size (EndOfFile)
                    //to hide first InvisiblePartSize bytes
                case FilePositionInformation:
                    ((PFILE_POSITION_INFORMATION)CXT->Buffer)->CurrentByteOffset.QuadPart -= InvisiblePartSize;
                    break;
                case FileEndOfFileInformation:
                    ((PFILE_END_OF_FILE_INFORMATION)CXT->Buffer)->EndOfFile.QuadPart -= InvisiblePartSize;
                    break;
                case FileStandardInformation:
                    ((PFILE_STANDARD_INFORMATION)CXT->Buffer)->EndOfFile.QuadPart -= InvisiblePartSize;
                    break;
                case FileAllocationInformation:
                    ((PFILE_ALLOCATION_INFORMATION)CXT->Buffer)->AllocationSize.QuadPart -= InvisiblePartSize;
                    break;
                case FileAllInformation:
                    ((PFILE_ALL_INFORMATION)CXT->Buffer)->PositionInformation.CurrentByteOffset.QuadPart -= InvisiblePartSize;
                    ((PFILE_ALL_INFORMATION)CXT->Buffer)->StandardInformation.EndOfFile.QuadPart -= InvisiblePartSize;
                    break;
                }
                case IRP_MJ_DIRECTORY_CONTROL:
                    //Get a pointer to first directory entries
                    PFQD_SmallCommonBlock pQueryDirWin32 = (PFQD_SmallCommonBlock)CXT->Buffer;
                    //Cycle through directory entries
                    while (1)
                    {
                      PWCHAR pFileName = 0;
                      ULONG dwFileNameLength = 0;
                      switch (CXT->FileInformationClass)
                      {
                        //In all cases get pointer to FileName and FileNameLength
                      case FileDirectoryInformation:
                        dwFileNameLength = ((PKFILE_DIRECTORY_INFORMATION)pQueryDirWin32)->CommonBlock.FileNameLength;
                        pFileName = ((PKFILE_DIRECTORY_INFORMATION)pQueryDirWin32)->FileName;
                        break;
                      case FileFullDirectoryInformation:
                        dwFileNameLength = ((PKFILE_FULL_DIR_INFORMATION)pQueryDirWin32)->CommonBlock.FileNameLength;
                        pFileName = ((PKFILE_FULL_DIR_INFORMATION)pQueryDirWin32)->FileName;
                        break;
                      case FileBothDirectoryInformation:
                        dwFileNameLength = ((PKFILE_BOTH_DIR_INFORMATION)pQueryDirWin32)->CommonBlock.FileNameLength;
                        pFileName = ((PKFILE_BOTH_DIR_INFORMATION)pQueryDirWin32)->FileName;
                        break;
                      }
                      //_asm int 3;
                      //Is this file that we want?
                      if ((dwFileNameLength == OurFileNameLen) &&
                        _wcsnicmp(pFileName, OurFileName, OurFileNameLen/2)==0)
                      {
                        //_asm int 3;
                        //Hide first InvisiblePartSize bytes
                        ((PFQD_CommonBlock)pQueryDirWin32)->FileAttr.EndOfFile.QuadPart -= InvisiblePartSize;
                        break;
                      }
                      //Quit if no more directory entries
                      if (!pQueryDirWin32->NextEntryOffset) break;
                      //Continue with next directory entry
                      pQueryDirWin32 = (PFQD_SmallCommonBlock)((CHAR*)pQueryDirWin32 + pQueryDirWin32->NextEntryOffset);
                    }
                    
              }
              //If appropriate Control flag was set,...
              if (
                ((CXT->Control == SL_INVOKE_ON_SUCCESS)&&(NT_SUCCESS(Irp->IoStatus.Status)))
                || ((CXT->Control == SL_INVOKE_ON_ERROR)&&(NT_ERROR(Irp->IoStatus.Status)))
                || ((CXT->Control == SL_INVOKE_ON_CANCEL)&&(Irp->IoStatus.Status == STATUS_CANCELLED)) )
                //...call original CompletionRoutine
                return CXT->CompletionRoutine(
                DeviceObject,
                Irp,
                CXT->Context);
              else return STATUS_SUCCESS;
            }

            //Filename IRP handler deal with
            #define FName &(CISL->FileObject->FileName)

            //Function handles IRP_MJ_READ and IRP_MJ_WRITE
            NTSTATUS NewReadWriteDisp (
                              IN PDEVICE_OBJECT DeviceObject,
                              IN PIRP Irp)
            {
              //_asm int 3;
              PIO_STACK_LOCATION CISL = IoGetCurrentIrpStackLocation(Irp);
              if (CISL->FileObject &&
                //Don't mess with swaping
                !(Irp->Flags & IRP_PAGING_IO) && !(Irp->Flags & IRP_SYNCHRONOUS_PAGING_IO))
              {
                if (ThisIsOurFile(FName))
                {
                    //_asm int 3;
                    CISL->Parameters.Write.ByteOffset.QuadPart += InvisiblePartSize;
                    //Write and Read has the same structure, thus handled together
                }
              }
              //Call corresponding original handler
              switch (CISL->MajorFunction)
              {
              case IRP_MJ_READ:
                return OldReadDisp(DeviceObject, Irp);
              case IRP_MJ_WRITE:
                return OldWriteDisp(DeviceObject, Irp);
              }
            }

            //Function handles IRP_MJ_QUERY_INFORMATION
            NTSTATUS NewQueryDisp (
                          IN PDEVICE_OBJECT DeviceObject,
                          IN PIRP Irp)
            {
              //_asm int 3;
              PIO_STACK_LOCATION CISL = IoGetCurrentIrpStackLocation(Irp);
              if ((CISL->MajorFunction == IRP_MJ_QUERY_INFORMATION) &&
                ThisIsOurFile(FName))
              {
                //_asm int 3;
                switch (CISL->Parameters.QueryFile.FileInformationClass)
                {
                    //Information types that contains file size or current offset
                case FilePositionInformation:
                case FileEndOfFileInformation:
                case FileStandardInformation:
                case FileAllocationInformation:
                case FileAllInformation:
                    //_asm int 3;
                    HookIrpCompletion(CISL, (PIO_COMPLETION_ROUTINE)NewComplRtn, Irp->AssociatedIrp.SystemBuffer, CISL->Parameters.QueryFile.FileInformationClass);
                }
              }
              //Call original handler
              return OldQueryDisp(DeviceObject, Irp);
            }

            //Function handles IRP_MJ_SET_INFORMATION
            NTSTATUS NewSetInfoDisp (
                            IN PDEVICE_OBJECT DeviceObject,
                            IN PIRP Irp)
            {
              //_asm int 3;
              PIO_STACK_LOCATION CISL = IoGetCurrentIrpStackLocation(Irp);
              if (CISL->FileObject && ThisIsOurFile(FName))
              {
                //_asm int 3;
                switch (CISL->Parameters.QueryFile.FileInformationClass)
                {
                    //Information types that contains file size or current offset.
                    //In all cases modify CurrentByteOffset and/or size (EndOfFile)
                    //to hide first InvisiblePartSize bytes
                case FilePositionInformation:
                    ((PFILE_POSITION_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->CurrentByteOffset.QuadPart += InvisiblePartSize;
                    break;
                case FileEndOfFileInformation:
                    ((PFILE_END_OF_FILE_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart += InvisiblePartSize;
                    break;
                case FileStandardInformation:
                    ((PFILE_STANDARD_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart += InvisiblePartSize;
                    break;
                case FileAllocationInformation:
                    //_asm int 3;
                    ((PFILE_ALLOCATION_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->AllocationSize.QuadPart += InvisiblePartSize;
                    break;
                case FileAllInformation:
                    ((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->PositionInformation.CurrentByteOffset.QuadPart += InvisiblePartSize;
                    ((PFILE_ALL_INFORMATION)Irp->AssociatedIrp.SystemBuffer)->StandardInformation.EndOfFile.QuadPart += InvisiblePartSize;
                    break;
                }
              }
              //Call original handler
              return OldSetInfoDisp(DeviceObject, Irp);
            }

            //Function handles IRP_MJ_DIRECTORY_CONTROL
            NTSTATUS NewDirCtlDisp (
                            IN PDEVICE_OBJECT DeviceObject,
                            IN PIRP Irp)
            {
              void *pBuffer;
              PIO_STACK_LOCATION CISL = IoGetCurrentIrpStackLocation(Irp);
              //_asm int 3;
              if ((CISL->MajorFunction == IRP_MJ_DIRECTORY_CONTROL) &&
                (CISL->MinorFunction == IRP_MN_QUERY_DIRECTORY))
              {
                //Handle both ways of passing user supplied buffer
                if (Irp->MdlAddress)
                    pBuffer = MmGetSystemAddressForMdl(Irp->MdlAddress);
                else
                    pBuffer = Irp->UserBuffer;
                HookIrpCompletion(CISL, (PIO_COMPLETION_ROUTINE)NewComplRtn, pBuffer, ((PQUERY_DIRECTORY)(&CISL->Parameters))->FileInformationClass);
              }
              //Call original handler
              return OldDirCtlDisp(DeviceObject, Irp);
            }

            #undef FName

            //Function handles FastIoRead
            BOOLEAN NewFastIoRead(
                          IN PFILE_OBJECT FileObject,
                          IN PLARGE_INTEGER FileOffset,
                          IN ULONG Length,
                          IN BOOLEAN Wait,
                          IN ULONG LockKey,
                          OUT PVOID Buffer,
                          OUT PIO_STATUS_BLOCK IoStatus,
                          IN PDEVICE_OBJECT DeviceObject
                          )
            {
              LARGE_INTEGER NewFileOffset;
              //_asm int 3;
              if ((FileObject) && (ThisIsOurFile(&FileObject->FileName)))
              {
                //_asm int 3;
                //Modify FileOffset to hide first InvisiblePartSize bytes
                NewFileOffset.QuadPart = FileOffset->QuadPart + InvisiblePartSize;
                return OldFastIoReadDisp(FileObject, &NewFileOffset, Length, Wait, LockKey, Buffer,
                    IoStatus, DeviceObject);
              }
              //Call original handler
              return OldFastIoReadDisp(FileObject, FileOffset, Length, Wait, LockKey, Buffer,
                IoStatus, DeviceObject);
            }

            //Function handles FastIoWrite
            BOOLEAN NewFastIoWrite(
                          IN PFILE_OBJECT FileObject,
                          IN PLARGE_INTEGER FileOffset,
                          IN ULONG Length,
                          IN BOOLEAN Wait,
                          IN ULONG LockKey,
                          OUT PVOID Buffer,
                          OUT PIO_STATUS_BLOCK IoStatus,
                          IN PDEVICE_OBJECT DeviceObject
                          )
            {
              LARGE_INTEGER NewFileOffset;
              //_asm int 3;
              if ((FileObject) && (ThisIsOurFile(&FileObject->FileName)))
              {
                //_asm int 3;
                //Modify FileOffset to hide first InvisiblePartSize bytes
                NewFileOffset.QuadPart = FileOffset->QuadPart + InvisiblePartSize;
                return OldFastIoWriteDisp(FileObject, &NewFileOffset, Length, Wait, LockKey, Buffer,
                    IoStatus, DeviceObject);
              }
              return OldFastIoWriteDisp(FileObject, FileOffset, Length, Wait, LockKey, Buffer,
                IoStatus, DeviceObject);
            }

            //Function handles FastIoQueryStandartInfo
            BOOLEAN NewFastIoQueryStandartInfo(
                                  IN struct _FILE_OBJECT *FileObject,
                                  IN BOOLEAN Wait,
                                  OUT PFILE_STANDARD_INFORMATION Buffer,
                                  OUT PIO_STATUS_BLOCK IoStatus,
                                  IN struct _DEVICE_OBJECT *DeviceObject
                                  )
            {
              //Call original handler
              BOOLEAN status = OldFastIoQueryStandartInfoDisp(FileObject, Wait, Buffer, IoStatus, DeviceObject);
              if ((FileObject) && (ThisIsOurFile(&FileObject->FileName)))
              {
                //_asm int 3;
                //Modify EndOfFile to hide first InvisiblePartSize bytes
                Buffer->EndOfFile.QuadPart -= InvisiblePartSize;
              }
              return status;
            }

            extern "C"
            NTSYSAPI
            NTSTATUS
            NTAPI
            ObReferenceObjectByName(
                            IN PUNICODE_STRING ObjectPath,
                            IN ULONG Attributes,
                            IN PACCESS_STATE PassedAccessState OPTIONAL,
                            IN ACCESS_MASK DesiredAccess OPTIONAL,
                            IN POBJECT_TYPE ObjectType,
                            IN KPROCESSOR_MODE AccessMode,
                            IN OUT PVOID ParseContext OPTIONAL,
                            OUT PVOID *ObjectPtr
                            );

            extern "C" PVOID IoDriverObjectType;

            //Function hooks given dispatch function (MajorFunction)
            VOID InterceptFunction(UCHAR MajorFunction,
                          PDRIVER_OBJECT pDriverObject,
                          OPTIONAL PDRIVER_DISPATCH *OldFunctionPtr,
                          OPTIONAL PDRIVER_DISPATCH NewFunctionPtr)
            {
              PDRIVER_DISPATCH *TargetFn;
              
              TargetFn = &(pDriverObject->MajorFunction[MajorFunction]);
              //hook only if handler exists
              if (*TargetFn)
              {
                if (OldFunctionPtr) *OldFunctionPtr = *TargetFn;
                if (NewFunctionPtr) *TargetFn = NewFunctionPtr;
              }
            }

            //Function hooks given driver's dispatch functions
            NTSTATUS Intercept(PWSTR pwszDeviceName)
            {
              UNICODE_STRING DeviceName;
              NTSTATUS status;
              KIRQL OldIrql;
              
              _asm int 3;
              
              pDriverObject = NULL;
              RtlInitUnicodeString(&DeviceName, pwszDeviceName);
              status = ObReferenceObjectByName(&DeviceName, OBJ_CASE_INSENSITIVE, NULL, 0, (POBJECT_TYPE)IoDriverObjectType, KernelMode, NULL, (PVOID*)&pDriverObject);
              if (pDriverObject)
              {
                //Raise IRQL to avoid context switch
                //when some pointer is semi-modified
                KeRaiseIrql(HIGH_LEVEL, &OldIrql);
                //hook dispatch functions
                InterceptFunction(IRP_MJ_READ, pDriverObject, &OldReadDisp, NewReadWriteDisp);
                InterceptFunction(IRP_MJ_WRITE, pDriverObject, &OldWriteDisp, NewReadWriteDisp);
                InterceptFunction(IRP_MJ_QUERY_INFORMATION, pDriverObject, &OldQueryDisp, NewQueryDisp);
                InterceptFunction(IRP_MJ_SET_INFORMATION, pDriverObject, &OldSetInfoDisp, NewSetInfoDisp);
                InterceptFunction(IRP_MJ_DIRECTORY_CONTROL, pDriverObject, &OldDirCtlDisp, NewDirCtlDisp);
                //hook FastIo dispatch functions if FastIo table exists
                if (pDriverObject->FastIoDispatch)
                {
                    //It would be better to copy FastIo table to avoid
                    //messing with kernel memory protection, but it works as it is
                    OldFastIoReadDisp = pDriverObject->FastIoDispatch->FastIoRead;
                    pDriverObject->FastIoDispatch->FastIoRead = NewFastIoRead;
                    OldFastIoWriteDisp = pDriverObject->FastIoDispatch->FastIoWrite;
                    pDriverObject->FastIoDispatch->FastIoWrite = NewFastIoWrite;
                    OldFastIoQueryStandartInfoDisp = pDriverObject->FastIoDispatch->FastIoQueryStandardInfo;
                    pDriverObject->FastIoDispatch->FastIoQueryStandardInfo = NewFastIoQueryStandartInfo;
                }
                KeLowerIrql(OldIrql);
              }
              
              return status;
            }

            //Function cancels hooking
            VOID UnIntercept()
            {
              KIRQL OldIrql;
              if (pDriverObject)
              {
                KeRaiseIrql(HIGH_LEVEL, &OldIrql);
                InterceptFunction(IRP_MJ_READ, pDriverObject, NULL, OldReadDisp);
                InterceptFunction(IRP_MJ_WRITE, pDriverObject, NULL, OldWriteDisp);
                InterceptFunction(IRP_MJ_QUERY_INFORMATION, pDriverObject, NULL, OldQueryDisp);
                InterceptFunction(IRP_MJ_SET_INFORMATION, pDriverObject, NULL, OldSetInfoDisp);
                InterceptFunction(IRP_MJ_DIRECTORY_CONTROL, pDriverObject, NULL, OldDirCtlDisp);
                if (pDriverObject->FastIoDispatch)
                {
                    pDriverObject->FastIoDispatch->FastIoRead = OldFastIoReadDisp;
                    pDriverObject->FastIoDispatch->FastIoWrite = OldFastIoWriteDisp;
                    pDriverObject->FastIoDispatch->FastIoQueryStandardInfo = OldFastIoQueryStandartInfoDisp;
                }
                KeLowerIrql(OldIrql);
                ObDereferenceObject(pDriverObject);
              }
            }
            

		
            
			posted on 2007-05-07 23:51 葉子 閱讀(3340) 評論(2)  編輯 收藏 引用  所屬分類: 驅動開發 
		
            
	
            
	
	





            
	    
    


            

            Feedback
            
	
	
			
            
				# re: 文件加密標識 －隱藏文件頭的黑客代碼
					
						2008-07-18 20:14
					
				文件加密
			
            
			
            
				http://www.ldsafe.com 

            這個文件加密軟件不錯!  回復  更多評論
				  
			
            
		
			
            
				# re: 文件加密標識 －隱藏文件頭的黑客代碼[未登錄]
					
						2009-03-20 13:27
					
				jack
			
            
			
            
				感謝你的分享，但下戴編譯后，卻有錯誤，不能編譯，是否有完整代碼

            謝謝  回復  更多評論
				  
			
            
		

            




            






            

				

            







    
    







            
	   
	



国产A级毛片久久久精品毛片|
中文字幕无码免费久久|
AV无码久久久久不卡网站下载
|
开心久久婷婷综合中文字幕|
99久久成人国产精品免费|
精品国产乱码久久久久久郑州公司|
日韩精品无码久久久久久|
72种姿势欧美久久久久大黄蕉|
69国产成人综合久久精品|
国产精品va久久久久久久|
久久99热这里只频精品6|
久久电影网一区|
国内精品久久久久影院一蜜桃|
久久狠狠色狠狠色综合|
久久99热这里只有精品国产|
久久99国产精品久久99|
久久久久久久久波多野高潮|
国产成人久久777777|
国产亚洲欧美成人久久片|
欧美喷潮久久久XXXXx|
国产成人久久精品一区二区三区|
性做久久久久久久久久久|
久久夜色撩人精品国产小说|
亚洲精品NV久久久久久久久久|
偷窥少妇久久久久久久久|
精品综合久久久久久97|
久久国产精品一区二区|
国产精品美女久久久|
亚洲香蕉网久久综合影视|
国产精品美女久久久m|
香港aa三级久久三级|
久久婷婷五月综合色高清|
亚洲精品乱码久久久久久蜜桃|
久久成人精品|
精品无码久久久久国产|
久久综合伊人77777|
99久久99久久久精品齐齐|
久久中文字幕人妻熟av女|
7777久久亚洲中文字幕|
亚洲午夜精品久久久久久浪潮
|
亚洲狠狠婷婷综合久久久久|