青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品

S.l.e!ep.¢%

像打了激速一樣,以四倍的速度運轉,開心的工作
簡單、開放、平等的公司文化;尊重個性、自由與個人價值;
posts - 1098, comments - 335, trackbacks - 0, articles - 1
  C++博客 :: 首頁 :: 新隨筆 :: 聯系 :: 聚合  :: 管理

FileMon源碼學習筆記(一)

Posted on 2010-02-18 15:10 S.l.e!ep.¢% 閱讀(1858) 評論(0)  編輯 收藏 引用 所屬分類: Windows WDM
FileMon源碼學習筆記(一)
2008-11-24 09:37

//----------------------------------------------------------------------
//
// HookDrive
//
// Hook the drive specified by determining which device object to
// attach to. The algorithm used here is similar to the one used
// internally by NT to determine which device object a file system request
// is directed at.
//
//----------------------------------------------------------------------
BOOLEAN
HookDrive(
??? IN ULONG Drive,
??? IN PDRIVER_OBJECT DriverObject
??? )
{
??? IO_STATUS_BLOCK???? ioStatus;
??? HANDLE????????????? ntFileHandle;??
??? OBJECT_ATTRIBUTES?? objectAttributes;
??? PDEVICE_OBJECT????? fileSysDevice;
??? PDEVICE_OBJECT????? hookDevice;
??? UNICODE_STRING????? fileNameUnicodeString;
??? PFILE_FS_ATTRIBUTE_INFORMATION fileFsAttributes;
??? ULONG?????????????? fileFsAttributesSize;
??? WCHAR?????????????? filename[] = L"
\\DosDevices\\A:\\ ";
??? NTSTATUS??????????? ntStatus;
??? ULONG?????????????? i;
??? PFILE_OBJECT??????? fileObject;
??? PHOOK_EXTENSION???? hookExtension;
???
??? //
??? // Is it a legal drive letter?
??? //
??? if( Drive >= 26 ) {

??????? return FALSE;
??? }

??? //
??? // Has this drive already been hooked?
??? //
??? if( DriveHookDevices[Drive] == NULL ) {

??????? //
??????? // Frob the name to make it refer to the drive specified in the input
??????? // parameter.
??????? //
??????? filename[12] = (CHAR) ('A'+Drive);

??????? //
??????? // We have to figure out what device to hook - first open the volume's
??????? // root directory
??????? //
??????? RtlInitUnicodeString( &fileNameUnicodeString, filename );
??????? InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString,
??????????????????????????????????? OBJ_CASE_INSENSITIVE, NULL, NULL );
??????? ntStatus = ZwCreateFile( &ntFileHandle, SYNCHRONIZE|FILE_ANY_ACCESS,
???????????????????????????????? &objectAttributes, &ioStatus, NULL, 0, FILE_SHARE_READ|FILE_SHARE_WRITE,
???????????????????????????????? FILE_OPEN,
???????????????????????????????? FILE_SYNCHRONOUS_IO_NONALERT|FILE_DIRECTORY_FILE,
???????????????????????????????? NULL, 0 );
??????? if( !NT_SUCCESS( ntStatus ) ) {

??????????? DbgPrint(("Filemon: Could not open drive %c: %x\n", 'A'+Drive, ntStatus ));
??????????? return FALSE;
??????? }

??????? DbgPrint(("Filemon: opened the root directory!!! handle: %x\n", ntFileHandle));??

??????? //
??????? // Got the file handle, so now look-up the file-object it refers to
??????? //
??????? ntStatus = ObReferenceObjectByHandle( ntFileHandle, FILE_READ_DATA,
????????????????????????????????????????????? NULL, KernelMode, &fileObject, NULL );
??????? if( !NT_SUCCESS( ntStatus )) {

??????????? DbgPrint(("Filemon: Could not get fileobject from handle: %c\n", 'A'+Drive ));
??????????? ZwClose( ntFileHandle );
??????????? return FALSE;
??????? }

??????? //
??????? // Next, find out what device is associated with the file object by getting its related
??????? // device object
??????? //
??????? fileSysDevice = IoGetRelatedDeviceObject( fileObject );

??????? if( ! fileSysDevice ) {

??????????? DbgPrint(("Filemon: Could not get related device object: %c\n", 'A'+Drive ));
??????????? ObDereferenceObject( fileObject );
??????????? ZwClose( ntFileHandle );
??????????? return FALSE;
??????? }

??????? //
??????? // Check the device list to see if we've already attached to this particular device.
??????? // This can happen when more than one drive letter is being handled by the same network
??????? // redirecter
??????? //
??????? for( i = 0; i < 26; i++ ) {

??????????? if( DriveHookDevices[i] == fileSysDevice ) {

??????????????? //
??????????????? // If we're already watching it, associate this drive letter
??????????????? // with the others that are handled by the same network driver. This
??????????????? // enables us to intelligently update the hooking menus when the user
??????????????? // specifies that one of the group should not be watched -we mark all
??????????????? // of the related drives as unwatched as well
??????????????? //
??????????????? ObDereferenceObject( fileObject );
??????????????? ZwClose( ntFileHandle );
??????????????? DriveHookDevices[ Drive ] = fileSysDevice;
??????????????? return TRUE;
??????????? }
??????? }

??????? //
??????? // The file system's device hasn't been hooked already, so make a hooking device
??????? // object that will be attached to it.
??????? //
??????? ntStatus = IoCreateDevice( DriverObject,
?????????????????????????????????? sizeof(HOOK_EXTENSION),
?????????????????????????????????? NULL,
?????????????????????????????????? fileSysDevice->DeviceType,
?????????????????????????????????? 0,
?????????????????????????????????? FALSE,
?????????????????????????????????? &hookDevice );
??????? if( !NT_SUCCESS(ntStatus) ) {

??????????? DbgPrint(("Filemon: failed to create associated device: %c\n", 'A'+Drive ));??

??????????? ObDereferenceObject( fileObject );
??????????? ZwClose( ntFileHandle );

??????????? return FALSE;
??????? }

??????? //
??????? // Clear the device's init flag as per NT DDK KB article on creating device
??????? // objects from a dispatch routine
??????? //
??????? hookDevice->Flags &= ~DO_DEVICE_INITIALIZING;

??????? //
??????? // Setup the device extensions. The drive letter and file system object are stored
??????? // in the extension.
??????? //
??????? hookExtension = hookDevice->DeviceExtension;
??????? hookExtension->LogicalDrive = 'A'+Drive;
??????? hookExtension->FileSystem?? = fileSysDevice;
??????? hookExtension->Hooked?????? = TRUE;
??????? hookExtension->Type???????? = STANDARD;

??????? //
??????? // Finally, attach to the device. The second we're successfully attached, we may
??????? // start receiving IRPs targetted at the device we've hooked.
??????? //
??????? ntStatus = IoAttachDeviceByPointer( hookDevice, fileSysDevice );
??????? if( !NT_SUCCESS(ntStatus) ) {

??????????? //
??????????? // Couldn' attach for some reason
??????????? //
??????????? DbgPrint(("Filemon: Connect with Filesystem failed: %c (%x) =>%x\n",
????????????????????? 'A'+Drive, fileSysDevice, ntStatus ));

??????????? //
??????????? // Derefence the object and get out
??????????? //
??????????? ObDereferenceObject( fileObject );
??????????? ZwClose( ntFileHandle );

??????????? return FALSE;

??????? } else {

??????????? //
??????????? // Make a new drive group for the device,l if it does not have one
??????????? // already
??????????? //
??????????? DbgPrint(("Filemon: Successfully connected to Filesystem device %c\n", 'A'+Drive ));
??????? }

??????? //
??????? // Determine if this is a NTFS drive
??????? //
??????? fileFsAttributesSize = sizeof( FILE_FS_ATTRIBUTE_INFORMATION) + MAXPATHLEN;
??????? hookExtension->FsAttributes = (PFILE_FS_ATTRIBUTE_INFORMATION) ExAllocatePool( NonPagedPool,
?????????????????????????????????????????????????????????????????????????????????????? fileFsAttributesSize );
??????? if( hookExtension->FsAttributes &&
??????????? !NT_SUCCESS( IoQueryVolumeInformation( fileObject, FileFsAttributeInformation,
?????????????????????????????????????????????????? fileFsAttributesSize, hookExtension->FsAttributes,
?????????????????????????????????????????????????? &fileFsAttributesSize ))) {

??????????? //
??????????? // On failure, we just don't have attributes for this file system
??????????? //
??????????? ExFreePool( hookExtension->FsAttributes );
??????????? hookExtension->FsAttributes = NULL;
??????? }

??????? //
??????? // Close the file and update the hooked drive list by entering a
??????? // pointer to the hook device object in it.
??????? //
??????? ObDereferenceObject( fileObject );

??????? ZwClose( ntFileHandle );

??????? DriveHookDevices[Drive] = hookDevice;
???????
??? } else {

??????? hookExtension = DriveHookDevices[Drive]->DeviceExtension;
??????? hookExtension->Hooked = TRUE;
??? }
??? return TRUE;
}

以上摘自FileMon源碼,作者在獲得要hook的設備的DeviceObject的時候用了以下方式:

ZwCreateFile——》ObReferenceObjectByHandle——》IoGetRelatedDeviceObject

另外,這個設備對象也可以直接用一個函數獲得IoGetDeviceObjectPointer,該函數原型如下:

NTSTATUS
IoGetDeviceObjectPointer(
??? IN PUNICODE_STRING ObjectName ,
??? IN ACCESS_MASK DesiredAccess ,
??? OUT PFILE_OBJECT * FileObject ,
??? OUT PDEVICE_OBJECT * DeviceObject
??? );

直接由名字獲得設備對象和文件對象,而該函數內部的實現方式combojiang大俠也給出過c的逆向代碼如下: 逆向為c的代碼:
NTSTATUS
IoGetDeviceObjectPointer(
???? IN PUNICODE_STRING ObjectName,
???? IN ACCESS_MASK DesiredAccess,
???? OUT PFILE_OBJECT *FileObject,
???? OUT PDEVICE_OBJECT *DeviceObject
???? )
{
???? IO_STATUS_BLOCK ioStatus;
???? OBJECT_ATTRIBUTES objectAttributes;
????
???? //額外定義出來的棧變量。由于C與匯編的游戲規則不同。
???? PFILE_OBJECT fileObject;
???? HANDLE fileHandle;
???? NTSTATUS status;
????
???? InitializeObjectAttributes( &objectAttributes,
???????????????????????????????? ObjectName,
???????????????????????????????? OBJ_KERNEL_HANDLE,
???????????????????????????????? (HANDLE) NULL,
???????????????????????????????? (PSECURITY_DESCRIPTOR) NULL );
????????????????????????????????
??? status = ZwOpenFile( &fileHandle,
????????????????????????? DesiredAccess,
????????????????????????? &objectAttributes,
????????????????????????? &ioStatus,
????????????????????????? 0,
????????????????????????? 0x40 );

???? if (status >= 0)
???? {

????????? status = ObReferenceObjectByHandle( fileHandle,
???????????????????????????????????????????? 0,
???????????????????????????????????????????? IoFileObjectType,
???????????????????????????????????????????? 0,
???????????????????????????????????????????? (PVOID *) &fileObject,
???????????????????????????????????????????? 0 );
???????? if (status >= 0)
???????? {

???????????? *FileObject = fileObject;
???????????? *DeviceObject = IoGetRelatedDeviceObject( fileObject );
???????? }

???????? ZwClose( fileHandle );
???? }

???? return status;
}
與FileMon的源碼使用的方法類似,所以FileMon源碼里面應該可以用這個函數直接替代,但是原作者沒有直接調用這個函數,不知道原因是什么,難道是寫FileMon的時候還沒提供這個函數,所以要自己來實現嗎?

青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品
  • <ins id="pjuwb"></ins>
    <blockquote id="pjuwb"><pre id="pjuwb"></pre></blockquote>
    <noscript id="pjuwb"></noscript>
          <sup id="pjuwb"><pre id="pjuwb"></pre></sup>
            <dd id="pjuwb"></dd>
            <abbr id="pjuwb"></abbr>
            99www免费人成精品| 在线观看亚洲精品视频| 一本色道久久综合亚洲精品不 | 久久久精品性| 亚洲黄色免费电影| 亚洲精品美女久久7777777| 欧美护士18xxxxhd| 亚洲男女毛片无遮挡| 亚洲少妇在线| 激情亚洲成人| 91久久综合| 国产精品推荐精品| 久久综合网hezyo| 欧美精品久久久久久久久老牛影院 | 国产精品一区二区男女羞羞无遮挡| 午夜伦欧美伦电影理论片| 欧美一区观看| 日韩亚洲不卡在线| 亚洲综合另类| 亚洲区一区二| 先锋影院在线亚洲| 亚洲茄子视频| 亚洲欧美日韩一区在线| 91久久精品国产91性色| 亚洲图片在区色| 最新国产成人在线观看| 亚洲一区二区免费| 亚洲日本欧美| 欧美伊人久久大香线蕉综合69| 91久久久在线| 午夜精品成人在线| 一区二区三区精品| 久久久噜噜噜久久人人看| 亚洲图片欧洲图片av| 久久三级福利| 欧美亚洲一级| 欧美日韩在线免费观看| 欧美成人精品福利| 国产亚洲一区在线播放| 99精品国产在热久久| 亚洲电影免费观看高清完整版在线| 亚洲一区二区三区三| 亚洲理论在线观看| 久久国产精品久久w女人spa| 亚洲一区二区av电影| 欧美第一黄色网| 免费成人在线观看视频| 国产欧美精品| 亚洲在线免费| 欧美亚洲尤物久久| 国产精品日韩欧美综合| 99re成人精品视频| 一区二区欧美日韩| 欧美大片18| 亚洲国产精品一区二区三区 | 欧美国产日韩一区二区在线观看| 久久亚洲精品中文字幕冲田杏梨| 国产精品久久久久久久久久久久久| 亚洲第一黄色| 亚洲精品一区二区三区99| 美女主播视频一区| 欧美高清你懂得| 亚洲国产欧美久久| 免费日韩成人| 亚洲激情一区| 99re在线精品| 欧美色大人视频| 一区二区三区免费看| 亚洲无线一线二线三线区别av| 欧美日韩中文字幕日韩欧美| 日韩一二三区视频| 亚洲一区二区三区在线播放| 国产精品久久久久久久久久久久久久| 日韩一区二区久久| 亚欧成人精品| 国产一区999| 麻豆精品在线视频| 亚洲激情国产精品| 亚洲一区综合| 国产亚洲福利| 免费黄网站欧美| 99精品黄色片免费大全| 亚洲欧美日韩成人| 国产亚洲毛片在线| 欧美 日韩 国产 一区| 亚洲日本一区二区三区| 亚洲女同性videos| 国产夜色精品一区二区av| 久久久欧美精品| 99在线视频精品| 久久久久久久综合色一本| 亚洲二区视频在线| 欧美视频免费| 久久精品日韩欧美| 亚洲国产一区二区三区青草影视 | 一本大道av伊人久久综合| 欧美色精品天天在线观看视频| 亚洲五月六月| 欧美大色视频| 欧美在线网站| 9l视频自拍蝌蚪9l视频成人| 国产精品一区二区三区免费观看| 久久久噜噜噜| 亚洲一区二区免费在线| 欧美激情精品久久久久久变态| 亚洲一区二区少妇| 亚洲高清在线视频| 国产伦精品一区二区三区四区免费| 久久久人成影片一区二区三区 | 亚洲欧美日韩成人高清在线一区| 亚洲电影网站| 久久国产一区| 亚洲午夜av电影| 亚洲国产精品一区二区www| 国产精品久久久久久久久免费桃花| 久久夜色精品国产欧美乱极品| 一区二区免费在线播放| 欧美高清视频免费观看| 性18欧美另类| 亚洲一区二区欧美| 亚洲日本欧美日韩高观看| 国产在线视频欧美一区二区三区| 欧美色图五月天| 欧美成在线观看| 久久香蕉国产线看观看av| 校园春色国产精品| 在线视频中文亚洲| 亚洲剧情一区二区| 亚洲国产综合在线看不卡| 蜜乳av另类精品一区二区| 久久久www| 欧美伊久线香蕉线新在线| 亚洲男人影院| 亚洲影视综合| 亚洲淫性视频| 午夜精品福利一区二区三区av| 一本在线高清不卡dvd| 99亚洲精品| 妖精成人www高清在线观看| 亚洲欧洲三级电影| 亚洲黄一区二区| 亚洲精品美女免费| 亚洲精品国产精品乱码不99按摩| 亚洲电影av| 亚洲日本va午夜在线电影| 亚洲国产三级网| 91久久精品网| 9l国产精品久久久久麻豆| 日韩写真视频在线观看| 一区二区三区视频观看| av成人免费在线| 午夜精品久久久久久99热| 亚洲欧美日韩在线观看a三区 | 亚洲尤物视频网| 欧美一激情一区二区三区| 久久成人综合网| 另类图片国产| 亚洲国产视频一区| 一区二区三区不卡视频在线观看 | 麻豆成人综合网| 欧美日韩国产专区| 国产伦理精品不卡| 国内久久婷婷综合| 亚洲人体1000| 午夜精品偷拍| 可以看av的网站久久看| 亚洲国产综合在线| 亚洲免费在线精品一区| 欧美一区二区三区的| 美女国内精品自产拍在线播放| 欧美激情中文字幕乱码免费| 国产精品久久久久久久久动漫| 国产日韩欧美综合一区| 亚洲黄色有码视频| 亚洲欧美日韩国产一区二区| 久久久久网站| 亚洲精品小视频| 久久久www成人免费无遮挡大片 | 欧美日韩精品免费观看视一区二区 | 99视频精品免费观看| 性色av香蕉一区二区| 欧美1级日本1级| 国产欧美 在线欧美| 亚洲免费成人av| 久久久久久久综合色一本| 亚洲免费电影在线| 久久精品国产亚洲一区二区| 欧美日韩精品一区二区| 国产一区二区成人| 一区二区毛片| 欧美成年人视频网站| 亚洲欧美视频| 欧美日韩亚洲三区| 亚洲欧洲精品成人久久奇米网| 午夜精品亚洲一区二区三区嫩草| 亚洲国产欧美不卡在线观看| 午夜在线精品| 国产精品亚洲成人| 一级成人国产| 欧美激情亚洲自拍|