青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品

S.l.e!ep.¢%

像打了激速一樣,以四倍的速度運轉,開心的工作
簡單、開放、平等的公司文化;尊重個性、自由與個人價值;
posts - 1098, comments - 335, trackbacks - 0, articles - 1
  C++博客 :: 首頁 :: 新隨筆 :: 聯系 :: 聚合  :: 管理

FileMon源碼學習筆記(一)

Posted on 2010-02-18 15:10 S.l.e!ep.¢% 閱讀(1858) 評論(0)  編輯 收藏 引用 所屬分類: Windows WDM
FileMon源碼學習筆記(一)
2008-11-24 09:37

//----------------------------------------------------------------------
//
// HookDrive
//
// Hook the drive specified by determining which device object to
// attach to. The algorithm used here is similar to the one used
// internally by NT to determine which device object a file system request
// is directed at.
//
//----------------------------------------------------------------------
BOOLEAN
HookDrive(
??? IN ULONG Drive,
??? IN PDRIVER_OBJECT DriverObject
??? )
{
??? IO_STATUS_BLOCK???? ioStatus;
??? HANDLE????????????? ntFileHandle;??
??? OBJECT_ATTRIBUTES?? objectAttributes;
??? PDEVICE_OBJECT????? fileSysDevice;
??? PDEVICE_OBJECT????? hookDevice;
??? UNICODE_STRING????? fileNameUnicodeString;
??? PFILE_FS_ATTRIBUTE_INFORMATION fileFsAttributes;
??? ULONG?????????????? fileFsAttributesSize;
??? WCHAR?????????????? filename[] = L"
\\DosDevices\\A:\\ ";
??? NTSTATUS??????????? ntStatus;
??? ULONG?????????????? i;
??? PFILE_OBJECT??????? fileObject;
??? PHOOK_EXTENSION???? hookExtension;
???
??? //
??? // Is it a legal drive letter?
??? //
??? if( Drive >= 26 ) {

??????? return FALSE;
??? }

??? //
??? // Has this drive already been hooked?
??? //
??? if( DriveHookDevices[Drive] == NULL ) {

??????? //
??????? // Frob the name to make it refer to the drive specified in the input
??????? // parameter.
??????? //
??????? filename[12] = (CHAR) ('A'+Drive);

??????? //
??????? // We have to figure out what device to hook - first open the volume's
??????? // root directory
??????? //
??????? RtlInitUnicodeString( &fileNameUnicodeString, filename );
??????? InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString,
??????????????????????????????????? OBJ_CASE_INSENSITIVE, NULL, NULL );
??????? ntStatus = ZwCreateFile( &ntFileHandle, SYNCHRONIZE|FILE_ANY_ACCESS,
???????????????????????????????? &objectAttributes, &ioStatus, NULL, 0, FILE_SHARE_READ|FILE_SHARE_WRITE,
???????????????????????????????? FILE_OPEN,
???????????????????????????????? FILE_SYNCHRONOUS_IO_NONALERT|FILE_DIRECTORY_FILE,
???????????????????????????????? NULL, 0 );
??????? if( !NT_SUCCESS( ntStatus ) ) {

??????????? DbgPrint(("Filemon: Could not open drive %c: %x\n", 'A'+Drive, ntStatus ));
??????????? return FALSE;
??????? }

??????? DbgPrint(("Filemon: opened the root directory!!! handle: %x\n", ntFileHandle));??

??????? //
??????? // Got the file handle, so now look-up the file-object it refers to
??????? //
??????? ntStatus = ObReferenceObjectByHandle( ntFileHandle, FILE_READ_DATA,
????????????????????????????????????????????? NULL, KernelMode, &fileObject, NULL );
??????? if( !NT_SUCCESS( ntStatus )) {

??????????? DbgPrint(("Filemon: Could not get fileobject from handle: %c\n", 'A'+Drive ));
??????????? ZwClose( ntFileHandle );
??????????? return FALSE;
??????? }

??????? //
??????? // Next, find out what device is associated with the file object by getting its related
??????? // device object
??????? //
??????? fileSysDevice = IoGetRelatedDeviceObject( fileObject );

??????? if( ! fileSysDevice ) {

??????????? DbgPrint(("Filemon: Could not get related device object: %c\n", 'A'+Drive ));
??????????? ObDereferenceObject( fileObject );
??????????? ZwClose( ntFileHandle );
??????????? return FALSE;
??????? }

??????? //
??????? // Check the device list to see if we've already attached to this particular device.
??????? // This can happen when more than one drive letter is being handled by the same network
??????? // redirecter
??????? //
??????? for( i = 0; i < 26; i++ ) {

??????????? if( DriveHookDevices[i] == fileSysDevice ) {

??????????????? //
??????????????? // If we're already watching it, associate this drive letter
??????????????? // with the others that are handled by the same network driver. This
??????????????? // enables us to intelligently update the hooking menus when the user
??????????????? // specifies that one of the group should not be watched -we mark all
??????????????? // of the related drives as unwatched as well
??????????????? //
??????????????? ObDereferenceObject( fileObject );
??????????????? ZwClose( ntFileHandle );
??????????????? DriveHookDevices[ Drive ] = fileSysDevice;
??????????????? return TRUE;
??????????? }
??????? }

??????? //
??????? // The file system's device hasn't been hooked already, so make a hooking device
??????? // object that will be attached to it.
??????? //
??????? ntStatus = IoCreateDevice( DriverObject,
?????????????????????????????????? sizeof(HOOK_EXTENSION),
?????????????????????????????????? NULL,
?????????????????????????????????? fileSysDevice->DeviceType,
?????????????????????????????????? 0,
?????????????????????????????????? FALSE,
?????????????????????????????????? &hookDevice );
??????? if( !NT_SUCCESS(ntStatus) ) {

??????????? DbgPrint(("Filemon: failed to create associated device: %c\n", 'A'+Drive ));??

??????????? ObDereferenceObject( fileObject );
??????????? ZwClose( ntFileHandle );

??????????? return FALSE;
??????? }

??????? //
??????? // Clear the device's init flag as per NT DDK KB article on creating device
??????? // objects from a dispatch routine
??????? //
??????? hookDevice->Flags &= ~DO_DEVICE_INITIALIZING;

??????? //
??????? // Setup the device extensions. The drive letter and file system object are stored
??????? // in the extension.
??????? //
??????? hookExtension = hookDevice->DeviceExtension;
??????? hookExtension->LogicalDrive = 'A'+Drive;
??????? hookExtension->FileSystem?? = fileSysDevice;
??????? hookExtension->Hooked?????? = TRUE;
??????? hookExtension->Type???????? = STANDARD;

??????? //
??????? // Finally, attach to the device. The second we're successfully attached, we may
??????? // start receiving IRPs targetted at the device we've hooked.
??????? //
??????? ntStatus = IoAttachDeviceByPointer( hookDevice, fileSysDevice );
??????? if( !NT_SUCCESS(ntStatus) ) {

??????????? //
??????????? // Couldn' attach for some reason
??????????? //
??????????? DbgPrint(("Filemon: Connect with Filesystem failed: %c (%x) =>%x\n",
????????????????????? 'A'+Drive, fileSysDevice, ntStatus ));

??????????? //
??????????? // Derefence the object and get out
??????????? //
??????????? ObDereferenceObject( fileObject );
??????????? ZwClose( ntFileHandle );

??????????? return FALSE;

??????? } else {

??????????? //
??????????? // Make a new drive group for the device,l if it does not have one
??????????? // already
??????????? //
??????????? DbgPrint(("Filemon: Successfully connected to Filesystem device %c\n", 'A'+Drive ));
??????? }

??????? //
??????? // Determine if this is a NTFS drive
??????? //
??????? fileFsAttributesSize = sizeof( FILE_FS_ATTRIBUTE_INFORMATION) + MAXPATHLEN;
??????? hookExtension->FsAttributes = (PFILE_FS_ATTRIBUTE_INFORMATION) ExAllocatePool( NonPagedPool,
?????????????????????????????????????????????????????????????????????????????????????? fileFsAttributesSize );
??????? if( hookExtension->FsAttributes &&
??????????? !NT_SUCCESS( IoQueryVolumeInformation( fileObject, FileFsAttributeInformation,
?????????????????????????????????????????????????? fileFsAttributesSize, hookExtension->FsAttributes,
?????????????????????????????????????????????????? &fileFsAttributesSize ))) {

??????????? //
??????????? // On failure, we just don't have attributes for this file system
??????????? //
??????????? ExFreePool( hookExtension->FsAttributes );
??????????? hookExtension->FsAttributes = NULL;
??????? }

??????? //
??????? // Close the file and update the hooked drive list by entering a
??????? // pointer to the hook device object in it.
??????? //
??????? ObDereferenceObject( fileObject );

??????? ZwClose( ntFileHandle );

??????? DriveHookDevices[Drive] = hookDevice;
???????
??? } else {

??????? hookExtension = DriveHookDevices[Drive]->DeviceExtension;
??????? hookExtension->Hooked = TRUE;
??? }
??? return TRUE;
}

以上摘自FileMon源碼,作者在獲得要hook的設備的DeviceObject的時候用了以下方式:

ZwCreateFile——》ObReferenceObjectByHandle——》IoGetRelatedDeviceObject

另外,這個設備對象也可以直接用一個函數獲得IoGetDeviceObjectPointer,該函數原型如下:

NTSTATUS
IoGetDeviceObjectPointer(
??? IN PUNICODE_STRING ObjectName ,
??? IN ACCESS_MASK DesiredAccess ,
??? OUT PFILE_OBJECT * FileObject ,
??? OUT PDEVICE_OBJECT * DeviceObject
??? );

直接由名字獲得設備對象和文件對象,而該函數內部的實現方式combojiang大俠也給出過c的逆向代碼如下: 逆向為c的代碼:
NTSTATUS
IoGetDeviceObjectPointer(
???? IN PUNICODE_STRING ObjectName,
???? IN ACCESS_MASK DesiredAccess,
???? OUT PFILE_OBJECT *FileObject,
???? OUT PDEVICE_OBJECT *DeviceObject
???? )
{
???? IO_STATUS_BLOCK ioStatus;
???? OBJECT_ATTRIBUTES objectAttributes;
????
???? //額外定義出來的棧變量。由于C與匯編的游戲規則不同。
???? PFILE_OBJECT fileObject;
???? HANDLE fileHandle;
???? NTSTATUS status;
????
???? InitializeObjectAttributes( &objectAttributes,
???????????????????????????????? ObjectName,
???????????????????????????????? OBJ_KERNEL_HANDLE,
???????????????????????????????? (HANDLE) NULL,
???????????????????????????????? (PSECURITY_DESCRIPTOR) NULL );
????????????????????????????????
??? status = ZwOpenFile( &fileHandle,
????????????????????????? DesiredAccess,
????????????????????????? &objectAttributes,
????????????????????????? &ioStatus,
????????????????????????? 0,
????????????????????????? 0x40 );

???? if (status >= 0)
???? {

????????? status = ObReferenceObjectByHandle( fileHandle,
???????????????????????????????????????????? 0,
???????????????????????????????????????????? IoFileObjectType,
???????????????????????????????????????????? 0,
???????????????????????????????????????????? (PVOID *) &fileObject,
???????????????????????????????????????????? 0 );
???????? if (status >= 0)
???????? {

???????????? *FileObject = fileObject;
???????????? *DeviceObject = IoGetRelatedDeviceObject( fileObject );
???????? }

???????? ZwClose( fileHandle );
???? }

???? return status;
}
與FileMon的源碼使用的方法類似,所以FileMon源碼里面應該可以用這個函數直接替代,但是原作者沒有直接調用這個函數,不知道原因是什么,難道是寫FileMon的時候還沒提供這個函數,所以要自己來實現嗎?

青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品
  • <ins id="pjuwb"></ins>
    <blockquote id="pjuwb"><pre id="pjuwb"></pre></blockquote>
    <noscript id="pjuwb"></noscript>
          <sup id="pjuwb"><pre id="pjuwb"></pre></sup>
            <dd id="pjuwb"></dd>
            <abbr id="pjuwb"></abbr>
            久久精品中文字幕一区| 亚洲欧美一区二区在线观看| 免费久久99精品国产自在现线| 激情五月婷婷综合| 老司机午夜精品| 欧美成人小视频| 99精品视频免费观看视频| 日韩视频在线一区二区| 欧美性大战久久久久久久蜜臀| 亚洲午夜伦理| 亚洲综合不卡| 亚洲第一在线| 一区二区三区四区在线| 国产欧美视频一区二区三区| 玖玖玖免费嫩草在线影院一区| 玖玖综合伊人| 亚洲线精品一区二区三区八戒| 午夜精品久久久99热福利| 国产亚洲一区二区三区| 欧美成人综合在线| 国产精品九九久久久久久久| 另类尿喷潮videofree| 欧美电影免费观看网站| 欧美在线1区| 欧美成年人视频| 久久国产99| 欧美人体xx| 久久女同互慰一区二区三区| 欧美日韩国内自拍| 久久午夜羞羞影院免费观看| 欧美日韩午夜在线视频| 久热精品视频在线| 国产精品日日摸夜夜摸av| 欧美激情亚洲自拍| 国产真实久久| 亚洲视频免费看| 亚洲精品欧美| 久久精品在线| 久久高清一区| 国产精品久久久久久久久久妞妞| 欧美国产丝袜视频| 国产一区二区三区在线免费观看 | 欧美亚洲综合另类| 一本一道久久综合狠狠老精东影业| 欧美在线视频观看| 亚洲午夜一区二区三区| 欧美成在线视频| 久久综合伊人77777麻豆| 国产欧美va欧美不卡在线| 99热免费精品| 99精品欧美一区| 欧美成人激情视频免费观看| 免费不卡在线视频| 国产一区二区在线免费观看 | 久久久久国产一区二区| 欧美在线视频免费播放| 国产精品videossex久久发布| 91久久精品国产91久久性色| 亚洲国产欧美在线| 欧美jizz19性欧美| 亚洲国产精品美女| 亚洲全黄一级网站| 欧美国产日本| 日韩亚洲在线观看| 亚洲欧美日韩精品久久奇米色影视| 欧美日韩理论| 亚洲一二三级电影| 久久国产精品久久精品国产| 国产亚洲成人一区| 国产精品久久福利| 欧美网站大全在线观看| 欧美精品国产一区二区| 性欧美长视频| 久久久999精品视频| 狠狠色综合播放一区二区| 久久久99免费视频| 久久最新视频| 精品动漫3d一区二区三区| 欧美一区二区三区免费观看视频| 久久精品国产99| 国语精品一区| 久久久另类综合| 欧美大片在线看| 亚洲精品日韩久久| 欧美在线视频免费| 亚洲国产你懂的| av成人天堂| 欧美日韩在线观看一区二区| 99re66热这里只有精品3直播| 一区二区日韩伦理片| 国产精品福利在线观看| 亚洲一区在线播放| 久久午夜av| 99成人免费视频| 国产精品国产三级国产专播精品人 | 亚洲一区二区三区免费观看 | 欧美日韩一区二区三区免费| 亚洲欧美视频| 麻豆国产va免费精品高清在线| 在线精品国产欧美| 欧美日本三级| 亚洲欧美日韩区| 美女黄毛**国产精品啪啪| 国产午夜精品一区理论片飘花| 久久久久国产精品麻豆ai换脸| 亚洲电影在线| 亚洲一区二区三区中文字幕在线| 狠狠综合久久| 欧美区一区二| 午夜综合激情| 91久久久久久久久| 性欧美1819sex性高清| **欧美日韩vr在线| 欧美日韩亚洲另类| 免费成人高清| 亚洲女人天堂av| 亚洲国产精品成人综合色在线婷婷| 亚洲视频中文| 亚洲国内精品在线| 国产精品日韩| 欧美日韩免费一区| 久久免费视频在线观看| 一区二区欧美在线| 欧美大秀在线观看| 久久se精品一区精品二区| 亚洲精品看片| 国产日韩在线视频| 国产精品丝袜久久久久久app| 欧美高清视频免费观看| 亚洲自拍偷拍一区| 99精品欧美一区| 欧美激情久久久| 久久综合久久久| 久久大综合网| 亚洲免费在线| 亚洲午夜国产成人av电影男同| 伊人精品久久久久7777| 国产欧美一区二区精品性| 欧美日韩精品免费观看| 久久精品亚洲| 久久免费偷拍视频| 久久国内精品视频| 先锋影音久久| 亚洲男人的天堂在线| 一区二区av| 亚洲精品三级| 在线一区日本视频| 夜夜嗨av一区二区三区四区| 亚洲精品国产精品乱码不99按摩| 欧美成人一区二区三区在线观看| 久久综合中文色婷婷| 亚洲欧美中文在线视频| 欧美在线一级视频| 欧美在线观看一区二区| 亚洲欧美日韩国产精品| 亚洲一区久久久| 午夜精品视频| 久久aⅴ国产欧美74aaa| 欧美在线一级va免费观看| 久久成人综合网| 久久精品99国产精品日本| 欧美一区二区视频网站| 久久国产精品黑丝| 久久亚洲国产成人| 免费成人小视频| 亚洲第一久久影院| 欧美福利电影在线观看| 亚洲激情另类| 亚洲视频视频在线| 久久精品夜色噜噜亚洲aⅴ| 久久综合久久88| 欧美精品成人| 国产精品免费视频观看| 国产综合精品| 制服丝袜亚洲播放| 性欧美videos另类喷潮| 久久亚洲精品一区二区| 亚洲国产成人av| 欧美国产日韩免费| 亚洲综合国产| 卡一卡二国产精品| 欧美三区美女| 好看的av在线不卡观看| 国产又爽又黄的激情精品视频| 亚洲巨乳在线| 久久国产日韩| 亚洲国产精品电影在线观看| 中文亚洲字幕| 久久夜色精品| 国产亚洲成av人片在线观看桃| 最新国产成人av网站网址麻豆| 在线观看一区二区精品视频| 在线观看福利一区| 亚洲人被黑人高潮完整版| 久久久久国产一区二区| 亚洲另类自拍| 久久五月天婷婷| 国产欧美日韩视频一区二区| 亚洲少妇自拍| 欧美激情精品久久久久久免费印度|