ATAPI（磁盘端口驱动）级文件保护简单实现

来源：互联网发布：谷原章介知乎编辑：程序博客网时间：2024/06/02 02:23

ATAPI（磁盘端口驱动）级文件保护简单实现

#define IoGetIrpStackLocation( Irp , Level) (\
(Irp)->Tail.Overlay.CurrentStackLocation + Level )
BOOL IfIrpHasFobj(PIRP pIrp , LPCWSTR FileName)
{
ULONG i , j ;
PIO_STACK_LOCATION irpStack ;
PVOID NamePool ;

for ( i = 0 ; i < (ULONG)(pIrp->StackCount - pIrp->CurrentLocation + 1) ; i ++)
{
   irpStack = IoGetIrpStackLocation(pIrp , i );
   if (irpStack->FileObject)
   {
    if (irpStack->FileObject->FileName.Buffer)
    {
     NamePool = ExAllocatePool(NonPagedPool , irpStack->FileObject->FileName.Length + 2);
     if (NamePool)
     {
      KDMSG(("%ws" , irpStack->FileObject->FileName.Buffer));
      RtlCopyMemory(NamePool ,
       irpStack->FileObject->FileName.Buffer ,
       irpStack->FileObject->FileName.Length + 2);
      _wcsupr((wchar_t*)NamePool);
      if (wcsstr((wchar_t*)NamePool , FileName))
      {
       ExFreePool(NamePool);
       return TRUE ;
      }

ExFreePool(NamePool);
}

}
}

}
return FALSE ;
}

NTSTATUS ProxyAtapiScsi(PDEVICE_OBJECT devobj , PIRP pIrp)
{
NTSTATUS stat ;
if (IfIrpHasFobj(pIrp , L"123.TXT"))
{
   pIrp->IoStatus.Status = 0xc0000001;
   pIrp->IoStatus.Information = 0 ;

   IoCompleteRequest(pIrp , IO_NO_INCREMENT);
   return 0xc0000001;
}

__asm
{
   push pIrp
   push devobj
   call OldAtapiScsiDispatch
   mov   stat ,eax
}
return stat ;
}

http://hi.baidu.com/new/mj0011