文件过滤驱动--隐藏目录

//目录控制函数

NTSTATUS
SpyDirControl(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    )
{
    PFILESPY_DEVICE_EXTENSION devExt;
    PIO_STACK_LOCATION irpSp;
    PFILE_OBJECT FileObject;
    KEVENT waitEvent;
    NTSTATUS status;
    ULONG bufferLength;
    ULONG newLength;
    ULONG offset;
    ULONG currentPosition;
    PFILE_BOTH_DIR_INFORMATION dirInfo = NULL;
    PFILE_BOTH_DIR_INFORMATION preDirInfo = NULL;
    //CHAR  name[PROCNAMELEN];
    //PWSTR fileNameBuffer = UNICODE_NULL;

   if(gControlDeviceState == CLOSED || PsGetCurrentProcessId()==g_hProcessId)
   {
        return SpyDispatch(DeviceObject,Irp);
   }

   devExt = DeviceObject->DeviceExtension;
   irpSp = IoGetCurrentIrpStackLocation(Irp);
   FileObject = irpSp->FileObject;

    PAGED_CODE();

//  if (IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject)) {
//        Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
//        Irp->IoStatus.Information = 0;
//        IoCompleteRequest(Irp, IO_NO_INCREMENT);
//        return STATUS_INVALID_DEVICE_REQUEST;
//    }

    if (Irp->RequestorMode == KernelMode) {

        IoSkipCurrentIrpStackLocation(Irp);
        return IoCallDriver(devExt->NLExtHeader.AttachedToDeviceObject, Irp);
    }

    //
    // Record: Add by lwf : 07-07-20
    // Purpose: We care about volume filter device object
    //
   
    if (!devExt->NLExtHeader.StorageStackDeviceObject){
   
      IoSkipCurrentIrpStackLocation(Irp);
      return IoCallDriver(devExt->NLExtHeader.AttachedToDeviceObject, Irp);
   }

   if (irpSp->MinorFunction != IRP_MN_QUERY_DIRECTORY){
  
      IoSkipCurrentIrpStackLocation(Irp);
      return IoCallDriver(devExt->NLExtHeader.AttachedToDeviceObject, Irp);
   }

    if (FileBothDirectoryInformation != ((PQUERY_DIRECTORY)&irpSp->Parameters)->FileInformationClass) {

        IoSkipCurrentIrpStackLocation(Irp);
        return IoCallDriver(devExt->NLExtHeader.AttachedToDeviceObject, Irp);
    }

    KeInitializeEvent(&waitEvent, NotificationEvent, FALSE);
   
    IoCopyCurrentIrpStackLocationToNext(Irp);

    IoSetCompletionRoutine(Irp,
        SpyDirControlCompletion,
        &waitEvent,     //context parameter
        TRUE,
        TRUE,
        TRUE
        );
   
    status = IoCallDriver(devExt->NLExtHeader.AttachedToDeviceObject, Irp);
   
    //
    // Wait for the operation to complete
    //
    if (STATUS_PENDING == status) {
   
        status = KeWaitForSingleObject(&waitEvent,
              Executive,
              KernelMode,
              FALSE,
              NULL
              );
        ASSERT(STATUS_SUCCESS == status);
    }

    if (!NT_SUCCESS(status) ||(0 == irpSp->Parameters.QueryFile.Length)) {

        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return status;
    }
   
    //
    //  Record: add by lwf :07-06-30
    //  Purpose:Add for Test getting full path name
    //
    
    while (TRUE) {

        bufferLength = ((PQUERY_DIRECTORY)&irpSp->Parameters)->Length;
        newLength = bufferLength;
        currentPosition = 0;
        dirInfo =(PFILE_BOTH_DIR_INFORMATION) Irp->UserBuffer;
        preDirInfo = dirInfo;

        if ((!dirInfo) ||(dirInfo->NextEntryOffset > bufferLength)) {

              IoCompleteRequest(Irp, IO_NO_INCREMENT);
              return status;
        }
       
        do {
       
              //DbgPrint("[FileSpy.sys]MajorFunction-SpyDirControl:%s", SpyGetProcess(name));
            
              //
              // Record:  Modify by lwf : 07-06-20
              // Purpose: Hide Install Directory and permit special process's access
              // for virtual encrypt disk using "(_stricmp((const char*)VENCRPYTDISK, FileSpyGetProcess(name)))"
              // Record:  Modify For OS Restart BUG 07-07-06
              //
             
              offset = dirInfo->NextEntryOffset;
              if (/*1*/(dirInfo->FileNameLength > 0)/*1*/ &&
                  /*2*/(IsDirectory(dirInfo->FileAttributes))/*2*/ &&
                  /*3*/(g_ulHiddenDirLen == dirInfo->FileNameLength + sizeof(WCHAR))/*3*/ &&
                  /*4*/(_wcsnicmp( dirInfo->FileName, g_szHiddenDir, dirInfo->FileNameLength / sizeof(WCHAR)) == 0)/*4*/){
                
                 DbgPrint("[FileSpy.sys]MajorFunction-SpyDirControl,FileNameLength:%d",dirInfo->FileNameLength);
                
                  if (0 == offset) { // the last one

                      preDirInfo->NextEntryOffset = 0;
                      newLength = currentPosition;

                  } else {

                      if (preDirInfo != dirInfo) {

                            preDirInfo->NextEntryOffset += dirInfo->NextEntryOffset;
                            dirInfo = (PFILE_BOTH_DIR_INFORMATION) ((PUCHAR) dirInfo + offset);
                           
                      } else {

                            RtlMoveMemory((PUCHAR) dirInfo,(PUCHAR) dirInfo + offset, bufferLength - currentPosition - offset);
                            newLength -= offset;

                      }
                  }
                 
//                   break;
              }
              else
              {              
                  currentPosition += offset;
                  preDirInfo = dirInfo;
                  dirInfo =(PFILE_BOTH_DIR_INFORMATION)((PUCHAR) dirInfo + offset);
              }

        } while(0 != offset);

        if (0 == newLength) {
             
              KeResetEvent(&waitEvent);
             
              IoCopyCurrentIrpStackLocationToNext(Irp);
             
              IoSetCompletionRoutine(Irp,
                  SpyDirControlCompletion,
                  &waitEvent,     //context parameter
                  TRUE,
                  TRUE,
                  TRUE
                  );
             
              status = IoCallDriver(devExt->NLExtHeader.AttachedToDeviceObject, Irp);
             
              //
              //     Wait for the operation to complete
              //
              if (STATUS_PENDING == status) {
             
                  status = KeWaitForSingleObject(&waitEvent,
                      Executive,
                      KernelMode,
                      FALSE,
                      NULL
                      );
                  ASSERT(STATUS_SUCCESS == status);
              }

              if (!NT_SUCCESS(status) ||(0 == Irp->IoStatus.Information)) {
                 
                  break;
              }

        } else {

              Irp->IoStatus.Information = newLength;
              break;
        }
    }

    //
    //  Record: add by lwf :07-06-30
    //  Purpose:Add for Test getting full path name
    //

    Irp->IoStatus.Information = newLength;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
} 

 

 

BOOLEAN IsDirectory(
    ULONG dirattr
  )
//----------------------------------------------------------------------
//
// IsDirectory
//
// Check Whether File Object is Directory 
//
//----------------------------------------------------------------------
{
    return ( (dirattr != 0xffffffff) && (FILE_ATTRIBUTE_DIRECTORY & dirattr) );
 
}

 

 

 

 

        //
        // Record : Add by lwf : 07-06-19
        // Purpose: Handle Setting Hidden Directory Control Code
        // 
        case FILESPY_SetHiddenDir:

            if (InputBuffer == NULL || InputBufferLength <= 0) {

                IoStatus->Status = STATUS_INVALID_PARAMETER;
                DbgPrint("[FileSpy.sys]IOCTLCODE-FILESPY_SetHiddenDir,Err: buffer or length invalid");
                break;
            }           

            //
            //  Copy the device name and add a null to ensure that it is null
            //  terminated
            //

            g_szHiddenDir =  ExAllocatePoolWithTag( NonPagedPool,
                                                 InputBufferLength + sizeof(WCHAR),
                                                 FILESPY_POOL_TAG );

            if (NULL == g_szHiddenDir) {

                IoStatus->Status = STATUS_INSUFFICIENT_RESOURCES;
                DbgPrint("[FileSpy.sys]IOCTLCODE-FILESPY_SetHiddenDir,Err: alloc memory failed");
                break;
            }

            try {

                RtlCopyMemory( g_szHiddenDir, InputBuffer, InputBufferLength );

            } except (EXCEPTION_EXECUTE_HANDLER) {

                IoStatus->Status = GetExceptionCode();
                DbgPrint("[FileSpy.sys]IOCTLCODE-FILESPY_SetHiddenDir,Err: copy memory err-%0x",IoStatus->Status);
            }

            if (NT_SUCCESS( IoStatus->Status )) {

                g_szHiddenDir[InputBufferLength / sizeof(WCHAR)] = UNICODE_NULL;
                DbgPrint("[Filespy.sys]IOCTLCODE-SetHiddenDir.Dir:%ws-Len:%d",InputBuffer,InputBufferLength);
                g_ulHiddenDirLen = InputBufferLength;//string length
                IoStatus->Status = STATUS_SUCCESS;
            }

            break;