NTFS FSD HOOK

NTSTATUS FSDHookControl( IN BOOLEAN IsHook ){    NTSTATUS status = STATUS_SUCCESS;    UNICODE_STRING uNTFS = {0};    PDRIVER_OBJECT NTFS = NULL;    RtlInitUnicodeString( &uNTFS, L"\\FileSystem\\Ntfs" );    status = ObReferenceObjectByName(   &uNTFS,                                         OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,                                        NULL,                                        0,                                        *IoDriverObjectType,                                        KernelMode,                                        NULL,                                        &NTFS);    if ( ! NT_SUCCESS( status ) )        return status;    if( IsHook )        NtfsCreateDispatch = InterlockedExchangePointer(                                    &NTFS->MajorFunction[ IRP_MJ_CREATE ],                                    NtfsCreateDispatchHook );    if( ! IsHook && MmIsAddressValid( NtfsCreateDispatch ) )        InterlockedExchangePointer( &NTFS->MajorFunction[ IRP_MJ_CREATE ],                                    NtfsCreateDispatch );    status = ObDereferenceObject( NTFS );    return status;}