bufferop.cpp

文件隐藏驱动 在2000XP2003等机器上可以运行 比较稳定

// HideHkApi.cpp : Defines the initialization routines for the DLL.
//

#include "stdafx.h"
#include "HideHkApi.h"
#include "HideHkApi_Header.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#endif


extern CArray<FILEHIDERULE, FILEHIDERULE> g_arryFileHideRule;
extern CArray<PROCESSHIDERULE, PROCESSHIDERULE> g_arryProcessHideRule;
extern CArray<KEYHIDERULE, KEYHIDERULE> g_arryKeyHideRule;
extern CArray<VALUEHIDERULE, VALUEHIDERULE> g_arryValueHideRule;
////////////////////////////////////////////////////////////////////////////////
//查找缓冲中是否有这个文件隐藏规则，返回值该值在缓冲区中的序号

int FindFileRule(FILEHIDERULE FileRule)
{
	int nIndex = 0;
	size_t nLen = 0;
	FILEHIDERULE inFileRule;


	nLen = strlen(FileRule.rule);

	for (nIndex = 0; nIndex < g_arryFileHideRule.GetCount(); nIndex ++ )
	{
		inFileRule = g_arryFileHideRule[nIndex];

		if ( nLen != strlen(inFileRule.rule) ) 
			continue;
		if ( !strncmp(inFileRule.rule, FileRule.rule, nLen ) )
			return nIndex;
	}

	return -1;
}

////////////////////////////////////////////////////////////////////////////////
//查找缓冲中是否有这个进程隐藏规则，返回值该值在缓冲区中的序号

int FindProcessRule(PROCESSHIDERULE ProcessRule)
{
	int nIndex = 0;
	size_t nLen = 0;
	PROCESSHIDERULE inProcessRule;


	nLen = strlen(ProcessRule.rule);

	for (nIndex = 0; nIndex < g_arryProcessHideRule.GetCount(); nIndex ++ )
	{
		inProcessRule = g_arryProcessHideRule[nIndex];

		if ( nLen != strlen(inProcessRule.rule) ) 
			continue;
		if ( !strncmp(inProcessRule.rule, ProcessRule.rule, nLen ) )
			return nIndex;
	}

	return -1;
}

////////////////////////////////////////////////////////////////////////////////
//查找缓冲中是否有这个注册表项隐藏规则，返回值该值在缓冲区中的序号

int FindKeyRule(KEYHIDERULE KeyRule)
{
	int nIndex = 0;
	size_t nLen = 0;
	KEYHIDERULE inKeyRule;


	nLen = strlen(KeyRule.rule);

	for (nIndex = 0; nIndex < g_arryKeyHideRule.GetCount(); nIndex ++ )
	{
		inKeyRule = g_arryKeyHideRule[nIndex];

		if ( nLen != strlen(inKeyRule.rule) ) 
			continue;
		if ( !strncmp(inKeyRule.rule, KeyRule.rule, nLen ) )
			return nIndex;
	}

	return -1;
}

////////////////////////////////////////////////////////////////////////////////
//查找缓冲中是否有这个注册表键值隐藏规则，返回值该值在缓冲区中的序号

int FindValueRule(VALUEHIDERULE ValueRule)
{
	int nIndex = 0;
	size_t nLen = 0;
	VALUEHIDERULE inValueRule;


	nLen = strlen(ValueRule.rule);

	for (nIndex = 0; nIndex < g_arryValueHideRule.GetCount(); nIndex ++ )
	{
		inValueRule = g_arryValueHideRule[nIndex];

		if ( nLen != strlen(inValueRule.rule) ) 
			continue;
		if ( !strncmp(inValueRule.rule, ValueRule.rule, nLen ) )
			return nIndex;
	}

	return -1;
}