test.h

在win2000sp4 + VM6基本稳定。 原理不多说了

#ifndef _TEST_H_
#define _TEST_H_

#include <ntddk.h>
#include "myfs.h"

PDEVICE_OBJECT	g_CDO;					//全局控制设备
LIST_ENTRY		g_HideObjHead;			//隐藏列表

//设备扩展定义
typedef struct _DEVICE_EXTENSION 
{
	union
	{
		PDEVICE_OBJECT AttachedToDevice;		//绑定的设备
		PDEVICE_OBJECT FileSystem;
	};
	
	PDEVICE_OBJECT PhysicDevice;				//实际的设备
	UNICODE_STRING DeviceName;					//设备名称
	WCHAR		   DeviceNameBuffer[512];	
} DEVICE_EXTENSION, *PDEVICE_EXTENSION, *PHOOK_EXTENSION;

typedef struct _HIDE_OBJECT
{
	LIST_ENTRY linkfield;	
	WCHAR	Name[256];
	ULONG	Flag;
} HIDE_FILE, *PHIDE_FILE;

VOID 
HideMe (IN PUNICODE_STRING RegistryPath);

VOID
AddHideObject(IN PWCHAR Name, 
			  IN ULONG Flag);

NTSTATUS 
SfPassThrough(IN PDEVICE_OBJECT DeviceObject, 
			  IN PIRP Irp);

VOID
SfGetObjectName(IN PVOID Object,
				IN OUT PUNICODE_STRING Name);

BOOLEAN
IS_MY_DEVICE_OBJECT(IN PDEVICE_OBJECT DeviceObject);

BOOLEAN
AttachToDiskDevice(IN PUNICODE_STRING pDiskName,
				   OUT PDEVICE_OBJECT *pOurDevice);

BOOLEAN
AttachDeviceToDeviceStack(IN PDEVICE_OBJECT DstDevice,
						  IN PDEVICE_OBJECT OurDevice);

VOID
DriverUnload(IN PDRIVER_OBJECT DriverObject);

NTSTATUS
FsDeviceCreate(IN PDEVICE_OBJECT DeviceObject,
			   IN PIRP Irp);

NTSTATUS
FsDeviceClose(IN PDEVICE_OBJECT DeviceObject,
			  IN PIRP Irp);

NTSTATUS
FsDirectoryControl(IN PDEVICE_OBJECT DeviceObject,
				   IN PIRP Irp);

NTSTATUS
FsDeviceControl(IN PDEVICE_OBJECT DeviceObject,
				   IN PIRP Irp);

NTSTATUS
FsFileSystemControl(IN PDEVICE_OBJECT DeviceObject,
					IN PIRP Irp);
NTSTATUS
DirControlCompletion(IN PDEVICE_OBJECT DeviceObject, 
					 IN PIRP Irp, 
					 IN PVOID Context);
BOOLEAN
HandleDirectory(IN OUT PFILE_BOTH_DIR_INFORMATION DirInfo,
				IN PULONG lpBufLenth);

BOOLEAN
IS_MY_HIDE_OBJECT(IN const WCHAR *Name, 
				  IN ULONG NameLenth, 
				  IN ULONG Flag);
#endif