hookdevice.cpp

一个过滤层文件系统驱动的完整代码,实现了文件的加密,操作截获等

/*++

Copyright (c) 2003  By LiGen

Module Name:

    HookDevice.cpp

Abstract:

		

Environment:

    kernel mode only

Notes:

    See readme.txt

Revision History:


Author：
	Li Gen 
	E-mail : [e-mail]

--*/
#include "FsTPM.h"

VOID 
FsTPMIoGetRelatedDeviceObject(
						 IN PFILE_OBJECT FileObject,
						 OUT PDEVICE_OBJECT *ppDeviceObject,
						 OUT PVPB			*ppVpb
						 )
										 
{
    PDEVICE_OBJECT  deviceObject = NULL;
	PVPB		    pVpb = NULL;
	
    //
    // If the file object was taken out against the mounted file system, it
    // will have a Vpb. Traverse it to get to the DeviceObject. Note that in
    // this case we should never follow FileObject->DeviceObject, as that
    // mapping may be invalid after a forced dismount.
    //
	
    if (FileObject->Vpb != NULL && FileObject->Vpb->DeviceObject != NULL) {
		
        ASSERT(!(FileObject->Flags & FO_DIRECT_DEVICE_OPEN));
        deviceObject = FileObject->Vpb->DeviceObject;
		pVpb = FileObject->Vpb;
		
        //
        // If a driver opened a disk device using direct device open and 
        // later on it uses IoGetRelatedTargetDeviceObject to find the
        // device object it wants to send an IRP then it should not get the
        // filesystem device object. This is so that if the device object is in the
        // process of being mounted then vpb is not stable.
        //
		
    } else if (!(FileObject->Flags & FO_DIRECT_DEVICE_OPEN) &&
		FileObject->DeviceObject->Vpb != NULL &&
		FileObject->DeviceObject->Vpb->DeviceObject != NULL) {
		
		deviceObject = FileObject->DeviceObject->Vpb->DeviceObject;
		pVpb = FileObject->DeviceObject->Vpb; 
		
		//
		// This is a direct open against the device stack (and there is no mounted
		// file system to strain the IRPs through).
		//
		
    } else {
		
        deviceObject = FileObject->DeviceObject;
    }
	
    ASSERT( deviceObject != NULL );

    if (deviceObject->AttachedDevice != NULL) {
        deviceObject = IoGetAttachedDevice( deviceObject );
    }
	
    //
    // Check to see whether or not the device has any associated devices.
    // If so, return the highest level device; otherwise, return a pointer
    // to the device object itself.
    //
	*ppDeviceObject = deviceObject;
	*ppVpb = pVpb;
	
}


NTSTATUS 
HookDevice( 
    IN ULONG DiskNum, 
    IN PDRIVER_OBJECT DriverObject 
    )
//++
// Function:	HookDrive
//
// Description:
//		Hook the drive specified by determining which device object to 
// attach to. The algorithm used here is similar to the one used
// internally by NT to determine which device object a file system request
// is directed at.
//
// Arguments:
//		DiskNum         - 0 stand for Driver A, 1 stand for Driver B, ect.
//		DriverObject - Passed from I/O Manager
//
// Return value:
//		STATUS_SUCCESS if successful,
//		STATUS_UNSUCCESSFUL otherwise
//--
{
    IO_STATUS_BLOCK     ioStatus;
    HANDLE              ntFileHandle;   
    OBJECT_ATTRIBUTES   objectAttributes;
    PDEVICE_OBJECT      fileSysDevice;
    PDEVICE_OBJECT      hookDevice;
    UNICODE_STRING      fileNameUnicodeString;
//    ULONG               fileFsAttributesSize;
    WCHAR               filename[] = L"\\DosDevices\\A:\\";
    NTSTATUS            ntStatus;
    ULONG               i;
    PFILE_OBJECT        fileObject;
    PHOOK_EXTENSION     hookExtension;
	PVPB				pVpb;
    

    //
    // Is it a legal drive letter?
    //
    if( DiskNum >= 26 )  {

        return STATUS_UNSUCCESSFUL;
    }

    //
    // Has this drive already been hooked?
    //
    if( DriveHookDevices[DiskNum] == NULL )  {

        //
        // Frob the name to make it refer to the drive specified in the input 
        // parameter.
        //
        filename[12] = (WCHAR) ('A'+DiskNum);

        //
        // We have to figure out what device to hook - first open the volume's 
        // root directory
        //
        RtlInitUnicodeString( &fileNameUnicodeString, filename );
        InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString, 
                                    OBJ_CASE_INSENSITIVE, NULL, NULL );
        ntStatus = ZwCreateFile( &ntFileHandle, SYNCHRONIZE|FILE_ANY_ACCESS, 
                                 &objectAttributes, &ioStatus, NULL, 0, FILE_SHARE_READ|FILE_SHARE_WRITE, 
                                 FILE_OPEN, 
                                 FILE_SYNCHRONOUS_IO_NONALERT|FILE_DIRECTORY_FILE, 
                                 NULL, 0 );
        if( !NT_SUCCESS( ntStatus ) ) {

            FsTPM_DbgPrint(("FsTPM: Could not open drive %c: %x\n", 'A'+DiskNum, ntStatus ));
            return ntStatus;
        }

        FsTPM_DbgPrint(("FsTPM:  opened the root directory!!! handle: %x\n", ntFileHandle));   

        //
        // Got the file handle, so now look-up the file-object it refers to
        //
        ntStatus = ObReferenceObjectByHandle( ntFileHandle, FILE_READ_DATA, 
                                              NULL, KernelMode, (void**)&fileObject, NULL );

        if( !NT_SUCCESS( ntStatus )) {

            FsTPM_DbgPrint(("FsTPM: Could not get fileobject from handle: %c. I have added some codes: '(void**)'\n", 'A'+DiskNum ));
            ZwClose( ntFileHandle );
            return ntStatus;
        }

        //  
        // Next, find out what device is associated with the file object by getting its related
        // device object
        //
        FsTPMIoGetRelatedDeviceObject( fileObject, &fileSysDevice, &pVpb);

        if( ! fileSysDevice ) {

            FsTPM_DbgPrint(("FsTPM: Could not get related device object: %c\n", 'A'+DiskNum ));
            ObDereferenceObject( fileObject );
            ZwClose( ntFileHandle );
            return STATUS_UNSUCCESSFUL;
        }

        //  
        // Check the device list to see if we've already attached to this particular device. 
        // This can happen when more than one drive letter is being handled by the same network
        // redirecter
        //  
        for( i = 0; i < 26; i++ ) {

            if( DriveHookDevices[i] == fileSysDevice ) {

                //
                // If we're already watching it, associate this drive letter
                // with the others that are handled by the same network driver. This
                // enables us to intelligently update the hooking menus when the user
                // specifies that one of the group should not be watched -we mark all
                // of the related drives as unwatched as well
                //
                ObDereferenceObject( fileObject );
                ZwClose( ntFileHandle );
                DriveHookDevices[ DiskNum ] = fileSysDevice;
				FsTPM_DbgPrint(("DiskNum %c has already been hooked.\n",'A'+DiskNum));

                return STATUS_SUCCESS;
            }
        }

        //
        // The file system's device hasn't been hooked already, so make a hooking device
        //  object that will be attached to it.
        //
        ntStatus = IoCreateDevice( DriverObject,
                                   sizeof(HOOK_EXTENSION),
                                   NULL,
                                   fileSysDevice->DeviceType,
                                   0,
                                   FALSE,
                                   &hookDevice );
        if( !NT_SUCCESS(ntStatus) ) {

            FsTPM_DbgPrint(("FsTPM: failed to create associated device: %c\n", 'A'+DiskNum ));   

            ObDereferenceObject( fileObject );
            ZwClose( ntFileHandle );

            return STATUS_UNSUCCESSFUL;
        }

        //
        // Clear the device's init flag as per NT DDK KB article on creating device 
        // objects from a dispatch routine
        //
        hookDevice->Flags &= ~DO_DEVICE_INITIALIZING;

        if ( fileSysDevice->Flags & DO_BUFFERED_IO ) {

             hookDevice->Flags |= DO_BUFFERED_IO;
        }

        if ( fileSysDevice->Flags & DO_DIRECT_IO ) {

              hookDevice->Flags |= DO_DIRECT_IO;
        }

  
		//
        // Finally, attach to the device. The second we're successfully attached, we may 
        // start receiving IRPs targetted at the device we've hooked.
        //
		PDEVICE_OBJECT Ret;
        Ret = IoAttachDeviceToDeviceStack( hookDevice, fileSysDevice );