filtermanager.h

名为 GHOST的Win32下的Rootkit源码, 是学习ROOTKIT编写入门的优秀学习材料.

// Copyright Ric Vieler, 2006
// Support header for filterManager.c

#ifndef _FILTER_MANAGER_H_
#define _FILTER_MANAGER_H_

NTSTATUS insertFileFilter(PDRIVER_OBJECT pDriverObject,
	PDEVICE_OBJECT* ppOldDevice,
	PDEVICE_OBJECT* ppNewDevice,
	wchar_t* deviceName);

NTSTATUS insertNetworkFilter(PDRIVER_OBJECT pDriverObject,
	PDEVICE_OBJECT* ppOldDevice,
	PDEVICE_OBJECT* ppNewDevice,
	wchar_t* deviceName);

NTSTATUS insertKeyboardFilter(PDRIVER_OBJECT pDriverObject,
	PDEVICE_OBJECT* ppOldDevice,
	PDEVICE_OBJECT* ppNewDevice,
	wchar_t* deviceName);

void removeFilter(PDEVICE_OBJECT* ppOldDevice,
	PDEVICE_OBJECT* ppNewDevice);

#endif