通過Hook Npfs對象的Dispatch的IRP回調函數,達到過濾命名管道的需求,這種方式測試了WinXPsp3-win10_1909 都非常穩定!
效果圖:
代碼:
#include <ntifs.h>
#include <ntstrsafe.h>
#include <ntddkbd.h>
// Propertys
// ==============================================================================
extern POBJECT_TYPE* IoDriverObjectType;
NTKERNELAPI UCHAR* NTAPI PsGetProcessImageFileName(PEPROCESS process);
NTSTATUS ObReferenceObjectByName(
PUNICODE_STRING ObjectName,
ULONG Attributes,
PACCESS_STATE AccessState,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID ParseContext,
PVOID* Object
);
#define DELAY_ONE_MICROSECOND (-10)
#define DELAY_ONE_MILLISECOND (DELAY_ONE_MICROSECOND*1000)
#define DELAY_ONE_SECOND (DELAY_ONE_MILLISECOND*1000);
// The Target Driver Object Name
#define TARGET_DRIVER_NAME L"\\FileSystem\\Npfs"
PDRIVER_OBJECT g_pNpfs = NULL;
BOOLEAN IsHooked = FALSE;
PDRIVER_DISPATCH g_OriginalCreate = NULL;
PDRIVER_DISPATCH g_OriginalCreateNamedPipe = NULL;
NTSTATUS MyCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(Irp);
DbgPrint("Openning NamedPipe:%wZ\n", &pStack->FileObject->FileName);
return g_OriginalCreate(DeviceObject,Irp);
}
NTSTATUS MyCreateNamedPipe(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(Irp);
DbgPrint("Creating NamedPipe:%wZ\n", &pStack->FileObject->FileName);
return g_OriginalCreateNamedPipe(DeviceObject, Irp);
}
// 卸載函數
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
if (g_pNpfs)
{
InterlockedExchangePointer(&g_pNpfs->MajorFunction[IRP_MJ_CREATE], g_OriginalCreate);
InterlockedExchangePointer(&g_pNpfs->MajorFunction[IRP_MJ_CREATE_NAMED_PIPE], g_OriginalCreateNamedPipe);
ObDereferenceObject(g_pNpfs);
DbgPrint("Restore hook!\n");
}
KdPrint(("Driver unloaded!!!\n"));
}
//
NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT pDriverObject, _In_ PUNICODE_STRING RegistryPath)
{
NTSTATUS status;
KdPrint(("Enter DriverEntry!!\n"));
pDriverObject->DriverUnload = DriverUnload;
UNICODE_STRING uniNtNameString = {0};
RtlInitUnicodeString(&uniNtNameString, TARGET_DRIVER_NAME);
status = ObReferenceObjectByName(&uniNtNameString, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &g_pNpfs);
if (!NT_SUCCESS(status))
{
KdPrint(("Couldn't get the NPFS driver object \n"));
return STATUS_UNSUCCESSFUL;
}
else
{
// Start Hooking
g_OriginalCreate = InterlockedExchangePointer(&g_pNpfs->MajorFunction[IRP_MJ_CREATE],MyCreate);
g_OriginalCreateNamedPipe = InterlockedExchangePointer(&g_pNpfs->MajorFunction[IRP_MJ_CREATE_NAMED_PIPE],MyCreateNamedPipe);
DbgPrint("Hook: HOOK driver object! Success\n");
}
return status;
}