NTFS FSD HOOK

NTFS FSD HOOK

NTSTATUS FSDHookControl( IN BOOLEAN IsHook )
{
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING uNTFS = {0};
PDRIVER_OBJECT NTFS = NULL;

RtlInitUnicodeString( &uNTFS, L"\\FileSystem\\Ntfs" );

status = ObReferenceObjectByName(   &uNTFS,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
0,
*IoDriverObjectType,
KernelMode,
NULL,
&NTFS);

if ( ! NT_SUCCESS( status ) )
return status;

if( IsHook )
NtfsCreateDispatch = InterlockedExchangePointer(
&NTFS->MajorFunction[ IRP_MJ_CREATE ],
NtfsCreateDispatchHook );

if( ! IsHook && MmIsAddressValid( NtfsCreateDispatch ) )
InterlockedExchangePointer( &NTFS->MajorFunction[ IRP_MJ_CREATE ],
NtfsCreateDispatch );

status = ObDereferenceObject( NTFS );

return status;
}