过滤/ObReferenceObjectByName/XT

#include "ntddk.h"

NTKERNELAPI
NTSTATUS
ObReferenceObjectByName(
IN PUNICODE_STRING ObjectName,
IN ULONG Attributes,
IN PACCESS_STATE PassedAccessState OPTIONAL,
IN ACCESS_MASK DesiredAccess OPTIONAL,
IN POBJECT_TYPE ObjectType,
IN KPROCESSOR_MODE AccessMode,
IN OUT PVOID ParseContext OPTIONAL,
OUT PVOID *Object
);

extern POBJECT_TYPE *IoDriverObjectType;

//global
PDRIVER_OBJECT g_FilterDriverObject;
PDRIVER_DISPATCH gfn_OrigReadCompleteRoutine;

NTSTATUS FilterReadCompleteRoutine(
__in struct _DEVICE_OBJECT *DeviceObject,
__inout struct _IRP *Irp
)
{
KdPrint(("IRP_MJ_DEVICE_CONTROL."));

return gfn_OrigReadCompleteRoutine(DeviceObject,Irp);
}

VOID UnFilterDriverRoutine()
{
if (MmIsAddressValid(gfn_OrigReadCompleteRoutine))
{
g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = gfn_OrigReadCompleteRoutine;
}
}

NTSTATUS FilterDriverQuery()
{
NTSTATUS Status;
UNICODE_STRING  usObjectName;

RtlInitUnicodeString(&usObjectName,L"\\Driver\\Xuetr");

Status = ObReferenceObjectByName(
&usObjectName,
OBJ_CASE_INSENSITIVE,
NULL,
0,
*IoDriverObjectType,
KernelMode,
NULL,
(PVOID*)&g_FilterDriverObject
);

if(!NT_SUCCESS(Status))
{
KdPrint (("ObReferenceObjectByName failed"));
return Status;
}
KdPrint (("0x%X",g_FilterDriverObject));

gfn_OrigReadCompleteRoutine = g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL];
g_FilterDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = (PDRIVER_DISPATCH)FilterReadCompleteRoutine;

ObDereferenceObject(g_FilterDriverObject);

return STATUS_SUCCESS;
}

VOID MyDriverUnLoad(PDRIVER_OBJECT pDriverObject)
{
UNICODE_STRING usSymName;
RtlInitUnicodeString(&usSymName,L"\\??\\FirstDevice");

if(pDriverObject->DeviceObject!=NULL)
{
IoDeleteSymbolicLink(&usSymName);
IoDeleteDevice(pDriverObject->DeviceObject);
KdPrint(("delete device success"));
}

UnFilterDriverRoutine();

}

NTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObject)
{
NTSTATUS Status;
PDEVICE_OBJECT pDevObj;
UNICODE_STRING usDevName;//type error bluescreen
UNICODE_STRING usSymName;

RtlInitUnicodeString(&usDevName,L"\\Device\\FirstDevice");

Status = IoCreateDevice(pDriverObject,0,&usDevName,FILE_DEVICE_UNKNOWN,0,TRUE,&pDevObj);

if(!NT_SUCCESS(Status))
{
return Status;
}

pDevObj->Flags |= DO_BUFFERED_IO;

RtlInitUnicodeString(&usSymName,L"\\??\\FirstDevice");

Status = IoCreateSymbolicLink(&usSymName,&usDevName);
if(!NT_SUCCESS(Status))
{
IoDeleteDevice(pDevObj);
return Status;
}
return STATUS_SUCCESS;

}

NTSTATUS CreateCompleteRoutine(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{

NTSTATUS Status;

Status = STATUS_SUCCESS;

KdPrint(("create routine"));

pIrp->IoStatus.Status = Status;
pIrp->IoStatus.Information = 0;

IoCompleteRequest(pIrp,IO_NO_INCREMENT);
return Status;
}

NTSTATUS CloseCompleteRoutine(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
NTSTATUS Status;

Status = STATUS_SUCCESS;

KdPrint(("close routine"));

pIrp->IoStatus.Status = Status;
pIrp->IoStatus.Information = 0;

IoCompleteRequest(pIrp,IO_NO_INCREMENT);
return Status;
}

NTSTATUS ReadCompleteRoutine(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
NTSTATUS Status;

Status = STATUS_SUCCESS;

KdPrint(("read routine"));

pIrp->IoStatus.Status = Status;
pIrp->IoStatus.Information = 0;

IoCompleteRequest(pIrp,IO_NO_INCREMENT);
return Status;
}

NTSTATUS WriteCompleteRoutine(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
NTSTATUS Status;

Status = STATUS_SUCCESS;

KdPrint(("write routine"));

pIrp->IoStatus.Status = Status;
pIrp->IoStatus.Information = 0;

IoCompleteRequest(pIrp,IO_NO_INCREMENT);
return Status;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
NTSTATUS Status;

Status = CreateDevice(pDriverObject);
if (!NT_SUCCESS(Status))
{
KdPrint(("create device failed"));
}
else
{
KdPrint(("create device successed"));
KdPrint(("%wZ",pRegistryPath));
}

pDriverObject->MajorFunction[IRP_MJ_CREATE] = CreateCompleteRoutine;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = CloseCompleteRoutine;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = ReadCompleteRoutine;
pDriverObject->MajorFunction[IRP_MJ_WRITE] = WriteCompleteRoutine;

FilterDriverQuery();

pDriverObject->DriverUnload = MyDriverUnLoad;
return STATUS_SUCCESS;

}