NTSTATUS NT5FuckChildren(PSCB pScb)//XP
{
PULONG pExact = NULL ,pExact_Bak = NULL;
PLCB pLcb = NULL;
LIST_ENTRY *pList = NULL,*pNew = NULL;
PSCB pMyScb = NULL;
char Sign = 0;
if (!pScb || 0x703 != *(PUSHORT)pScb){
DbgPrint("pScb为NULL或者非文件夹不用Fuck!\n");
return 0;
}
DbgPrint("----------------进入目录分析----------------\n");
CLEANXCB(pScb)
pExact_Bak = pExact = ((PCHAR)pScb + 0x160) ;
//DbgPrint("pExact %X *pExact %X\n",pExact,*pExact);
if (*pExact == (ULONG)pExact){
DbgPrint("此SCB无子LCB!\n");
DbgPrint("----------------目录分析完毕----------------\n");
return STATUS_UNSUCCESSFUL;
}
pLcb = (PLCB)(*pExact - 0x8);
//DbgPrint("PLCB%XpLcb->ScbLinks.Flink%XpLcb->ScbLinks.Blink%X\n",pLcb,pLcb->ScbLinks.Flink,pLcb->ScbLinks.Blink);
if (pLcb->NodeTypeCode != 0x70B){
DbgPrint("此LCB错误!\n");
DbgPrint("----------------目录分析完毕----------------\n");
return STATUS_UNSUCCESSFUL;
}
while(pLcb->ScbLinks.Flink != pExact ){
DbgPrint("-->LCB: %X FCB: %X SCB: %X\n",pLcb,pLcb->CleanupCount,pLcb->Scb);
//===============================================================================
pNew = pList = & ((PFCB)((PCHAR)pLcb+0x14))->ScbQueue;
while(!((pList->Blink ==pNew || pList->Flink ==pNew) || pList->Flink==NULL)){
pMyScb = CONTAINING_RECORD(pList->Flink,SCB, FcbLinks.Flink);
DbgPrint("----------------MySCB %X NodeTypeCode:%X\n",pMyScb,pMyScb->Header.NodeTypeCode);
//--------------------------
CLEANXCB(pMyScb)
//-------------------------
if (0x703 == pMyScb->Header.NodeTypeCode) {//此SCB代表一个目录
DbgPrint("\t");
NT5FuckChildren(pMyScb);
}
pList = pList->Flink;
}
//=================================================================================
pLcb = ( ((PUCHAR)pLcb->ScbLinks.Flink) -0x8);
}
DbgPrint("-->LCB: %X FCB: %X SCB: %X\n",pLcb,pLcb->CleanupCount,pLcb->Scb);
pNew = pList = & ((PFCB)pLcb->CleanupCount)->ScbQueue;
while(!((pList->Blink ==pNew || pList->Flink ==pNew) || pList->Flink==NULL)){
pMyScb = CONTAINING_RECORD(pList->Flink,SCB, FcbLinks.Flink);
DbgPrint("----------------MySCB: %X NodeTypeCode:%X\n",pMyScb,pMyScb->Header.NodeTypeCode);
CLEANXCB(pMyScb)
if (0x703 == pMyScb->Header.NodeTypeCode) {//此SCB代表一个目录
DbgPrint("\t");
NT5FuckChildren(pMyScb);
}
pList = pList->Flink;
}
DbgPrint("----------------目录分析完毕----------------\n");
return STATUS_SUCCESS;
}
