源码如下:
NTSTATUS SfZwCreateFile(
OUT PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN OPTIONAL PLARGE_INTEGER AllocationSize,
IN ULONG FileAttributes,
IN ULONG ShareAccess,
IN ULONG CreateDisposition,
IN ULONG CreateOptions,
IN OPTIONAL PVOID EaBuffer,
IN ULONG Ealength)
{
NTSTATUS Status = 0;
ULONG i = 0;
ULONG j = 0;
ULONG Size = 0;
DWORD ProcessId = (DWORD)PsGetCurrentProcessId();
DWORD ThreadId = (DWORD)PsGetCurrentThreadId();
// 取进程名
if (!SfGetProcessName(wc_process_name))
{
Status = g_old_zw_create_file(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition,
CreateOptions, EaBuffer, Ealength);
InterlockedDecrement(&g_createfile_lock);
return Status;
}
// 如果是"360"发来的请求, 直接略过
if (wcsstr(wc_process_name, L"360") != NULL)
{
//DbgPrint(("YUBAN.FILEWATCH.DRIVER <<<<<< !SfNtCreateSection ------ NOTE: Is 360, Pass. ------ >>>>>>"));
Status = g_old_zw_create_file(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition,
CreateOptions, EaBuffer, Ealength);
InterlockedDecrement(&g_createfile_lock);
return Status;
}
/*
if (wcsncmp(wc_process_name, L"watchprocess.exe", wcslen(L"watchprocess.exe")) == 0)
{
DbgPrint(("YUBAN.FILEWATCH.DRIVER <<<<<< !SfNtCreateSection ------ NOTE: Is My Driver ------ >>>>>>"));
Status = g_old_zw_create_file(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition,
CreateOptions, EaBuffer, Ealength);
InterlockedDecrement(&g_createfile_lock);
return Status;
}
*/
// 缓冲区不为空才处理
if (ObjectAttributes != NULL && (ObjectAttributes->ObjectName != NULL) && (ObjectAttributes->ObjectName->Buffer != NULL))
{
// 输出调试信息时间对齐用到
/*
for (i = wcslen(ObjectAttributes->ObjectName->Buffer), j = 0; i < MAX_PROCESS; i++, j++)
{
wc_spc[j] = L' ';
}
DbgPrint(("YUBAN.FILEWATCH.DRIVER <<<<<< !SfZwCreateFile ------ File: %ws%ws, Current Process Id : %04d, Current Thread Id : %04d, DesiredAccess : 0x%08d,
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: c92d8000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8443f310, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Unable to load image \SystemRoot\System32\Drivers\Hookport.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Hookport.sys
*** ERROR: Module load completed but symbols could not be loaded for Hookport.sys
*** WARNING: Unable to verify timestamp for qutmdrv.sys
*** ERROR: Module load completed but symbols could not be loaded for qutmdrv.sys
READ_ADDRESS: GetPointerFromAddress: unable to read from 845a084c
Unable to read MiSystemVaType memory at 8457fe20
c92d8000
