FNtCreateFile g_NtCreateFile = 0;
NTSTATUS MyNtCreateFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength)
{
if (KeGetCurrentIrql() != PASSIVE_LEVEL) return g_NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
if (ExGetPreviousMode() == KernelMode) return g_NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
if (PsGetProcessSessionId(IoGetCurrentProcess()) == 0) return g_NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
if (ObjectAttributes &&
ObjectAttributes->ObjectName &&
ObjectAttributes->ObjectName->Buffer)
{
wchar_t* name = (wchar_t*)ExAllocatePool(NonPagedPool, ObjectAttributes->ObjectName->Length + sizeof(wchar_t));
if (name)
{
RtlZeroMemory(name, ObjectAttributes->ObjectName->Length + sizeof(wchar_t));
RtlCopyMemory(name, ObjectAttributes->ObjectName->Buffer, ObjectAttributes->ObjectName->Length);
if (wcsstr(name, L"c:\\tmp\\1.txt"))
{
//新的名字
UNICODE_STRING nName;
RtlInitUnicodeString(&nName, L"c:\\tmp\22222.txt");
//复制回ObjectAttributes->ObjectName， 如果nName长度小于ObjectAttributes->ObjectName，那正常能执行。但是nName长度比ObjectAttributes->ObjectName长时候，就出问题了
RtlCopyUnicodeString(ObjectAttributes->ObjectName, &nName);
//也加了下面这两句，长度比他原来长时是乱码。。。。
ObjectAttributes->ObjectName->Length = nName.Length;
ObjectAttributes->ObjectName->MaximumLength = nName.MaximumLength;
NTSTATUS status = g_NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
ExFreePool(name);
return status;
}
ExFreePool(name);
}
}
return g_NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
}
}
