NTSTATUS HookZwCreateFile(OUT PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN PLARGE_INTEGER AllocationSize OPTIONAL,
IN ULONG FileAttributes,
IN ULONG ShareAccess,
IN ULONG CreateDisposition,
IN ULONG CreateOptions,
IN PVOID EaBuffer OPTIONAL,
IN ULONG EaLength)
{
UNICODE_STRING Path;
RtlInitUnicodeString(&Path,L"\\??\\D:\\1.txt");
if(RtlCompareUnicodeString(&Path,ObjectAttributes->ObjectName,TRUE)==0);
{
dprintf("%wZ",&Path);
return STATUS_SUCCESS;
}
return RealZwCreateFile(FileHandle,DesiredAccess,ObjectAttributes,IoStatusBlock,
AllocationSize OPTIONAL,FileAttributes,ShareAccess,CreateDisposition,CreateOptions,
EaBuffer OPTIONAL,EaLength);
}
我晕了 没看见...
