ATAPI（磁盘端口驱动）级文件保护简单实现

define IoGetIrpStackLocation( Irp , Level) (/
 (Irp)->Tail.Overlay.CurrentStackLocation + Level )
BOOL IfIrpHasFobj(PIRP pIrp , LPCWSTR FileName)
{
ULONG i , j ;
PIO_STACK_LOCATION irpStack ;
PVOID NamePool ;

for ( i = 0 ; i < (ULONG)(pIrp->StackCount - pIrp->CurrentLocation + 1) ; i ++)
{
 irpStack = IoGetIrpStackLocation(pIrp , i );
 if (irpStack->FileObject)
 {
 if (irpStack->FileObject->FileName.Buffer)
 {
 NamePool = ExAllocatePool(NonPagedPool , irpStack->FileObject->FileName.Length + 2);
 if (NamePool)
 {
 KDMSG(("%ws" , irpStack->FileObject->FileName.Buffer));
 RtlCopyMemory(NamePool ,
 irpStack->FileObject->FileName.Buffer ,
 irpStack->FileObject->FileName.Length + 2);
 _wcsupr((wchar_t*)NamePool);
 if (wcsstr((wchar_t*)NamePool , FileName))
 {
 ExFreePool(NamePool);
 return TRUE ;
 }

 ExFreePool(NamePool);
 }

 }
 }

}
return FALSE ;
}

NTSTATUS ProxyAtapiScsi(PDEVICE_OBJECT devobj , PIRP pIrp)
{
NTSTATUS stat ;
if (IfIrpHasFobj(pIrp , L"123.TXT"))
{
 pIrp->IoStatus.Status = 0xc0000001;
 pIrp->IoStatus.Information = 0 ;
 
 IoCompleteRequest(pIrp , IO_NO_INCREMENT);
 return 0xc0000001;
}

__asm
{
 push pIrp
 push devobj
 call OldAtapiScsiDispatch
 mov stat ,eax
}
return stat ;
}