枚举系统的过滤驱动

/************************************************************************/
/*查找文件过滤系统
                                                                      */
/************************************************************************/
NTSTATUS FindDevice(UNICODE_STRING FileSys,UNICODE_STRING ObjectType,PFILTERSYS_INFO PFilterInfo,ULONG Count)
{
NTSTATUS Status;
UNICODE_STRING DriverName1,DriverName2;
PDRIVER_OBJECT DriverObject=NULL;
PDEVICE_OBJECT AttachObject=NULL;
WCHAR DriNa1[64]={L'/0'};
WCHAR DriNa2[64]={L'/0'};

PLDR_DATA_TABLE_ENTRY Ldr=NULL;
wcscpy(DriNa1,L"//Driver//");

wcscat(DriNa1,FileSys.Buffer);
RtlInitUnicodeString(&DriverName1,DriNa1);
/************************************************************************/
/*                                                                   */
/************************************************************************/
DbgPrint("%S/n",DriverName1.Buffer);
Status=ObReferenceObjectByName(&DriverName1,OBJ_CASE_INSENSITIVE,NULL,FILE_ALL_ACCESS,IoDriverObjectType,KernelMode,NULL,(PVOID *)&DriverObject);
if (NT_SUCCESS(Status))
{
 if (DriverObject==NULL)
 {
  return STATUS_UNSUCCESSFUL;
 }
 __try
 {

 AttachObject=DriverObject->DeviceObject->AttachedDevice;
 
  if (AttachObject==NULL)
  {
   return STATUS_UNSUCCESSFUL;
  }
  DbgPrint("要查找的设备是:%S,类型:%S,%.8X/n",FileSys.Buffer,ObjectType.Buffer,AttachObject);

 
  DbgPrint("ATTACHNAME :%S/n",AttachObject->DriverObject->DriverName.Buffer);
  
  for (ULONG i=0;i<Count;i++)
  {
   if (PFilterInfo[i].AttachDevice==0)
   {
    
    PFilterInfo[i].ObjectType=AttachObject->DeviceType;
    PFilterInfo[i].AttachDevice=(ULONG)AttachObject;
    
    RtlCopyMemory(PFilterInfo[i].SysName,AttachObject->DriverObject->DriverName.Buffer,AttachObject->DriverObject->DriverName.Length);
    RtlCopyMemory(PFilterInfo[i].HostSysName,DriverObject->DriverName.Buffer,DriverObject->DriverName.Length);
    Ldr=(PLDR_DATA_TABLE_ENTRY)(AttachObject->DriverObject->DriverSection);
    if (Ldr!=NULL && Ldr->FullDllName.Buffer!=NULL)
    {
     RtlCopyMemory(PFilterInfo[i].SysPath,Ldr->FullDllName.Buffer,Ldr->FullDllName.Length);
    }
    else
    {
     RtlCopyMemory(PFilterInfo[i].SysPath,AttachObject->DriverObject->DriverName.Buffer,AttachObject->DriverObject->DriverName.Length);
    }
    if (i==Count-1)
    {
     return STATUS_BUFFER_TOO_SMALL;
    }
    return STATUS_SUCCESS;
    
   }
   if (i==Count-1)
   {
    return STATUS_BUFFER_TOO_SMALL;
   }
  }
  
  
  
 } 
 __except(EXCEPTION_EXECUTE_HANDLER)
 {
  
 }
 return STATUS_SUCCESS;
 

 
}
else
{
 wcscpy(DriNa2,L"//FileSystem//");
 
 wcscat(DriNa2,FileSys.Buffer);
 RtlInitUnicodeString(&DriverName2,DriNa2);

 DbgPrint("%S/n",DriverName2.Buffer);
 Status=ObReferenceObjectByName(&DriverName2,OBJ_CASE_INSENSITIVE,NULL,FILE_ALL_ACCESS,IoDriverObjectType,KernelMode,NULL,(PVOID *)&DriverObject);
 if (NT_SUCCESS(Status))
 {
  if (DriverObject==NULL)
  {
   return STATUS_UNSUCCESSFUL;
  }
  __try
  {
  AttachObject=DriverObject->DeviceObject->AttachedDevice;
   if (AttachObject==NULL)
   {
    return STATUS_UNSUCCESSFUL;
   }
   DbgPrint("要查找的设备是:%S,类型:%S,%.8X/n",FileSys.Buffer,ObjectType.Buffer,AttachObject);
   DbgPrint("ATTACHNAME :%S/n",AttachObject->DriverObject->DriverName.Buffer);
   for (ULONG i=0;i<Count;i++)
   {
    if (PFilterInfo[i].AttachDevice==0)
    {
     
     PFilterInfo[i].ObjectType=AttachObject->DeviceType;
     PFilterInfo[i].AttachDevice=(ULONG)AttachObject;
     
     RtlCopyMemory(PFilterInfo[i].SysName,AttachObject->DriverObject->DriverName.Buffer,AttachObject->DriverObject->DriverName.Length);
     RtlCopyMemory(PFilterInfo[i].HostSysName,DriverObject->DriverName.Buffer,DriverObject->DriverName.Length);
     Ldr=(PLDR_DATA_TABLE_ENTRY)(AttachObject->DriverObject->DriverSection);
     if (Ldr!=NULL && Ldr->FullDllName.Buffer!=NULL)
     {
      RtlCopyMemory(PFilterInfo[i].SysPath,Ldr->FullDllName.Buffer,Ldr->FullDllName.Length);
     }
     else
     {
      RtlCopyMemory(PFilterInfo[i].SysPath,AttachObject->DriverObject->DriverName.Buffer,AttachObject->DriverObject->DriverName.Length);
     }
     if (i==Count-1)
     {
      return STATUS_BUFFER_TOO_SMALL;
     }
     return STATUS_SUCCESS;
     
    }
    if (i==Count-1)
    {
     return STATUS_BUFFER_TOO_SMALL;
    }
   }
   
  }
  __except(EXCEPTION_EXECUTE_HANDLER)
  {
       
  }
   
   
  return STATUS_SUCCESS;
  
   
 }
 else
 {
  return Status;
 }
 
}

return STATUS_UNSUCCESSFUL;

}

#pragma PAGEDCODE
NTSTATUS OpenFileSysDir(UNICODE_STRING DriPath,PFILTERSYS_INFO PFilterInfo,ULONG Count)
{
 
 OBJECT_ATTRIBUTES oa;
 NTSTATUS Status;
 HANDLE hDriver;
 ULONG Length=0x8000;
 ULONG                context,dwRet,count=0;
 PDIRECTORY_BASIC_INFORMATION pBuffer=NULL,pB2;
 //先打开FileSystem目录
 //RtlInitUnicodeString(&DriPath,L"//FileSystem");
 InitializeObjectAttributes(&oa,&DriPath,OBJ_CASE_INSENSITIVE,NULL,NULL);
 Status=ZwOpenDirectoryObject(&hDriver,DIRECTORY_QUERY,&oa);
 if (NT_SUCCESS(Status))
 {
next:
 pBuffer=(PDIRECTORY_BASIC_INFORMATION)ExAllocatePoolWithTag(PagedPool,Length,'so');
 
 if (pBuffer!=NULL)
 {
  Status=ZwQueryDirectoryObject(hDriver,pBuffer,Length,FALSE,TRUE,&context,&dwRet);
  if (NT_SUCCESS(Status))
  { 
   pB2=pBuffer;
   while (pB2->ObjectName.Length!=0&& pB2->ObjectTypeName.Length!=0)
   {
    DbgPrint("ObjectName: %S ObjectTypeName: %S ",pB2->ObjectName.Buffer,pB2->ObjectTypeName.Buffer);
   
    Status=FindDevice(pB2->ObjectName,pB2->ObjectTypeName,PFilterInfo, Count);
    if (Status==STATUS_BUFFER_TOO_SMALL)
    {
     return STATUS_BUFFER_TOO_SMALL;
    }
    pB2++;
    count++;
   }
   if (pBuffer)
   {
    ExFreePoolWithTag(pBuffer,'so');
   }
   if (hDriver)
   {
    ZwClose(hDriver);
   }
   // DbgPrint("count is %d/n",count);
   return STATUS_SUCCESS;
  }
  else if (Status==STATUS_BUFFER_TOO_SMALL||Status==STATUS_MORE_ENTRIES)
  {
   ExFreePoolWithTag(pBuffer,'so');
   Length*=2;
   goto next;
  }
  else{
   
   // DbgPrint("ZwQueryDirectoryObject failed/n");
   ExFreePoolWithTag(pBuffer,'so');
   if (hDriver)
   {
    ZwClose(hDriver);
   }
   return STATUS_UNSUCCESSFUL;
  }
 }
 else
 {
  if (hDriver)
  {
   ZwClose(hDriver);
  }
  return STATUS_UNSUCCESSFUL;
 }
 }
 else
 {
  DbgPrint("ZwOpenDirectoryObject failed,status %.8X/n",Status);
  return STATUS_UNSUCCESSFUL;
 }
 
 
}

 

 

下面是调用上面的

RtlInitUnicodeString(&DirPath1,L"//FileSystem");
    status=OpenFileSysDir(DirPath1,POUTfilterInfo,cout/sizeof(FILTERSYS_INFO));
    if (STATUS_BUFFER_TOO_SMALL==status)
    {
     DbgPrint("分配的内存太小/n");
     goto END;
    }
    RtlInitUnicodeString(&DirPath2,L"//Driver");
    status=OpenFileSysDir(DirPath2,POUTfilterInfo,cout/sizeof(FILTERSYS_INFO));
    if (STATUS_BUFFER_TOO_SMALL==status)
    {
     DbgPrint("分配的内存太小/n");
     goto END;
    }

 

POUTfilterInfo是分配的内存，用来存放枚举到的过滤驱动的一些信息

//检测到的过滤驱动的信息
typedef struct _FILTERSYS_INFO{
 ULONG ObjectType;
 WCHAR SysName[64];
 WCHAR SysPath[260];
 ULONG AttachDevice;
 WCHAR HostSysName[64];
 
}FILTERSYS_INFO,*PFILTERSYS_INFO;

 

 

代码写的比较乱，还有改进的地方，例如FindDevice这里面