HOOK NTFS 禁止格式化

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

if(bHooked == FALSE) { RtlInitUnicodeString (&HookDriverName, L"\\FileSystem\\Ntfs"); //获得\Driver\VolSnap驱动对象 status = ObReferenceObjectByName ( &HookDriverName, OBJ_CASE_INSENSITIVE, 0, 0, *IoDriverObjectType, KernelMode, 0, (PVOID*)&diskdrvobj ); if (NT_SUCCESS (status)  && pgOldFileControl == NULL) { pgOldFileControl = (PDRIVER_DISPATCH) InterlockedExchange( ( PLONG)&(diskdrvobj->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL]), (LONG)&DispatchMyfileControl); ObDereferenceObject(diskdrvobj); DbgPrint("Hook: HOOK driver object! Success\n"); bHooked = TRUE; }else          HOOK NTFS 禁止格式化               // 禁止格式化 NTSTATUS DispatchMyfileControl ( IN PDEVICE_OBJECT pDeviceObject, IN PIRP Irp) { PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation( Irp );   if(IrpSp->Parameters.FileSystemControl.FsControlCode == FSCTL_LOCK_VOLUME || IrpSp->Parameters.FileSystemControl.FsControlCode == FSCTL_DISMOUNT_VOLUME) { PIRP NewIrp = NULL; PIO_STACK_LOCATION NewIrpSp = NULL; KEVENT event; IO_STATUS_BLOCK         ioStatus; NTSTATUS status; PDEVICE_OBJECT  QuerryDev = NULL;   QuerryDev = IrpSp->FileObject->Vpb->RealDevice; if(QuerryDev == NULL) { _asm int 3; }   Irp->IoStatus.Information = 0; Irp->IoStatus.Status = STATUS_ACCESS_DENIED; IoCompleteRequest(Irp, IO_NO_INCREMENT); return STATUS_ACCESS_DENIED; } return pgOldFileControl(pDeviceObject,Irp); }