| 市面上所有号称"虚拟机","防火墙"的实时监控杀毒软件无一不是使用的IFSHOOK技术.但是同时也有一些朋友不断写MAIL给我打听如何实现读写的监控.下面给出用VTOOLSD写的代码.也就是所有实时杀毒软件的奥秘.同时,很多拦截文件操作的软件,例如对目录加密,文件加密等,也采用了雷同的技术. 由于代码十分简单,不分析了. //============================================================================= // //By Lu Lin 2000.5.10 // Apply with VtoolsD 3.01 // DDK version is available if requested. //Abstract: // Install a IFS hook, monitoring any read and write access // //============================================================================= // IFSHOOK.c - main module for IFSHOOK #define DEVICE_MAIN #include "ifshook.h" #undef DEVICE_MAIN //typedef EventHdl(pevent pev,pioreq pir); typedef struct _Monitored_Files{ struct _Monitored_Files *pNext_Monitored_Files;//pointer to next struct struct _Monitored_Files *pPre_Monitored_Files;//pointer to previous struct int sfn;//system file number int open_count; char path[260]; //ansi path name }_Monitored_Files,*pMonitored_Files; // //Declare virtual device // Declare_Virtual_Device(IFSHOOK) _Monitored_Files Monitored_Files; ppIFSFileHookFunc PrevHook; DefineControlHandler(SYS_VM_INIT, OnSysVMInit); DefineControlHandler(SYS_DYNAMIC_DEVICE_INIT, OnSysDynamicDeviceInit); DefineControlHandler(SYS_DYNAMIC_DEVICE_EXIT, OnSysDynamicDeviceExit); DefineControlHandler(SYS_VM_TERMINATE, OnSysVMTerminate); PCHAR ConvertPath( int drive, path_t ppath, PCHAR fullpathname ) { int i = 0; _QWORD result; // // Stick on the drive letter if we know it. // if( drive != 0xFF ) { fullpathname[0] = drive+'A'-1; fullpathname[1] = ':'; i = 2; } UniToBCSPath( &fullpathname[i], ppath-〉pp_elements, 260 , BCS_WANSI, &result ); return( fullpathname ); } pMonitored_Files IsFileOpened(int i){ pMonitored_Files p=&Monitored_Files; while (p){ if (i==p-〉sfn){ return p; } p=p-〉pNext_Monitored_Files; } return 0; } BOOL ControlDispatcher( DWORD dwControlMessage, DWORD EBX, DWORD EDX, DWORD ESI, DWORD EDI, DWORD ECX) { START_CONTROL_DISPATCH ON_SYS_VM_INIT(OnSysVMInit); ON_SYS_DYNAMIC_DEVICE_INIT(OnSysDynamicDeviceInit); ON_SYS_DYNAMIC_DEVICE_EXIT(OnSysDynamicDeviceExit); END_CONTROL_DISPATCH return TRUE; } int _cdecl MyIfsHook(pIFSFunc pfn, int fn, int Drive, int ResType, int CodePage, pioreq pir) { int retvar,i; char fullpathname[260]; _Monitored_Files *FileEntry; switch(fn){ case IFSFN_OPEN:{ retvar=(*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); ConvertPath( Drive, pir-〉ir_ppath, fullpathname ); FileEntry=IsFileOpened(pir-〉ir_sfn); if (FileEntry){ FileEntry-〉open_count++; }else{ FileEntry=&Monitored_Files; while(1){ if (FileEntry-〉pNext_Monitored_Files){ FileEntry=FileEntry-〉pNext_Monitored_Files; } else{ break; } } FileEntry-〉pNext_Monitored_Files=\ HeapAllocate( sizeof(_Monitored_Files),HEAPZEROINIT); FileEntry-〉pNext_Monitored_Files-〉pPre_Monitored_Files=FileEntry; FileEntry=FileEntry-〉pNext_Monitored_Files; FileEntry-〉sfn=pir-〉ir_sfn; FileEntry-〉open_count=1; memcpy(FileEntry-〉path,fullpathname,260); } return retvar; } case IFSFN_READ:{ //Do something here, //eg. Decrypt the file. char *str; int j; str=pir-〉ir_data; j=pir-〉ir_length; retvar=(*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); FileEntry=IsFileOpened(pir-〉ir_sfn); if (!stricmp("c:\\test.txt",FileEntry-〉path)){ for (i=0;i〈j;i++){ str[i]--; } } return retvar; } case IFSFN_WRITE:{ //Do something here //eg. Encrypt the file FileEntry=IsFileOpened(pir-〉ir_sfn); if (FileEntry){ if (!stricmp("c:\\test.txt",FileEntry-〉path)){ for (i=0;i〈pir-〉ir_length;i++){ (((char*)pir-〉ir_data)[i])++; } } } return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); } case IFSFN_CLOSE:{ FileEntry=IsFileOpened(pir-〉ir_sfn); if (FileEntry){ FileEntry-〉open_count--; if (!FileEntry-〉open_count){ FileEntry-〉pPre_Monitored_Files-〉pNext_Monitored_Files=\ FileEntry-〉pNext_Monitored_Files; FileEntry-〉pNext_Monitored_Files-〉pPre_Monitored_Files=\ FileEntry-〉pPre_Monitored_Files; HeapFree(FileEntry,0); } } return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); } } return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); } BOOL OnSysVMInit(VMHANDLE hVM){ return OnSysDynamicDeviceInit(); } BOOL OnSysDynamicDeviceInit() { PrevHook = IFSMgr_InstallFileSystemApiHook(MyIfsHook); Monitored_Files.pNext_Monitored_Files=0; Monitored_Files.pPre_Monitored_Files=0; Monitored_Files.sfn=-1; Monitored_Files.open_count=0; Monitored_Files.path[0]=0; return TRUE; } BOOL OnSysDynamicDeviceExit() { IFSMgr_RemoveFileSystemApiHook(MyIfsHook); return TRUE; } void OnSysVMTerminate(VMHANDLE hVM){ return OnSysDynamicDeviceExit(); }
更多文章请访问:http://www.codesky.net 
|
本类阅读TOP10