-
-
[求助]MiniFilter隐藏文件资源管理器看不到,但是PCHunter不显示红色
-
发表于: 2018-11-8 15:03 2680
-
这是隐藏文件的post
FLT_POSTOP_CALLBACK_STATUS PfltPostOperationCallbackDirectory(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID CompletionContext, FLT_POST_OPERATION_FLAGS Flags) { /* PFLT_FILE_NAME_INFORMATION stNameInfo; NTSTATUS lStatus = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &stNameInfo); if (!NT_SUCCESS(lStatus)) { return FLT_POSTOP_FINISHED_PROCESSING; } lStatus = FltParseFileNameInformation(stNameInfo); if (!NT_SUCCESS(lStatus)) { return FLT_POSTOP_FINISHED_PROCESSING; } DbgPrint("文件名:%wZ 文件路径:%wZ", stNameInfo->Name, stNameInfo->ParentDir); FltReleaseFileNameInformation(stNameInfo); */ if (FlagOn(Flags, FLTFL_POST_OPERATION_DRAINING)) { return FLT_POSTOP_FINISHED_PROCESSING; } PVOID pSafeBuffer; if (Data->Iopb->MinorFunction == IRP_MN_QUERY_DIRECTORY && Data->Iopb->Parameters.DirectoryControl.QueryDirectory.FileInformationClass == FileIdBothDirectoryInformation && Data->Iopb->Parameters.DirectoryControl.QueryDirectory.Length > 0 && NT_SUCCESS(Data->IoStatus.Status)) { pSafeBuffer = Data->Iopb->Parameters.DirectoryControl.QueryDirectory.DirectoryBuffer; PFILE_ID_BOTH_DIR_INFORMATION pstCurrentFileInfo = (PFILE_ID_BOTH_DIR_INFORMATION)pSafeBuffer; PFILE_ID_BOTH_DIR_INFORMATION pstNextFileInfo; PFILE_ID_BOTH_DIR_INFORMATION pPrevFileInfo = pstCurrentFileInfo; int i = 0; do { DbgPrint("FileName:%ls", pstCurrentFileInfo->FileName); pstNextFileInfo = (PFILE_ID_BOTH_DIR_INFORMATION)((ULONG64)pstCurrentFileInfo + pstCurrentFileInfo->NextEntryOffset); if (wcsstr(pstCurrentFileInfo->FileName, L"AAAA.pak")) { DbgPrint("隐藏文件!"); if (i == 0) { Data->Iopb->Parameters.DirectoryControl.QueryDirectory.DirectoryBuffer = (PVOID)((ULONG64)pstCurrentFileInfo + pstCurrentFileInfo->NextEntryOffset); } if (pstCurrentFileInfo->NextEntryOffset == 0) { pPrevFileInfo->NextEntryOffset = 0; } else { pPrevFileInfo->NextEntryOffset = (ULONG)((ULONG64)pstCurrentFileInfo - (ULONG64)pPrevFileInfo) + pstCurrentFileInfo->NextEntryOffset; } } pPrevFileInfo = pstCurrentFileInfo; pstCurrentFileInfo = pstNextFileInfo; i++; } while (pPrevFileInfo->NextEntryOffset != 0); FltSetCallbackDataDirty(Data); } return FLT_POSTOP_FINISHED_PROCESSING; }
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
他的文章
赞赏
雪币:
留言: