1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
#include "ntddk.h"
//////////////////////////////////////////////////////////////////////////
// Structures
typedef struct _FSFILTER_DEVICE_EXTENSION
{
PDEVICE_OBJECT AttachedToDeviceObject;
} FSFILTER_DEVICE_EXTENSION, *PFSFILTER_DEVICE_EXTENSION;
/////////////////////////////////////////////////////////////////////////
VOID Unload ( IN PDRIVER_OBJECT DriverObject)
{
DbgPrint("Driver déchargé !");
}
NTSTATUS DriverEntry (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
PIO_STACK_LOCATION IrpSp;
PUNICODE_STRING FileName;
PVOID FileNameBuffer;
UNICODE_STRING NewFileName;
BOOLEAN bRedirectFileOpen = TRUE;
PDEVICE_OBJECT FsDeviceObject;
PDEVICE_OBJECT AttachedToDeviceObject;
PFSFILTER_DEVICE_EXTENSION pDevExt;
//
// If the device being opened is the primary device object instead of a
// filter device object, just indicate that the operation worked.
//
FsDeviceObject = DeviceObject;
if (DeviceObject == FsDeviceObject)
{
//
// Allow users to open the device that represents our driver.
//
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = FILE_OPENED;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_SUCCESS;
}
IrpSp = IoGetCurrentIrpStackLocation(Irp);
//
// At this point, you must determine whether you want to redirect
// the file open/create for this particular file.
// Beware that the file name from the FILE_OBJECT in the current
// IRP stack location is not always the file name with the full
// path, nor the long file name or even a name. The way the file is
// opened (with full path, relatively to another file, with short
// or long file name, by ID, ...) affects this name.
//
// TODO: Put your code here to check whether you have to redirect the operation.
// If so, set bRedirectFileOpen to TRUE and initialize the NewFileName
// UNICODE_STRING to the full file name of the destination file.
//
RtlInitUnicodeString(&NewFileName, L"<a href="file://\\??\\C:\\test.txt" target="_blank">\\??\\C:\\test.txt</a>");
if ( bRedirectFileOpen )
{
FileName = &(IrpSp->FileObject->FileName);
FileNameBuffer = ExAllocatePool( NonPagedPool, NewFileName.MaximumLength );
if (!FileNameBuffer)
{
//
// Not enough resources. Complete the IRP with the appropriate status.
//
Irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
Irp->IoStatus.Information = 0;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_INSUFFICIENT_RESOURCES;
}
ExFreePool( FileName->Buffer );
FileName->Buffer = FileNameBuffer;
FileName->MaximumLength = NewFileName.MaximumLength;
RtlCopyUnicodeString( FileName, &NewFileName );
//
// Instruct the IO Manager to reparse this file.
//
Irp->IoStatus.Status = STATUS_REPARSE;
Irp->IoStatus.Information = IO_REPARSE;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_REPARSE;
}
else
{
//
// Pass the request "as is" down the device stack.
//
//
// The next driver will get the IO_STACK_LOCATION
// that you received.
//
IoSkipCurrentIrpStackLocation( Irp );
//
// Call the appropriate file system driver with the request.
//
// TODO: Replace AttachedToDeviceObject by the device
// object pointer your device object is attached to (the
// lower device object in the stack).
// Typically, this device object pointer is saved by your
// filter in your device extension.
//
//return IoCallDriver( AttachedToDeviceObject, Irp );
pDevExt = DeviceObject->DeviceExtension;
return IoCallDriver(pDevExt->AttachedToDeviceObject, Irp);
}
} |
