hook NtCreateFile的问题.(在线等侯)

我按照undocument nt书上说的那个hooksys
hook了 NtCreateFile 函数.
hook本身我想是成功的.我能在 drivermonitor中看到我程序输出的调试信息.
愿本想是当在c盘建立一个1.txt文件的时候结果是建立一个0.txt的文件.
可不知道为什么却不能.
不知道是什么原因.

主要代码如下

NTSTATUS NewNtCreateFile(
                    PHANDLE FileHandle,
                    ACCESS_MASK DesiredAccess,
                    POBJECT_ATTRIBUTES ObjectAttributes,
                    PIO_STATUS_BLOCK IoStatusBlock,
                    PLARGE_INTEGER AllocationSize OPTIONAL,
                    ULONG FileAttributes,
                    ULONG ShareAccess,
                    ULONG CreateDisposition,
                    ULONG CreateOptions,
                    PVOID EaBuffer OPTIONAL,
                    ULONG EaLength)
{
        int rc;
        char ParentDirectory[1024];
        PUNICODE_STRING Parent=NULL;
/////////////////////我自己加的        
	    long mypanduan;
	            UNICODE_STRING mystr,newstr;
        mypanduan=1;
        RtlInitUnicodeString(&mystr, L\"\\\\??\\\\C:\\\\1.txt\");
        RtlInitUnicodeString(&newstr, L\"\\\\??\\\\C:\\\\0.txt\");
//////////////////////////////////////////////////////        
        ParentDirectory[0]=\'\\0\';
        
        if (ObjectAttributes->RootDirectory!=0) {
                PVOID Object;

                Parent=(PUNICODE_STRING)ParentDirectory;
                rc=ObReferenceObjectByHandle(ObjectAttributes->RootDirectory,
                                             0,
                                             0,
                                             KernelMode,
                                             &Object,
                                             NULL);
                if (rc==STATUS_SUCCESS) {
                        extern NTSTATUS ObQueryNameString(void *, void *, int size,
                                                          int *);
                        int BytesReturned;

                        rc=ObQueryNameString(Object,
                                          ParentDirectory,
                                          sizeof(ParentDirectory),
                                          &BytesReturned);
                        ObDereferenceObject(Object);

                        if (rc!=STATUS_SUCCESS)
                                RtlInitUnicodeString(Parent, L\"Unknown\\\\\");
                } else {
                                RtlInitUnicodeString(Parent, L\"Unknown\\\\\");
                }
        }

////////////检查是否有我指定的文件名
mypanduan=RtlCompareUnicodeString(&mystr,ObjectAttributes->ObjectName,TRUE);

if (mypanduan==0)  //是
{
	ObjectAttributes->ObjectName=&newstr;
	DbgPrint(\"match match match\\n\");
}
else  //不是
{
	DbgPrint(\"no match no match no match\\n\");
	}

//////////////////////////////////////////////
        DbgPrint(\"NtCreateFile : Filename = %S ^ %S ^ %S \\n\", Parent?Parent->Buffer:L\"\",
                        Parent?L\"\\\\\":L\"\", ObjectAttributes->ObjectName->Buffer);
        rc=((NTCREATEFILE)(OldNtCreateFile)) (
                        FileHandle,
                        DesiredAccess,
                        ObjectAttributes,
                        IoStatusBlock,
                        AllocationSize,
                        FileAttributes,
                        ShareAccess,
                        CreateDisposition,
                        CreateOptions,
                        EaBuffer,
                        EaLength);
        DbgPrint(\"my test:filename=%S\\n\",ObjectAttributes->ObjectName->Buffer);
        DbgPrint(\"NtCreateFile : rc = %x\\n\", rc);
        return rc;
}

[编辑 -  8/18/03 by  testcrab]

[编辑 -  8/18/03 by  testcrab]

ObjectAttributes->ObjectName可不一定是全路经。