阅读:1406回复:1
IFSMgr_InstallFileSystemApiHook的问题!!
这是一个使用vxd的程序,它的目的是想利用vxd来拦载消息,
当一个文件被打开时就显示一个消息框!!!! 它们可以编译,link通过,但是只要一运行win98就蓝屏,为什么??? 我错在哪里了吗? 发e-mail给我,重要重要!!!! 因为我要想找到这个文章好难啊,所以发e-mail给我是最好了!! 谢谢!!! yuqiang0304@163.net 要原代码就发e-mail好了!!!! 可以发e-mail:yuqiang0304@163.net 给我,教我吗??谢谢!!!!! 以下是原代码(是长了点,请仔细看了,谢谢!!^_^) //////file.vxd的原代码 .386p include \\masm32\\include\\vmm.inc include \\masm32\\include\\vwin32.inc include \\masm32\\include\\shell.inc MASM=1 include \\masm32\\include\\ifs.inc include \\masm32\\include\\ifsmgr.inc Declare_Virtual_Device FILE,1,0,Vxd_Control,\\ UNDEFINED_Device_ID, VxD_DATA_SEG Prev_File_System_Api_Hook dd 0 ;保存以前的Api地址 In_File_System_Api_Hook db 0 Message1 db \'Open File!!\',0 Caption1 db \'File Hook\',0 VxD_DATA_ENDS VxD_CODE_SEG BeginProc VxD_Control Control_Dispatch SYS_DYNAMIC_DEVICE_INIT,VxD_Device_Init Control_Dispatch SYS_DYNAMIC_DEVICE_EXIT,VxD_Device_Exit Control_Dispatch W32_DEVICEIOCONTROL,VxD_IOCTL clc ret EndProc VxD_Control ;响应DeviceIoControl BeginProc VxD_IOCTL mov ecx,[esi.dwIoControlCode] cmp ecx,1 jz Install_File_System_Api_Hook cmp ecx,2 jz Uninstall_File_System_Api_Hook jmp VxD_IOCTL_Exit Install_File_System_Api_Hook: mov eax,OFFSET32 File_System_Api_Hook VxDCall IFSMgr_InstallFileSystemApiHook or eax,eax jz Error_Handler mov Prev_File_System_Api_Hook,eax jmp VxD_IOCTL_Exit Uninstall_File_System_Api_Hook: mov eax,OFFSET32 File_System_Api_Hook VxDCall IFSMgr_RemoveFileSystemApiHook cmp eax,0FFFFFFFFH jz Error_Handler jmp VxD_IOCTL_Exit VxD_IOCTL_Exit: xor eax,eax clc ret Error_Handler: mov eax,0FFFFFFFFH stc ret EndProc VxD_IOCTL BeginProc VxD_Device_Exit clc ret EndProc VxD_Device_Exit ;我的响应文件打开的函数 BeginProc File_System_Api_Hook,CCALL ArgVar FSDFnAddr,DWORD ArgVar FunctionNum,DWORD ArgVar Driver,DWORD ArgVar CodePage,DWORD ArgVar pir,DWORD EnterProc pushad cmp byte ptr In_File_System_Api_Hook,00h jnz Pre_Hook cmp dword ptr FunctionNum,IFSFN_OPEN jnz Pre_Hook inc byte ptr In_File_System_Api_Hook VMMCall Get_Cur_VM_Handle mov eax,MB_ICONASTERISK+MB_OK mov ecx,OFFSET32 Message1 mov edi,OFFSET32 Caption1 mov esi,0 mov edx,0 VxDCall Shell_Message dec In_File_System_Api_Hook Pre_Hook: popad LeaveProc mov eax,Prev_File_System_Api_Hook jmp dword ptr [eax] Return EndProc File_System_Api_Hook VxD_CODE_ENDS VxD_ICODE_SEG BeginProc VxD_Device_Init clc ret EndProc VxD_Device_Init VxD_ICODE_ENDS end ///////用来加载vxd的win32程序的原代码 #include <windows.h> #include <tchar.h> #define INSTALL_FILE_SYSTEM_API_HOOK 1 #define UNINSTALL_FILE_SYSTEM_API_HOOK 2 static TCHAR szAppName[]=_T(\"FHTEST\"); static TCHAR szAppTitle[]=_T(\"拦截Windows 95/98 文件操作测试程序\"); static HANDLE hDevice; LRESULT CALLBACK WndProc(HWND hWnd,UINT Message, WPARAM wParam,LPARAM lParam); int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine,int nCmdShow) { HWND hWnd; WNDCLASSEX wcex; MSG Msg; if(!hPrevInstance) { wcex.cbSize=sizeof(WNDCLASSEX); wcex.style=CS_HREDRAW|CS_VREDRAW; wcex.lpfnWndProc=WndProc; wcex.cbClsExtra=0; wcex.cbWndExtra=0; wcex.hInstance=hInstance; wcex.hIcon=LoadIcon(hInstance,IDI_APPLICATION); wcex.hCursor=LoadCursor(NULL,IDC_ARROW); wcex.hbrBackground=(HBRUSH)(COLOR_WINDOW+1); wcex.lpszMenuName=NULL; wcex.lpszClassName=szAppName; wcex.hIconSm=NULL; if(!RegisterClassEx(&wcex)) return FALSE; } hWnd=CreateWindow(szAppName,szAppTitle, WS_OVERLAPPEDWINDOW, CW_USEDEFAULT,CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT,0,0,hInstance,NULL); if(!hWnd) return FALSE; ShowWindow(hWnd,nCmdShow); UpdateWindow(hWnd); while(GetMessage(&Msg,0,0,0)) { TranslateMessage(&Msg); DispatchMessage(&Msg); } return Msg.wParam; } LRESULT CALLBACK WndProc(HWND hWnd,UINT Message, WPARAM wParam,LPARAM lParam) { HDC hDC; PAINTSTRUCT ps; DWORD cb; BOOL bResult; switch(Message) { case WM_CREATE: hDevice=CreateFile(\"\\\\\\\\.\\\\FILE.VXD\",0,0,NULL,0, FILE_FLAG_DELETE_ON_CLOSE,NULL); if(hDevice!=INVALID_HANDLE_VALUE) { bResult=DeviceIoControl(hDevice, INSTALL_FILE_SYSTEM_API_HOOK, NULL,0,NULL,0,&cb,0); if(bResult) MessageBox(hWnd, _T(\"文件系统API 钩子安装成功!\"), szAppTitle,MB_ICONINFORMATION|MB_OK); else MessageBox(hWnd,_T(\"不能安装文件系统API 钩子!\"), szAppTitle,MB_ICONINFORMATION|MB_OK); } else { MessageBox(hWnd,_T(\"不能打开FILEHOOK.VXD!\"), szAppTitle,MB_ICONINFORMATION|MB_OK); } break; case WM_PAINT: hDC=BeginPaint(hWnd,&ps); EndPaint(hWnd,&ps); break; case WM_DESTROY: if(hDevice!=INVALID_HANDLE_VALUE) { bResult=DeviceIoControl(hDevice, UNINSTALL_FILE_SYSTEM_API_HOOK, NULL,0,NULL,0,&cb,0); if(bResult) MessageBox(hWnd, _T(\"文件系统API 钩子移去成功!\"), szAppTitle,MB_ICONINFORMATION|MB_OK); else MessageBox(hWnd, _T(\"不能移去文件系统API 钩子!\"), szAppTitle,MB_ICONINFORMATION|MB_OK); CloseHandle(hDevice); } else { MessageBox(hWnd,_T(\"不能打开FILEHOOK.VXD!\"), szAppTitle,MB_ICONINFORMATION|MB_OK); } PostQuitMessage(0); break; default: return DefWindowProc(hWnd,Message,wParam,lParam); } return 0; } |
|
沙发#
发布于:2001-12-03 19:35
test
|
|