yuqiang
驱动牛犊
驱动牛犊
  • 注册日期2001-09-06
  • 最后登录2001-12-04
  • 粉丝0
  • 关注0
  • 积分0分
  • 威望0点
  • 贡献值0点
  • 好评度0点
  • 原创分0分
  • 专家分0分
阅读:1406回复:1

IFSMgr_InstallFileSystemApiHook的问题!!

楼主#
更多 发布于:2001-12-03 16:54
这是一个使用vxd的程序,它的目的是想利用vxd来拦载消息,
当一个文件被打开时就显示一个消息框!!!!
它们可以编译,link通过,但是只要一运行win98就蓝屏,为什么???
我错在哪里了吗?

发e-mail给我,重要重要!!!!
因为我要想找到这个文章好难啊,所以发e-mail给我是最好了!!
谢谢!!!

yuqiang0304@163.net

要原代码就发e-mail好了!!!!

可以发e-mail:yuqiang0304@163.net 给我,教我吗??谢谢!!!!!
以下是原代码(是长了点,请仔细看了,谢谢!!^_^)

//////file.vxd的原代码
.386p

include \\masm32\\include\\vmm.inc
include \\masm32\\include\\vwin32.inc
include \\masm32\\include\\shell.inc

MASM=1

include \\masm32\\include\\ifs.inc
include \\masm32\\include\\ifsmgr.inc

Declare_Virtual_Device FILE,1,0,Vxd_Control,\\
UNDEFINED_Device_ID,

VxD_DATA_SEG
Prev_File_System_Api_Hook dd 0  
;保存以前的Api地址
In_File_System_Api_Hook db 0
Message1 db \'Open File!!\',0
Caption1 db \'File Hook\',0
VxD_DATA_ENDS

VxD_CODE_SEG

BeginProc VxD_Control
Control_Dispatch  SYS_DYNAMIC_DEVICE_INIT,VxD_Device_Init
Control_Dispatch  SYS_DYNAMIC_DEVICE_EXIT,VxD_Device_Exit
Control_Dispatch  W32_DEVICEIOCONTROL,VxD_IOCTL
clc
ret
EndProc VxD_Control
;响应DeviceIoControl
BeginProc VxD_IOCTL
mov ecx,[esi.dwIoControlCode]
cmp ecx,1
jz Install_File_System_Api_Hook
cmp ecx,2
jz Uninstall_File_System_Api_Hook
jmp VxD_IOCTL_Exit

Install_File_System_Api_Hook:
mov eax,OFFSET32  File_System_Api_Hook
VxDCall IFSMgr_InstallFileSystemApiHook
or eax,eax
jz Error_Handler
mov Prev_File_System_Api_Hook,eax
jmp VxD_IOCTL_Exit

Uninstall_File_System_Api_Hook:
mov eax,OFFSET32  File_System_Api_Hook
VxDCall IFSMgr_RemoveFileSystemApiHook
cmp eax,0FFFFFFFFH
jz Error_Handler
jmp VxD_IOCTL_Exit

VxD_IOCTL_Exit:
xor eax,eax
clc
ret

Error_Handler:
mov eax,0FFFFFFFFH
stc
ret
EndProc VxD_IOCTL

BeginProc VxD_Device_Exit
clc
ret
EndProc VxD_Device_Exit
;我的响应文件打开的函数
BeginProc File_System_Api_Hook,CCALL
ArgVar FSDFnAddr,DWORD
ArgVar FunctionNum,DWORD
ArgVar Driver,DWORD
ArgVar CodePage,DWORD
ArgVar pir,DWORD
EnterProc
pushad
cmp byte ptr In_File_System_Api_Hook,00h
jnz Pre_Hook
cmp dword ptr FunctionNum,IFSFN_OPEN
jnz Pre_Hook
inc byte ptr In_File_System_Api_Hook
VMMCall Get_Cur_VM_Handle
mov eax,MB_ICONASTERISK+MB_OK
mov ecx,OFFSET32 Message1
mov edi,OFFSET32 Caption1
mov esi,0
mov edx,0
VxDCall Shell_Message
dec In_File_System_Api_Hook

Pre_Hook:
popad
LeaveProc
mov eax,Prev_File_System_Api_Hook
jmp dword ptr [eax]
Return
EndProc File_System_Api_Hook

VxD_CODE_ENDS

VxD_ICODE_SEG
BeginProc VxD_Device_Init
clc
ret
EndProc VxD_Device_Init
VxD_ICODE_ENDS

end


///////用来加载vxd的win32程序的原代码

#include <windows.h>
#include <tchar.h>

#define INSTALL_FILE_SYSTEM_API_HOOK 1
#define UNINSTALL_FILE_SYSTEM_API_HOOK 2

static TCHAR szAppName[]=_T(\"FHTEST\");
static TCHAR szAppTitle[]=_T(\"拦截Windows 95/98
文件操作测试程序\");
static HANDLE hDevice;

LRESULT CALLBACK WndProc(HWND hWnd,UINT Message,
WPARAM wParam,LPARAM lParam);

int WINAPI WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,int nCmdShow)
{
HWND hWnd;
WNDCLASSEX wcex;
MSG Msg;
if(!hPrevInstance)
{
  wcex.cbSize=sizeof(WNDCLASSEX);
  wcex.style=CS_HREDRAW|CS_VREDRAW;
  wcex.lpfnWndProc=WndProc;
  wcex.cbClsExtra=0;
  wcex.cbWndExtra=0;
  wcex.hInstance=hInstance;
  wcex.hIcon=LoadIcon(hInstance,IDI_APPLICATION);
  wcex.hCursor=LoadCursor(NULL,IDC_ARROW);
  wcex.hbrBackground=(HBRUSH)(COLOR_WINDOW+1);
  wcex.lpszMenuName=NULL;
  wcex.lpszClassName=szAppName;
  wcex.hIconSm=NULL;

  if(!RegisterClassEx(&wcex))
 return FALSE;
}
hWnd=CreateWindow(szAppName,szAppTitle,
WS_OVERLAPPEDWINDOW,
CW_USEDEFAULT,CW_USEDEFAULT,
CW_USEDEFAULT,
CW_USEDEFAULT,0,0,hInstance,NULL);
if(!hWnd)
return FALSE;

ShowWindow(hWnd,nCmdShow);
UpdateWindow(hWnd);

while(GetMessage(&Msg,0,0,0))
{
  TranslateMessage(&Msg);
  DispatchMessage(&Msg);
}
return Msg.wParam;
}

LRESULT CALLBACK WndProc(HWND hWnd,UINT Message,
WPARAM wParam,LPARAM lParam)
{
HDC hDC;
PAINTSTRUCT ps;
DWORD cb;
BOOL bResult;

switch(Message)
{
case WM_CREATE:

hDevice=CreateFile(\"\\\\\\\\.\\\\FILE.VXD\",0,0,NULL,0,
FILE_FLAG_DELETE_ON_CLOSE,NULL);
  if(hDevice!=INVALID_HANDLE_VALUE)
  {
  
   bResult=DeviceIoControl(hDevice,
INSTALL_FILE_SYSTEM_API_HOOK,
NULL,0,NULL,0,&cb,0);
   if(bResult)
  MessageBox(hWnd,
_T(\"文件系统API 钩子安装成功!\"),
szAppTitle,MB_ICONINFORMATION|MB_OK);
   else MessageBox(hWnd,_T(\"不能安装文件系统API 钩子!\"),
szAppTitle,MB_ICONINFORMATION|MB_OK);
  }
  else
  {
   MessageBox(hWnd,_T(\"不能打开FILEHOOK.VXD!\"),
szAppTitle,MB_ICONINFORMATION|MB_OK);
  }
  break;
case WM_PAINT:
  hDC=BeginPaint(hWnd,&ps);
  EndPaint(hWnd,&ps);
  break;
case WM_DESTROY:
  if(hDevice!=INVALID_HANDLE_VALUE)
  {
  
bResult=DeviceIoControl(hDevice,
UNINSTALL_FILE_SYSTEM_API_HOOK,
NULL,0,NULL,0,&cb,0);
   if(bResult) MessageBox(hWnd,
_T(\"文件系统API 钩子移去成功!\"),
szAppTitle,MB_ICONINFORMATION|MB_OK);
   else MessageBox(hWnd,
_T(\"不能移去文件系统API 钩子!\"),
szAppTitle,MB_ICONINFORMATION|MB_OK);
   CloseHandle(hDevice);
  }
  else
  {
   MessageBox(hWnd,_T(\"不能打开FILEHOOK.VXD!\"),
szAppTitle,MB_ICONINFORMATION|MB_OK);
  }
  PostQuitMessage(0);
  break;
default:
  return DefWindowProc(hWnd,Message,wParam,lParam);
}
return 0;
}

ZOU
ZOU
驱动牛犊
驱动牛犊
  • 注册日期2001-09-11
  • 最后登录2010-12-20
  • 粉丝0
  • 关注0
  • 积分20分
  • 威望3点
  • 贡献值0点
  • 好评度1点
  • 原创分0分
  • 专家分0分
沙发#
发布于:2001-12-03 19:35
test
游客

返回顶部