在文件系统过滤驱动中获取用户名 [zt]

#include "ntifs.h"
/*-------------------------------------------------------------------------*/
#define SYSTEMACCOUNT_LOW 999
#define SYSTEMACCOUNT_HIGH 0
#define SYSTEMUSER L"SYSTEM"
/*-------------------------------------------------------------------------*/
BOOLEAN GetUserName(PSECURITY_SUBJECT_CONTEXT securitySubjectContext, PUNICODE_STRING userName)
{
    PACCESS_TOKEN token;
    LUID luid;
    PSecurityUserData userInformation = NULL;
    NTSTATUS status;

    //初始化userName
    userName->Length = 0;
    userName->MaximumLength = 0;
    userName->Buffer = NULL;

    //取token
    token = SeQuerySubjectContextToken(securitySubjectContext);

    //根据token查询用户的LUID
    status = SeQueryAuthenticationIdToken(token, &luid);
    if (!NT_SUCCESS(status))
    {
        KdPrint(("GetUserName(): SeQueryAuthenticationIdToken fail\n"));
        return FALSE;
    }

    //特殊情况，SYSTEM用户
    if(luid.LowPart==SYSTEMACCOUNT_LOW && luid.HighPart==SYSTEMACCOUNT_HIGH)
    {
        userName->Length = 12;
        userName->MaximumLength = 12;
        userName->Buffer = ExAllocatePool(NonPagedPool, userName->MaximumLength);
        if (userName->Buffer==NULL)
        {
            KdPrint(("GetUserName(): ExAllocatePool fail\n"));
            return FALSE;
        }

        RtlCopyMemory(userName->Buffer, SYSTEMUSER, userName->MaximumLength);

        return TRUE;
    }

    //根据用户的luid取用户名
    status = GetSecurityUserInfo(&luid, UNDERSTANDS_LONG_NAMES, &userInformation);
    if (!NT_SUCCESS(status))
    {
        KdPrint(("GetUserName(): GetSecurityUserInfo fail\n"));
        return FALSE;
    }

    userName->Length = 0;
    userName->MaximumLength = userInformation->UserName.Length;
    userName->Buffer = ExAllocatePool(NonPagedPool, userName->MaximumLength);
    if (userName->Buffer==NULL)
    {
        KdPrint(("GetUserName(): ExAllocatePool fail\n"));
        return FALSE;
    }

    RtlCopyUnicodeString(userName, &userInformation->UserName);

    LsaFreeReturnBuffer(userInformation);

    return TRUE;
}
/*-------------------------------------------------------------------------*/

 

由于使用了GetSecurityUserInfo()函数，因此还要在sources文件里加上

TARGETLIBS=$(BASEDIR)\lib$(BUILD_ALT_DIR)\i386\ksecdd.lib
 

znsoft  跟我研究的方向, 怎么有点类似呀.

类似？不明白。

一直在折腾文件加密...