来帮看下这段代码怎么老蓝....

HOOK ZwQueryDirectoryFile来隐藏文件的,这些这个是替换的ZwQueryDirectoryFile函数,修改输出结果的部分都已经注释掉了,怎么还老蓝噢....
我是加载驱动后.开着dbgview,然后刷新文件夹来测试,有时候一刷新就蓝了,有时候又不会...大部分时候都蓝......为什么噢?高手们帮看下问题在哪```winxp sp2 + xp ddk,在sp2虚拟机下测试的

NTSTATUS NewZwQueryDirectoryFile(
    IN HANDLE hFile,
    IN HANDLE hEvent OPTIONAL,
    IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
    IN PVOID IoApcContext OPTIONAL,
    OUT PIO_STATUS_BLOCK pIoStatusBlock,
    OUT PVOID FileInformationBuffer,
    IN ULONG FileInformationBufferLength,
    IN FILE_INFORMATION_CLASS FileInfoClass,
    IN BOOLEAN bReturnOnlyOneEntry,
    IN PUNICODE_STRING PathMask OPTIONAL,
    IN BOOLEAN bRestartQuery
    )
{
    NTSTATUS ntStatus;

    ntStatus = ((ZWQUERYDIRECTORYFILE)(OldZwQueryDirectoryFile))(
                    hFile,
                    hEvent,
                    IoApcRoutine,
                    IoApcContext,
                    pIoStatusBlock,
                    FileInformationBuffer,
                    FileInformationBufferLength,
                    FileInfoClass,
                    bReturnOnlyOneEntry,
                    PathMask,
                    bRestartQuery);
    if(NT_SUCCESS(ntStatus))
    {
        if(FileInfoClass==3)
        {
            PFILE_BOTH_DIRECTORY_INFORMATION pFileInfo = (PFILE_BOTH_DIRECTORY_INFORMATION)FileInformationBuffer;
            PFILE_BOTH_DIRECTORY_INFORMATION pLastFileInfo = NULL;
            UNICODE_STRING uniFileName;
            ANSI_STRING ansiFileName;
            while(pFileInfo)
            {
                RtlInitUnicodeString(&uniFileName, pFileInfo->FileName);
                RtlUnicodeStringToAnsiString(&ansiFileName, &uniFileName, TRUE);
                if(ansiFileName.Buffer!=NULL)
                {
                    DbgPrint("pFileInfo->FileName = %s(%d)\n", ansiFileName.Buffer, ansiFileName.Length);
                /*    if(0 == memcmp(uniFileName.Buffer, HideFileName.Buffer, HideFileName.Length))
                    {
                        if(pLastFileInfo)
                        {
                            if(pFileInfo->NextEntryOffset)
                                pLastFileInfo->NextEntryOffset += pFileInfo->NextEntryOffset;
                            else
                                pLastFileInfo->NextEntryOffset = 0;
                        }
                        else
                        {
                            if(pFileInfo->NextEntryOffset)
                                (char *)FileInformationBuffer += pFileInfo->NextEntryOffset;
                            else
                                FileInformationBuffer = NULL;
                        }
                    }*/
                }
                pLastFileInfo = pFileInfo;
                if(pFileInfo->NextEntryOffset)
                    pFileInfo += pFileInfo->NextEntryOffset;
                else
                    pFileInfo = NULL;
            }
        }
    }

    return ntStatus;
}

有两个错误：

1、指针偏移错误
pFileInfo += pFileInfo->NextEntryOffset;
应该修改为
(char*)pFileInfo += pFileInfo->NextEntryOffset;
或者
pFileInfo = (PFILE_BOTH_DIRECTORY_INFORMATION)((char*)pFileInfo + pFileInfo->NextEntryOffset);

2、内存泄漏
没有RtlFreeAnsiString(&ansiFileName);

这句也危险
memcmp(uniFileName.Buffer, HideFileName.Buffer, HideFileName.Length)

一般情况下可能不会出问题
如果HideFileName长度远大于uniFileName时，可能会引发内存越界访问

为什么不用RtlCompareUnicodeString？

#pragma text(PAGE,NewZwQueryDirectoryFile)