阅读:1034回复:0
ZwCreateFile打开U盘失败
ZwCreateFile打开U盘盘符时返回FACILITY_CLUSTER_ERROR_CODE
,why? BOOLEAN HookDrive( IN CHAR AccessModel, IN ULONG Drive, IN PDRIVER_OBJECT DriverObject ) { IO_STATUS_BLOCK ioStatus; HANDLE ntFileHandle; OBJECT_ATTRIBUTES objectAttributes; PDEVICE_OBJECT fileSysDevice; PDEVICE_OBJECT hookDevice; UNICODE_STRING fileNameUnicodeString; WCHAR filename[] = L\"\\\\DosDevices\\\\A:\\\\\"; NTSTATUS ntStatus; PFILE_OBJECT fileObject; PSFILTER_DEVICE_EXTENSION sfhookDevExt; if( Drive >= 26 ) { return FALSE; } if( DriveHookDevices[Drive] == NULL ) { KdBreakPoint(); filename[12] = (CHAR) (\'A\'+Drive); RtlInitUnicodeString( &fileNameUnicodeString, filename ); InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL ); ntStatus = ZwCreateFile( &ntFileHandle, SYNCHRONIZE|FILE_ANY_ACCESS, &objectAttributes, &ioStatus, NULL, 0, FILE_SHARE_READ, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT|FILE_DIRECTORY_FILE, NULL, 0 ); if( !NT_SUCCESS( ntStatus ) ) { return FALSE; } ntStatus = ObReferenceObjectByHandle( ntFileHandle, FILE_READ_DATA, NULL, KernelMode, &fileObject, NULL ); if( !NT_SUCCESS( ntStatus )) { ZwClose( ntFileHandle ); return FALSE; } fileSysDevice = IoGetRelatedDeviceObject( fileObject ); if( ! fileSysDevice ) { ObDereferenceObject( fileObject ); ZwClose( ntFileHandle ); return FALSE; } ntStatus = IoCreateDevice( DriverObject, sizeof(SFILTER_DEVICE_EXTENSION), NULL, fileSysDevice->DeviceType, 0, FALSE, &hookDevice ); if( !NT_SUCCESS(ntStatus) ) { ObDereferenceObject( fileObject ); ZwClose( ntFileHandle ); return FALSE; } hookDevice->Flags &= ~DO_DEVICE_INITIALIZING; sfhookDevExt = hookDevice->DeviceExtension; sfhookDevExt->AttachedToDeviceObject = fileSysDevice; sfhookDevExt->VolumeName[0] = \'A\'+ (CHAR)Drive; sfhookDevExt->AccessModel = AccessModel; sfhookDevExt->theVolume = fileSysDevice; sfhookDevExt->Type = STANDARD; ntStatus = IoAttachDeviceByPointer( hookDevice, fileSysDevice ); if( !NT_SUCCESS(ntStatus) ) { ObDereferenceObject( fileObject ); ZwClose( ntFileHandle ); return FALSE; } ObDereferenceObject( fileObject ); ZwClose( ntFileHandle ); DriveHookDevices[Drive] = hookDevice; } return TRUE; } |
|