Function DriverMonGenericDispatch

KernelLibrary/DevMonManager.cpp:293–373

NTSTATUS DriverMonGenericDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
	auto driver = DeviceObject->DriverObject;
	auto stack = IoGetCurrentIrpStackLocation(Irp);

	IrpArrivedInfo* info = nullptr;

	for (int i = 0; i < MaxMonitoredDrivers; i++) {
		if (globals.Drivers[i].DriverObject != driver)
			continue;

		if (globals.IsMonitoring && globals.NotifyEvent) {
			NT_ASSERT(driver == DeviceObject->DriverObject);

			KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "Driver 0x%p intercepted!\n", driver));

			info = static_cast<IrpArrivedInfo*>(ExAllocatePool(NonPagedPool, MaxDataSize + sizeof(IrpArrivedInfo)));
			if (info) {
				info->Type = DataItemType::IrpArrived;
				KeQuerySystemTime((PLARGE_INTEGER)&info->Time);
				info->Size = sizeof(IrpArrivedInfo);
				info->DeviceObject = DeviceObject;
				info->Irp = Irp;
				info->DriverObject = driver;
				info->MajorFunction = static_cast<IrpMajorCode>(stack->MajorFunction);
				info->MinorFunction = static_cast<IrpMinorCode>(stack->MinorFunction);
				info->ProcessId = HandleToUlong(PsGetCurrentProcessId());
				info->ThreadId = HandleToUlong(PsGetCurrentThreadId());
				info->Irql = KeGetCurrentIrql();
				info->DataSize = 0;

				switch (info->MajorFunction) {
					case IrpMajorCode::WRITE:
						info->Write.Length = stack->Parameters.Write.Length;
						info->Write.Offset = stack->Parameters.Write.ByteOffset.QuadPart;
						if(info->Write.Length>0){ 
							auto dataSize = min(MaxDataSize, info->Write.Length);
							if (NT_SUCCESS(GetDataFromIrp(DeviceObject, Irp, stack, info->MajorFunction, (PUCHAR)info + sizeof(IrpArrivedInfo), dataSize))) {
								info->DataSize = dataSize;
								info->Size += (USHORT)dataSize;
							}
						}
						break;

					case IrpMajorCode::DEVICE_CONTROL:
					case IrpMajorCode::INTERNAL_DEVICE_CONTROL:
						info->DeviceIoControl.IoControlCode = stack->Parameters.DeviceIoControl.IoControlCode;
						info->DeviceIoControl.InputBufferLength = stack->Parameters.DeviceIoControl.InputBufferLength;
						info->DeviceIoControl.OutputBufferLength = stack->Parameters.DeviceIoControl.OutputBufferLength;
						if (info->DeviceIoControl.InputBufferLength > 0) {
							auto dataSize = min(MaxDataSize, info->DeviceIoControl.InputBufferLength);
							if (NT_SUCCESS(GetDataFromIrp(DeviceObject, Irp, stack, info->MajorFunction, (PUCHAR)info + sizeof(IrpArrivedInfo), dataSize))) {
								info->DataSize = dataSize;
								info->Size += (USHORT)dataSize;
							}
						}
						break;
				}