| 66 | |
| 67 | |
| 68 | NTSTATUS NTAPI XDriver::NtCreateFile_Hook(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength) |
| 69 | { |
| 70 | |
| 71 | DWORD dwWritten = 0; |
| 72 | NTSTATUS Status = -1; |
| 73 | if (ObjectAttributes && |
| 74 | ObjectAttributes->ObjectName && |
| 75 | ObjectAttributes->ObjectName->Buffer && |
| 76 | wcsstr(ObjectAttributes->ObjectName->Buffer, SERVICE_NAME)) |
| 77 | { |
| 78 | Status = o_NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength); |
| 79 | if (NT_SUCCESS(Status)) |
| 80 | { |
| 81 | if (FileHandle) |
| 82 | fIOs.push_back(*FileHandle); |
| 83 | } |
| 84 | return Status; |
| 85 | } |
| 86 | |
| 87 | return o_NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength); |
| 88 | }; |
| 89 | |
| 90 | NTSTATUS NTAPI XDriver::ZwReadFile_Hook(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key) |
| 91 | { |
nothing calls this directly
no outgoing calls
no test coverage detected