| 41 | } |
| 42 | |
| 43 | bool XDriver::detour_DriverConnection(bool Status) |
| 44 | { |
| 45 | |
| 46 | BOOL Result = 1; |
| 47 | o_NtCreateFile = o_NtCreateFile ? o_NtCreateFile : reinterpret_cast<p_NtCreateFile>(reinterpret_cast<DWORD_PTR>(GetProcAddress(GetModuleHandle("ntdll.dll"), "NtCreateFile"))); |
| 48 | if (!o_NtCreateFile) |
| 49 | Result = 0; |
| 50 | o_ZwWriteFile = o_ZwWriteFile ? o_ZwWriteFile : reinterpret_cast<p_ZwWriteFile>(reinterpret_cast<DWORD_PTR>(GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwWriteFile"))); |
| 51 | if (!o_ZwWriteFile) |
| 52 | Result = 0; |
| 53 | o_ZwReadFile = o_ZwReadFile ? o_ZwReadFile : reinterpret_cast<p_ZwReadFile>(reinterpret_cast<DWORD_PTR>(GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwReadFile"))); |
| 54 | if (!o_ZwReadFile) |
| 55 | Result = 0; |
| 56 | if (DetourTransactionBegin() != NO_ERROR || |
| 57 | DetourUpdateThread(GetCurrentThread()) != NO_ERROR || |
| 58 | (Status ? DetourAttach : DetourDetach)(&(PVOID&)o_NtCreateFile, NtCreateFile_Hook) != NO_ERROR || |
| 59 | (Status ? DetourAttach : DetourDetach)(&(PVOID&)o_ZwReadFile, ZwReadFile_Hook) != NO_ERROR || |
| 60 | (Status ? DetourAttach : DetourDetach)(&(PVOID&)o_ZwWriteFile, ZwWriteFile_Hook) != NO_ERROR || |
| 61 | DetourTransactionCommit() != NO_ERROR) |
| 62 | Result = 0; |
| 63 | |
| 64 | return Result; |
| 65 | } |
| 66 | |
| 67 | |
| 68 | NTSTATUS NTAPI XDriver::NtCreateFile_Hook(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength) |
nothing calls this directly
no outgoing calls
no test coverage detected