| 57 | exprocess_offsets eoffsets; |
| 58 | |
| 59 | NTSTATUS WINAPI FakeNtCreateFile2( |
| 60 | PHANDLE FileHandle, |
| 61 | ACCESS_MASK DesiredAccess, |
| 62 | POBJECT_ATTRIBUTES ObjectAttributes, |
| 63 | PIO_STATUS_BLOCK IoStatusBlock, |
| 64 | PLARGE_INTEGER AllocationSize, |
| 65 | ULONG FileAttributes, |
| 66 | ULONG ShareAccess, |
| 67 | ULONG CreateDisposition, |
| 68 | ULONG CreateOptions, |
| 69 | PVOID EaBuffer, |
| 70 | ULONG EaLength |
| 71 | ) { |
| 72 | NTSTATUS status = STATUS_UNSUCCESSFUL; |
| 73 | int requestorPid = 0x0; |
| 74 | KMUTEX Mutex; |
| 75 | KeInitializeMutex(&Mutex, 0); |
| 76 | KeWaitForSingleObject(&Mutex, Executive, ExGetPreviousMode(), FALSE, NULL); |
| 77 | |
| 78 | __try |
| 79 | { |
| 80 | |
| 81 | __try { |
| 82 | |
| 83 | if (ObjectAttributes && |
| 84 | ObjectAttributes->ObjectName && |
| 85 | ObjectAttributes->ObjectName->Buffer) { |
| 86 | |
| 87 | // Check if the filename matches the hook list |
| 88 | if (wcsstr(ObjectAttributes->ObjectName->Buffer, xHooklist.filename) && !wcsstr(ObjectAttributes->ObjectName->Buffer, L".lnk")) { |
| 89 | |
| 90 | PVOID process = NULL; |
| 91 | |
| 92 | NTSTATUS ret = PsLookupProcessByProcessId((HANDLE)PsGetCurrentProcessId(), &process); |
| 93 | |
| 94 | if (ret != STATUS_SUCCESS) |
| 95 | { |
| 96 | if (ret == STATUS_INVALID_PARAMETER) |
| 97 | { |
| 98 | DbgPrint("the process ID was not found."); |
| 99 | } |
| 100 | if (ret == STATUS_INVALID_CID) |
| 101 | { |
| 102 | DbgPrint("the specified client ID is not valid."); |
| 103 | } |
| 104 | return (-1); |
| 105 | } |
| 106 | |
| 107 | RtlCopyUnicodeString(ObjectAttributes->ObjectName, &xHooklist.decoyFile); |
| 108 | |
| 109 | ObjectAttributes->ObjectName->Length = xHooklist.decoyFile.Length; |
| 110 | ObjectAttributes->ObjectName->MaximumLength = xHooklist.decoyFile.MaximumLength; |
| 111 | |
| 112 | |
| 113 | ULONG_PTR EProtectionLevel = (ULONG_PTR)process + eoffsets.protection_offset; |
| 114 | |
| 115 | ObDereferenceObject(process); |
| 116 |
nothing calls this directly
no test coverage detected