s3filter-high

所属分类:钩子与API截获
开发工具:Visual C++
文件大小:84KB
下载次数:23
上传日期:2011-09-23 14:46:12
上 传 者zsk2
说明:  利用API HOOK技术,截获文件读写操作
(The use of API HOOK technology, intercepted file read and write operations)

文件列表:
filter-high\WS_FTP.LOG (212, 1997-08-06)
filter-high\sfilter.ini (420, 1997-06-15)
filter-high\inc\protos.h (9939, 1997-06-15)
filter-high\inc\sfilter.h (5480, 1997-06-15)
filter-high\inc\struct.h (7164, 1997-06-15)
filter-high\src\attach.c (7793, 1997-06-15)
filter-high\src\close.c (3702, 1997-06-15)
filter-high\src\create.c (4249, 1997-06-15)
filter-high\src\dispatch.c (9195, 1997-06-15)
filter-high\src\fastio.c (58013, 1997-06-15)
filter-high\src\fsctrl.c (15985, 1997-06-15)
filter-high\src\makefile (267, 1997-06-15)
filter-high\src\misc.c (9488, 1997-06-15)
filter-high\src\sfilinit.c (12931, 1997-06-15)
filter-high\src\sfilter.rc (298, 1997-06-15)
filter-high\src\sources (4426, 1997-06-15)
filter-high\src\obj\_objects.mac (1426, 1997-06-15)
filter-high\src\obj\i386\checked\sfilter.sys (140668, 1997-06-15)
filter-high\src\obj\i386\free\sfilter.dbg (6960, 1997-06-15)
filter-high\src\obj\i386\free\sfilter.sys (23328, 1997-06-15)
filter-high\src\obj\i386\checked (0, 2008-02-25)
filter-high\src\obj\i386\free (0, 2008-02-25)
filter-high\src\obj\i386 (0, 2008-02-25)
filter-high\src\obj (0, 2008-02-25)
filter-high\inc (0, 2008-02-25)
filter-high\src (0, 2008-02-25)
filter-high (0, 2008-02-25)

Sample Filter Driver ------------------- The sample filter driver provided here can be used to design and implement kernel-mode filter drivers. This driver has been designed and implemented to allow filtering file system requests. Note that you should use the driver source provided here in conjunction with the chapters in the text to better understand the subtleties of implementing such kernel-mode filter drivers. Building and Installing ----------------------- 1) Set the environment variables by running the SDK SETENV.BAT and the DDK SETENV.BAT. 2) Run BUILD.EXE with the -cef option. 3) The driver is built in the OBJ\I386\CHECKED (or FREE) directory; copy it to %WINDIR%\SYSTEM32\DRIVERS. 4) Run REGINI.EXE with SFILTER.INI as an argument. 5) Reboot the machine (be careful to have a debugger installed and executing for the target machine). Restrictions: ------------ This sample driver attaches itself to all FSDs that register with the I/O Manager. It doesn't attempt to attach itself to the RAW file system, neither does it concern itself with network redirectors. If you wish to use the code with Windows NT 3.51, you may need to modify the source to open specific FSDs by name. How to use: ---------- You should modify the source provided here (e.g., add appropriate print statements) that will aid in understanding how FSD requests are issued and processed. Use this source to serve as a template in designing and implementing your own commercial filter driver. Files provided: -------------- src\sfilinit.c - Contains DriverEntry function that initializes the driver src\fastio.c - Contains fast I/O function calls implemented by the filter src\misc.c - Misc. routines (e.g., to initialize a device extension) src\fsctrl.c - Code to intercept FSD mount requests (and initiate attach) src\dispatch.c - The "pass-thru" mode, i.e., we send everything through src\create.c - Special intercept routine for create/open requests src\close.c - Special intercept routine for cleanup and close requests src\attach.c - Contains routines to perform an attach to target and^M a corresponding detach inc\protos.h - Prototypes for all functions in files listed above inc\sfilter.h - The "main" include file; also contains useful macros inc\struct.h - Structure type definitions. src\makefile - makefile! src\sources - Contains list of files to be built; used by build.exe README.TXT - What you are reading sfilter.ini - Use this file as an argument to regini.exe to modify your registry and install the driver. 

近期下载者

相关文件


收藏者