s3filter-high
所属分类:钩子与API截获
开发工具:Visual C++
文件大小:84KB
下载次数:23
上传日期:2011-09-23 14:46:12
上 传 者:
zsk2
说明: 利用API HOOK技术,截获文件读写操作
(The use of API HOOK technology, intercepted file read and write operations)
文件列表:
filter-high\WS_FTP.LOG (212, 1997-08-06)
filter-high\sfilter.ini (420, 1997-06-15)
filter-high\inc\protos.h (9939, 1997-06-15)
filter-high\inc\sfilter.h (5480, 1997-06-15)
filter-high\inc\struct.h (7164, 1997-06-15)
filter-high\src\attach.c (7793, 1997-06-15)
filter-high\src\close.c (3702, 1997-06-15)
filter-high\src\create.c (4249, 1997-06-15)
filter-high\src\dispatch.c (9195, 1997-06-15)
filter-high\src\fastio.c (58013, 1997-06-15)
filter-high\src\fsctrl.c (15985, 1997-06-15)
filter-high\src\makefile (267, 1997-06-15)
filter-high\src\misc.c (9488, 1997-06-15)
filter-high\src\sfilinit.c (12931, 1997-06-15)
filter-high\src\sfilter.rc (298, 1997-06-15)
filter-high\src\sources (4426, 1997-06-15)
filter-high\src\obj\_objects.mac (1426, 1997-06-15)
filter-high\src\obj\i386\checked\sfilter.sys (140668, 1997-06-15)
filter-high\src\obj\i386\free\sfilter.dbg (6960, 1997-06-15)
filter-high\src\obj\i386\free\sfilter.sys (23328, 1997-06-15)
filter-high\src\obj\i386\checked (0, 2008-02-25)
filter-high\src\obj\i386\free (0, 2008-02-25)
filter-high\src\obj\i386 (0, 2008-02-25)
filter-high\src\obj (0, 2008-02-25)
filter-high\inc (0, 2008-02-25)
filter-high\src (0, 2008-02-25)
filter-high (0, 2008-02-25)
Sample Filter Driver
-------------------
The sample filter driver provided here can be used to design
and implement kernel-mode filter drivers. This driver has been designed and
implemented to allow filtering file system requests.
Note that you should use the driver source provided here in conjunction with
the chapters in the text to better understand the subtleties of implementing
such kernel-mode filter drivers.
Building and Installing
-----------------------
1) Set the environment variables by running the SDK SETENV.BAT and the DDK
SETENV.BAT.
2) Run BUILD.EXE with the -cef option.
3) The driver is built in the OBJ\I386\CHECKED (or FREE) directory; copy
it to %WINDIR%\SYSTEM32\DRIVERS.
4) Run REGINI.EXE with SFILTER.INI as an argument.
5) Reboot the machine (be careful to have a debugger installed and
executing for the target machine).
Restrictions:
------------
This sample driver attaches itself to all FSDs that register with
the I/O Manager. It doesn't attempt to attach itself to the RAW file system,
neither does it concern itself with network redirectors.
If you wish to use the code with Windows NT 3.51, you may need to
modify the source to open specific FSDs by name.
How to use:
----------
You should modify the source provided here (e.g., add appropriate print
statements) that will aid in understanding how FSD requests are
issued and processed. Use this source to serve as a template in
designing and implementing your own commercial filter driver.
Files provided:
--------------
src\sfilinit.c - Contains DriverEntry function that initializes the driver
src\fastio.c - Contains fast I/O function calls implemented by the filter
src\misc.c - Misc. routines (e.g., to initialize a device extension)
src\fsctrl.c - Code to intercept FSD mount requests (and initiate attach)
src\dispatch.c - The "pass-thru" mode, i.e., we send everything through
src\create.c - Special intercept routine for create/open requests
src\close.c - Special intercept routine for cleanup and close requests
src\attach.c - Contains routines to perform an attach to target and^M
a corresponding detach
inc\protos.h - Prototypes for all functions in files listed above
inc\sfilter.h - The "main" include file; also contains useful macros
inc\struct.h - Structure type definitions.
src\makefile - makefile!
src\sources - Contains list of files to be built; used by build.exe
README.TXT - What you are reading
sfilter.ini - Use this file as an argument to regini.exe to modify
your registry and install the driver.
近期下载者:
相关文件:
收藏者: