Minfilter过滤框架

const FLT_REGISTRATION fileMonitorRegistration = 
{
sizeof( FLT_REGISTRATION ),                     //  Size
FLT_REGISTRATION_VERSION,                       //  Version
0,                                              //  Flags
ContextRegistration,                            //  ContextRegistration
fileMonitorCallbacks,                           //  Operation callbacks
fileMonUnload,                                  //  FilterUnload
fileMonInstanceSetup,                           //  InstanceSetup
NULL,                                           //  InstanceQueryTeardown
fileMonInstanceTeardownStart,                   //  InstanceTeardownStart
NULL,                                           //  InstanceTeardownComplete
NULL,                                           //  GenerateFileName
NULL,                                           //  GenerateDestinationFileName
NULL                                            //  NormalizeNameComponent
};

const FLT_OPERATION_REGISTRATION 
fileMonitorCallbacks[] =
{
    { 
        IRP_MJ_CREATE,
        FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO,
        HOOK_PreNtCreateFile,
        HOOK_PostNtCreateFile
    },
    { 
        IRP_MJ_CLEANUP,
        0,
        HOOK_PreNtCleanup,
        NULL
    },
    {
        IRP_MJ_WRITE,
        0,
        HOOK_PreNtWriteFile,
        HOOK_PostNtWriteFile
    },
    {  
        IRP_MJ_SET_INFORMATION,
        0,
        HOOK_PreNtSetInformationFile,
        HOOK_PostNtSetInformationFile
    },
    { 
        IRP_MJ_OPERATION_END
    }
};

NTSTATUS FltRegisterFilter(
    IN PDRIVER_OBJECT  Driver,
    IN CONST FLT_REGISTRATION  *Registration,
    OUT PFLT_FILTER  *RetFilter
    ); 

NTSTATUS
DriverEntry (
    __in PDRIVER_OBJECT DriverObject,
    __in PUNICODE_STRING RegistryPath
    )
{
    NTSTATUS status;

    UNREFERENCED_PARAMETER( RegistryPath );
    //注册回调函数
    status = FltRegisterFilter( DriverObject,
                                &FilterRegistration,
                                &NullFilterData.FilterHandle );

    ASSERT( NT_SUCCESS( status ) );

    if (NT_SUCCESS( status )) {
        //如果注册成功则开启minfilter监控
        status = FltStartFiltering( NullFilterData.FilterHandle );

        if (!NT_SUCCESS( status )) {
        //如果失败则卸载注册的回调
            FltUnregisterFilter( NullFilterData.FilterHandle );
        }
    }
    DbgPrint("Minifilter started\n");
    return status;
}

typedef FLT_PREOP_CALLBACK_STATUS
  (*PFLT_PRE_OPERATION_CALLBACK) (
    IN OUT PFLT_CALLBACK_DATA Data,
    IN PCFLT_RELATED_OBJECTS FltObjects,
    OUT PVOID *CompletionContext
    );

Data->IoStatus.Status = STATUS_SUCCESS;
Data->IoStatus.Information = 0;

typedef FLT_POSTOP_CALLBACK_STATUS
(FLTAPI *PFLT_POST_OPERATION_CALLBACK) (
    __inout PFLT_CALLBACK_DATA Data,
    __in PCFLT_RELATED_OBJECTS FltObjects,
    __in_opt PVOID CompletionContext,
    __in FLT_POST_OPERATION_FLAGS Flags
    );

[Version]
Signature   = "$Windows NT$"
Class       = "ActivityMonitor"             ;This is determined by the work this filter driver does
ClassGuid   = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}    ;This value is determined by the Class
Provider    = %Msft%
DriverVer   = 06/16/2007,1.0.0.0
CatalogFile = nullfilter.cat


[DestinationDirs]
DefaultDestDir          = 12
NullFilter.DriverFiles  = 12            ;%windir%\system32\drivers

;;
;; Default install sections
;;

[DefaultInstall]
OptionDesc  = %ServiceDescription%
CopyFiles   = NullFilter.DriverFiles

[DefaultInstall.Services]
AddService  = %ServiceName%,,NullFilter.Service

[DefaultUninstall]
DelFiles   = NullFilter.DriverFiles

[DefaultUninstall.Services]
DelService = %ServiceName%,0x200      ;Ensure service is stopped before deleting

[NullFilter.Service]
DisplayName      = %ServiceName%
Description      = %ServiceDescription%
ServiceBinary    = %12%\%DriverName%.sys    ;%windir%\system32\drivers\
Dependencies     = "FltMgr"
ServiceType      = 2                        ;SERVICE_FILE_SYSTEM_DRIVER
StartType        = 3                        ;SERVICE_DEMAND_START
ErrorControl     = 1                        ;SERVICE_ERROR_NORMAL
LoadOrderGroup   = "FSFilter Activity Monitor"
AddReg           = NullFilter.AddRegistry


[NullFilter.AddRegistry]
HKR,"Instances","DefaultInstance",0x00000000,%DefaultInstance%
HKR,"Instances\"%Instance1.Name%,"Altitude",0x00000000,%Instance1.Altitude%
HKR,"Instances\"%Instance1.Name%,"Flags",0x00010001,%Instance1.Flags%

[NullFilter.DriverFiles]
%DriverName%.sys

[SourceDisksFiles]
nullfilter.sys = 1,,

[SourceDisksNames]
1 = %DiskId1%,,,

[Strings]
Msft                    = "Microsoft Corporation"
ServiceDescription      = "NullFilter mini-filter driver"
ServiceName             = "NullFilter"
DriverName              = "NullFilter"
DiskId1                 = "NullFilter Device Installation Disk"

;Instances specific information.
DefaultInstance         = "Null Instance"
Instance1.Name          = "Null Instance"
Instance1.Altitude      = "370020"
Instance1.Flags         = 0x1          ; Suppress automatic attachments

BOOL InstallDriver(const char* lpszDriverName,const char* lpszDriverPath,const char* lpszAltitude)
{
    char    szTempStr[MAX_PATH];
    HKEY    hKey;
    DWORD    dwData;
    char    szDriverImagePath[MAX_PATH];    

    if( NULL==lpszDriverName || NULL==lpszDriverPath )
    {
        return FALSE;
    }
    //得到完整的驱动路径
    GetFullPathName(lpszDriverPath, MAX_PATH, szDriverImagePath, NULL);

    SC_HANDLE hServiceMgr=NULL;// SCM管理器的句柄
    SC_HANDLE hService=NULL;// NT驱动程序的服务句柄

    //打开服务控制管理器
    hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );
    if( hServiceMgr == NULL ) 
    {
        // OpenSCManager失败
        CloseServiceHandle(hServiceMgr);
        return FALSE;        
    }

    // OpenSCManager成功  

    //创建驱动所对应的服务
    hService = CreateService( hServiceMgr,
        lpszDriverName,             // 驱动程序的在注册表中的名字
        lpszDriverName,             // 注册表驱动程序的DisplayName 值
        SERVICE_ALL_ACCESS,         // 加载驱动程序的访问权限
        SERVICE_FILE_SYSTEM_DRIVER, // 表示加载的服务是文件系统驱动程序
        SERVICE_DEMAND_START,       // 注册表驱动程序的Start 值
        SERVICE_ERROR_IGNORE,       // 注册表驱动程序的ErrorControl 值
        szDriverImagePath,          // 注册表驱动程序的ImagePath 值
        "FSFilter Activity Monitor",// 注册表驱动程序的Group 值
        NULL, 
        "FltMgr",                   // 注册表驱动程序的DependOnService 值
        NULL, 
        NULL);

    if( hService == NULL ) 
    {        
        if( GetLastError() == ERROR_SERVICE_EXISTS ) 
        {
            //服务创建失败，是由于服务已经创立过
            CloseServiceHandle(hService);       // 服务句柄
            CloseServiceHandle(hServiceMgr);    // SCM句柄
            return TRUE; 
        }
        else 
        {
            CloseServiceHandle(hService);       // 服务句柄
            CloseServiceHandle(hServiceMgr);    // SCM句柄
            return FALSE;
        }
    }
    CloseServiceHandle(hService);       // 服务句柄
    CloseServiceHandle(hServiceMgr);    // SCM句柄

    //-------------------------------------------------------------------------------------------------------
    // SYSTEM\\CurrentControlSet\\Services\\DriverName\\Instances子健下的键值项 
    //-------------------------------------------------------------------------------------------------------
    strcpy(szTempStr,"SYSTEM\\CurrentControlSet\\Services\\");
    strcat(szTempStr,lpszDriverName);
    strcat(szTempStr,"\\Instances");
    if(RegCreateKeyEx(HKEY_LOCAL_MACHINE,szTempStr,0,"",REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,&hKey,(LPDWORD)&dwData)!=ERROR_SUCCESS)
    {
        return FALSE;
    }
    // 注册表驱动程序的DefaultInstance 值 
    strcpy(szTempStr,lpszDriverName);
    strcat(szTempStr," Instance");
    if(RegSetValueEx(hKey,"DefaultInstance",0,REG_SZ,(CONST BYTE*)szTempStr,(DWORD)strlen(szTempStr))!=ERROR_SUCCESS)
    {
        return FALSE;
    }
    RegFlushKey(hKey);//刷新注册表
    RegCloseKey(hKey);


    //-------------------------------------------------------------------------------------------------------
    // SYSTEM\\CurrentControlSet\\Services\\DriverName\\Instances\\DriverName Instance子健下的键值项 
    //-------------------------------------------------------------------------------------------------------
    strcpy(szTempStr,"SYSTEM\\CurrentControlSet\\Services\\");
    strcat(szTempStr,lpszDriverName);
    strcat(szTempStr,"\\Instances\\");
    strcat(szTempStr,lpszDriverName);
    strcat(szTempStr," Instance");
    if(RegCreateKeyEx(HKEY_LOCAL_MACHINE,szTempStr,0,"",REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,&hKey,(LPDWORD)&dwData)!=ERROR_SUCCESS)
    {
        return FALSE;
    }
    // 注册表驱动程序的Altitude 值
    strcpy(szTempStr,lpszAltitude);
    if(RegSetValueEx(hKey,"Altitude",0,REG_SZ,(CONST BYTE*)szTempStr,(DWORD)strlen(szTempStr))!=ERROR_SUCCESS)
    {
        return FALSE;
    }
    // 注册表驱动程序的Flags 值
    dwData=0x0;
    if(RegSetValueEx(hKey,"Flags",0,REG_DWORD,(CONST BYTE*)&dwData,sizeof(DWORD))!=ERROR_SUCCESS)
    {
        return FALSE;
    }
    RegFlushKey(hKey);//刷新注册表
    RegCloseKey(hKey);

    return TRUE;
}

BOOL StartDriver(const char* lpszDriverName)
{
    SC_HANDLE        schManager;
    SC_HANDLE        schService;

    if(NULL==lpszDriverName)
    {
        return FALSE;
    }

    schManager=OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);
    if(NULL==schManager)
    {
        CloseServiceHandle(schManager);
        return FALSE;
    }
    schService=OpenService(schManager,lpszDriverName,SERVICE_ALL_ACCESS);
    if(NULL==schService)
    {
        CloseServiceHandle(schService);
        CloseServiceHandle(schManager);
        return FALSE;
    }

    if(!StartService(schService,0,NULL))
    {
        CloseServiceHandle(schService);
        CloseServiceHandle(schManager);
        if( GetLastError() == ERROR_SERVICE_ALREADY_RUNNING ) 
        {             
            // 服务已经开启
            return TRUE;
        } 
        return FALSE;
    }

    CloseServiceHandle(schService);
    CloseServiceHandle(schManager);

    return TRUE;
}

BOOL StopDriver(const char* lpszDriverName)
{
    SC_HANDLE        schManager;
    SC_HANDLE        schService;
    SERVICE_STATUS    svcStatus;
    bool            bStopped=false;

    schManager=OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);
    if(NULL==schManager)
    {
        return FALSE;
    }
    schService=OpenService(schManager,lpszDriverName,SERVICE_ALL_ACCESS);
    if(NULL==schService)
    {
        CloseServiceHandle(schManager);
        return FALSE;
    }    
    if(!ControlService(schService,SERVICE_CONTROL_STOP,&svcStatus) && (svcStatus.dwCurrentState!=SERVICE_STOPPED))
    {
        CloseServiceHandle(schService);
        CloseServiceHandle(schManager);
        return FALSE;
    }

    CloseServiceHandle(schService);
    CloseServiceHandle(schManager);

    return TRUE;
}

BOOL DeleteDriver(const char* lpszDriverName)
{
    SC_HANDLE        schManager;
    SC_HANDLE        schService;
    SERVICE_STATUS    svcStatus;

    schManager=OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);
    if(NULL==schManager)
    {
        return FALSE;
    }
    schService=OpenService(schManager,lpszDriverName,SERVICE_ALL_ACCESS);
    if(NULL==schService)
    {
        CloseServiceHandle(schManager);
        return FALSE;
    }
    ControlService(schService,SERVICE_CONTROL_STOP,&svcStatus);
    if(!DeleteService(schService))
    {
        CloseServiceHandle(schService);
        CloseServiceHandle(schManager);
        return FALSE;
    }
    CloseServiceHandle(schService);
    CloseServiceHandle(schManager);

    return TRUE;
}

/*如果当前线程的ETHREAD结构不为NULL则根据线程ETHREAD来获取进程否则调用函数PsGetCurrentProcess()获取当前进程的EPROCESS结构*/
PEPROCESS processObject = 
        Data->Thread ? IoThreadToProcess(Data->Thread) : PsGetCurrentProcess();

Data->IoStatus.Status = ntStatus;
Data->IoStatus.Information = 0;

typedef struct _FLT_FILE_NAME_INFORMATION {
  USHORT  Size;
  FLT_FILE_NAME_PARSED_FLAGS  NamesParsed;
  FLT_FILE_NAME_OPTIONS  Format;
  UNICODE_STRING  Name;
  UNICODE_STRING  Volume;
  UNICODE_STRING  Share;
  UNICODE_STRING  Extension;
  UNICODE_STRING  Stream;
  UNICODE_STRING  FinalComponent;
  UNICODE_STRING  ParentDir;
} FLT_FILE_NAME_INFORMATION, *PFLT_FILE_NAME_INFORMATION;

    NTSTATUS ntStatus;
    PFLT_FILE_NAME_INFORMATION pNameInfo = NULL;

    UNREFERENCED_PARAMETER( Data );
    UNREFERENCED_PARAMETER( FltObjects );
    UNREFERENCED_PARAMETER( CompletionContext );
    UNREFERENCED_PARAMETER( Flags );

    //获取文件路径信息
    ntStatus = FltGetFileNameInformation(Data,
        FLT_FILE_NAME_NORMALIZED| 
        FLT_FILE_NAME_QUERY_DEFAULT,
        &pNameInfo);
    if (NT_SUCCESS(ntStatus))
    {
        //解析获取到的信息
        FltParseFileNameInformation(pNameInfo);
        DbgPrint("FileName:%wZ\n", &pNameInfo->Name);
        //使用完成后释放这个空间
        FltReleaseFileNameInformation(pNameInfo);
    }

PFILE_RENAME_INFORMATION 
    pFileRenameInfomation = (PFILE_RENAME_INFORMATION)Data->Iopb->Parameters.SetFileInformation.InfoBuffer;

typedef struct _INSTANCE_CONTEXT {
…
} INSTANCE_CONTEXT, *PINSTANCE_CONTEXT;
PINSTANCE_CONTEXT pContext = NULL;
//从设备对象上获取上下文
ntStatus = FltGetInstanceContext(FltObjects->Instance, & pContext);
if(NT_SUCCESS(Status) == FALSE)
{
    //设备上没有上下文则分配上下文的内存
    ntStatus = FltAllocateContext(g_pFilter,FLT_INSTANCE_CONTEXT,
        sizeof(INSTANCE_CONTEXT),
        PagedPool,& pContext);
    if(NT_SUCCESS(Status) == FALSE)
    {
        //返回资源不足
        return STATUS_INSUFFICIENT_RESOURCES;
    }
    RtlZeroMemory(pContext, sizeof(INSTANCE_CONTEXT));
}
pContext ->m_DeviceType = VolumeDeviceType;
pContext->m_FSType = VolumeFilesystemType;
FltSetInstanceContext(FltObjects->Instance, FLT_SET_CONTEXT_REPLACE_IF_EXISTS,pContext,NULL);
if (pContext)
{
    FltReleaseContext(pContext);
}

//获取访问
PINSTANCE_CONTEXT pContext = NULL;
Status = FltGetInstanceContext(FltObjects->Instance,&pContext);
//下面是使用这个上下文，和一些其他的操作
pContext->xxx = xxx;

NTSTATUS
ScannerpScanFileInUserMode (
    __in PFLT_INSTANCE Instance,
    __in PFILE_OBJECT FileObject,
    __out PBOOLEAN SafeToOpen
    )
/*读取文件中的部分数据，然后交由R3处理，并根据R3返回的结果判断R3是否安全*/

{
    NTSTATUS status = STATUS_SUCCESS;
    PVOID buffer = NULL;
    ULONG bytesRead;
    PSCANNER_NOTIFICATION notification = NULL;
    FLT_VOLUME_PROPERTIES volumeProps;
    LARGE_INTEGER offset;
    ULONG replyLength, length;
    PFLT_VOLUME volume = NULL;

    *SafeToOpen = TRUE;

    if (ScannerData.ClientPort == NULL) {

        return STATUS_SUCCESS;
    }

    try {
        status = FltGetVolumeFromInstance( Instance, &volume );
        if (!NT_SUCCESS( status )) {
            leave;
        }
        status = FltGetVolumeProperties( volume,
                                         &volumeProps,
                                         sizeof( volumeProps ),
                                         &length );
        if (NT_ERROR( status )) {
            leave;
        }

        //取1024和扇区的最大值，保证读取的数据至少有一个扇区的大小
        length = max( SCANNER_READ_BUFFER_SIZE, volumeProps.SectorSize );
        /*分配一块内存用于从文件中读取数据，在minfilter中进行文件操作时申请缓冲区最好使用flt开头的一组函数，因为它不是简单的分配一块内存，还能保证在有程序使用这段内存时不会出现内存已被释放的情况，内部可能也用了引用计数*/
        buffer = FltAllocatePoolAlignedWithTag( Instance,
                                                NonPagedPool,
                                                length,
                                                'nacS' );

        if (NULL == buffer) {
            status = STATUS_INSUFFICIENT_RESOURCES;
            leave;
        }
        //构建发送给R3层的结构体的内存
        notification = ExAllocatePoolWithTag( NonPagedPool,
                                              sizeof( SCANNER_NOTIFICATION ),
                                              'nacS' );

        if(NULL == notification) {

            status = STATUS_INSUFFICIENT_RESOURCES;
            leave;
        }
        offset.QuadPart = bytesRead = 0;
        status = FltReadFile( Instance,
                              FileObject,
                              &offset,
                              length,
                              buffer,
                              FLTFL_IO_OPERATION_NON_CACHED |
                               FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET,
                              &bytesRead,
                              NULL,
                              NULL );

        if (NT_SUCCESS( status ) && (0 != bytesRead)) {

            notification->BytesToScan = (ULONG) bytesRead;

            /*将这段信息发送到R3，这个函数是一个阻塞的函数，只有当超时值过了或者R3返回了数据才会返回，在这设置超时值为NULL表示会一直等待，在这返回值也是使用notification做为接受返回值的缓冲，在这不会出现覆盖的情况，因为这个函数在调用后首先是R3接受数据，然后进行处理，处理完成后R3才会主动调用另一个API返回数据，所以这里有一个时间差，当获取到返回值时之前传入的数据已经没有用了，这里将发送的缓冲与返回的缓冲定义为同一个只是为了节省内存*/
            RtlCopyMemory( &notification->Contents,
                           buffer,
                           min( notification->BytesToScan, SCANNER_READ_BUFFER_SIZE ) );

            replyLength = sizeof( SCANNER_REPLY );
            //在这我们将
            status = FltSendMessage( ScannerData.Filter,
                                     &ScannerData.ClientPort,
                                     notification,
                                     sizeof(SCANNER_NOTIFICATION),
                                     notification,
                                     &replyLength,
                                     NULL );

            if (STATUS_SUCCESS == status) {

                *SafeToOpen = ((PSCANNER_REPLY) notification)->SafeToOpen;

            } else {
                DbgPrint( "!!! scanner.sys --- couldn't send message to user-mode to scan file, status 0x%X\n", status );
            }
        }

    } finally {
        //最后清理内存
        if (NULL != buffer) {

            FltFreePoolAlignedWithTag( Instance, buffer, 'nacS' );
        }

        if (NULL != notification) {

            ExFreePoolWithTag( notification, 'nacS' );
        }

        if (NULL != volume) {

            FltObjectDereference( volume );
        }
    }

    return status;
}

    while (TRUE) 
    {
    //这是一个阻塞函数，当能从R0接受到数据的时候返回
        result = GetQueuedCompletionStatus( Context->Completion, &outSize, &key, &pOvlp, INFINITE );
        message = CONTAINING_RECORD( pOvlp, SCANNER_MESSAGE, Ovlp );
        if (!result) 
        {
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

        printf( "Received message, size %d\n", pOvlp->InternalHigh );
        notification = &message->Notification;

        assert(notification->BytesToScan <= SCANNER_READ_BUFFER_SIZE);
        /*R3层定义的这个SCANNER_MESSAGE结构体是在notification这个结构体的基础之上加了一个头，所以大小会大于这个notification*/
        __analysis_assume(notification->BytesToScan <= SCANNER_READ_BUFFER_SIZE);

        //这个函数是一个自定义函数，用来扫描R0传上来的数据有没有特定的字符
        result = ScanBuffer( notification->Contents, notification->BytesToScan );

        replyMessage.ReplyHeader.Status = 0;
        replyMessage.ReplyHeader.MessageId = message->MessageHeader.MessageId;

        replyMessage.Reply.SafeToOpen = !result;

        printf( "Replying message, SafeToOpen: %d\n", replyMessage.Reply.SafeToOpen );
        //向R0返回数据
        hr = FilterReplyMessage( Context->Port,
                                 (PFILTER_REPLY_HEADER) &replyMessage,
                                 sizeof( replyMessage ) );

        if (SUCCEEDED( hr )) {

            printf( "Replied message\n" );

        } else {

            printf( "Scanner: Error replying message. Error = 0x%X\n", hr );
            break;
        }

        memset( &message->Ovlp, 0, sizeof( OVERLAPPED ) );
        //再次等待从R0下发的数据
        hr = FilterGetMessage( Context->Port,
                               &message->MessageHeader,
                               FIELD_OFFSET( SCANNER_MESSAGE, Ovlp ),
                               &message->Ovlp );

        if (hr != HRESULT_FROM_WIN32( ERROR_IO_PENDING )) 
        {
            break;
        }
    }