1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
#pragma once
#include <dllimport.h>
#include <loghelpers.h>
#include <ntdll_declarations.h>
namespace usvfs
{
DLLEXPORT NTSTATUS WINAPI
hook_NtQueryFullAttributesFile(POBJECT_ATTRIBUTES ObjectAttributes,
PFILE_NETWORK_OPEN_INFORMATION FileInformation);
DLLEXPORT NTSTATUS WINAPI hook_NtQueryAttributesFile(
POBJECT_ATTRIBUTES ObjectAttributes, PFILE_BASIC_INFORMATION FileInformation);
DLLEXPORT NTSTATUS WINAPI hook_NtQueryDirectoryFile(
HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext,
PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length,
FILE_INFORMATION_CLASS FileInformationClass, BOOLEAN ReturnSingleEntry,
PUNICODE_STRING FileName, BOOLEAN RestartScan);
DLLEXPORT NTSTATUS WINAPI hook_NtQueryDirectoryFileEx(
HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext,
PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length,
FILE_INFORMATION_CLASS FileInformationClass, ULONG QueryFlags,
PUNICODE_STRING FileName);
DLLEXPORT NTSTATUS WINAPI hook_NtQueryObject(
HANDLE Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass,
PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength);
DLLEXPORT NTSTATUS WINAPI hook_NtQueryInformationFile(
HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation,
ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);
DLLEXPORT NTSTATUS WINAPI hook_NtQueryInformationByName(
POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock,
PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);
DLLEXPORT NTSTATUS WINAPI hook_NtOpenFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,
ULONG ShareAccess, ULONG OpenOptions);
DLLEXPORT NTSTATUS WINAPI hook_NtCreateFile(
PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes,
ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer,
ULONG EaLength);
DLLEXPORT NTSTATUS WINAPI hook_NtClose(HANDLE Handle);
DLLEXPORT NTSTATUS WINAPI hook_NtTerminateProcess(HANDLE ProcessHandle,
NTSTATUS ExitStatus);
} // namespace usvfs
|
