ob_callback.c

/*
	swirl - inREVERSE
*/

#include "obstuff.h"

DRIVER_INITIALIZE DriverEntry;

PVOID obHandle;


OB_PREOP_CALLBACK_STATUS 
preCall(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation)
{
	PFILE_OBJECT fileo = OperationInformation->Object;
	ACCESS_MASK amask = OperationInformation->Parameters->CreateHandleInformation.DesiredAccess;
	
	UNREFERENCED_PARAMETER(RegistrationContext);

	DbgPrint("[PRE] object:%p access:%X file:%wZ\n", fileo, amask, &fileo->FileName);
	return OB_PREOP_SUCCESS;
}


VOID
EnableObType(POBJECT_TYPE ObjectType)
{
	PMY_OBJECT_TYPE myobtype = (PMY_OBJECT_TYPE)ObjectType;
	DbgPrint("[OBTEST] SupportsObjectCallbacks=%d\n", myobtype->TypeInfo.SupportsObjectCallbacks);
	myobtype->TypeInfo.SupportsObjectCallbacks = 1;
}


VOID 
Unload(IN PDRIVER_OBJECT DriverObject)
{
	UNREFERENCED_PARAMETER(DriverObject);

	DbgPrint("[OBTEST] unloading..\n");
	ObUnRegisterCallbacks(obHandle);
}

NTSTATUS
DriverEntry(
    __in PDRIVER_OBJECT   DriverObject,
    __in PUNICODE_STRING  RegistryPath
    )
{
	NTSTATUS status = STATUS_SUCCESS;
	OB_CALLBACK_REGISTRATION obReg;
	OB_OPERATION_REGISTRATION opReg;
	PLDR_DATA ldr;

	UNREFERENCED_PARAMETER(RegistryPath);

	DbgPrint("[OBTEST] starting..\n");
	DriverObject->DriverUnload = &Unload;
	
	
	// enable IoFileObjectType
	DbgPrint("[OBTEST] enable IoFileObjectType\n");
	EnableObType(*IoFileObjectType);
	
	
	// init callbacks
	memset(&obReg, 0, sizeof(obReg));
	obReg.Version = ObGetFilterVersion();
	obReg.OperationRegistrationCount = 1;
	obReg.RegistrationContext = NULL;
	RtlInitUnicodeString(&obReg.Altitude, L"321000");
	obReg.OperationRegistration = &opReg;
	
	memset(&opReg, 0, sizeof(opReg));
	opReg.ObjectType = IoFileObjectType;
	opReg.Operations = OB_OPERATION_HANDLE_CREATE;
	opReg.PreOperation = (POB_PRE_OPERATION_CALLBACK)&preCall; 
	
	
	// bypass MmVerifyCallbackFunction
	DbgPrint("[OBTEST] bypass MmVerifyCallbackFunction\n");
	ldr = (PLDR_DATA)DriverObject->DriverSection;
	ldr->Flags |= 0x20;
	
	// register callbacks
	status = ObRegisterCallbacks(&obReg, &obHandle);
	if (!NT_SUCCESS(status)) {
		DbgPrint("[OBTEST] ERROR: events sources not installed\n");
		status = STATUS_UNSUCCESSFUL;
	} 
	else
		DbgPrint("[OBTEST] SUCCESS, callbacks registered\n");
	
		 
	return status; 
}