Skip to content

Instantly share code, notes, and snippets.

@eahydra
Created March 13, 2015 10:36
Show Gist options
  • Save eahydra/e0de17de624177c00a4c to your computer and use it in GitHub Desktop.
Save eahydra/e0de17de624177c00a4c to your computer and use it in GitHub Desktop.
/*
swirl - inREVERSE
*/
#include "obstuff.h"
DRIVER_INITIALIZE DriverEntry;
PVOID obHandle;
OB_PREOP_CALLBACK_STATUS
preCall(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation)
{
PFILE_OBJECT fileo = OperationInformation->Object;
ACCESS_MASK amask = OperationInformation->Parameters->CreateHandleInformation.DesiredAccess;
UNREFERENCED_PARAMETER(RegistrationContext);
DbgPrint("[PRE] object:%p access:%X file:%wZ\n", fileo, amask, &fileo->FileName);
return OB_PREOP_SUCCESS;
}
VOID
EnableObType(POBJECT_TYPE ObjectType)
{
PMY_OBJECT_TYPE myobtype = (PMY_OBJECT_TYPE)ObjectType;
DbgPrint("[OBTEST] SupportsObjectCallbacks=%d\n", myobtype->TypeInfo.SupportsObjectCallbacks);
myobtype->TypeInfo.SupportsObjectCallbacks = 1;
}
VOID
Unload(IN PDRIVER_OBJECT DriverObject)
{
UNREFERENCED_PARAMETER(DriverObject);
DbgPrint("[OBTEST] unloading..\n");
ObUnRegisterCallbacks(obHandle);
}
NTSTATUS
DriverEntry(
__in PDRIVER_OBJECT DriverObject,
__in PUNICODE_STRING RegistryPath
)
{
NTSTATUS status = STATUS_SUCCESS;
OB_CALLBACK_REGISTRATION obReg;
OB_OPERATION_REGISTRATION opReg;
PLDR_DATA ldr;
UNREFERENCED_PARAMETER(RegistryPath);
DbgPrint("[OBTEST] starting..\n");
DriverObject->DriverUnload = &Unload;
// enable IoFileObjectType
DbgPrint("[OBTEST] enable IoFileObjectType\n");
EnableObType(*IoFileObjectType);
// init callbacks
memset(&obReg, 0, sizeof(obReg));
obReg.Version = ObGetFilterVersion();
obReg.OperationRegistrationCount = 1;
obReg.RegistrationContext = NULL;
RtlInitUnicodeString(&obReg.Altitude, L"321000");
obReg.OperationRegistration = &opReg;
memset(&opReg, 0, sizeof(opReg));
opReg.ObjectType = IoFileObjectType;
opReg.Operations = OB_OPERATION_HANDLE_CREATE;
opReg.PreOperation = (POB_PRE_OPERATION_CALLBACK)&preCall;
// bypass MmVerifyCallbackFunction
DbgPrint("[OBTEST] bypass MmVerifyCallbackFunction\n");
ldr = (PLDR_DATA)DriverObject->DriverSection;
ldr->Flags |= 0x20;
// register callbacks
status = ObRegisterCallbacks(&obReg, &obHandle);
if (!NT_SUCCESS(status)) {
DbgPrint("[OBTEST] ERROR: events sources not installed\n");
status = STATUS_UNSUCCESSFUL;
}
else
DbgPrint("[OBTEST] SUCCESS, callbacks registered\n");
return status;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment