Hello all. I am new to the boards and to the Windows DDK. I had to pick it up for my new job. We are developing a Malware Development system and we have a portion that hooks all of the zw functions and passes the information to userland via IRP communications so we can create an infection tree.
So anyways I have been making improvements to the system as it wasn’t getting full path names for the targets of zwCreateFile, zwReadFile, and zwWriteFile, so I figured out how to do so with ObReferenceObjectByHandle. The only problem is I wasn’t getting a drive letter or a symbolic link in front of the path. So I learned about a function called IoQueryFileDosDeviceName…and it works…but after about 2 minutes of running it BSODs. It doesn’t give me anything like BAD_POOL_CALLER or anything, it just lists ws2ifsl.sys as the offending party. That is the winsock2 ifs layer if I’m not mistaken.
So armed with this knowledge, I realized that the part of our system that tracks TCP and DNS traffic uses Winsock. So I disabled it, and sure enough…no more BSOD. I am confused as to why this is happening…especially since I didn’t write the TCP, DNS portion.
But what I wanted to know is if there was a way I could make my call to IoQueryFileDosDeviceName and somehow ignore any FILE_OBJECTs that have to do with winsock2. Because I imagine if it worked for several minutes before crashing, then it must be BSODing when it finds FILE_OBJECT that both the TCP, DNS portion and my zw hooking portion are trying to use. Here is the code I use to find the path via the handle, including the call to IoQueryFileDosDeviceName:
int GetPathByHandle(PHANDLE handle, char *path, int pathLen) {
ANSI_STRING ansiFileName;
ANSI_STRING ansiDriveLetter;
PFILE_OBJECT fObject;
NTSTATUS myNtStatus;
POBJECT_NAME_INFORMATION pObjectInfo = ExAllocatePool(NonPagedPool, sizeof(OBJECT_NAME_INFORMATION)+1024);
if(path==NULL)
return -1;
RtlInitAnsiString(&ansiFileName, “NULL”);
myNtStatus = ObReferenceObjectByHandle((HANDLE)*handle, GENERIC_READ, *IoFileObjectType, KernelMode, &fObject, NULL);
if(myNtStatus >= STATUS_SUCCESS && fObject!=NULL && fObject->FileName.Buffer!=NULL){
IoQueryFileDosDeviceName(fObject, &pObjectInfo);
//DbgPrint(“VolumeLabel(%d): %wZ\n”, fObject->DeviceObject->Vpb->VolumeLabelLength, fObject->DeviceObject->Vpb->VolumeLabel);
RtlUnicodeStringToAnsiString(&ansiFileName, &(fObject->FileName), TRUE);
RtlUnicodeStringToAnsiString(&ansiDriveLetter, &(pObjectInfo->Name), TRUE);
RtlStringCbPrintfA(path, pathLen, “%s%s”,ansiDriveLetter.Buffer, ansiFileName.Buffer);
ObDereferenceObject(fObject);
ExFreePool(pObjectInfo);
//strncpy(path, ansiFileName.Buffer, pathLen);
}
else
return -1;
return 1;
}
Any assistance would be appreciated. This has me pulling my hair out…and getting the guy who made the TCP, DNS section to fix his code is out of the question.