NtCreateFile hooking

? Hi all,
??? how can i hook NtCreateFile.I hooked ZwCreatefile successfully using DDK.but it does nt support NtCrteateFile.How it possible
??? Thanks

The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

You shouldn’t be hooking either one of these.

mm

SSDT hooking, ofocurse on 64 bit u need to bribe patch guard and friends :slight_smile:
good luck

On Mon, Nov 23, 2009 at 2:46 PM, Sree K wrote:

> Hi all,
> how can i hook NtCreateFile.I hooked ZwCreatefile successfully using
> DDK.but it does nt support NtCrteateFile.How it possible
> Thanks
>
> ------------------------------
> The INTERNET now has a personality. YOURS! See your Yahoo! Homepagehttp:</http:>.
> — NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and
> other seminars visit: http://www.osr.com/seminars To unsubscribe, visit
> the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer



- amitr0

You don’t, can’t, and shouldn’t. Period. Everytime this has ever been
espoused by a poster as a solution, it is shown to be a knee jerk reaction
and not a well thought out solution. Another period. So, instead of trying
to tell us a solution that will not work and not well thought of, tell us
the problem.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Sree K
Sent: Monday, November 23, 2009 3:17 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] NtCreateFile hooking

Hi all,
how can i hook NtCreateFile.I hooked ZwCreatefile successfully using
DDK.but it does nt support NtCrteateFile.How it possible
Thanks


The INTERNET now has a personality. YOURS! See
http:</http:> your Yahoo!
Homepage. — NTDEV is sponsored by OSR For our schedule of WDF, WDM,
debugging and other seminars visit: http://www.osr.com/seminars To
unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature
database 4630 (20091123) __________

The message was checked by ESET Smart Security.

http://www.eset.com

Write a FltMgr minifilter, it has PreCreate and PostCreate paths.


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

“Sree K” wrote in message news:xxxxx@ntdev…
Hi all,
how can i hook NtCreateFile.I hooked ZwCreatefile successfully using DDK.but it does nt support NtCrteateFile.How it possible
Thanks

The INTERNET now has a personality. YOURS! See your Yahoo! Homepage.