Hi,
I’m playing about with hooking into NtOpenFile() but I’ve got a little
problem.
My function basically copies the UNICODE_STRING containing the file name and
then calls the real NtOpenFile
with this string rather than the one passed to it. However, the call to the
real NtOpenFile returns with 0xC0000005
which maps to STATUS_ACCESS_VIOLATION.
Okay - so it didn’t like me pointing to memory I allocated with
ExAllocatePool(). My current guess is that this
memory needs to be put into the processes memory map - but (a) is this
correct? and (b) if so, how do I do
that (or is there a better way to allocate the memory)?
NTSTATUS NewNtOpenFile(DWORD a1,DWORD a2,DWORD a3,DWORD a4,DWORD a5,DWORD
a6)
{
NTSTATUS rc;
UNICODE_STRING *newFileName;
UNICODE_STRING *oldFileName;
oldFileName=(UNICODE_STRING
*)(((POBJECT_ATTRIBUTES)a3)->ObjectName);
/* Allocate memory for newFileName */
newFileName=ExAllocatePool(NonPagedPool,sizeof(UNICODE_STRING));
newFileName->Buffer=ExAllocatePool(NonPagedPool,sizeof(WCHAR)*((oldFileName-
MaximumLength)+1));
/* Copy oldFileName to newFileName, setting Length and Maximum
length as well */
uscopy(newFileName,oldFileName);
/* Use newFileName rather than oldFileName */
((POBJECT_ATTRIBUTES)a3)->ObjectName=newFileName;
/* Call the real NTOpenFile */
rc=((NTSTATUS
(*)(DWORD,DWORD,DWORD,DWORD,DWORD,DWORD))orig_call[79])(a1,a2,a3,a4,a5,a6);
/* Move it back in case the subsystem gets funny */
((POBJECT_ATTRIBUTES)a3)->ObjectName=oldFileName;
/* Free memory */
ExFreePool(newFileName->Buffer);
ExFreePool(newFileName);
return rc;
}
Regards
Stuart