hi everyone:
this is a paragraph of source code to hide a dir!
i don’t know that why not hide the dir!
please give me some advice! thanks!
purpose: hide C:\Apc\TestH
VOID ApcHookHideFile( PIRP Irp, PIO_STACK_LOCATION currentIrpStack )
{
PFILE_BOTH_DIR_INFORMATION QueryBuffer = NULL;
ULONG offset = 0;
ULONG currentPosition = 0;
ULONG bufferLength = currentIrpStack->Parameters.QueryFile.Length;
ULONG NewLength = 0;
WCHAR fileNameToRemove = L"TestH";
PUCHAR startEntryToRemove = NULL;
PUCHAR startNextEntry = NULL;
NewLength = bufferLength;
QueryBuffer = (PFILE_BOTH_DIR_INFORMATION) Irp->UserBuffer;
if( QueryBuffer->NextEntryOffset > bufferLength ) return;
do {
offset = QueryBuffer->NextEntryOffset;
DebugPrint( ( “HookRoutine : QUERY_DIR : TestH - %ws 0x%d\n”,
QueryBuffer->FileName, QueryBuffer->NextEntryOffset ) );
if( wcsncmp(QueryBuffer->FileName, fileNameToRemove, 5 ) == 0 ) {
startEntryToRemove = (PUCHAR) QueryBuffer;
startNextEntry = (PUCHAR) QueryBuffer + offset;
RtlMoveMemory( startEntryToRemove, startNextEntry, bufferLength -
currentPosition - offset );
NewLength -= offset;
break;
}
currentPosition += offset;
QueryBuffer = (PFILE_BOTH_DIR_INFORMATION) ( (PUCHAR) QueryBuffer +
offset );
} while( offset != 0 );
Irp->IoStatus.Information = NewLength;
}
case IRP_MJ_DIRECTORY_CONTROL:
if( currentIrpStack->MinorFunction == IRP_MN_QUERY_DIRECTORY ) {
if( strncmp( fullPathName, “C:\0”, 3 ) == 0 ) {
ApcHookHideFile( Irp, currentIrpStack );
}
}
break;