HOOK NTFS 禁止格式化

if(bHooked == FALSE)
{
RtlInitUnicodeString (&HookDriverName, L"\\FileSystem\\Ntfs");
//获得\Driver\VolSnap驱动对象
status = ObReferenceObjectByName (
&HookDriverName,
OBJ_CASE_INSENSITIVE,
0,
0,
*IoDriverObjectType,
KernelMode,
0,
(PVOID*)&diskdrvobj
); 
if (NT_SUCCESS (status)  && pgOldFileControl == NULL)
{
pgOldFileControl = (PDRIVER_DISPATCH) InterlockedExchange( ( PLONG)&(diskdrvobj->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL]), (LONG)&DispatchMyfileControl);
ObDereferenceObject(diskdrvobj);
DbgPrint("Hook: HOOK driver object! Success\n");
bHooked = TRUE;
}else 


 

HOOK NTFS 禁止格式化 


 

 

// 禁止格式化
NTSTATUS DispatchMyfileControl ( IN PDEVICE_OBJECT pDeviceObject, IN PIRP Irp)
{
PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation( Irp );

if(IrpSp->Parameters.FileSystemControl.FsControlCode == FSCTL_LOCK_VOLUME ||
IrpSp->Parameters.FileSystemControl.FsControlCode == FSCTL_DISMOUNT_VOLUME)
{
PIRP NewIrp = NULL;
PIO_STACK_LOCATION NewIrpSp = NULL;
KEVENT event;
IO_STATUS_BLOCK         ioStatus;
NTSTATUS status;
PDEVICE_OBJECT  QuerryDev = NULL;

QuerryDev = IrpSp->FileObject->Vpb->RealDevice;
if(QuerryDev == NULL)
{
_asm int 3;
}

Irp->IoStatus.Information = 0;
Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;
}
return pgOldFileControl(pDeviceObject,Irp);
}