Click here to Skip to main content
15,883,883 members
Please Sign up or sign in to vote.
2.00/5 (1 vote)
Dear all
I'm new in driver programming and I want to hook ZwQueryDirectoryFile to hide files in win7. It works fine but when I want to create a file with the name of hidden files, it shows a blue screen. I think I should hook NtQueryAttributesFile, but I can't find the equal zw routin.
Here is my code:
C++
if(FileInformationClass == 37)
{
	PFILE_ID_BOTH_DIR_INFORMATION current = (PFILE_ID_BOTH_DIR_INFORMATION)FileInformation; 
	PFILE_ID_BOTH_DIR_INFORMATION previous = NULL;
	do
	{
		RtlInitAnsiString(&ansiFileName, "");
		if(current!= NULL)
		{
			if(current->FileName!= NULL)
			{
				RtlInitUnicodeString(&uniFileName, current->FileName);
				RtlUnicodeStringToAnsiString(&ansiFileName, &uniFileName, TRUE);
				if(RtlCompareMemory(ansiFileName.Buffer, HideFileOne.Buffer, HideFileOne.Length) == HideFileOne.Length)
				{
					if(!(current->NextEntryOffset))
					{
						previous->NextEntryOffset = 0;
						break;
					} 
					else
					{
						int iPos = ((ULONG)current) - (ULONG)FileInformation;
						int iLeft = (DWORD)Length - iPos - current->NextEntryOffset;
						RtlCopyMemory((PVOID)current, (PVOID)((char *)current + current->NextEntryOffset), (DWORD)iLeft );
						continue;
					}
				}
				previous = current;
				current = (PFILE_ID_BOTH_DIR_INFORMATION)((char *)current + current->NextEntryOffset);
			}
		}
	}while(current->NextEntryOffset);

I also check the value of 1,2 and 3 for FileInformationClass.
I am waiting for your answers.
Thanks for all guidance
Posted
Updated 22-Jul-13 19:17pm
v4
Comments
Sergey Alexandrovich Kryukov 21-Jul-13 3:11am    
Without a comprehensive code sample, this request hardly makes sense. There are too many ways to screw up things. Getting a blue screen is relatively rare, but still can be made in some different ways.
—SA
The_Inventor 25-Jul-13 5:27am    
Could this be an issue: 'I want to create a file with the name of hidden files'?
H.Brydon 21-Jul-13 9:22am    
Agreed, although a BSOD is pretty common in badly written driver code.
(And thanks for the 5).
Sergey Alexandrovich Kryukov 21-Jul-13 14:44pm    
Yes, of course, only this information is not enough without a comprehensive code sample.
Thank you for the note.
—SA

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900