杀毒软件实时杀毒的奥秘(vxd文件监控)

CODE:

//================================================
// 
//By Lu Lin 2000.5.10 
// Apply with VtoolsD 3.01 
// DDK version is available if requested. 
//Abstract: 
// Install a IFS hook, monitoring any read and write access 
// 
//================================================
// IFSHOOK.c - main module for IFSHOOK 

#define　 DEVICE_MAIN 
#include　"ifshook.h" 
#undef　　DEVICE_MAIN　 

//typedef EventHdl(pevent pev,pioreq pir); 

typedef struct _Monitored_Files{ 
struct _Monitored_Files *pNext_Monitored_Files;//pointer to next struct 
struct _Monitored_Files *pPre_Monitored_Files;//pointer to previous struct 
int sfn;//system file number 
int open_count; 
char path[260]; //ansi path name 
}_Monitored_Files,*pMonitored_Files; 

// 
//Declare virtual device 
// 
Declare_Virtual_Device(IFSHOOK) 

_Monitored_Files Monitored_Files; 
ppIFSFileHookFunc PrevHook; 

DefineControlHandler(SYS_VM_INIT, OnSysVMInit); 
DefineControlHandler(SYS_DYNAMIC_DEVICE_INIT, OnSysDynamicDeviceInit); 
DefineControlHandler(SYS_DYNAMIC_DEVICE_EXIT, OnSysDynamicDeviceExit); 
DefineControlHandler(SYS_VM_TERMINATE, OnSysVMTerminate); 

PCHAR ConvertPath( int drive, path_t ppath, PCHAR fullpathname ) 
{ 
　　int　i = 0; 
　　_QWORD　result; 

　　// 
　　// Stick on the drive letter if we know it. 
　　// 
　　if( drive != 0xFF ) { 

　　　　fullpathname[0] = drive+"A"-1; 
　　　　fullpathname[1] = ":"; 
　　　　i = 2; 
　　} 
　　UniToBCSPath( &fullpathname, ppath->pp_elements, 260 , BCS_WANSI, &result ); 
　　return( fullpathname ); 
} 

pMonitored_Files IsFileOpened(int i){ 
pMonitored_Files p=&Monitored_Files; 

while (p){ 
　if (i==p->sfn){ 
　 return p; 
　} 
　p=p->pNext_Monitored_Files; 
} 
return 0; 
} 

BOOL ControlDispatcher( 
DWORD dwControlMessage, 
DWORD EBX, 
DWORD EDX, 
DWORD ESI, 
DWORD EDI, 
DWORD ECX) 
{ 
START_CONTROL_DISPATCH 

　ON_SYS_VM_INIT(OnSysVMInit); 
　ON_SYS_DYNAMIC_DEVICE_INIT(OnSysDynamicDeviceInit); 
　ON_SYS_DYNAMIC_DEVICE_EXIT(OnSysDynamicDeviceExit); 

END_CONTROL_DISPATCH 

return TRUE; 
} 

int _cdecl MyIfsHook(pIFSFunc pfn, int fn, int Drive, int ResType, 
　int CodePage, pioreq pir) 
{ 
int retvar,i; 
char fullpathname[260]; 
_Monitored_Files *FileEntry; 
switch(fn){ 
　case IFSFN_OPEN:{ 
　 retvar=(*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); 
　 ConvertPath( Drive, pir->ir_ppath, fullpathname ); 
　 FileEntry=IsFileOpened(pir->ir_sfn); 
　 if (FileEntry){ 
　　FileEntry->open_count++; 
　 }else{ 
　　FileEntry=&Monitored_Files; 
　　while(1){ 
　　 if (FileEntry->pNext_Monitored_Files){ 
　　　FileEntry=FileEntry->pNext_Monitored_Files; 
　　 } 
　　 else{ 
　　　break; 
　　 } 
　　} 
　　FileEntry->pNext_Mon_itored_Files= 
　　 HeapAllocate( sizeof(_Monitored_Files),HEAPZEROINIT); 
　　FileEntry->pNext_Monitored_Files->pPre_Mon_itored_Files=FileEntry; 
　　FileEntry=FileEntry->pNext_Monitored_Files; 
　　FileEntry->sfn=pir->ir_sfn; 
　　FileEntry->open_count=1; 
　　memcpy(FileEntry->path,fullpathname,260); 
　 } 
　 return retvar; 
　} 

　case IFSFN_READ:{ 
　 //Do something here, 
　 //eg. Decrypt the file. 
　 char *str; 
　 int j; 
　 str=pir->ir_data; 
　 j=pir->ir_length; 
　 retvar=(*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); 
　 FileEntry=IsFileOpened(pir->ir_sfn); 
　 if (!stricmp("c:\test.txt",FileEntry->path)){ 
　　for (i=0;i<j;i++){ 
　　 str--; 
　　} 
　 } 
　 return retvar; 
　} 

　case IFSFN_WRITE:{ 
　 //Do something here 
　 //eg. Encrypt the file 
　 FileEntry=IsFileOpened(pir->ir_sfn); 
　 if (FileEntry){ 
　　if (!stricmp("c:\test.txt",FileEntry->path)){ 
　　 for (i=0;i<pir->ir_length;i++){ 
　　　(((char*)pir->ir_data))++; 
　　 } 
　　} 
　 } 
　 return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); 
　} 

　case IFSFN_CLOSE:{ 
　 FileEntry=IsFileOpened(pir->ir_sfn); 
　 if (FileEntry){　 
　　FileEntry->open_count--; 
　　if (!FileEntry->open_count){ 
　　 FileEntry->pPre_Monitored_Files->pNext_Mon_itored_Files= 
　　 FileEntry->pNext_Monitored_Files; 
　　 FileEntry->pNext_Monitored_Files->pPre_Mon_itored_Files= 
　　　FileEntry->pPre_Monitored_Files; 
　　 HeapFree(FileEntry,0); 
　　 } 
　 } 
　 return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); 
　} 

}　 

return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir); 
} 

BOOL OnSysVMInit(VMHANDLE hVM){ 
return OnSysDynamicDeviceInit(); 
} 

BOOL OnSysDynamicDeviceInit() 
{ 
PrevHook = IFSMgr_InstallFileSystemApiHook(MyIfsHook); 
Monitored_Files.pNext_Mon_itored_Files=0; 
Monitored_Files.pPre_Mon_itored_Files=0; 
Monitored_Files.sfn=-1; 
Monitored_Files.open_count=0; 
Monitored_Files.path[0]=0; 

return TRUE; 
} 

BOOL OnSysDynamicDeviceExit() 
{ 
IFSMgr_RemoveFileSystemApiHook(MyIfsHook); 
return TRUE; 
} 

void OnSysVMTerminate(VMHANDLE hVM){ 
return OnSysDynamicDeviceExit(); 
}