資源簡介
基于minifilter框架下的透明加解密源碼。
1 手工加載時自動增加system,explorer.exe,notepad.exe為監控進程
2 添加了異或加密算法
3 取消了不對c分區監控的限制,因為很多虛擬機里只有C分區
安裝和加載說明
1 把engine.inf,engine.sys拷貝到虛擬機里
2 右擊engine.inf,點安裝
3 手工加載進cmd, 輸入 sc start engine
4 手工停止進cmd,輸入 sc stop engine
5 測試時請關閉殺毒軟件,代碼與諾頓殺毒軟件的沖突是由于刷緩存引起的,是能解決的,不過初學者不必關心這個

代碼片段和文件信息
#include?“cache.h“
#include?“file.h“
void?Cc_ClearFileCache(PFILE_object?Fileobject?BOOLEAN?bIsFlushCache?PLARGE_INTEGER?FileOffset?ULONG?Length)
{
BOOLEAN?PurgeRes?;
BOOLEAN?ResourceAcquired?=?FALSE?;
BOOLEAN?PagingIoResourceAcquired?=?FALSE?;
PFSRTL_COMMON_FCB_HEADER?Fcb?=?NULL?;
LARGE_INTEGER?Delay50Milliseconds?=?{(ULONG)(-50?*?1000?*?10)?-1};
IO_STATUS_BLOCK?IoStatus?=?{0}?;
if?((Fileobject?==?NULL))
{
return?;
}
???????Fcb?=?(PFSRTL_COMMON_FCB_HEADER)Fileobject->FsContext?;
if?(Fcb?==?NULL)
{
return?;
}
Acquire:
FsRtlEnterFileSystem()?;
if?(Fcb->Resource)
ResourceAcquired?=?ExAcquireResourceExclusiveLite(Fcb->Resource?TRUE)?;
if?(Fcb->PagingIoResource)
PagingIoResourceAcquired?=?ExAcquireResourceExclusive(Fcb->PagingIoResourceFALSE);
else
PagingIoResourceAcquired?=?TRUE?;
if?(!PagingIoResourceAcquired)
{
if?(Fcb->Resource)??ExReleaseResource(Fcb->Resource);
FsRtlExitFileSystem();
KeDelayExecutionThread(KernelModeFALSE&Delay50Milliseconds);
goto?Acquire;
}
if(Fileobject->SectionobjectPointer)
{
IoSetTopLevelIrp(?(PIRP)FSRTL_FSP_TOP_LEVEL_IRP?);
if?(bIsFlushCache)
{
CcFlushCache(?Fileobject->SectionobjectPointer?FileOffset?Length?&IoStatus?);
}
if(Fileobject->SectionobjectPointer->ImageSectionobject)
{
MmFlushImageSection(
Fileobject->SectionobjectPointer
MmFlushForWrite
)?;
}
if(Fileobject->SectionobjectPointer->DataSectionobject)
{?
PurgeRes?=?CcPurgeCacheSection(?Fileobject->SectionobjectPointer
NULL
0
FALSE?);????????????????????????????????????????????????????
}
??????????????????????????????????????
IoSetTopLevelIrp(NULL);???????????????????????????????????
}
if?(Fcb->PagingIoResource)
ExReleaseResourceLite(Fcb->PagingIoResource?);???????????????????????????????????????
if?(Fcb->Resource)
ExReleaseResourceLite(Fcb->Resource?);?????????????????????
FsRtlExitFileSystem()?;
}
?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????文件?????????13??2010-01-18?14:39??engine\Build.txt
?????文件?????????66??2010-11-17?13:53??engine\engine\buildfre_wxp_x86.err
?????文件???????8271??2010-11-17?13:53??engine\engine\buildfre_wxp_x86.log
?????文件???????2259??2010-11-17?13:53??engine\engine\buildfre_wxp_x86.wrn
?????文件???????2018??2010-10-10?18:56??engine\engine\cache.c
?????文件????????222??2010-01-18?10:36??engine\engine\cache.h
?????文件???????3504??2010-10-10?18:38??engine\engine\common.h
?????文件???????5801??2010-10-10?18:18??engine\engine\ctx.c
?????文件???????1194??2010-10-10?15:37??engine\engine\ctx.h
?????文件???????2481??2010-01-18?11:55??engine\engine\engine.inf
?????文件????????266??2009-08-19?09:48??engine\engine\engine.rc
?????文件??????15016??2010-10-13?09:54??engine\engine\file.c
?????文件???????3744??2010-01-18?10:38??engine\engine\file.h
?????文件?????121786??2008-01-19?13:16??engine\engine\fltKernel.h
?????文件???????1975??2010-01-18?14:35??engine\engine\key.c
?????文件????????528??2010-01-18?14:06??engine\engine\key.h
?????文件???????1230??2010-11-17?13:49??engine\engine\lib.c
?????文件????????977??2010-11-16?20:22??engine\engine\lib.h
?????文件??????75619??2010-11-17?13:52??engine\engine\main.c
?????文件???????9178??2010-11-16?19:09??engine\engine\main.h
?????文件????????399??2009-10-11?09:40??engine\engine\makefile
?????文件???????4882??2010-01-18?14:10??engine\engine\message.c
?????文件????????861??2010-01-18?10:56??engine\engine\message.h
?????文件??????18292??2010-11-16?18:28??engine\engine\objfre_wxp_x86\i386\cache.obj
?????文件??????22030??2010-11-16?18:28??engine\engine\objfre_wxp_x86\i386\ctx.obj
?????文件???????4645??2010-11-16?18:33??engine\engine\objfre_wxp_x86\i386\ctx.obj.oacr.root.x86fre.pft.xm
?????文件?????347136??2010-11-17?13:53??engine\engine\objfre_wxp_x86\i386\engine.pdb
?????文件????????992??2010-11-16?18:28??engine\engine\objfre_wxp_x86\i386\engine.res
?????文件??????26112??2010-11-17?13:53??engine\engine\objfre_wxp_x86\i386\engine.sys
?????文件??????33698??2010-11-16?18:28??engine\engine\objfre_wxp_x86\i386\file.obj
............此處省略35個文件信息
評論
共有 條評論