● 杀毒软件的奥秘(zz) - 荔园在线 | 深圳大学学生论坛,荔园晨风BBS,深大在线网站

荔园之美，在春之萌芽，在夏之绽放，在秋之收获，在冬之沉淀

发信人: fast (快), 信区: Virus
标  题: 杀毒软件的奥秘(zz)
发信站: 荔园晨风BBS站 (Wed Nov 14 14:49:18 2001), 转信

杀毒软件的奥秘
     作者:陆麟

    市面上所有号称"虚拟机","防火墙"的实时监控杀毒软件无一不是使用的
IFSHOOK技术.但是同时也有一些朋友不断写MAIL给我打听如何实现读写的监控.下
面给出用VTOOLSD写的代码.也就是所有实时杀毒软件的奥秘.同时,很多拦截文件操
作的软件,例如对目录加密,文件加密等,也采用了雷同的技术.
由于代码十分简单,不分析了.
//======================================================================
=======
//
//By Lu Lin 2000.5.10
// Apply with VtoolsD 3.01
// DDK version is available if requested.
//Abstract:
// Install a IFS hook, monitoring any read and write access
//
//======================================================================
=======
// IFSHOOK.c - main module for IFSHOOK

#define   DEVICE_MAIN
#include  "ifshook.h"
#undef    DEVICE_MAIN

//typedef EventHdl(pevent pev,pioreq pir);

typedef struct _Monitored_Files{
struct _Monitored_Files *pNext_Monitored_Files;//pointer to next struct

struct _Monitored_Files *pPre_Monitored_Files;//pointer to previous
struct
int sfn;//system file number
int open_count;
char path[260]; //ansi path name
}_Monitored_Files,*pMonitored_Files;

//
//Declare virtual device
//
Declare_Virtual_Device(IFSHOOK)

_Monitored_Files Monitored_Files;
ppIFSFileHookFunc PrevHook;

DefineControlHandler(SYS_VM_INIT, OnSysVMInit);
DefineControlHandler(SYS_DYNAMIC_DEVICE_INIT, OnSysDynamicDeviceInit);

DefineControlHandler(SYS_DYNAMIC_DEVICE_EXIT, OnSysDynamicDeviceExit);

DefineControlHandler(SYS_VM_TERMINATE, OnSysVMTerminate);

PCHAR ConvertPath( int drive, path_t ppath, PCHAR fullpathname )
{
    int  i = 0;
    _QWORD  result;

    //
    // Stick on the drive letter if we know it.
    //
    if( drive != 0xFF ) {

        fullpathname[0] = drive+'A'-1;
        fullpathname[1] = ':';
        i = 2;
    }
    UniToBCSPath( &fullpathname[i], ppath->pp_elements, 260 , BCS_WANSI,
&result );
    return( fullpathname );
}

pMonitored_Files IsFileOpened(int i){
pMonitored_Files p=&Monitored_Files;

while (p){
  if (i==p->sfn){
   return p;
  }
  p=p->pNext_Monitored_Files;
}
return 0;
}

BOOL ControlDispatcher(
DWORD dwControlMessage,
DWORD EBX,
DWORD EDX,
DWORD ESI,
DWORD EDI,
DWORD ECX)
{
START_CONTROL_DISPATCH

  ON_SYS_VM_INIT(OnSysVMInit);
  ON_SYS_DYNAMIC_DEVICE_INIT(OnSysDynamicDeviceInit);
  ON_SYS_DYNAMIC_DEVICE_EXIT(OnSysDynamicDeviceExit);

END_CONTROL_DISPATCH

return TRUE;
}

int _cdecl MyIfsHook(pIFSFunc pfn, int fn, int Drive, int ResType,
  int CodePage, pioreq pir)
{
int retvar,i;
char fullpathname[260];
_Monitored_Files *FileEntry;
switch(fn){
  case IFSFN_OPEN:{
   retvar=(*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
   ConvertPath( Drive, pir->ir_ppath, fullpathname );
   FileEntry=IsFileOpened(pir->ir_sfn);
   if (FileEntry){
    FileEntry->open_count++;
   }else{
    FileEntry=&Monitored_Files;
    while(1){
     if (FileEntry->pNext_Monitored_Files){
      FileEntry=FileEntry->pNext_Monitored_Files;
     }
     else{
      break;
     }
    }
    FileEntry->pNext_Monitored_Files=\
     HeapAllocate( sizeof(_Monitored_Files),HEAPZEROINIT);
    FileEntry->pNext_Monitored_Files->pPre_Monitored_Files=FileEntry;

    FileEntry=FileEntry->pNext_Monitored_Files;
    FileEntry->sfn=pir->ir_sfn;
    FileEntry->open_count=1;
    memcpy(FileEntry->path,fullpathname,260);
   }
   return retvar;
  }

  case IFSFN_READ:{
   //Do something here,
   //eg. Decrypt the file.
   char *str;
   int j;
   str=pir->ir_data;
   j=pir->ir_length;
   retvar=(*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
   FileEntry=IsFileOpened(pir->ir_sfn);
   if (!stricmp("c:\\test.txt",FileEntry->path)){
    for (i=0;i<j;i++){
     str[i]--;
    }
   }
   return retvar;
  }

  case IFSFN_WRITE:{
   //Do something here
   //eg. Encrypt the file
   FileEntry=IsFileOpened(pir->ir_sfn);
   if (FileEntry){
    if (!stricmp("c:\\test.txt",FileEntry->path)){
     for (i=0;i<pir->ir_length;i++){
      (((char*)pir->ir_data)[i])++;
     }
    }
   }
   return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
  }

  case IFSFN_CLOSE:{
   FileEntry=IsFileOpened(pir->ir_sfn);
   if (FileEntry){
    FileEntry->open_count--;
    if (!FileEntry->open_count){
     FileEntry->pPre_Monitored_Files->pNext_Monitored_Files=\
     FileEntry->pNext_Monitored_Files;
     FileEntry->pNext_Monitored_Files->pPre_Monitored_Files=\
      FileEntry->pPre_Monitored_Files;
     HeapFree(FileEntry,0);
     }
   }
   return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
  }

}

return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
}

BOOL OnSysVMInit(VMHANDLE hVM){
return OnSysDynamicDeviceInit();
}

BOOL OnSysDynamicDeviceInit()
{
PrevHook = IFSMgr_InstallFileSystemApiHook(MyIfsHook);
Monitored_Files.pNext_Monitored_Files=0;
Monitored_Files.pPre_Monitored_Files=0;
Monitored_Files.sfn=-1;
Monitored_Files.open_count=0;
Monitored_Files.path[0]=0;

return TRUE;
}

BOOL OnSysDynamicDeviceExit()
{
IFSMgr_RemoveFileSystemApiHook(MyIfsHook);
return TRUE;
}

void OnSysVMTerminate(VMHANDLE hVM){
return OnSysDynamicDeviceExit();
}

--
※ 来源:·荔园晨风BBS站 bbs.szu.edu.cn·[FROM: 192.168.0.101]

荔园在线首页友情链接：深圳大学深大招生荔园晨风BBS S-Term软件网络书店