#include "precomp.h"


enum
{
	bluetooth_btkrnl = 0,
	bluetooth_rfcomm,
	bluetooth_btwusb,
	bluetooth_bthusb,
	bluetooth_bthenum, //테스트 필요..
	bluetooth_maximum
};

static WCHAR* s_bthname[] =
{
	L"\\Driver\\BTKRNL",
	L"\\Driver\\RFCOMM",
	L"\\Driver\\BTWUSB",
	L"\\Driver\\BTHUSB",	
	L"\\Driver\\BTHENUM",
	NULL
};


static BOOLEAN enable_bluetoothhook = FALSE;


NTSTATUS BtkrnHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp);
NTSTATUS RfcommHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp);
NTSTATUS BtwusbHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp);
NTSTATUS BthusbHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp);
NTSTATUS BthEnumHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp);


static PDRIVER_DISPATCH s_ProxyDispatchers[bluetooth_maximum] =
{
	BtkrnHookDispatch,
	RfcommHookDispatch,
	BtwusbHookDispatch,
	BthusbHookDispatch,
	BthEnumHookDispatch //테스트 필요
};

NTSTATUS BtkrnlDeviceIoControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp);
NTSTATUS RfcommInternalDeviceIoControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp);
NTSTATUS BtwusbDeviceIoControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp);
NTSTATUS BthusbDeviceIoControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp);
NTSTATUS BthEnumPnpControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp);

#define BTKRNL_COMMON_HOOK_HANDLERS \
    [IRP_MJ_DEVICE_CONTROL] = { NULL, IRP_MJ_DEVICE_CONTROL, TRUE, BtkrnlDeviceIoControl }, \
    
#define RFCOMM_COMMON_HOOK_HANDLERS \
    [IRP_MJ_INTERNAL_DEVICE_CONTROL] = { NULL, IRP_MJ_INTERNAL_DEVICE_CONTROL, TRUE, RfcommInternalDeviceIoControl }, \

#define BTWUSB_COMMON_HOOK_HANDLERS \
    [IRP_MJ_DEVICE_CONTROL] = { NULL, IRP_MJ_DEVICE_CONTROL, TRUE, BtwusbDeviceIoControl }, \

#define BTHUSB_COMMON_HOOK_HANDLERS \
    [IRP_MJ_DEVICE_CONTROL] = { NULL, IRP_MJ_DEVICE_CONTROL, TRUE, BthusbDeviceIoControl }, \

#define BTHENUM_COMMON_HOOK_HANDLERS \
    [IRP_MJ_PNP] = { NULL, IRP_MJ_PNP, TRUE, BthEnumPnpControl }, \

static HOOK_CONTEXT g_BlueToothHookContexts[] =
{
	{ NULL, FALSE, 0, { BTKRNL_COMMON_HOOK_HANDLERS } },
	{ NULL, FALSE, 0, { RFCOMM_COMMON_HOOK_HANDLERS } },
	{ NULL, FALSE, 0, { BTWUSB_COMMON_HOOK_HANDLERS } },
	{ NULL, FALSE, 0, { BTHUSB_COMMON_HOOK_HANDLERS } }
	//{ NULL, FALSE, 0, { BTHENUM_COMMON_HOOK_HANDLERS } }
};


NTSTATUS BlueToothHookDispatch_Common(ULONG ContextIndex, PDEVICE_OBJECT deviceObject, PIRP irp)
{
	NTSTATUS NtStatus = STATUS_SUCCESS;
	PIO_STACK_LOCATION pCurrentIoStack = IoGetCurrentIrpStackLocation(irp);
	ULONG id = pCurrentIoStack->MajorFunction;
	PHOOK_CONTEXT hook = NULL;
	PDRIVER_DISPATCH pOrgHandler = NULL;

	if (ContextIndex >= ARRAYSIZE(g_BlueToothHookContexts))
		return STATUS_UNSUCCESSFUL;
			
	InterlockedIncrement((volatile LONG*)&g_BlueToothHookContexts[ContextIndex].IrpEnterCount);

	hook = &g_BlueToothHookContexts[ContextIndex];

	// 2. 후킹 유효성 검사
	if (hook->IsHooked &&
		hook->HookHandlers[id].IsHook &&
		hook->HookHandlers[id].Work)
	{
		pOrgHandler = hook->HookHandlers[id].pOrgHandler;
		
		NtStatus = hook->HookHandlers[id].Work(
			pOrgHandler,
			deviceObject,
			irp
		);
	}
	else
	{
		NtStatus = STATUS_UNSUCCESSFUL;
	}

	InterlockedDecrement((volatile LONG*)&g_BlueToothHookContexts[ContextIndex].IrpEnterCount);

	return NtStatus;
}

NTSTATUS BthEnumHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp)
{
	return BlueToothHookDispatch_Common(bluetooth_bthenum, deviceObject, irp);
}

NTSTATUS BtkrnHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp)
{
	return BlueToothHookDispatch_Common(bluetooth_btkrnl, deviceObject, irp);
}

NTSTATUS RfcommHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp)
{
	return BlueToothHookDispatch_Common(bluetooth_rfcomm, deviceObject, irp);
}

NTSTATUS BtwusbHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp)
{
	return BlueToothHookDispatch_Common(bluetooth_btwusb, deviceObject, irp);
}
NTSTATUS BthusbHookDispatch(PDEVICE_OBJECT deviceObject, PIRP irp)
{
	return BlueToothHookDispatch_Common(bluetooth_bthusb, deviceObject, irp);
}

// 매핑을 위한 구조체 정의
typedef struct _BTH_UUID_MAPPING {
	PWCHAR UuidLower;       // 소문자 UUID
	PWCHAR UuidUpper;       // 대문자 UUID
	PWCHAR ReadableName;    // 변환될 한글/영문 설명
} BTH_UUID_MAPPING, * PBTH_UUID_MAPPING;

// 기존 완료 루틴의 정보를 백업해둘 구조체 선언 (전역 헤더에 선언하세요)
typedef struct _BTH_HOOK_CONTEXT {
	PIO_COMPLETION_ROUTINE OldCompletionRoutine;
	PVOID OldContext;
	UCHAR OldControl;
	char processName[50];
} BTH_HOOK_CONTEXT, * PBTH_HOOK_CONTEXT;

// 블루투스 주요 장치 UUID 매핑 테이블 (전역 배열)
BTH_UUID_MAPPING g_BthUuidTable[] = {
	// --- [보안 위협 / 데이터 유출 (차단 권장)] ---
	{ L"1105", L"1105", L"파일 전송 (OBEX Object Push)" },
	{ L"1101", L"1101", L"시리얼 통신 (Serial Port)" },
	{ L"1115", L"1115", L"블루투스 테더링/공유 (PANU)" },
	{ L"1116", L"1116", L"블루투스 핫스팟 (NAP)" },
	{ L"1132", L"1132", L"문자 메시지 접근 (MAP)" },

	// --- [미디어 / 오디오 (선택적 차단)] ---
	{ L"110b", L"110B", L"오디오/헤드셋 스피커 (A2DP Sink)" },
	{ L"110a", L"110A", L"오디오 소스 (A2DP Source)" },
	{ L"1108", L"1108", L"구형 모노 헤드셋 (Headset)" },
	{ L"111e", L"111E", L"핸즈프리 통화 (Handsfree)" },
	{ L"110c", L"110C", L"미디어 리모컨 (AVRCP)" },

	// --- [입력 장치 (허용 권장)] ---
	{ L"1124", L"1124", L"마우스/키보드 (HID)" },
	{ L"1812", L"1812", L"저전력 마우스/키보드 (BLE HID)" },

	// 배열의 끝을 알리는 널(NULL) 값
	{ NULL, NULL, L"알 수 없는 블루투스 장치" }
};

/**
 * 하드웨어 ID 문자열 내에서 특정 UUID를 찾아 읽기 쉬운 이름으로 반환합니다.
 * @param HardwareIdString: 검사할 문자열 (예: L"BTHENUM\\{0000110b-0000...}")
 * @return 매칭된 장치의 한글 설명 포인터
 */
PWCHAR GetReadableBluetoothName(PWCHAR HardwareIdString) {
	int i = 0;

	if (HardwareIdString == NULL) {
		return L"잘못된 장치 정보";
	}

	// 배열을 순회하며 매칭되는 UUID가 있는지 검사
	while (g_BthUuidTable[i].UuidLower != NULL) {
		// 소문자 또는 대문자가 포함되어 있는지 확인 (wcsstr)
		if (wcsstr(HardwareIdString, g_BthUuidTable[i].UuidLower) != NULL ||
			wcsstr(HardwareIdString, g_BthUuidTable[i].UuidUpper) != NULL)
		{
			return g_BthUuidTable[i].ReadableName;
		}
		i++;
	}

	// 매칭되는 값이 없으면 기본값 반환
	return L"알 수 없는 블루투스 장치 (기타)";
}

#define TAG_LOG_STR 'goLB'
NTSTATUS GetAllHardwareIdsAsString(
	_In_ PWCHAR MultiSzBuffer,
	_Out_ PUNICODE_STRING CombinedString
) 
{
	PWCHAR currentString;
	ULONG totalChars = 0;
	USHORT maxLen = 0;

	if (MultiSzBuffer == NULL || CombinedString == NULL) 
	{
		return STATUS_INVALID_PARAMETER;
	}

	// 1. 병합에 필요한 전체 문자열 길이 계산
	currentString = MultiSzBuffer;
	while (*currentString != L'\0') 
	{
		// 현재 문자열 길이 + 구분자("; ") 2글자
		totalChars += (ULONG)wcslen(currentString) + 2;

		// 다음 문자열로 포인터 이동 (현재길이 + NULL)
		currentString += wcslen(currentString) + 1;
	}

	if (totalChars == 0) 
	{
		RtlInitUnicodeString(CombinedString, L"");
		return STATUS_NOT_FOUND;
	}

	// UNICODE_STRING의 최대 크기는 65535 바이트(USHORT)로 제한됨
	if ((totalChars * sizeof(WCHAR) + sizeof(WCHAR)) > 0xFFFF) 
	{
		return STATUS_BUFFER_OVERFLOW;
	}

	// 2. 메모리 할당 (NonPagedPool 사용 - 완료 루틴(DISPATCH_LEVEL)에서 안전)
	maxLen = (USHORT)(totalChars * sizeof(WCHAR) + sizeof(WCHAR));

	// 최신 WDK에서는 NonPagedPoolNx를 권장하나, 구버전 호환성을 위해 NonPagedPool 사용
	CombinedString->Buffer = (PWCHAR)ExAllocatePoolWithTag(NonPagedPool, maxLen, TAG_LOG_STR);

	if (CombinedString->Buffer == NULL) {
		return STATUS_INSUFFICIENT_RESOURCES;
	}

	// UNICODE_STRING 구조체 초기화
	CombinedString->MaximumLength = maxLen;
	CombinedString->Length = 0;
	CombinedString->Buffer[0] = L'\0';

	// 3. 문자열 결합 (Concatenation)
	currentString = MultiSzBuffer;
	while (*currentString != L'\0')
	{
		UNICODE_STRING tempStr;
		RtlInitUnicodeString(&tempStr, currentString);

		// 현재 문자열을 붙임
		RtlAppendUnicodeStringToString(CombinedString, &tempStr);

		currentString += (tempStr.Length / sizeof(WCHAR)) + 1;

		// 다음 문자열이 존재하면 구분자("; ") 삽입
		if (*currentString != L'\0') {
			RtlAppendUnicodeToString(CombinedString, L"; ");
		}
	}

	return STATUS_SUCCESS;
}

// -----------------------------------------------------------------------
// IRP_MN_QUERY_ID 완료 루틴 (여기서 기기 종류를 판별하고 차단합니다)
// -----------------------------------------------------------------------
NTSTATUS PnpQueryIdCompletionRoutine(
	PDEVICE_OBJECT DeviceObject,
	PIRP Irp,
	PVOID Context
) {
	UNREFERENCED_PARAMETER(DeviceObject);
	UNREFERENCED_PARAMETER(Context);
	PBTH_HOOK_CONTEXT hookCtx = (PBTH_HOOK_CONTEXT)Context;
	ULONG state = GetPolicyState(BDC_BLUETOOTH);
	ULONG policyLog = IsPolicyLog(BDC_BLUETOOTH);	
	WCHAR processName[50] = { 0, };
	WCHAR notice[MAX_PATH] = { 0, };
	NTSTATUS status = Irp->IoStatus.Status;
	BOOLEAN bBlock = FALSE;
	//if (Irp->PendingReturned) {
	//	IoMarkIrpPending(Irp);
	//}

	//PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);

	// 하위 드라이버가 처리를 성공했고, 우리가 원하는 Hardware IDs 요청인 경우
	if (NT_SUCCESS(Irp->IoStatus.Status) /*&&
		irpSp->MinorFunction == IRP_MN_QUERY_ID &&
		irpSp->Parameters.QueryId.IdType == BusQueryHardwareIDs*/)
	{
		if (Irp->IoStatus.Information != 0) 
		{
			UNICODE_STRING allHwIdsStr;
			PWCHAR hwIds = (PWCHAR)Irp->IoStatus.Information;

			status = GetAllHardwareIdsAsString(hwIds, &allHwIdsStr);
			if (NT_SUCCESS(status))
			{
				PWCHAR name = GetReadableBluetoothName(allHwIdsStr.Buffer); // 로그에 사람이 읽을 수 있는 이름으로 남기기 위해 변환 시도				
				KLogEx(DEBUG_TRACE_INFO, "btheunm connect : %S, %S", name, allHwIdsStr.Buffer);

				if (wcsstr(allHwIdsStr.Buffer, L"110b") != NULL ||
					wcsstr(allHwIdsStr.Buffer, L"110B") != NULL ||
					wcsstr(allHwIdsStr.Buffer, L"1105") != NULL)
				{
					bBlock = TRUE;
				}

				//'1124', '1812', '110B', '1108'
				if (policyLog)
				{
					if(hookCtx->processName)
						RtlStringCbPrintfW(processName, sizeof(processName), L"%S", hookCtx->processName);

					if (/*state == DISABLE &&*/ bBlock)
						RtlStringCbPrintfW(notice, sizeof(notice), L"btheunm blocked(%s)(%s)", name, allHwIdsStr.Buffer);
					else
						RtlStringCbPrintfW(notice, sizeof(notice), L"btheunm allow(%s)(%s)", name, allHwIdsStr.Buffer);

					SetLog(NULL, NULL, LOG_POLICY, BDC_BLUETOOTH, state, 0, processName, notice);
				}

				if (/*state == DISABLE &&*/ bBlock)
				{
					KLogEx(DEBUG_TRACE_INFO, "btheunm connect STATUS_ACCESS_DENIED !!!");
					ExFreePool(hwIds); // BthEnum이 만들어준 원래 버퍼도 해제
					Irp->IoStatus.Information = 0;
					Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
				}
				else
				{

				}
				
				if(allHwIdsStr.Buffer)
					ExFreePoolWithTag(allHwIdsStr.Buffer, TAG_LOG_STR);
			}
			else
			{
				KLogEx(DEBUG_TRACE_ERROR, "GetAllHardwareIdsAsString Fail (%X)", status);
			}			
		}
	}

	// 상위 드라이버가 원래 등록해두었던 완료 루틴이 있다면 호출하여 흐름 복원
	if (hookCtx->OldCompletionRoutine != NULL) {
		BOOLEAN bInvoke = FALSE;
		if (NT_SUCCESS(Irp->IoStatus.Status) && (hookCtx->OldControl & SL_INVOKE_ON_SUCCESS)) bInvoke = TRUE;
		if (!NT_SUCCESS(Irp->IoStatus.Status) && (hookCtx->OldControl & SL_INVOKE_ON_ERROR)) bInvoke = TRUE;
		if (Irp->Cancel && (hookCtx->OldControl & SL_INVOKE_ON_CANCEL)) bInvoke = TRUE;

		if (bInvoke) {
			status = hookCtx->OldCompletionRoutine(DeviceObject, Irp, hookCtx->OldContext);
		}
		else if (Irp->PendingReturned) {
			IoMarkIrpPending(Irp);
		}
	}
	else {
		if (Irp->PendingReturned) {
			IoMarkIrpPending(Irp);
		}
	}

	// 할당했던 컨텍스트 메모리 해제 (메모리 릭 방지)
	ExFreePoolWithTag(hookCtx, 'kooH');

	return status;
}

NTSTATUS BthEnumPnpControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp)
{
	PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(irp);
	ULONG processId = 0;
	char szProcessName[20] = { 0, };

	if (!g_bs1Flt.IsAttached)
		goto $BthEnumCleanup;

	if (!enable_bluetoothhook)
		goto $BthEnumCleanup;

	processId = HandleToULong(PsGetCurrentProcessId());
	UGetProcessName(szProcessName);

	// IRP_MN_QUERY_ID (장치 식별자 요청) 일 때만 완료 루틴을 답니다.
	if (irpSp->MinorFunction == IRP_MN_QUERY_ID &&
		irpSp->Parameters.QueryId.IdType == BusQueryHardwareIDs)
	{
		PBTH_HOOK_CONTEXT hookCtx = (PBTH_HOOK_CONTEXT)ExAllocatePoolWithTag(NonPagedPool, sizeof(BTH_HOOK_CONTEXT), 'kooH');

		if (hookCtx != NULL) {
			// 기존 스택의 완료 루틴 백업
			hookCtx->OldCompletionRoutine = irpSp->CompletionRoutine;
			hookCtx->OldContext = irpSp->Context;
			hookCtx->OldControl = irpSp->Control;
			strcpy(hookCtx->processName, szProcessName);

			// 우리의 완료 루틴으로 현재 스택 위치 덮어쓰기 (IoSetCompletionRoutine 사용 불가)
			irpSp->CompletionRoutine = PnpQueryIdCompletionRoutine;
			irpSp->Context = hookCtx;
			irpSp->Control = SL_INVOKE_ON_SUCCESS | SL_INVOKE_ON_ERROR | SL_INVOKE_ON_CANCEL;
		}

		// 원래의 BthEnum 함수 호출
		return dispath(deviceObject, irp);
	}
$BthEnumCleanup:
	// 그 외의 PnP 요청은 원래의 BthEnum 함수로 그대로 넘겨버림
	return dispath(deviceObject, irp);
}

/**
	@brief		블루투스 동글 후킹함수
*/
NTSTATUS BtkrnlDeviceIoControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp)
{
	PIO_STACK_LOCATION irpstack = IoGetCurrentIrpStackLocation(irp);
	ULONG buffSize = irpstack->Parameters.DeviceIoControl.InputBufferLength;
	ULONG controlCode = irpstack->Parameters.DeviceIoControl.IoControlCode;
	ULONG state = 0;
	WCHAR processName[50] = { 0, };
	ULONG processId = 0;
	ULONG policyLog = 0;
	char szProcessName[20] = { 0, };
	
	if (!g_bs1Flt.IsAttached)
		goto $BtkrnlCleanup;

	if (!enable_bluetoothhook)
		goto $BtkrnlCleanup;

	processId = HandleToULong(PsGetCurrentProcessId());
	UGetProcessName(szProcessName);

	state = GetPolicyState(BDC_BLUETOOTH);
	policyLog = IsPolicyLog(BDC_BLUETOOTH);

	if (state == DISABLE)
	{
		// 버퍼 크기 체크 등은 필요에 따라 수행
		if (buffSize > 4)
		{
			WCHAR notice[MAX_PATH] = { 0, };
			
			KLogEx(DEBUG_TRACE_INFO, "btkrnl blocked(%X)(%d)", controlCode, buffSize);
			if (policyLog)
			{
				RtlStringCbPrintfW(processName, sizeof(processName), L"%S", szProcessName);
				RtlStringCbPrintfW(notice, sizeof(notice), L"btkrnl blocked(%X)(%d)", controlCode, buffSize);
				SetLog(NULL, NULL, LOG_POLICY, BDC_BLUETOOTH, state, 0, processName, notice);
			}

			irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST; // 또는 STATUS_ACCESS_DENIED
			irp->IoStatus.Information = 0;
			IoCompleteRequest(irp, IO_NO_INCREMENT);

			return STATUS_INVALID_DEVICE_REQUEST;
		}
	}
$BtkrnlCleanup:
	return dispath(deviceObject, irp);
}

/**
	@brief		내장 블루투스 장치 후킹 함수 (RfComm / Microsoft Stack)
*/
PFILE_OBJECT gFileObject = NULL;
NTSTATUS RfcommInternalDeviceIoControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp)
{
	PIO_STACK_LOCATION	irpstack = IoGetCurrentIrpStackLocation(irp);
	NTSTATUS status = STATUS_SUCCESS;
	PCHAR pBuffer = NULL;
	PFILE_OBJECT pFileObject = irpstack->FileObject;
	ULONG controlCode = irpstack->Parameters.DeviceIoControl.IoControlCode;

	ULONG blueToothState = 0;
	ULONG blueToothFileState = 0;
	WCHAR processName[50] = { 0, };
	ULONG processId = 0;
	ULONG blueToothlog = 0;
	ULONG blueToothFilelog = 0;
	char szProcessName[20] = { 0, };
	WCHAR notice[MAX_PATH] = { 0, };

	if (!g_bs1Flt.IsAttached)
		return dispath(deviceObject, irp);

	if (!enable_bluetoothhook)
		return dispath(deviceObject, irp);

	processId = HandleToULong(PsGetCurrentProcessId());
	UGetProcessName(szProcessName);

	blueToothState = GetPolicyState(BDC_BLUETOOTH);	
	blueToothlog = IsPolicyLog(BDC_BLUETOOTH);

	if (blueToothState == DISABLE)
	{
		KLogEx(DEBUG_TRACE_INFO, "  blocked(%X)", controlCode);

		if (blueToothlog)
		{
			RtlStringCbPrintfW(processName, sizeof(processName), L"%S", szProcessName);
			RtlStringCbPrintfW(notice, sizeof(notice), L"rfcom blocked(%X)", controlCode);
			SetLog(NULL, NULL, LOG_POLICY, BDC_BLUETOOTH, blueToothState, 0, processName, notice);
		}

		irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
		irp->IoStatus.Information = 0;
		IoCompleteRequest(irp, IO_NO_INCREMENT);

		return STATUS_INVALID_DEVICE_REQUEST;
	}

	if (!irp->MdlAddress || !irp->MdlAddress->ByteCount ||!irpstack->FileObject)
		return dispath(deviceObject, irp);

	pBuffer = MmGetSystemAddressForMdl(irp->MdlAddress);
	if (!pBuffer)
		return dispath(deviceObject, irp);
	
	__try
	{

		blueToothFileState = GetPolicyState(BDC_BLUETOOTH_FILE);
		blueToothFilelog = IsPolicyLog(BDC_BLUETOOTH_FILE);

		RtlStringCbPrintfW(processName, sizeof(processName), L"%S", szProcessName);
		POBEX_COMMON_HEADER pCommon = (POBEX_COMMON_HEADER)pBuffer;				
		KLogEx(DEBUG_TRACE_INFO, "Opcode(%X)", pCommon->Opcode);
		switch (pCommon->Opcode)
		{
		case OBEX_OPCODE_CONNECT:
			{
				KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_CONNECT(%p)", pFileObject);
				POBEX_CONNECT_PACKET pConn = (POBEX_CONNECT_PACKET)pBuffer;
				USHORT hostPacketLen = 0;
				USHORT hostMaxPktSize = 0;

				if (blueToothFilelog || blueToothlog)
				{
					if (irp->MdlAddress->ByteCount < sizeof(OBEX_CONNECT_PACKET))
					{
						KLogEx(DEBUG_TRACE_INFO, "Data too short for OBEX Connect");
						break;
					}

					hostPacketLen = SWAP_USHORT(pConn->PacketLength);
					hostMaxPktSize = SWAP_USHORT(pConn->MaxPacketSize);

					RtlStringCbPrintfW(notice, sizeof(notice),
						L"OBEX_OPCODE_CONNECT, hostPacketLen(%d), version(0x%x), flag(%d), hostMaxPktSize(%d)",
						hostPacketLen, pConn->Version, pConn->Flags, hostMaxPktSize);

					KLogEx(DEBUG_TRACE_INFO, "file blocked(%X), (%S)", controlCode, notice);
					SetLog(NULL, NULL, LOG_POLICY, BDC_BLUETOOTH, blueToothFileState, 0, processName, notice);
				}

				gFileObject = pFileObject;
				if (blueToothFileState == DISABLE)
				{
					KLogEx(DEBUG_TRACE_INFO, "Blocked OBEX Connect");
					irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
					irp->IoStatus.Information = 0;
					IoCompleteRequest(irp, IO_NO_INCREMENT);

					return STATUS_INVALID_DEVICE_REQUEST;
				}											
			}
			break;
		case OBEX_OPCODE_DISCONNECT: // Disconnect
			{
				KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_DISCONNECT(%p)", pFileObject);
					
				gFileObject = NULL;
				if (blueToothFilelog || blueToothlog)
				{
					RtlStringCbPrintfW(notice, sizeof(notice),
						L"OBEX_OPCODE_DISCONNECT, ByteCount(%d)", irp->MdlAddress->ByteCount);

					KLogEx(DEBUG_TRACE_INFO, "(%S)", notice);
					SetLog(NULL, NULL, LOG_POLICY, BDC_BLUETOOTH, blueToothFileState, 0, processName, notice);
				}
			}
			break;
		case OBEX_OPCODE_PUT: // Put
		case OBEX_OPCODE_PUT_FINAL: // Put Final
			{
				KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_PUT,OBEX_OPCODE_PUT_FINAL(%p)", pFileObject);
				if (gFileObject != pFileObject)
				{
					break;
				}

				ULONG currentOffset = 3;
				WCHAR szFileName[260] = { 0 };
				ULONG packetLen = irp->MdlAddress->ByteCount;
				PUCHAR pData = (PUCHAR)pBuffer;

				if (blueToothFilelog || blueToothlog)
				{
					while (currentOffset < packetLen)
					{
						UCHAR headerId = pData[currentOffset];
						if (currentOffset + 3 > packetLen) 
							break;

						// OBEX 헤더는 상위 2비트에 따라 인코딩 방식이 다름
						// 00xxxxxx: Unicode String (Length 포함) -> Name 헤더가 여기 속함
						// 01xxxxxx: Byte Sequence (Length 포함)
						// 10xxxxxx: 1 Byte Value (Length 필드 없음)
						// 11xxxxxx: 4 Byte Value (Length 필드 없음)

						if (headerId == OBEX_OPCODE_NAME) // 0x01: 파일명 발견!
						{
							USHORT headerLen = 0;
							// Length 필드는 Big Endian (2 bytes)
							((PUCHAR)&headerLen)[1] = pData[currentOffset + 1];
							((PUCHAR)&headerLen)[0] = pData[currentOffset + 2];

							// 실제 이름 길이 = 헤더길이 - (ID 1byte + Length 2bytes)
							// OBEX Name은 Null-terminated Unicode임 (마지막 2바이트 0x00 0x00 포함)
							if (headerLen > 5 && (currentOffset + headerLen <= packetLen))
							{
									
								ULONG nameByteLen = headerLen - 3; // 순수 문자열 바이트 수 (헤더 오버헤드 3바이트 제외)

								if (nameByteLen >= sizeof(szFileName))
									nameByteLen = sizeof(szFileName) - 2;

								// 파일명 복사 (pData + offset + 3)
								RtlCopyMemory(szFileName, &pData[currentOffset + 3], nameByteLen);
								for (ULONG k = 0; k < nameByteLen / 2; k++)
									szFileName[k] = SWAP_USHORT(szFileName[k]);

								szFileName[nameByteLen/2] = 0;

								KLogEx(DEBUG_TRACE_INFO, "File Name Found: %ws", szFileName);

								RtlStringCbPrintfW(notice, sizeof(notice), L"File Transfer: %s, packetLen: %d", szFileName, packetLen);
							}

							break; // 이름을 찾았으면 루프 종료 (최적화)
						}

						// 다음 헤더로 이동하기 위한 오프셋 계산
						if ((headerId & 0xC0) == 0x00 || (headerId & 0xC0) == 0x40)
						{
							// Length 필드가 있는 타입 (String, Sequence)
							USHORT chunkLen = 0;
							((PUCHAR)&chunkLen)[1] = pData[currentOffset + 1];
							((PUCHAR)&chunkLen)[0] = pData[currentOffset + 2];

							if (chunkLen == 0) break; // 무한루프 방지
							currentOffset += chunkLen;
						}
						else if ((headerId & 0xC0) == 0x80)
						{
							// 1 Byte Value (총 2바이트: ID + Value)
							currentOffset += 2;
						}
						else if ((headerId & 0xC0) == 0xC0)
						{
							// 4 Byte Value (총 5바이트: ID + Value 4bytes)
							currentOffset += 5;
						}
					}

					if(notice[0] == 0)
						RtlStringCbPrintfW(notice, sizeof(notice), L"File Transfer: unknown, packetLen: %d", packetLen);

					SetLog(NULL, NULL, LOG_POLICY, BDC_BLUETOOTH, blueToothFileState, 0, processName, notice);
				}

				if (blueToothFileState == DISABLE || blueToothFileState == READONLY)
				{
					KLogEx(DEBUG_TRACE_INFO, "Blocked File Transfer: %ws", szFileName);
					irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
					irp->IoStatus.Information = 0;
					IoCompleteRequest(irp, IO_NO_INCREMENT);
					return STATUS_INVALID_DEVICE_REQUEST;
				}
			}
			break;
		case OBEX_OPCODE_OK:
			KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_OK");
			break;
		case OBEX_OPCODE_CONTINUE:
			KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_CONTINUE");
			break;
		case OBEX_OPCODE_BODY:
			KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_BODY");
			break;
		case OBEX_OPCODE_END_BODY:
			KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_END_BODY");					
			break;
		case OBEX_OPCODE_VERSION:
			KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_VERSION");
			break;
		case OBEX_OPCODE_CONN_FLAGS:
			KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_CONN_FLAGS");
			break;
		case OBEX_OPCODE_NAME:
			KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_NAME");
			break;
		case OBEX_OPCODE_LENGTH:
			KLogEx(DEBUG_TRACE_INFO, "OBEX_OPCODE_LENGTH");
			break;
		default:
			KLogEx(DEBUG_TRACE_INFO, "default OBEX_OPCODE");
			break;
		}
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		NTSTATUS exceptStatus = GetExceptionCode();
		KLogEx(DEBUG_TRACE_ERROR, "Exception accessing buffer: 0x%X", exceptStatus);

	}

	status = dispath(deviceObject, irp);
	return status;
}

/**
	@brief		블루투스 USB 장치 후킹 함수 (BTWUSB)
*/
NTSTATUS BtwusbDeviceIoControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp)
{
	PIO_STACK_LOCATION	irpstack = IoGetCurrentIrpStackLocation(irp);
	ULONG controlCode = irpstack->Parameters.DeviceIoControl.IoControlCode;
	NTSTATUS ntStatus = STATUS_SUCCESS;
	ULONG blueToothState = 0;
	WCHAR processName[50] = { 0, };
	ULONG processId = 0;
	ULONG blueToothlog = 0;
	char szProcessName[20] = { 0, };
	WCHAR notice[MAX_PATH] = { 0, };

	if (!g_bs1Flt.IsAttached)
		return dispath(deviceObject, irp);

	if (!enable_bluetoothhook)
		return dispath(deviceObject, irp);

	processId = HandleToULong(PsGetCurrentProcessId());
	UGetProcessName(szProcessName);

	blueToothState = GetPolicyState(BDC_BLUETOOTH);	
	blueToothlog = IsPolicyLog(BDC_BLUETOOTH);

	if (blueToothState == DISABLE)
	{
		KLogEx(DEBUG_TRACE_INFO, " btwusb blocked(%X)", controlCode);

		if (blueToothlog)
		{
			RtlStringCbPrintfW(processName, sizeof(processName), L"%S", szProcessName);
			RtlStringCbPrintfW(notice, sizeof(notice), L"btwusb blocked(%X)", controlCode);
			SetLog(NULL, NULL, LOG_POLICY, BDC_BLUETOOTH, blueToothState, 0, processName, notice);
		}

		irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
		irp->IoStatus.Information = 0;
		IoCompleteRequest(irp, IO_NO_INCREMENT);

		return STATUS_INVALID_DEVICE_REQUEST;
	}

	ntStatus = dispath(deviceObject, irp);

	if (blueToothlog == TRUE)
	{

	}


	return ntStatus;
}

/**
	@brief		블루투스 USB 장치 후킹 함수 (BTHUSB)
*/
NTSTATUS BthusbDeviceIoControl(PDRIVER_DISPATCH dispath, PDEVICE_OBJECT deviceObject, PIRP irp)
{
	PIO_STACK_LOCATION	irpstack = IoGetCurrentIrpStackLocation(irp);
	ULONG controlCode = irpstack->Parameters.DeviceIoControl.IoControlCode;
	NTSTATUS ntStatus = STATUS_SUCCESS;
	ULONG blueToothState = 0;
	WCHAR processName[50] = { 0, };
	ULONG processId = 0;
	ULONG blueToothlog = 0;
	char szProcessName[20] = { 0, };
	WCHAR notice[MAX_PATH] = { 0, };

	if (!g_bs1Flt.IsAttached)
		return dispath(deviceObject, irp);

	if (!enable_bluetoothhook)
		return dispath(deviceObject, irp);

	processId = HandleToULong(PsGetCurrentProcessId());
	UGetProcessName(szProcessName);

	blueToothState = GetPolicyState(BDC_BLUETOOTH);
	blueToothlog = IsPolicyLog(BDC_BLUETOOTH);

	if (blueToothState == DISABLE)
	{
		if (processId == 4)
			return dispath(deviceObject, irp);

		if (IsDefalutLocalDiskExceptProcess(szProcessName))
			return dispath(deviceObject, irp);

		if (_strnicmp(szProcessName, "SystemSettings", strlen(szProcessName)) == 0 || 
			_strnicmp(szProcessName, "RuntimeBroker.", strlen(szProcessName)) == 0 )
			return dispath(deviceObject, irp);

	
		KLogEx(DEBUG_TRACE_INFO, " bthusb blocked(%s)(%X)", szProcessName, controlCode);

		if (blueToothlog)
		{
			RtlStringCbPrintfW(processName, sizeof(processName), L"%S", szProcessName);
			RtlStringCbPrintfW(notice, sizeof(notice), L"bthusb blocked(%X)", controlCode);
			SetLog(NULL, NULL, LOG_POLICY, BDC_BLUETOOTH, blueToothState, 0, processName, notice);
		}

		irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
		irp->IoStatus.Information = 0;
		IoCompleteRequest(irp, IO_NO_INCREMENT);

		return STATUS_INVALID_DEVICE_REQUEST;
	}

	ntStatus = dispath(deviceObject, irp);

	if (blueToothlog == TRUE)
	{

	}


	return ntStatus;
}


NTSTATUS BlueToothIrpHookInit()
{
	WCHAR* name = NULL;
	ULONG i, mi;
	PDRIVER_OBJECT obj = NULL;
	PHOOK_CONTEXT hook = NULL;

	for (i = 0; i < ARRAYSIZE(g_BlueToothHookContexts); i++)
	{
		hook = &g_BlueToothHookContexts[i];

		if (hook->IsHooked) 
			continue;

		name = s_bthname[i];
		if (name == NULL) 
			continue;

		KLogEx(DEBUG_TRACE_INFO, "Target driver(%S)\n", name);

		obj = SearchDriverObject(name);
		if (!obj)
		{
			KLogEx(DEBUG_TRACE_ERROR, "Not found object (%S)\n", name);
			continue;
		}

		hook->DriverObject = obj;

		for (mi = 0; mi < IRP_MJ_MAXIMUM_FUNCTION + 1; mi++)
		{
			if (!hook->HookHandlers[mi].IsHook)
				continue;

			if (obj->MajorFunction[mi] == s_ProxyDispatchers[i])
				continue;

			hook->HookHandlers[mi].pOrgHandler = obj->MajorFunction[mi];

			if (hook->HookHandlers[mi].pOrgHandler == NULL)
				continue;
			
			InterlockedExchangePointer((PVOID)&obj->MajorFunction[mi], (PVOID)s_ProxyDispatchers[i]);

			KLogEx(DEBUG_TRACE_INFO, "[Hook] %S MJ:%d Org:%p New:%p\n",
				name, mi, hook->HookHandlers[mi].pOrgHandler, s_ProxyDispatchers[i]);
		}

		hook->IsHooked = TRUE;
		enable_bluetoothhook = TRUE;
	}

	KLogEx(DEBUG_TRACE_INFO, "complete\n");
	return STATUS_SUCCESS;
}


NTSTATUS BlueToothIrpHookCleanup()
{
	ULONG i, mi;
	LARGE_INTEGER WaitTime;
	PHOOK_CONTEXT hook = NULL;
	PDRIVER_DISPATCH pCurrentHandler = NULL;

	enable_bluetoothhook = FALSE;

	KLogEx(DEBUG_TRACE_INFO, "Started...\n");

	for (i = 0; i < ARRAYSIZE(g_BlueToothHookContexts); i++)
	{
		hook = &g_BlueToothHookContexts[i];

		if (!hook->IsHooked || !hook->DriverObject)
			continue;

		KLogEx(DEBUG_TRACE_INFO, "Unhooking Driver Index: %d\n", i);

		for (mi = 0; mi <= IRP_MJ_MAXIMUM_FUNCTION; mi++)
		{
			if (!hook->HookHandlers[mi].IsHook)
				continue;

			if (hook->HookHandlers[mi].pOrgHandler == NULL)
				continue;

			pCurrentHandler = (PDRIVER_DISPATCH)InterlockedExchangePointer(
				(PVOID)&hook->DriverObject->MajorFunction[mi],
				(PVOID)hook->HookHandlers[mi].pOrgHandler
			);

			hook->HookHandlers[mi].pOrgHandler = NULL;
		}

		WaitTime.QuadPart = -50 * 1000 * 10; // 50ms 단위로 대기
		while (hook->IrpEnterCount > 0)
		{
			KLogEx(DEBUG_TRACE_INFO, "(%d), Waiting for active IRPs... Count: %d\n", i, hook->IrpEnterCount);
			KeDelayExecutionThread(KernelMode, FALSE, &WaitTime);
		}

		hook->IsHooked = FALSE;
		hook->DriverObject = NULL;
		//RtlZeroMemory(hook->HookHandlers, sizeof(hook->HookHandlers));
	}

	WaitTime.QuadPart = -500 * 1000 * 10;
	KeDelayExecutionThread(KernelMode, FALSE, &WaitTime);

	KLogEx(DEBUG_TRACE_INFO, "Complete.\n");

	return STATUS_SUCCESS;
}