90 lines
2.3 KiB
C
90 lines
2.3 KiB
C
#pragma once
|
|
|
|
typedef NTSTATUS(__stdcall* AntiHandler)(PDRIVER_DISPATCH, PDEVICE_OBJECT, PIRP);
|
|
typedef struct _IRP_HOOK_HANDLER
|
|
{
|
|
PDRIVER_DISPATCH pOrgHandler;
|
|
ULONG MajorIndex;
|
|
BOOLEAN IsHook;
|
|
AntiHandler Work;
|
|
}IRP_HOOK_HANDLER, * PIRP_HOOK_HANDLER;
|
|
|
|
typedef struct _IRP_CORE
|
|
{
|
|
PDRIVER_OBJECT HookDriverObject;
|
|
PVOID HookDispatch;
|
|
PIRP_HOOK_HANDLER IrpHookHandler;
|
|
ULONG IrpHookHandlerCount;
|
|
ULONG IrpEnterCount;
|
|
|
|
}IRP_CORE, * PIRP_CORE;
|
|
|
|
// 컨텍스트 구조체
|
|
typedef struct _HOOK_CONTEXT
|
|
{
|
|
PDRIVER_OBJECT DriverObject;
|
|
BOOLEAN IsHooked;
|
|
ULONG IrpEnterCount;
|
|
IRP_HOOK_HANDLER HookHandlers[IRP_MJ_MAXIMUM_FUNCTION + 1];
|
|
} HOOK_CONTEXT, * PHOOK_CONTEXT;
|
|
|
|
#pragma pack(push, 1)
|
|
|
|
// OBEX 공통 헤더
|
|
typedef struct _OBEX_COMMON_HEADER
|
|
{
|
|
UCHAR Opcode; // 0x80 for Connect
|
|
USHORT PacketLength; // Big Endian, 헤더 포함 전체 길이
|
|
} OBEX_COMMON_HEADER, * POBEX_COMMON_HEADER;
|
|
|
|
// OBEX Connect 패킷 구조체
|
|
typedef struct _OBEX_CONNECT_PACKET
|
|
{
|
|
UCHAR Opcode; // 0x80
|
|
USHORT PacketLength; // Big Endian
|
|
UCHAR Version; // 0x10 (OBEX 1.0)
|
|
UCHAR Flags; // 0x00
|
|
USHORT MaxPacketSize; // Big Endian
|
|
// 이후부터는 Optional Header가 올 수 있음
|
|
} OBEX_CONNECT_PACKET, * POBEX_CONNECT_PACKET;
|
|
|
|
#pragma pack(pop)
|
|
|
|
#define BLUESOLEIL_BUFFER_IOCTL (ULONG)0x00220028
|
|
#define BLUESOLEIL_TETHERING_IOCTL (ULONG)0x0022002C
|
|
|
|
// OBEX Opcode 정의
|
|
#define OBEX_OPCODE_CONNECT 0x80
|
|
#define OBEX_OPCODE_DISCONNECT 0x81
|
|
#define OBEX_OPCODE_PUT 0x02
|
|
#define OBEX_OPCODE_PUT_FINAL 0x82
|
|
#define OBEX_OPCODE_GET 0x03
|
|
#define OBEX_OPCODE_GET_FINAL 0x83
|
|
#define OBEX_OPCODE_OK 0xA0
|
|
#define OBEX_OPCODE_CONTINUE 0x90
|
|
#define OBEX_OPCODE_BODY 0x48
|
|
#define OBEX_OPCODE_END_BODY 0x49
|
|
#define OBEX_OPCODE_VERSION 0x10
|
|
#define OBEX_OPCODE_CONN_FLAGS 0x00
|
|
#define OBEX_OPCODE_NAME 0x01
|
|
#define OBEX_OPCODE_LENGTH 0xC3
|
|
#define OBEX_OPCODE_TYPE 0x42
|
|
|
|
// Big Endian -> Little Endian 변환 매크로
|
|
#define SWAP_USHORT(x) ((((x) & 0xff) << 8) | (((x) >> 8) & 0xff))
|
|
|
|
NTSTATUS ODDIrpHookInit();
|
|
NTSTATUS ODDIrpHookCleanup();
|
|
|
|
NTSTATUS USBIrpHookInit();
|
|
NTSTATUS USBIrpHookCleanup();
|
|
|
|
NTSTATUS BlueToothIrpHookCleanup();
|
|
NTSTATUS BlueToothIrpHookInit();
|
|
|
|
NTSTATUS MtpIrpHookCleanup();
|
|
NTSTATUS MtpIrpHookInit();
|
|
|
|
NTSTATUS EtcIrpHookInit();
|
|
NTSTATUS EtcIrpHookCleanup();
|