Skip to content

Commit 3136bfe

Browse files
Holt59Holt59
committed
Add hook for NtQueryInformationFile.
1 parent 57d8b0a commit 3136bfe

File tree

7 files changed

+234
-38
lines changed

7 files changed

+234
-38
lines changed

‎src/shared/ntdll_declarations.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ NtQueryDirectoryFile_type NtQueryDirectoryFile;
2727
NtQueryDirectoryFileEx_type NtQueryDirectoryFileEx;
2828
NtQueryFullAttributesFile_type NtQueryFullAttributesFile;
2929
NtQueryAttributesFile_type NtQueryAttributesFile;
30+
NtQueryObject_type NtQueryObject;
31+
NtQueryInformationFile_type NtQueryInformationFile;
3032
NtOpenFile_type NtOpenFile;
3133
NtCreateFile_type NtCreateFile;
3234
NtClose_type NtClose;
@@ -46,6 +48,8 @@ void ntdll_declarations_init() {
4648
LOAD_EXT(ntDLLMod, NtQueryDirectoryFileEx);
4749
LOAD_EXT(ntDLLMod, NtQueryFullAttributesFile);
4850
LOAD_EXT(ntDLLMod, NtQueryAttributesFile);
51+
LOAD_EXT(ntDLLMod, NtQueryObject);
52+
LOAD_EXT(ntDLLMod, NtQueryInformationFile);
4953
LOAD_EXT(ntDLLMod, NtCreateFile);
5054
LOAD_EXT(ntDLLMod, NtOpenFile);
5155
LOAD_EXT(ntDLLMod, NtClose);

‎src/shared/ntdll_declarations.h

Lines changed: 106 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -116,13 +116,80 @@ typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
116116
WCHAR FileName[1];
117117
} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
118118

119+
typedef struct _FILE_BASIC_INFORMATION
120+
{
121+
LARGE_INTEGER CreationTime;
122+
LARGE_INTEGER LastAccessTime;
123+
LARGE_INTEGER LastWriteTime;
124+
LARGE_INTEGER ChangeTime;
125+
ULONG FileAttributes;
126+
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
127+
128+
typedef struct _FILE_STANDARD_INFORMATION
129+
{
130+
LARGE_INTEGER AllocationSize;
131+
LARGE_INTEGER EndOfFile;
132+
ULONG NumberOfLinks;
133+
BOOLEAN DeletePending;
134+
BOOLEAN Directory;
135+
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
136+
119137
typedef struct _FILE_NAMES_INFORMATION {
120138
ULONG NextEntryOffset;
121139
ULONG FileIndex;
122140
ULONG FileNameLength;
123141
WCHAR FileName[1];
124142
} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
125143

144+
typedef struct _FILE_INTERNAL_INFORMATION
145+
{
146+
LARGE_INTEGER IndexNumber;
147+
} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
148+
149+
typedef struct _FILE_EA_INFORMATION
150+
{
151+
ULONG EaSize;
152+
} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
153+
154+
typedef struct _FILE_ACCESS_INFORMATION
155+
{
156+
ACCESS_MASK AccessFlags;
157+
} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
158+
159+
typedef struct _FILE_POSITION_INFORMATION
160+
{
161+
LARGE_INTEGER CurrentByteOffset;
162+
} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
163+
164+
typedef struct _FILE_MODE_INFORMATION
165+
{
166+
ULONG Mode;
167+
} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
168+
169+
typedef struct _FILE_ALIGNMENT_INFORMATION
170+
{
171+
ULONG AlignmentRequirement;
172+
} FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;
173+
174+
typedef struct _FILE_NAME_INFORMATION
175+
{
176+
ULONG FileNameLength;
177+
WCHAR FileName[1];
178+
} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
179+
180+
typedef struct _FILE_ALL_INFORMATION
181+
{
182+
FILE_BASIC_INFORMATION BasicInformation;
183+
FILE_STANDARD_INFORMATION StandardInformation;
184+
FILE_INTERNAL_INFORMATION InternalInformation;
185+
FILE_EA_INFORMATION EaInformation;
186+
FILE_ACCESS_INFORMATION AccessInformation;
187+
FILE_POSITION_INFORMATION PositionInformation;
188+
FILE_MODE_INFORMATION ModeInformation;
189+
FILE_ALIGNMENT_INFORMATION AlignmentInformation;
190+
FILE_NAME_INFORMATION NameInformation;
191+
} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
192+
126193
typedef struct _FILE_OBJECTID_INFORMATION {
127194
LONGLONG FileReference;
128195
UCHAR ObjectId[16];
@@ -158,13 +225,17 @@ typedef enum _FILE_INFORMATION_CLASS {
158225
FileDirectoryInformation = 1,
159226
FileFullDirectoryInformation = 2,
160227
FileBothDirectoryInformation = 3,
228+
FileStandardInformation = 5,
229+
FileNameInformation = 9,
230+
FileRenameInformation = 10,
161231
FileNamesInformation = 12,
232+
FileAllInformation = 18,
162233
FileObjectIdInformation = 29,
163234
FileReparsePointInformation = 33,
164235
FileIdBothDirectoryInformation = 37,
165-
FileIdFullDirectoryInformation = 38
166-
} FILE_INFORMATION_CLASS,
167-
*PFILE_INFORMATION_CLASS;
236+
FileIdFullDirectoryInformation = 38,
237+
FileNormalizedNameInformation = 48,
238+
} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
168239

169240
typedef enum _MODE { KernelMode, UserMode, MaximumMode } MODE;
170241

@@ -253,6 +324,12 @@ typedef struct _OBJECT_HANDLE_INFORMATION {
253324
ACCESS_MASK GrantedAccess;
254325
} OBJECT_HANDLE_INFORMATION, *POBJECT_HANDLE_INFORMATION;
255326

327+
typedef enum _OBJECT_INFORMATION_CLASS
328+
{
329+
ObjectBasicInformation = 0,
330+
ObjectTypeInformation = 2
331+
} OBJECT_INFORMATION_CLASS;
332+
256333
typedef struct _RTL_RELATIVE_NAME {
257334
UNICODE_STRING RelativeName;
258335
HANDLE ContainingDirectory;
@@ -269,14 +346,6 @@ typedef struct _FILE_NETWORK_OPEN_INFORMATION {
269346
ULONG FileAttributes;
270347
} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
271348

272-
typedef struct _FILE_BASIC_INFORMATION {
273-
LARGE_INTEGER CreationTime;
274-
LARGE_INTEGER LastAccessTime;
275-
LARGE_INTEGER LastWriteTime;
276-
LARGE_INTEGER ChangeTime;
277-
ULONG FileAttributes;
278-
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
279-
280349
#define FILE_DIRECTORY_FILE 0x00000001
281350
#define FILE_WRITE_THROUGH 0x00000002
282351
#define FILE_SEQUENTIAL_ONLY 0x00000004
@@ -302,55 +371,62 @@ typedef struct _FILE_BASIC_INFORMATION {
302371
#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000
303372
#define FILE_CONTAINS_EXTENDED_CREATE_INFORMATION 0x10000000
304373

305-
typedef NTSTATUS(WINAPI *NtQueryDirectoryFile_type)(
374+
// Nt
375+
376+
using NtQueryDirectoryFile_type = NTSTATUS(WINAPI *)(
306377
HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG,
307378
FILE_INFORMATION_CLASS, BOOLEAN, PUNICODE_STRING, BOOLEAN);
308-
309-
typedef NTSTATUS(WINAPI *NtQueryDirectoryFileEx_type)(
379+
using NtQueryDirectoryFileEx_type = NTSTATUS(WINAPI *)(
310380
HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG,
311381
FILE_INFORMATION_CLASS, ULONG, PUNICODE_STRING);
312382

313-
typedef NTSTATUS(WINAPI *NtQueryFullAttributesFile_type)(
383+
using NtQueryFullAttributesFile_type = NTSTATUS(WINAPI *)(
314384
POBJECT_ATTRIBUTES, PFILE_NETWORK_OPEN_INFORMATION);
315-
316-
typedef NTSTATUS(WINAPI *NtQueryAttributesFile_type)(POBJECT_ATTRIBUTES,
385+
using NtQueryAttributesFile_type = NTSTATUS(WINAPI *)(POBJECT_ATTRIBUTES,
317386
PFILE_BASIC_INFORMATION);
318387

319-
typedef NTSTATUS(WINAPI *NtOpenFile_type)(PHANDLE, ACCESS_MASK,
388+
using NtQueryObject_type = NTSTATUS (WINAPI *)(
389+
HANDLE Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass,
390+
PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength);
391+
using NtQueryInformationFile_type = NTSTATUS(WINAPI*)(
392+
HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation,
393+
ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);
394+
395+
using NtOpenFile_type = NTSTATUS(WINAPI *)(PHANDLE, ACCESS_MASK,
320396
POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK,
321397
ULONG, ULONG);
322-
323-
typedef NTSTATUS(WINAPI *NtCreateFile_type)(PHANDLE, ACCESS_MASK,
398+
using NtCreateFile_type = NTSTATUS(WINAPI *)(PHANDLE, ACCESS_MASK,
324399
POBJECT_ATTRIBUTES,
325400
PIO_STATUS_BLOCK, PLARGE_INTEGER,
326401
ULONG, ULONG, ULONG, ULONG, PVOID,
327402
ULONG);
328403

329-
typedef NTSTATUS(WINAPI *NtClose_type)(HANDLE);
330-
331-
typedef NTSYSAPI BOOLEAN(NTAPI *RtlDoesFileExists_U_type)(PCWSTR);
332-
333-
typedef NTSTATUS(NTAPI *RtlDosPathNameToRelativeNtPathName_U_WithStatus_type)(
334-
PCWSTR DosFileName, PUNICODE_STRING NtFileName, PWSTR* FilePath, PRTL_RELATIVE_NAME RelativeName);
404+
using NtClose_type = NTSTATUS(WINAPI *)(HANDLE);
335405

336-
typedef void (NTAPI *RtlReleaseRelativeName_type)(PRTL_RELATIVE_NAME RelativeName);
406+
using NtTerminateProcess_type = NTSTATUS(WINAPI *)(HANDLE ProcessHandle, NTSTATUS ExitStatus);
337407

338-
typedef NTSTATUS (NTAPI *RtlGetVersion_type)(PRTL_OSVERSIONINFOW);
408+
// Rtl
339409

340-
typedef NTSTATUS(WINAPI *NtTerminateProcess_type)(HANDLE ProcessHandle, NTSTATUS ExitStatus);
410+
using RtlDoesFileExists_U_type = NTSYSAPI BOOLEAN(NTAPI *)(PCWSTR);
411+
using RtlDosPathNameToRelativeNtPathName_U_WithStatus_type = NTSTATUS(NTAPI *)(
412+
PCWSTR DosFileName, PUNICODE_STRING NtFileName, PWSTR* FilePath, PRTL_RELATIVE_NAME RelativeName);
413+
using RtlReleaseRelativeName_type = void (NTAPI *)(PRTL_RELATIVE_NAME RelativeName);
414+
using RtlGetVersion_type = NTSTATUS (NTAPI *)(PRTL_OSVERSIONINFOW);
341415

342416
extern NtQueryDirectoryFile_type NtQueryDirectoryFile;
343417
extern NtQueryDirectoryFileEx_type NtQueryDirectoryFileEx;
344418
extern NtQueryFullAttributesFile_type NtQueryFullAttributesFile;
345419
extern NtQueryAttributesFile_type NtQueryAttributesFile;
420+
extern NtQueryObject_type NtQueryObject;
421+
extern NtQueryInformationFile_type NtQueryInformationFile;
346422
extern NtOpenFile_type NtOpenFile;
347423
extern NtCreateFile_type NtCreateFile;
348424
extern NtClose_type NtClose;
425+
extern NtTerminateProcess_type NtTerminateProcess;
349426
extern RtlDoesFileExists_U_type RtlDoesFileExists_U;
350427
extern RtlDosPathNameToRelativeNtPathName_U_WithStatus_type RtlDosPathNameToRelativeNtPathName_U_WithStatus;
351428
extern RtlReleaseRelativeName_type RtlReleaseRelativeName;
352429
extern RtlGetVersion_type RtlGetVersion;
353-
extern NtTerminateProcess_type NtTerminateProcess;
354430

355431
// ensures ntdll functions have been initialized (only needed during static objects initialization)
356432
void ntdll_declarations_init();

‎src/usvfs_dll/hookmanager.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,8 @@ void HookManager::initHooks()
267267
installHook(ntdllMod, nullptr, "NtQueryAttributesFile", hook_NtQueryAttributesFile);
268268
installHook(ntdllMod, nullptr, "NtQueryDirectoryFile", hook_NtQueryDirectoryFile);
269269
installHook(ntdllMod, nullptr, "NtQueryDirectoryFileEx", hook_NtQueryDirectoryFileEx);
270+
installHook(ntdllMod, nullptr, "NtQueryObject", hook_NtQueryObject);
271+
installHook(ntdllMod, nullptr, "NtQueryInformationFile", hook_NtQueryInformationFile);
270272
installHook(ntdllMod, nullptr, "NtOpenFile", hook_NtOpenFile);
271273
installHook(ntdllMod, nullptr, "NtCreateFile", hook_NtCreateFile);
272274
installHook(ntdllMod, nullptr, "NtClose", hook_NtClose);

‎src/usvfs_dll/hooks/ntdll.cpp

Lines changed: 92 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,10 @@ void SetInfoFilename(LPVOID address, FILE_INFORMATION_CLASS infoClass,
372372
const std::wstring &fileName)
373373
{
374374
switch (infoClass) {
375+
case FileAllInformation: {
376+
SetInfoFilenameImpl(
377+
&reinterpret_cast<FILE_ALL_INFORMATION*>(address)->NameInformation, fileName);
378+
} break;
375379
case FileBothDirectoryInformation: {
376380
SetInfoFilenameImplSN(
377381
reinterpret_cast<FILE_BOTH_DIR_INFORMATION *>(address), fileName);
@@ -380,9 +384,17 @@ void SetInfoFilename(LPVOID address, FILE_INFORMATION_CLASS infoClass,
380384
SetInfoFilenameImpl(
381385
reinterpret_cast<FILE_DIRECTORY_INFORMATION *>(address), fileName);
382386
} break;
387+
case FileNameInformation: {
388+
SetInfoFilenameImpl(
389+
reinterpret_cast<FILE_NAME_INFORMATION*>(address), fileName);
390+
} break;
383391
case FileNamesInformation: {
384-
SetInfoFilenameImpl(reinterpret_cast<FILE_NAMES_INFORMATION *>(address),
385-
fileName);
392+
SetInfoFilenameImpl(
393+
reinterpret_cast<FILE_NAMES_INFORMATION *>(address), fileName);
394+
} break;
395+
case FileNormalizedNameInformation: {
396+
SetInfoFilenameImpl(
397+
reinterpret_cast<FILE_NAME_INFORMATION*>(address), fileName);
386398
} break;
387399
case FileIdFullDirectoryInformation: {
388400
SetInfoFilenameImpl(
@@ -394,8 +406,7 @@ void SetInfoFilename(LPVOID address, FILE_INFORMATION_CLASS infoClass,
394406
} break;
395407
case FileIdBothDirectoryInformation: {
396408
SetInfoFilenameImplSN(
397-
reinterpret_cast<FILE_ID_BOTH_DIR_INFORMATION *>(address),
398-
fileName);
409+
reinterpret_cast<FILE_ID_BOTH_DIR_INFORMATION *>(address), fileName);
399410
} break;
400411
default: {
401412
// NOP
@@ -1040,6 +1051,83 @@ NTSTATUS WINAPI usvfs::hook_NtQueryDirectoryFileEx(
10401051
return res;
10411052
}
10421053

1054+
DLLEXPORT NTSTATUS WINAPI usvfs::hook_NtQueryObject(
1055+
HANDLE Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass,
1056+
PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength)
1057+
{
1058+
NTSTATUS res;
1059+
1060+
HOOK_START_GROUP(MutExHookGroup::FILE_ATTRIBUTES)
1061+
if (!callContext.active()) {
1062+
return ::NtQueryObject(Handle, ObjectInformationClass, ObjectInformation,
1063+
ObjectInformationLength, ReturnLength);
1064+
}
1065+
1066+
PRE_REALCALL
1067+
res = ::NtQueryObject(Handle, ObjectInformationClass, ObjectInformation,
1068+
ObjectInformationLength, ReturnLength);
1069+
POST_REALCALL
1070+
1071+
LOG_CALL()
1072+
.addParam("path", ntdllHandleTracker.lookup(Handle))
1073+
.PARAM(ObjectInformationClass);
1074+
1075+
HOOK_END
1076+
return res;
1077+
}
1078+
1079+
DLLEXPORT NTSTATUS WINAPI usvfs::hook_NtQueryInformationFile(
1080+
HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation,
1081+
ULONG Length, FILE_INFORMATION_CLASS FileInformationClass)
1082+
{
1083+
NTSTATUS res;
1084+
1085+
HOOK_START_GROUP(MutExHookGroup::FILE_ATTRIBUTES)
1086+
if (!callContext.active()) {
1087+
return ::NtQueryInformationFile(FileHandle, IoStatusBlock, FileInformation,
1088+
Length, FileInformationClass);
1089+
}
1090+
1091+
PRE_REALCALL
1092+
res = ::NtQueryInformationFile(FileHandle, IoStatusBlock, FileInformation, Length,
1093+
FileInformationClass);
1094+
POST_REALCALL
1095+
1096+
if (res == STATUS_SUCCESS && (
1097+
FileInformationClass == FileNameInformation
1098+
|| FileInformationClass == FileAllInformation
1099+
|| FileInformationClass == FileNormalizedNameInformation)) {
1100+
1101+
const auto trackerInfo = ntdllHandleTracker.lookup(FileHandle);
1102+
const auto redir = applyReroute(READ_CONTEXT(), callContext, trackerInfo);
1103+
1104+
// TODO: difference between FileNameInformation and FileNormalizedNameInformation
1105+
1106+
FILE_NAME_INFORMATION *info;
1107+
if (FileInformationClass == FileAllInformation) {
1108+
info = &reinterpret_cast<FILE_ALL_INFORMATION*>(FileInformation)->NameInformation;
1109+
} else {
1110+
info = reinterpret_cast<FILE_NAME_INFORMATION*>(FileInformation);
1111+
}
1112+
1113+
if (redir.redirected)
1114+
{
1115+
SetInfoFilename(FileInformation, FileInformationClass, static_cast<LPCWSTR>(redir.path));
1116+
};
1117+
1118+
LOG_CALL()
1119+
.addParam("tracker_path", trackerInfo)
1120+
.PARAM(FileInformationClass)
1121+
.PARAM(redir.redirected)
1122+
.PARAM(redir.path)
1123+
.addParam("name_info", std::wstring{info->FileName, info->FileNameLength});
1124+
1125+
}
1126+
1127+
HOOK_END
1128+
return res;
1129+
}
1130+
10431131
unique_ptr_deleter<OBJECT_ATTRIBUTES>
10441132
makeObjectAttributes(RedirectionInfo &redirInfo,
10451133
POBJECT_ATTRIBUTES attributeTemplate)

‎src/usvfs_dll/hooks/ntdll.h

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,22 @@ hook_NtQueryDirectoryFileEx(HANDLE FileHandle,
4040
ULONG QueryFlags,
4141
PUNICODE_STRING FileName);
4242

43+
DLLEXPORT NTSTATUS WINAPI
44+
hook_NtQueryObject(
45+
HANDLE Handle,
46+
OBJECT_INFORMATION_CLASS ObjectInformationClass,
47+
PVOID ObjectInformation,
48+
ULONG ObjectInformationLength,
49+
PULONG ReturnLength);
50+
51+
DLLEXPORT NTSTATUS WINAPI
52+
hook_NtQueryInformationFile(
53+
HANDLE FileHandle,
54+
PIO_STATUS_BLOCK IoStatusBlock,
55+
PVOID FileInformation,
56+
ULONG Length,
57+
FILE_INFORMATION_CLASS FileInformationClass);
58+
4359
DLLEXPORT NTSTATUS WINAPI hook_NtOpenFile(PHANDLE FileHandle,
4460
ACCESS_MASK DesiredAccess,
4561
POBJECT_ATTRIBUTES ObjectAttributes,

0 commit comments

Comments
 (0)