开发者

NT FileManagement functions

开发者 https://www.devze.com 2023-01-07 20:01 出处:网络
I have been analysing Ntdll file system functions from the total ntdll function list. First, I obtain the total function li开发者_StackOverflow中文版st from ntdlls export directory.

I have been analysing Ntdll file system functions from the total ntdll function list. First, I obtain the total function li开发者_StackOverflow中文版st from ntdlls export directory. Next, I seperated the file management set from the total function list and tried hooking the entire file management set.

However, I miss to hook a function, which i dint know. Hence I could not catch an API which takes Path as an input and performing a directory management functionality.

Is there anywhere you find/Know related information having the complete set of file management functions in NTDLL.


Probably you should implement an File System Filter Drivers (see http://www.microsoft.com/whdc/driver/filterdrv/default.mspx) instead of hooking of all possible undocumented file management functions from ntdll.dll

0

精彩评论

暂无评论...
验证码 换一张
取 消

关注公众号