Skip to content
This repository has been archived by the owner on Jul 23, 2020. It is now read-only.

Adding FileInfo API. Watch them looking at things.... Closes #26 #32

Open
wants to merge 1 commit into
base: development
Choose a base branch
from
Open

Adding FileInfo API. Watch them looking at things.... Closes #26 #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions cuckoomon.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,14 @@ static hook_t g_hooks[] = {
HOOK(kernel32, DeleteFileA),
HOOK(kernel32, DeleteFileW),

HOOK(kernel32, GetFileType),
HOOK(kernel32, GetFileSize),
HOOK(kernel32, GetFileSizeEx),
HOOK(kernel32, GetFileInformationsByHandle),
// Needs Windows Vista
// HOOK(kernel32, GetFileInformationsByHandleEx),


//
// Registry Hooks
//
Expand Down
44 changes: 44 additions & 0 deletions hook_file.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -504,3 +504,47 @@ HOOKDEF(BOOL, WINAPI, DeleteFileW,
LOQ("u", "FileName", lpFileName);
return ret;
}

HOOKDEF(DWORD, WINAPI, GetFileType,
_In_ HANDLE hFile
) {
DWORD ret = Old_GetFileType(hFile);
LOQ("p", "FileHandle", hFile);
return ret;
}

HOOKDEF(BOOL, WINAPI, GetFileSizeEx,
_In_ HANDLE hFile,
_Out_ PLARGE_INTEGER lpFileSize
) {
DWORD ret = Old_GetFileSizeEx(hFile, lpFileSize);
LOQ("p", "FileHandle", hFile);
return ret;
}

HOOKDEF(DWORD, WINAPI, GetFileSize,
_In_ HANDLE hFile,
_Out_opt_ LPDWORD lpFileSizeHigh
) {
DWORD ret = Old_GetFileSize(hFile, lpFileSizeHigh);
LOQ("ps", "FileHandle", hFile, "FileSize", lpFileSizeHigh);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Surely s is not the correct format specifier here :-)

return ret;
}

HOOKDEF(BOOL, WINAPI, GetFileInformationsByHandle,
_In_ HANDLE hFile,
_Out_ LPBY_HANDLE_FILE_INFORMATION lpFileInformation
) {
DWORD ret = Old_GetFileInformationsByHandle(hFile, lpFileInformation);
LOQ("p", "FileHandle", hFile);
return ret;
}

/* // Needs Windows Vista

HOOKDEF(BOOL, WINAPI, GetFileInformationsByHandleEx,
_In_ HANDLE hFile,
_In_ FILE_INFO_BY_HANDLE_CLASS FileInformationClass,
_Out_ LPVOID lpFileInformation,
_In_ DWORD dwBufferSize
){}*/
30 changes: 30 additions & 0 deletions hooks.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
#include <windns.h>
#include <wininet.h>
#include <mswsock.h>
#include <winbase.h>
#include "ntapi.h"

//
Expand Down Expand Up @@ -213,6 +214,35 @@ extern HOOKDEF(BOOL, WINAPI, DeleteFileW,
__in LPWSTR lpFileName
);

extern HOOKDEF(DWORD, WINAPI, GetFileType,
_In_ HANDLE hFile
);

extern HOOKDEF(BOOL, WINAPI, GetFileSizeEx,
_In_ HANDLE hFile,
_Out_ PLARGE_INTEGER lpFileSize
);

extern HOOKDEF(DWORD, WINAPI, GetFileSize,
_In_ HANDLE hFile,
_Out_opt_ LPDWORD lpFileSizeHigh
);

extern HOOKDEF(BOOL, WINAPI, GetFileInformationsByHandle,
_In_ HANDLE hFile,
_Out_ LPBY_HANDLE_FILE_INFORMATION lpFileInformation
);

/* // Needs Windows Vista

extern HOOKDEF(BOOL, WINAPI, GetFileInformationsByHandleEx,
_In_ HANDLE hFile,
_In_ FILE_INFO_BY_HANDLE_CLASS FileInformationClass,
_Out_ LPVOID lpFileInformation,
_In_ DWORD dwBufferSize
);
*/

//
// Registry Hooks
//
Expand Down