Пишу минифильтр-драйвер файловой системы для USB-флешек. Опытным путем определил, что UDB-флешки от других дисков отличаются тем, что в InstanceSetup () после выполнения FltGetVolumeProperties() получаю:
DEVICE_TYPE =FILE_DEVICE_DISK_FILE_SYSTEM
VolumeProperty.DeviceCharacteristics = 257
При заражении ПК вирусом типа CopyTo.lnk ситуация меняется:
DEVICE_TYPE =FILE_DEVICE_DISK_FILE_SYSTEM
VolumeProperty.DeviceCharacteristics = 0 (как у жесткого диска)
Вопрос первый: что значит это 257?
Вопрос второй: как определять со 100% гарантией из минифильтра что подключаемый том находится именно на сменном USB-носителе (флешке)
Вот код InstanceSetup:
//Вызывается, когда подключается устройство (диск)
NTSTATUS
InstanceSetup (
__in PCFLT_RELATED_OBJECTS FltObjects,
__in FLT_INSTANCE_SETUP_FLAGS Flags,
__in DEVICE_TYPE VolumeDeviceType,
__in FLT_FILESYSTEM_TYPE VolumeFilesystemType
)
{
FLT_VOLUME_PROPERTIES VolumeProperty;
ULONG LengthReturned;
UNREFERENCED_PARAMETER( FltObjects );
UNREFERENCED_PARAMETER( Flags );
UNREFERENCED_PARAMETER( VolumeFilesystemType );
PAGED_CODE();
ASSERT( FltObjects->Filter == DriverData.Filter );
FltGetVolumeProperties(FltObjects->Volume,&VolumeProperty,sizeof(FLT_VOLUME_PROPERTIES),& LengthReturned);
DbgPrint("++++++++++++++++ FLT_VOLUME_PROPERTY ++++++++++++++++++++\n");
DbgPrint("IN DEVICE_TYPE = %d\n",VolumeDeviceType);
DbgPrint("DEVICE_TYPE = %d\n", VolumeProperty.DeviceType);
DbgPrint("DeviceCharacteristics = %d\n", VolumeProperty.DeviceCharacteristics);
DbgPrint("FileSystemDriverName = %wZ\n", &VolumeProperty.FileSystemDriverName);
DbgPrint("FileSystemDeviceName = %wZ\n", &VolumeProperty. FileSystemDeviceName);
DbgPrint("RealDeviceName = %wZ\n", &VolumeProperty.RealDeviceName);
// узнаем тип подключаемого VolumeProperty.DeviceType
switch(VolumeProperty.DeviceType)
{
case FILE_DEVICE_8042_PORT:
DbgPrint("FILE_DEVICE_8042_PORT");
break;
case FILE_DEVICE_ACPI:
DbgPrint("FILE_DEVICE_ACPI");
break;
case FILE_DEVICE_BATTERY:
DbgPrint("FILE_DEVICE_BATTERY");
break;
case FILE_DEVICE_BEEP:
DbgPrint("FILE_DEVICE_BEEP");
break;
case FILE_DEVICE_BUS_EXTENDER:
DbgPrint("FILE_DEVICE_BUS_EXTENDER");
break;
case FILE_DEVICE_CD_ROM:
DbgPrint("FILE_DEVICE_CD_ROM");
break;
case FILE_DEVICE_CD_ROM_FILE_SYSTEM:
DbgPrint("FILE_DEVICE_CD_ROM_FILE_SYSTEM");
break;
case FILE_DEVICE_CHANGER:
DbgPrint("FILE_DEVICE_CHANGER");
break;
case FILE_DEVICE_CONTROLLER:
DbgPrint("FILE_DEVICE_CONTROLLER");
break;
case FILE_DEVICE_DATALINK:
DbgPrint("FILE_DEVICE_DATALINK");
break;
case FILE_DEVICE_DFS:
DbgPrint("FILE_DEVICE_DFS");
break;
case FILE_DEVICE_DFS_FILE_SYSTEM:
DbgPrint("FILE_DEVICE_DFS_FILE_SYSTEM");
break;
case FILE_DEVICE_DFS_VOLUME:
DbgPrint("FILE_DEVICE_DFS_VOLUME");
break;
case FILE_DEVICE_DISK:
DbgPrint("FILE_DEVICE_DISK");
break;
case FILE_DEVICE_DISK_FILE_SYSTEM:
DbgPrint("FILE_DEVICE_DISK_FILE_SYSTEM");
break;
case FILE_DEVICE_DVD:
DbgPrint("FILE_DEVICE_DVD");
break;
case FILE_DEVICE_FILE_SYSTEM:
DbgPrint("FILE_DEVICE_FILE_SYSTEM");
break;
case FILE_DEVICE_FIPS:
DbgPrint("FILE_DEVICE_FIPS");
break;
case FILE_DEVICE_FULLSCREEN_VIDEO:
DbgPrint("FILE_DEVICE_FULLSCREEN_VIDEO");
break;
case FILE_DEVICE_INPORT_PORT:
DbgPrint("FILE_DEVICE_INPORT_PORT");
break;
case FILE_DEVICE_KEYBOARD:
DbgPrint("FILE_DEVICE_KEYBOARD");
break;
case FILE_DEVICE_KS:
DbgPrint("FILE_DEVICE_KS");
break;
case FILE_DEVICE_KSEC:
DbgPrint("FILE_DEVICE_KSEC");
break;
case FILE_DEVICE_MAILSLOT:
DbgPrint("FILE_DEVICE_MAILSLOT");
break;
case FILE_DEVICE_MASS_STORAGE:
DbgPrint("FILE_DEVICE_MASS_STORAGE");
break;
case FILE_DEVICE_MIDI_IN:
DbgPrint("FILE_DEVICE_MIDI_IN");
break;
case FILE_DEVICE_MIDI_OUT:
DbgPrint("FILE_DEVICE_MIDI_OUT");
break;
case FILE_DEVICE_MODEM:
DbgPrint("FILE_DEVICE_MODEM");
break;
case FILE_DEVICE_MOUSE:
DbgPrint("FILE_DEVICE_MOUSE");
break;
case FILE_DEVICE_MULTI_UNC_PROVIDER:
DbgPrint("FILE_DEVICE_MULTI_UNC_PROVIDER");
break;
case FILE_DEVICE_NAMED_PIPE:
DbgPrint("FILE_DEVICE_NAMED_PIPE");
break;
case FILE_DEVICE_NETWORK:
DbgPrint("FILE_DEVICE_NETWORK");
break;
case FILE_DEVICE_NETWORK_BROWSER:
DbgPrint("FILE_DEVICE_NETWORK_BROWSER");
break;
case FILE_DEVICE_NETWORK_FILE_SYSTEM:
DbgPrint("FILE_DEVICE_NETWORK_FILE_SYSTEM");
break;
case FILE_DEVICE_NETWORK_REDIRECTOR:
DbgPrint("FILE_DEVICE_NETWORK_REDIRECTOR");
break;
case FILE_DEVICE_NULL:
DbgPrint("FILE_DEVICE_NULL");
break;
case FILE_DEVICE_PARALLEL_PORT:
DbgPrint("FILE_DEVICE_PARALLEL_PORT");
break;
case FILE_DEVICE_PHYSICAL_NETCARD:
DbgPrint("FILE_DEVICE_PHYSICAL_NETCARD");
break;
case FILE_DEVICE_PRINTER:
DbgPrint("FILE_DEVICE_PRINTER");
break;
case FILE_DEVICE_SCANNER:
DbgPrint("FILE_DEVICE_SCANNER");
break;
case FILE_DEVICE_SCREEN:
DbgPrint("FILE_DEVICE_SCREEN");
break;
case FILE_DEVICE_SERENUM:
DbgPrint("FILE_DEVICE_SERENUM");
break;
case FILE_DEVICE_SERIAL_MOUSE_PORT:
DbgPrint("FILE_DEVICE_SERIAL_MOUSE_PORT");
break;
case FILE_DEVICE_SERIAL_PORT:
DbgPrint("FILE_DEVICE_SERIAL_PORT");
break;
case FILE_DEVICE_SMARTCARD:
DbgPrint("FILE_DEVICE_SMARTCARD");
break;
case FILE_DEVICE_SMB:
DbgPrint("FILE_DEVICE_SMB");
break;
case FILE_DEVICE_SOUND:
DbgPrint("FILE_DEVICE_SOUND");
break;
case FILE_DEVICE_STREAMS:
DbgPrint("FILE_DEVICE_STREAMS");
break;
case FILE_DEVICE_TAPE:
DbgPrint("FILE_DEVICE_TAPE");
break;
case FILE_DEVICE_TAPE_FILE_SYSTEM:
DbgPrint("FILE_DEVICE_TAPE_FILE_SYSTEM");
break;
case FILE_DEVICE_TERMSRV:
DbgPrint("FILE_DEVICE_TERMSRV");
break;
case FILE_DEVICE_TRANSPORT:
DbgPrint("FILE_DEVICE_TRANSPORT");
break;
case FILE_DEVICE_UNKNOWN:
DbgPrint("FILE_DEVICE_UNKNOWN");
break;
case FILE_DEVICE_VDM:
DbgPrint("FILE_DEVICE_VDM");
break;
case FILE_DEVICE_VIDEO:
DbgPrint("FILE_DEVICE_VIDEO");
break;
case FILE_DEVICE_VIRTUAL_DISK:
DbgPrint("FILE_DEVICE_VIRTUAL_DISK");
break;
case FILE_DEVICE_WAVE_IN :
DbgPrint("FILE_DEVICE_WAVE_IN ");
break;
case FILE_DEVICE_WAVE_OUT:
DbgPrint("FILE_DEVICE_WAVE_OUT");
break;
default:
DbgPrint("DeviceType UNKNOWN");
}
DbgPrint("===========================================================\n");
// не аттачимся к СД/ДВД-дискам
if(VolumeProperty.DeviceType == FILE_DEVICE_CD_ROM_FILE_SYSTEM)
{
return STATUS_FLT_DO_NOT_ATTACH;
}
if((VolumeProperty.DeviceType == FILE_DEVICE_DISK_FILE_SYSTEM))
{
//не аттачимся к жестким дискам
if(VolumeProperty.DeviceCharacteristics != 0)
{
DbgPrint("ATTACHED\n");
return STATUS_SUCCESS;
}
}
return STATUS_FLT_DO_NOT_ATTACH;
}
