Skip to main content

windows_reactor/
ntoskrnl.rs

1use vmi::{
2    VmiContext, VmiError, VmiOs,
3    driver::VmiRead,
4    os::windows::{ArchAdapter, WindowsFileObject, WindowsOs, WindowsOsExt as _},
5    trace::Hex,
6    utils::reactor::Action,
7};
8
9/// Demonstrates how to monitor `NtWriteFile` calls in the kernel and log the
10/// full path of the file being written to.
11pub fn NtWriteFile<Driver>(
12    vmi: &VmiContext<WindowsOs<Driver>>,
13) -> Result<Action<<WindowsOs<Driver> as VmiOs>::Architecture>, VmiError>
14where
15    Driver: VmiRead,
16    Driver::Architecture: ArchAdapter<Driver>,
17{
18    //
19    // NTSTATUS
20    // NTAPI
21    // NtWriteFile(
22    //     _In_ HANDLE FileHandle,
23    //     _In_opt_ HANDLE Event,
24    //     _In_opt_ PIO_APC_ROUTINE ApcRoutine,
25    //     _In_opt_ PVOID ApcContext,
26    //     _Out_ PIO_STATUS_BLOCK IoStatusBlock,
27    //     _In_reads_bytes_(Length) PVOID Buffer,
28    //     _In_ ULONG Length,
29    //     _In_opt_ PLARGE_INTEGER ByteOffset,
30    //     _In_opt_ PULONG Key
31    //     );
32    //
33
34    let FileHandle = vmi.os().function_argument(0)?;
35
36    // Check if we have to look for the object in the kernel handle table
37    // or the current process handle table.
38    let owning_process = match vmi.os().is_kernel_handle(FileHandle)? {
39        true => vmi.os().system_process()?,
40        false => vmi.os().current_process()?,
41    };
42
43    let file_object = match owning_process.lookup_object::<WindowsFileObject<_>>(FileHandle)? {
44        Some(file_object) => file_object,
45        None => {
46            tracing::error!(handle = %Hex(FileHandle), "cannot find file object");
47            return Ok(Action::default());
48        }
49    };
50
51    let path = file_object.full_path()?;
52    tracing::info!(handle = %Hex(FileHandle), path);
53
54    Ok(Action::default())
55}