diff --git a/ProtectBoot.cpp b/ProtectBoot.cpp deleted file mode 100644 index c1a0233..0000000 --- a/ProtectBoot.cpp +++ /dev/null @@ -1,34 +0,0 @@ -#include "DriverCommon.h" - -#ifndef IOCTL_DISK_FORMAT_TRACKS -#define IOCTL_DISK_FORMAT_TRACKS CTL_CODE(IOCTL_DISK_BASE, 0x0006, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) -#endif -#ifndef IOCTL_DISK_FORMAT_TRACKS_EX -#define IOCTL_DISK_FORMAT_TRACKS_EX CTL_CODE(IOCTL_DISK_BASE, 0x000b, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) -#endif - -FLT_PREOP_CALLBACK_STATUS ProtectBoot_PreDeviceControl(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) { - UNREFERENCED_PARAMETER(FltObjects); - UNREFERENCED_PARAMETER(CompletionContext); - - if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK; - - if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK; - - ULONG IoControlCode = Data->Iopb->Parameters.DeviceIoControl.Common.IoControlCode; - - if (IoControlCode == IOCTL_DISK_SET_DRIVE_LAYOUT_EX || - IoControlCode == IOCTL_SCSI_PASS_THROUGH_DIRECT || - IoControlCode == IOCTL_DISK_FORMAT_TRACKS || - IoControlCode == IOCTL_DISK_FORMAT_TRACKS_EX) { - - HANDLE Pid = PsGetCurrentProcessId(); - if (!IsProcessTrusted(Pid) && !IsInstallerProcess(Pid)) { - UNICODE_STRING MsgStr = RTL_CONSTANT_STRING(L"Disk_Wiper_Attempt"); - SendMessageToUser(4001, (ULONG)(ULONG_PTR)Pid, MsgStr.Buffer, MsgStr.Length); - Data->IoStatus.Status = STATUS_ACCESS_DENIED; - return FLT_PREOP_COMPLETE; - } - } - return FLT_PREOP_SUCCESS_NO_CALLBACK; -} \ No newline at end of file