#include "dmincludes.h" // Please note, I (Nathan LeRoux) did not write this file! // cOz requested that I add this into xbdm, so I did #define TOTAL_TYPES 4 DWORD obtypes[] = { OBJ_TYP_SYMBLINK, OBJ_TYP_DEVICE, 0x0, OBJ_TYP_DIRECTORY }; static int iLevel = 0; VOID DumpAllObjects(char* pszDir, SOCKET s) { int i, typeCount = 0; ANSI_STRING UName; BOOL restart = FALSE; HANDLE hObj, hLink; NTSTATUS ntStatus, ntStatusTmp; OBJECT_ATTRIBUTES ObjectAttributes; POBJECT_DIRECTORY_INFORMATION DirObjInformation; CHAR szData[256]; CHAR szLinkName[256]; CHAR tabs[32]; CHAR dirTabs[32]; DWORD dw, index; DirObjInformation = (POBJECT_DIRECTORY_INFORMATION)szData; ZeroMemory(tabs, 32); ZeroMemory(dirTabs, 32); if(iLevel == 0) { strcat_s(tabs, sizeof(tabs), " "); } else { for(i=0; iName.Buffer); else RtlSnprintf(szLinkName, 256, "%s%s", pszDir, DirObjInformation->Name.Buffer); //DbgPrint("checking type %x index %x typecount %d\r\n", obtypes[typeCount], index, typeCount); if((DirObjInformation->Type == obtypes[typeCount])&&(obtypes[typeCount] == OBJ_TYP_SYMBLINK)) { ANSI_STRING symb; FSendLine(s, "%s'%s' ", tabs, szLinkName); RtlInitAnsiString(&symb, szLinkName); InitializeObjectAttributes(&ObjectAttributes, &symb, OBJ_CASE_INSENSITIVE, NULL); ntStatusTmp = NtOpenSymbolicLinkObject(&hLink, &ObjectAttributes); if(NT_SUCCESS(ntStatusTmp)) { ANSI_STRING LName; char outstr[256]; LName.Buffer = outstr; LName.Length = 0; LName.MaximumLength = 256; memset(outstr, 0x0, 256); ntStatusTmp = NtQuerySymbolicLinkObject(hLink, &LName, &dw); if(NT_SUCCESS(ntStatusTmp)) FSendLine(s, "linked to: '%s' (SymbolicLink)", outstr); else FSendLine(s, "\r\n NtQuerySymbolicLinkObject fail = 0x%lX\r\n", ntStatusTmp); NtClose(hLink); } else FSendLine(s, "\r\n NtOpenSymboliclinkObject fail = 0x%lX\r\n", ntStatusTmp); } else if((DirObjInformation->Type == obtypes[typeCount])&&(obtypes[typeCount] == OBJ_TYP_DEVICE)) { FSendLine(s, "%s'%s' (Device)", tabs, szLinkName); } else if((DirObjInformation->Type == obtypes[typeCount])&&(obtypes[typeCount] == OBJ_TYP_DIRECTORY)) { iLevel++; DumpAllObjects(szLinkName, s); iLevel--; } else if(obtypes[typeCount] == 0x0) { DWORD tt = DirObjInformation->Type; if((tt != OBJ_TYP_DIRECTORY)&&(tt != OBJ_TYP_DEVICE)&&(tt != OBJ_TYP_SYMBLINK)) { if(DirObjInformation->Type == OBJ_TYP_EVENT) FSendLine(s, "%s'%s' (Event)", tabs, szLinkName); else if(DirObjInformation->Type == OBJ_TYP_DEBUG) FSendLine(s, "%s'%s' (Debug)", tabs, szLinkName); else { FSendLine(s, "%s**** '%s' (unknown %08x-'%c%c%c%c')", tabs, szLinkName, tt, tt&0xFF, (tt>>8)&0xFF, (tt>>16)&0xFF, (tt>>24)&0xFF); } } } } else { FSendLine(s, "NtQueryDirectoryObject = 0x%lX (%S)", ntStatus, pszDir); } } NtClose(hObj); } else { printf("NtOpenDirectoryObject = 0x%lX (%S)\r\n", ntStatus, pszDir); } } // Xam 0x9BB(Open), Xam 0x9BC(Close) DWORD XSecurityAllOk_Hook() { return ERROR_SUCCESS; } // Xam 0x9BD(Verify) DWORD XSecurityVerify_Hook(DWORD dwMilliseconds, LPOVERLAPPED lpOverlapped, LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine) { if(lpCompletionRoutine) lpCompletionRoutine(0, 0, lpOverlapped); return ERROR_SUCCESS; } // Xam 0x9BE(GetFailures) DWORD XSecurityGetFailureInfo_Hook(PXSECURITY_FAILURE_INFORMATION pFailureInformation) { if(pFailureInformation->dwSize == 0x14) { pFailureInformation->dwBlocksChecked = 0x64; pFailureInformation->dwFailedHashes = 0; pFailureInformation->dwFailedReads = 0; pFailureInformation->dwTotalBlocks = 0x64; } else if(pFailureInformation->dwSize == sizeof(XSECURITY_FAILURE_INFORMATION)) { pFailureInformation->dwBlocksChecked = 0x100; pFailureInformation->dwFailedHashes = 0; pFailureInformation->dwFailedReads = 0; pFailureInformation->dwTotalBlocks = 0x100; pFailureInformation->fComplete = TRUE; } else return ERROR_NOT_ENOUGH_MEMORY; return ERROR_SUCCESS; }