| David J. Craig 2006-10-19, 1:25 am |
| I would not expect any help with stolen code.
"Skybuck Flying" <spam@hotmail.com> wrote in message
news:eh6n7r$qie$1@news3.zwoll1.ov.home.nl...
> Here is a piece of code from the filedisk.sys driver:
>
> case IRP_MJ_DEVICE_CONTROL:
> switch (io_stack->Parameters.DeviceIoControl.IoControlCode)
> {
> case IOCTL_FILE_DISK_OPEN_FILE:
>
>
> SeImpersonateClient(device_extension->security_client_context, NULL); //
> *** looks suspicious ***
>
> irp->IoStatus.Status = FileDiskOpenFile(device_object,
> irp);
>
> PsRevertToSelf();
>
> break;
>
> case IOCTL_FILE_DISK_CLOSE_FILE:
> irp->IoStatus.Status = FileDiskCloseFile(device_object,
> irp);
> break;
>
> default:
> irp->IoStatus.Status = STATUS_DRIVER_INTERNAL_ERROR;
> }
> break;
>
> default:
> irp->IoStatus.Status = STATUS_DRIVER_INTERNAL_ERROR;
> }
>
> Maybe impersonating the thread is detected by windows/iis and causing
> problems ?
>
> Just a guess
>
> Bye,
> Skybuck.
>
>
> "Skybuck Flying" <spam@hotmail.com> wrote in message
> news:eh6l52$chi$1@news3.zwoll1.ov.home.nl...
>
>
|