From a795c96752c5d217144bc634a760a74aa0eb54ad Mon Sep 17 00:00:00 2001 From: Shao Miller Date: Wed, 12 Dec 2012 22:47:04 -0500 Subject: [PATCH] [safehook] Note the previous INT 0x13 handler Cache a record of a safe hook's ancestor in the chain. --- src/include/safehook.h | 3 +++ src/winvblock/safehook/probe.c | 1 + 2 files changed, 4 insertions(+) diff --git a/src/include/safehook.h b/src/include/safehook.h index abe335e..ff7cfd9 100644 --- a/src/include/safehook.h +++ b/src/include/safehook.h @@ -127,6 +127,9 @@ struct S_WV_SAFE_HOOK_BUS { /** PnP bus relations. A safe hook can only have one child, at most */ DEVICE_RELATIONS BusRelations[1]; + + /** A record of the previous INT 0x13 handler in the chain */ + S_X86_SEG16OFF16 PreviousInt13hHandler[1]; }; #endif /* WV_M_PROBE_H_ */ diff --git a/src/winvblock/safehook/probe.c b/src/winvblock/safehook/probe.c index 856d5ce..51a21f0 100644 --- a/src/winvblock/safehook/probe.c +++ b/src/winvblock/safehook/probe.c @@ -238,6 +238,7 @@ static NTSTATUS STDCALL WvSafeHookDriveDevice( bus->PhysicalDeviceObject = pdo; bus->BusRelations->Count = 0; bus->BusRelations->Objects[0] = NULL; + bus->PreviousInt13hHandler[0] = hook->PrevHook; /* Attach the FDO to the PDO */ if (!WvlAttachDeviceToDeviceStack(fdo, pdo)) {