From 543eedcc76b74c7d40adb66e203c34ee641179ac Mon Sep 17 00:00:00 2001
From: BeneficialCode <3123132899@qq.com>
Date: Sun, 8 Jan 2023 13:23:49 +0800
Subject: [PATCH] tweak the prevent delete policy bug

---
 Anti-Rootkit/AntiRootkit.h         | 9 ++++++++-
 KernelLibrary/MiniFilter.cpp       | 7 ++++++-
 WinSysCore/KernelModuleTracker.cpp | 1 +
 WinSysCore/KernelModuleTracker.h   | 1 +
 4 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/Anti-Rootkit/AntiRootkit.h b/Anti-Rootkit/AntiRootkit.h
index 4f77609..cbef3d8 100644
--- a/Anti-Rootkit/AntiRootkit.h
+++ b/Anti-Rootkit/AntiRootkit.h
@@ -45,7 +45,7 @@ Typical drivers just use FILE_ANY_ACCESS and deal with the actual request in the
 // 回调驱动 链接器 命令行 + -----> /integritycheck
 #define ANTI_ROOTKIT_DEVICE 0x8000
 
-#define DRIVER_CURRENT_VERSION 0xC4
+#define DRIVER_CURRENT_VERSION 0xC5
 
 
 // 用MDL锁定用户内存
@@ -135,6 +135,13 @@ struct KeyData {
 	WCHAR Name[1];
 };
 
+struct DumpSysData {
+	void* ImageBase;
+	ULONG ImageSize;
+	ULONG Length;
+	WCHAR Name[1];
+};
+
 struct ProcessNotifyCountData {
 	PULONG pCount;
 	PULONG pExCount;
diff --git a/KernelLibrary/MiniFilter.cpp b/KernelLibrary/MiniFilter.cpp
index 70c3230..da2cf4c 100644
--- a/KernelLibrary/MiniFilter.cpp
+++ b/KernelLibrary/MiniFilter.cpp
@@ -196,7 +196,12 @@ FLT_PREOP_CALLBACK_STATUS DelProtectPreSetInformation(PFLT_CALLBACK_DATA Data, P
 
 bool IsDeleteAllowed(PCUNICODE_STRING filename) {
 	UNICODE_STRING ext;
-	if (NT_SUCCESS(FltParseFileName(filename, &ext, nullptr, nullptr))) {
+	NTSTATUS status;
+	status = FltParseFileName(filename, &ext, nullptr, nullptr);
+	if(NT_SUCCESS(status)) {
+		if (ext.Buffer == nullptr || ext.Length == 0) {
+			return true;
+		}
 		WCHAR uext[16] = { 0 };
 		UNICODE_STRING suext;
 		suext.Buffer = uext;
diff --git a/WinSysCore/KernelModuleTracker.cpp b/WinSysCore/KernelModuleTracker.cpp
index 2ce0b71..289fb96 100644
--- a/WinSysCore/KernelModuleTracker.cpp
+++ b/WinSysCore/KernelModuleTracker.cpp
@@ -29,6 +29,7 @@ uint32_t WinSys::KernelModuleTracker::EnumModules() {
 		auto m = std::make_shared<KernelModuleInfo>();
 		m->Flags = p->BaseInfo.Flags;
 		m->FullPath = (const char*)p->BaseInfo.FullPathName;
+		m->NtPath = m->FullPath;
 		if (m->FullPath.find(global) == 0)
 			m->FullPath = m->FullPath.substr(global.size());
 		if (m->FullPath.find(root) == 0)
diff --git a/WinSysCore/KernelModuleTracker.h b/WinSysCore/KernelModuleTracker.h
index e674f3b..5450719 100644
--- a/WinSysCore/KernelModuleTracker.h
+++ b/WinSysCore/KernelModuleTracker.h
@@ -6,6 +6,7 @@ namespace WinSys {
 	struct KernelModuleInfo {
 		std::string Name;
 		std::string FullPath;
+		std::string NtPath;
 		HANDLE hSection;
 		void* MappedBase;
 		void* ImageBase;