Free2000fly's Official Blog

BOOLEAN _IsFromNetAccess(PIRP Irp);

#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE, _IsFromNetAccess)
#endif

BOOLEAN _IsFromNetAccess(PIRP Irp)
{
	NTSTATUS status;
	PACCESS_TOKEN pToken = NULL;
	PTOKEN_SOURCE pTokenSrc = NULL ;
	PSECURITY_SUBJECT_CONTEXT secSubCtx;
	BOOLEAN bResult = FALSE;
	PIO_STACK_LOCATION IrpSp = NULL;

	PAGED_CODE();

	__try
	{
		IrpSp = IoGetCurrentIrpStackLocation(Irp);

		secSubCtx = & (IrpSp->Parameters.Create.SecurityContext->
			AccessState->SubjectSecurityContext);

		if (secSubCtx->ClientToken != NULL ||
			secSubCtx->PrimaryToken != NULL)
		{
			pToken = SeQuerySubjectContextToken(secSubCtx);
		} 

		if (NULL == pToken)
		{
			__leave;
		}

		//
		// Get TokenSource Name If SourceName is "NtLmSsp",
		// it was logged-in via Lanmanager,
		// "User32" represents locally logged-in users.
		//
		status = SeQueryInformationToken(pToken, TokenSource, &pTokenSrc);
		if (NT_SUCCESS(status))
		{
			pTokenSrc->SourceName[TOKEN_SOURCE_LENGTH-1] = 0x00;

			//kdprintf(NC_DRV_PREFIX "Token Name :%s Len:%d\r\n",
			//	pTokenSrc->SourceName,strlen(pTokenSrc->SourceName)); 

			if (_stricmp(pTokenSrc->SourceName, "NtLmSsp") == 0 )
			{
				// kdprintf(NC_DRV_PREFIX "NetWork Access Token Find\r\n");
				bResult = TRUE;
			}
		}
	}
	__finally
	{
		if ( pTokenSrc ) {
			ExFreePool(pTokenSrc);
		}
	}
	return bResult;
} 

free2000fly 内核编程