atapi object +74h hook

atapi object +74h hook
설명은 아래 참고~ 초짜라 시간 너무 오래거리네...;;

char __stdcall atapi_IdePortDispatch_HOOK_(PCWSTR Object, int f, int code, int addr)
{
  const WCHAR *v4; // eax@2
  char result; // al@3
  UNICODE_STRING DestinationString; // [sp+0h] [bp-8h]@1

  RtlInitUnicodeString(&DestinationString, Object);// object = \\Driver\\atapi
  if ( ObReferenceObjectByName(&DestinationString, 0x240u, 0, 0, IoDriverObjectType, 0, 0, &Object) >= 0//
                                                // ObReferenceObjectByName를 이용
                                                // 이름으로 DriverObject를 얻어온다.
                                                //
    && (ObfDereferenceObject(Object), v4 = &Object[2 * f + 28], *v4) )
  {
    *addr = *v4;                                // 74h = IRP_MJ_SCSI / IRP_MJ_INTERNAL_DEVICE_CONTROL
    *v4 = code;                                 // atapi의 Object를 얻어와서 IdePortDispatch부분을
                                                // 자신의 함수 부분으로 바꿈
                                                //
                                                // [0f] IRP_MJ_INTERNAL_DEVICE_CONTROL
                                                // f0e75a30   FileEngine+0x1a30 <<<<<<
    result = 1;
  }
  else
  {
    result = 0;
  }
  return result;
}