Skip to content

Virtual filesystem that is able to replace files at runtime (Great for TOCTOU exploits)

License

Notifications You must be signed in to change notification settings

0blu/DokanFileReplacer

Repository files navigation

Dokan File Replacer

This is just a simple project to create a virtual filesystem with Dokan which is able to replace files on the fly (even if there are already opened from another process).

Works best with access behaviors that open a file just once (like File.ReadAllText(...)).

Example

The example shows how to use this library to intercept every second request that is made.

Output:

--- Reading files with File.ReadAllText("R:\hello world.txt") ---
[PROXY] File '\hello world.txt' was requested
Output 1: >> 'Just hello world' <<
[PROXY] File '\hello world.txt' was requested
[PROXY] Replace file!
Output 2: >> 'Definitely not the real file!' <<
...

The example mirror driver from Dokan was used and modified for this project.

License: Apache License 2.0

About

Virtual filesystem that is able to replace files at runtime (Great for TOCTOU exploits)

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages