Skip to content

Virtual filesystem that is able to replace files at runtime (Great for TOCTOU exploits)

License

Notifications You must be signed in to change notification settings

0blu/DokanFileReplacer

Repository files navigation

Dokan File Replacer

This is just a simple project to create a virtual filesystem with Dokan which is able to replace files on the fly (even if there are already opened from another process).

Works best with access behaviors that open a file just once (like File.ReadAllText(...)).

Example

The example shows how to use this library to intercept every second request that is made.

Output:

--- Reading files with File.ReadAllText("R:\hello world.txt") ---
[PROXY] File '\hello world.txt' was requested
Output 1: >> 'Just hello world' <<
[PROXY] File '\hello world.txt' was requested
[PROXY] Replace file!
Output 2: >> 'Definitely not the real file!' <<
...

The example mirror driver from Dokan was used and modified for this project.

License: Apache License 2.0

About

Virtual filesystem that is able to replace files at runtime (Great for TOCTOU exploits)

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Contributors

Languages