CODE:
            //================================================
            //
            //By Lu Lin 2000.5.10
            // Apply with VtoolsD 3.01
            // DDK version is available if requested.
            //Abstract:
            // Install a IFS hook, monitoring any read and write access
            //
            //================================================
            // IFSHOOK.c - main module for IFSHOOK
            #define　 DEVICE_MAIN
            #include　"ifshook.h"
            #undef　　DEVICE_MAIN　
            //typedef EventHdl(pevent pev,pioreq pir);
            typedef struct _Monitored_Files{
            struct _Monitored_Files *pNext_Monitored_Files;//pointer to next struct
            struct _Monitored_Files *pPre_Monitored_Files;//pointer to previous struct
            int sfn;//system file number
            int open_count;
            char path[260]; //ansi path name
            }_Monitored_Files,*pMonitored_Files;
            //
            //Declare virtual device
            //
            Declare_Virtual_Device(IFSHOOK)
            _Monitored_Files Monitored_Files;
            ppIFSFileHookFunc PrevHook;
            DefineControlHandler(SYS_VM_INIT, OnSysVMInit);
            DefineControlHandler(SYS_DYNAMIC_DEVICE_INIT, OnSysDynamicDeviceInit);
            DefineControlHandler(SYS_DYNAMIC_DEVICE_EXIT, OnSysDynamicDeviceExit);
            DefineControlHandler(SYS_VM_TERMINATE, OnSysVMTerminate);
            PCHAR ConvertPath( int drive, path_t ppath, PCHAR fullpathname )
            {
            　　int　i = 0;
            　　_QWORD　result;
            　　//
            　　// Stick on the drive letter if we know it.
            　　//
            　　if( drive != 0xFF ) {
            　　　　fullpathname[0] = drive+"A"-1;
            　　　　fullpathname[1] = ":";
            　　　　i = 2;
            　　}
            　　UniToBCSPath( &fullpathname, ppath->pp_elements, 260 , BCS_WANSI, &result );
            　　return( fullpathname );
            }
            pMonitored_Files IsFileOpened(int i){
            pMonitored_Files p=&Monitored_Files;
            while (p){
            　if (i==p->sfn){
            　 return p;
            　}
            　p=p->pNext_Monitored_Files;
            }
            return 0;
            }
            BOOL ControlDispatcher(
            DWORD dwControlMessage,
            DWORD EBX,
            DWORD EDX,
            DWORD ESI,
            DWORD EDI,
            DWORD ECX)
            {
            START_CONTROL_DISPATCH
            　ON_SYS_VM_INIT(OnSysVMInit);
            　ON_SYS_DYNAMIC_DEVICE_INIT(OnSysDynamicDeviceInit);
            　ON_SYS_DYNAMIC_DEVICE_EXIT(OnSysDynamicDeviceExit);
            END_CONTROL_DISPATCH
            return TRUE;
            }
            int _cdecl MyIfsHook(pIFSFunc pfn, int fn, int Drive, int ResType,
            　int CodePage, pioreq pir)
            {
            int retvar,i;
            char fullpathname[260];
            _Monitored_Files *FileEntry;
            switch(fn){
            　case IFSFN_OPEN:{
            　 retvar=(*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
            　 ConvertPath( Drive, pir->ir_ppath, fullpathname );
            　 FileEntry=IsFileOpened(pir->ir_sfn);
            　 if (FileEntry){
            　　FileEntry->open_count++;
            　 }else{
            　　FileEntry=&Monitored_Files;
            　　while(1){
            　　 if (FileEntry->pNext_Monitored_Files){
            　　　FileEntry=FileEntry->pNext_Monitored_Files;
            　　 }
            　　 else{
            　　　break;
            　　 }
            　　}
            　　FileEntry->pNext_Mon_itored_Files=
            　　 HeapAllocate( sizeof(_Monitored_Files),HEAPZEROINIT);
            　　FileEntry->pNext_Monitored_Files->pPre_Mon_itored_Files=FileEntry;
            　　FileEntry=FileEntry->pNext_Monitored_Files;
            　　FileEntry->sfn=pir->ir_sfn;
            　　FileEntry->open_count=1;
            　　memcpy(FileEntry->path,fullpathname,260);
            　 }
            　 return retvar;
            　}
            　case IFSFN_READ:{
            　 //Do something here,
            　 //eg. Decrypt the file.
            　 char *str;
            　 int j;
            　 str=pir->ir_data;
            　 j=pir->ir_length;
            　 retvar=(*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
            　 FileEntry=IsFileOpened(pir->ir_sfn);
            　 if (!stricmp("c:\test.txt",FileEntry->path)){
            　　for (i=0;i<j;i++){
            　　 str--;
            　　}
            　 }
            　 return retvar;
            　}
            　case IFSFN_WRITE:{
            　 //Do something here
            　 //eg. Encrypt the file
            　 FileEntry=IsFileOpened(pir->ir_sfn);
            　 if (FileEntry){
            　　if (!stricmp("c:\test.txt",FileEntry->path)){
            　　 for (i=0;i<pir->ir_length;i++){
            　　　(((char*)pir->ir_data))++;
            　　 }
            　　}
            　 }
            　 return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
            　}
            　case IFSFN_CLOSE:{
            　 FileEntry=IsFileOpened(pir->ir_sfn);
            　 if (FileEntry){　
            　　FileEntry->open_count--;
            　　if (!FileEntry->open_count){
            　　 FileEntry->pPre_Monitored_Files->pNext_Mon_itored_Files=
            　　 FileEntry->pNext_Monitored_Files;
            　　 FileEntry->pNext_Monitored_Files->pPre_Mon_itored_Files=
            　　　FileEntry->pPre_Monitored_Files;
            　　 HeapFree(FileEntry,0);
            　　 }
            　 }
            　 return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
            　}
            }　
            return (*PrevHook)(pfn, fn, Drive, ResType, CodePage, pir);
            }
            BOOL OnSysVMInit(VMHANDLE hVM){
            return OnSysDynamicDeviceInit();
            }
            BOOL OnSysDynamicDeviceInit()
            {
            PrevHook = IFSMgr_InstallFileSystemApiHook(MyIfsHook);
            Monitored_Files.pNext_Mon_itored_Files=0;
            Monitored_Files.pPre_Mon_itored_Files=0;
            Monitored_Files.sfn=-1;
            Monitored_Files.open_count=0;
            Monitored_Files.path[0]=0;
            return TRUE;
            }
            BOOL OnSysDynamicDeviceExit()
            {
            IFSMgr_RemoveFileSystemApiHook(MyIfsHook);
            return TRUE;
            }
            void OnSysVMTerminate(VMHANDLE hVM){
            return OnSysDynamicDeviceExit();
            }