详细的操作实例
相关内核API
ZwCreateFile
ZwOpenFile
ZwSetInformationFile
ZwQueryInfomationFile
ZwReadFile
ZwWriteFile
代码实例
002 | #define TAG 'tset' //驱动在内存的标志,即test |
004 | NTSTATUS MyCreateFile() |
007 | UNICODE_STRING usFileName; |
008 | OBJECT_ATTRIBUTES FileObjAttr; |
009 | IO_STATUS_BLOCK IoStatusBlock; |
011 | RtlInitUnicodeString(&usFileName,L "\\??\\c:\\1.txt" ); |
012 | memset (&FileObjAttr,0, sizeof (OBJECT_ATTRIBUTES)); |
014 | InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL); |
015 | Status = ZwCreateFile(&hFile, |
020 | FILE_ATTRIBUTE_NORMAL, |
023 | FILE_NON_DIRECTORY_FILE, |
027 | if (!NT_SUCCESS(Status)) |
029 | DbgPrint( "ZwCreateFile Error" ); |
032 | DbgPrint( "ZwCreateFile Success" ); |
041 | UNICODE_STRING usFileName; |
042 | OBJECT_ATTRIBUTES FileObjAttr; |
043 | IO_STATUS_BLOCK IoStatusBlock; |
046 | RtlInitUnicodeString(&usFileName,L "\\??\\c:\\1.txt" ); |
047 | memset (&FileObjAttr,0, sizeof (OBJECT_ATTRIBUTES)); |
049 | InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL); |
051 | Status = ZwOpenFile(&hFile,GENERIC_ALL,&FileObjAttr,&IoStatusBlock,FILE_SHARE_READ,FILE_NON_DIRECTORY_FILE); |
053 | if (!NT_SUCCESS(Status)) |
056 | DbgPrint( "ZwOpenFile Error, 0x%X\n" ,Status); |
059 | DbgPrint( "ZwOpenFile Success\n" ); |
064 | NTSTATUS MyQueryInformationFile() |
067 | UNICODE_STRING usFileName; |
068 | OBJECT_ATTRIBUTES FileObjAttr; |
069 | IO_STATUS_BLOCK IoStatusBlock; |
070 | FILE_BASIC_INFORMATION FileInfo; |
073 | RtlInitUnicodeString(&usFileName,L "\\??\\c:\\2.txt" ); |
074 | memset (&FileObjAttr,0, sizeof (OBJECT_ATTRIBUTES)); |
076 | InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL); |
077 | Status = ZwCreateFile(&hFile, |
082 | FILE_ATTRIBUTE_NORMAL, |
085 | FILE_NON_DIRECTORY_FILE, |
089 | if (!NT_SUCCESS(Status)) |
091 | DbgPrint( "ZwCreateFile Error" ); |
094 | DbgPrint( "ZwCreateFile Success" ); |
098 | Status = ZwQueryInformationFile(hFile, &IoStatusBlock, &FileInfo, sizeof (FILE_BASIC_INFORMATION), FileBasicInformation); |
099 | if (!NT_SUCCESS(Status)) |
101 | DbgPrint( "ZwQueryInformationFile 0x%X" ,Status); |
106 | DbgPrint( "ZwQueryInformationFile Success\n" ); |
107 | DbgPrint( "0x%x , 0x%x\n" ,FileInfo.ChangeTime.QuadPart,FileInfo.FileAttributes); |
114 | NTSTATUS MySetInformationFile() |
117 | UNICODE_STRING usFileName; |
118 | OBJECT_ATTRIBUTES FileObjAttr; |
119 | IO_STATUS_BLOCK IoStatusBlock; |
120 | FILE_BASIC_INFORMATION FileInfo; |
122 | RtlInitUnicodeString(&usFileName,L "\\??\\c:\\3.txt" ); |
123 | memset (&FileObjAttr,0, sizeof (OBJECT_ATTRIBUTES)); |
125 | InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL); |
126 | Status = ZwCreateFile(&hFile, |
131 | FILE_ATTRIBUTE_NORMAL, |
134 | FILE_NON_DIRECTORY_FILE, |
138 | if (!NT_SUCCESS(Status)) |
140 | DbgPrint( "ZwCreateFile Error" ); |
143 | DbgPrint( "ZwCreateFile Success" ); |
148 | Status = ZwQueryInformationFile(hFile, &IoStatusBlock, &FileInfo, sizeof (FILE_BASIC_INFORMATION), FileBasicInformation); |
149 | if (!NT_SUCCESS(Status)) |
151 | DbgPrint( "ZwQueryInformationFile 0x%X" ,Status); |
156 | DbgPrint( "ZwQueryInformationFile Success\n" ); |
157 | DbgPrint( "0x%x , 0x%x\n" ,FileInfo.ChangeTime.QuadPart,FileInfo.FileAttributes); |
160 | FileInfo.CreationTime.QuadPart = 0; |
161 | FileInfo.FileAttributes |= FILE_ATTRIBUTE_HIDDEN; |
163 | Status = ZwSetInformationFile(hFile, &IoStatusBlock, &FileInfo, sizeof (FILE_BASIC_INFORMATION), FileBasicInformation); |
164 | if (!NT_SUCCESS(Status)) |
166 | DbgPrint( "ZwSetInformationFile Error 0x%X" ,Status); |
171 | DbgPrint( "ZwSetInformationFile Success\n" ); |
179 | NTSTATUS MyWirteFile() |
182 | UNICODE_STRING usFileName; |
183 | OBJECT_ATTRIBUTES FileObjAttr; |
184 | IO_STATUS_BLOCK IoStatusBlock; |
185 | FILE_BASIC_INFORMATION FileInfo; |
188 | LARGE_INTEGER tempBuffer; |
190 | RtlInitUnicodeString(&usFileName,L "\\??\\c:\\5.txt" ); |
191 | memset (&FileObjAttr,0, sizeof (OBJECT_ATTRIBUTES)); |
193 | InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL); |
194 | Status = ZwCreateFile(&hFile, |
199 | FILE_ATTRIBUTE_NORMAL, |
202 | FILE_NON_DIRECTORY_FILE, |
206 | if (!NT_SUCCESS(Status)) |
208 | DbgPrint( "ZwCreateFile Error" ); |
211 | DbgPrint( "ZwCreateFile Success" ); |
215 | strBuffer = ExAllocatePoolWithTag(NonPagedPool, 50, TAG); |
216 | RtlCopyMemory(strBuffer, "www.gyarmy.com\n" , strlen ( "www.gyarmy.com\n" )); |
217 | tempBuffer.QuadPart = 0; |
219 | Status = ZwWriteFile(hFile, NULL, NULL, NULL, &IoStatusBlock, strBuffer, strlen ( "www.gyarmy.com\n" ), &tempBuffer, NULL); |
221 | KdPrint(( "%s" , strBuffer)); |
223 | if (!NT_SUCCESS(Status)) |
225 | DbgPrint( "ZwWriteFile Error" ); |
228 | DbgPrint( "ZwWriteFile Success" ); |
241 | UNICODE_STRING usFileName; |
242 | OBJECT_ATTRIBUTES FileObjAttr; |
243 | IO_STATUS_BLOCK IoStatusBlock; |
244 | FILE_BASIC_INFORMATION FileInfo; |
247 | LARGE_INTEGER tempBuffer; |
249 | RtlInitUnicodeString(&usFileName,L "\\??\\c:\\5.txt" ); |
250 | memset (&FileObjAttr,0, sizeof (OBJECT_ATTRIBUTES)); |
252 | InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL); |
253 | Status = ZwCreateFile(&hFile, |
258 | FILE_ATTRIBUTE_NORMAL, |
261 | FILE_NON_DIRECTORY_FILE, |
265 | if (!NT_SUCCESS(Status)) |
267 | DbgPrint( "ZwCreateFile Error" ); |
270 | DbgPrint( "ZwCreateFile Success" ); |
273 | strBuffer = ExAllocatePoolWithTag(NonPagedPool, 50, TAG); |
274 | memset (strBuffer,0,50); |
276 | tempBuffer.QuadPart = 0; |
278 | Status = ZwReadFile(hFile, NULL, NULL, NULL, &IoStatusBlock, strBuffer, 50, &tempBuffer, NULL); |
279 | if (!NT_SUCCESS(Status)) |
281 | KdPrint(( "错误码%x" , Status)); |
284 | KdPrint(( "strBuffer = %s\n" , strBuffer)); |
285 | DbgPrint( "ZwReadFile Success\n" ); |
293 | VOID MyUnloadDriver(PDRIVER_OBJECT pDriverObject) |
295 | DbgPrint( "Goodbye World!" ); |
300 | NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegisterPath) |
302 | DbgPrint( "Hello World!" ); |
303 | pDriverObject->DriverUnload = MyUnloadDriver; |
314 | return STATUS_SUCCESS; |
0则评论给“[驱动开发] 磁盘文件操作”