[驱动开发] 磁盘文件操作

详细的操作实例

相关内核API
ZwCreateFile
ZwOpenFile
ZwSetInformationFile
ZwQueryInfomationFile
ZwReadFile
ZwWriteFile


代码实例


001#include <ntddk.h>
002#define TAG 'tset' //驱动在内存的标志,即test
003 
004NTSTATUS MyCreateFile()
005{
006    HANDLE hFile;
007    UNICODE_STRING usFileName;
008    OBJECT_ATTRIBUTES FileObjAttr;
009    IO_STATUS_BLOCK IoStatusBlock;
010    NTSTATUS Status;
011    RtlInitUnicodeString(&usFileName,L"\\??\\c:\\1.txt");
012    memset(&FileObjAttr,0,sizeof(OBJECT_ATTRIBUTES));
013    //FileObjAttr.Attributes
014    InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
015    Status = ZwCreateFile(&hFile,
016        GENERIC_ALL,
017        &FileObjAttr,
018        &IoStatusBlock,
019        NULL,
020        FILE_ATTRIBUTE_NORMAL,
021        FILE_SHARE_READ,
022        FILE_OPEN_IF,
023        FILE_NON_DIRECTORY_FILE,
024        NULL,
025        0);
026 
027    if(!NT_SUCCESS(Status))
028    {
029        DbgPrint("ZwCreateFile Error");
030        return Status;
031    }
032    DbgPrint("ZwCreateFile Success");
033    //close handle;
034    ZwClose(hFile); //-1
035    return Status;
036}
037 
038NTSTATUS MyOpenFile()
039{
040    HANDLE hFile;
041    UNICODE_STRING usFileName;
042    OBJECT_ATTRIBUTES FileObjAttr;
043    IO_STATUS_BLOCK IoStatusBlock;
044    NTSTATUS Status;
045     
046    RtlInitUnicodeString(&usFileName,L"\\??\\c:\\1.txt");
047    memset(&FileObjAttr,0,sizeof(OBJECT_ATTRIBUTES));
048    //FileObjAttr.Attributes
049    InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
050 
051    Status = ZwOpenFile(&hFile,GENERIC_ALL,&FileObjAttr,&IoStatusBlock,FILE_SHARE_READ,FILE_NON_DIRECTORY_FILE);
052     
053    if(!NT_SUCCESS(Status))
054    {
055        //#define STATUS_OBJECT_NAME_NOT_FOUND     ((NTSTATUS)0xC0000034L)
056        DbgPrint("ZwOpenFile Error, 0x%X\n",Status);
057        return  Status;
058    }
059    DbgPrint("ZwOpenFile Success\n");
060    ZwClose(hFile);
061    return Status;
062}
063 
064NTSTATUS MyQueryInformationFile()
065{
066    HANDLE hFile;
067    UNICODE_STRING usFileName;
068    OBJECT_ATTRIBUTES FileObjAttr;
069    IO_STATUS_BLOCK IoStatusBlock;
070    FILE_BASIC_INFORMATION FileInfo;
071    NTSTATUS Status;
072     
073    RtlInitUnicodeString(&usFileName,L"\\??\\c:\\2.txt");
074    memset(&FileObjAttr,0,sizeof(OBJECT_ATTRIBUTES));
075    //FileObjAttr.Attributes
076    InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
077    Status = ZwCreateFile(&hFile,
078        GENERIC_ALL,
079        &FileObjAttr,
080        &IoStatusBlock,
081        NULL,
082        FILE_ATTRIBUTE_NORMAL,
083        FILE_SHARE_READ,
084        FILE_OPEN_IF,
085        FILE_NON_DIRECTORY_FILE,
086        NULL,
087        0);
088 
089    if(!NT_SUCCESS(Status))
090    {
091        DbgPrint("ZwCreateFile Error");
092        return Status;
093    }
094    DbgPrint("ZwCreateFile Success");
095    //hFile
096 
097    //ZwSetInformationFile(hFile,&IoStatusBlock,)
098    Status = ZwQueryInformationFile(hFile, &IoStatusBlock, &FileInfo, sizeof(FILE_BASIC_INFORMATION), FileBasicInformation);
099    if (!NT_SUCCESS(Status))
100    {
101        DbgPrint("ZwQueryInformationFile 0x%X",Status);
102        ZwClose(hFile);
103        return Status;
104    }
105 
106    DbgPrint("ZwQueryInformationFile Success\n");
107    DbgPrint("0x%x , 0x%x\n",FileInfo.ChangeTime.QuadPart,FileInfo.FileAttributes);
108     
109    //关闭句柄
110    ZwClose(hFile);
111    return Status;
112}
113 
114NTSTATUS MySetInformationFile()
115{
116    HANDLE hFile;
117    UNICODE_STRING usFileName;
118    OBJECT_ATTRIBUTES FileObjAttr;
119    IO_STATUS_BLOCK IoStatusBlock;
120    FILE_BASIC_INFORMATION FileInfo;
121    NTSTATUS Status;
122    RtlInitUnicodeString(&usFileName,L"\\??\\c:\\3.txt");
123    memset(&FileObjAttr,0,sizeof(OBJECT_ATTRIBUTES));
124    //FileObjAttr.Attributes
125    InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
126    Status = ZwCreateFile(&hFile,
127        GENERIC_ALL,
128        &FileObjAttr,
129        &IoStatusBlock,
130        NULL,
131        FILE_ATTRIBUTE_NORMAL,
132        FILE_SHARE_READ,
133        FILE_OPEN_IF,
134        FILE_NON_DIRECTORY_FILE,
135        NULL,
136        0);
137 
138    if(!NT_SUCCESS(Status))
139    {
140        DbgPrint("ZwCreateFile Error");
141        return Status;
142    }
143    DbgPrint("ZwCreateFile Success");
144    //hFile
145 
146    //ZwSetInformationFile(hFile,&IoStatusBlock,)
147    //获取信息
148    Status = ZwQueryInformationFile(hFile, &IoStatusBlock, &FileInfo, sizeof(FILE_BASIC_INFORMATION), FileBasicInformation);
149    if (!NT_SUCCESS(Status))
150    {
151        DbgPrint("ZwQueryInformationFile 0x%X",Status);
152        ZwClose(hFile);
153        return Status;
154    }
155 
156    DbgPrint("ZwQueryInformationFile Success\n");
157    DbgPrint("0x%x , 0x%x\n",FileInfo.ChangeTime.QuadPart,FileInfo.FileAttributes);
158 
159    //设置信息
160    FileInfo.CreationTime.QuadPart = 0;
161    FileInfo.FileAttributes |= FILE_ATTRIBUTE_HIDDEN;
162 
163    Status = ZwSetInformationFile(hFile, &IoStatusBlock, &FileInfo, sizeof(FILE_BASIC_INFORMATION), FileBasicInformation);
164    if (!NT_SUCCESS(Status))
165    {
166        DbgPrint("ZwSetInformationFile Error 0x%X",Status);
167        ZwClose(hFile);
168        return Status;
169    }
170 
171    DbgPrint("ZwSetInformationFile Success\n");
172    //关闭句柄
173    ZwClose(hFile);
174    return Status;
175     
176}
177 
178 
179NTSTATUS MyWirteFile()
180{
181    HANDLE hFile;
182    UNICODE_STRING usFileName;
183    OBJECT_ATTRIBUTES FileObjAttr;
184    IO_STATUS_BLOCK IoStatusBlock;
185    FILE_BASIC_INFORMATION FileInfo;
186    NTSTATUS Status;
187    PVOID strBuffer;
188    LARGE_INTEGER tempBuffer;
189 
190    RtlInitUnicodeString(&usFileName,L"\\??\\c:\\5.txt");
191    memset(&FileObjAttr,0,sizeof(OBJECT_ATTRIBUTES));
192    //FileObjAttr.Attributes
193    InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
194    Status = ZwCreateFile(&hFile,
195        GENERIC_ALL,
196        &FileObjAttr,
197        &IoStatusBlock,
198        NULL,
199        FILE_ATTRIBUTE_NORMAL,
200        FILE_SHARE_READ,
201        FILE_OPEN_IF,
202        FILE_NON_DIRECTORY_FILE,
203        NULL,
204        0);
205 
206    if(!NT_SUCCESS(Status))
207    {
208        DbgPrint("ZwCreateFile Error");
209        return Status;
210    }
211    DbgPrint("ZwCreateFile Success");
212    //hFile
213 
214    //strBuffer = ExAllocatePool(NonPagedPool, 50);
215    strBuffer = ExAllocatePoolWithTag(NonPagedPool, 50, TAG);
216    RtlCopyMemory(strBuffer, "www.gyarmy.com\n", strlen("www.gyarmy.com\n"));
217    tempBuffer.QuadPart = 0;
218     
219    Status = ZwWriteFile(hFile, NULL, NULL, NULL, &IoStatusBlock, strBuffer, strlen("www.gyarmy.com\n"), &tempBuffer, NULL);
220 
221    KdPrint(("%s", strBuffer));
222     
223    if(!NT_SUCCESS(Status))
224    {
225        DbgPrint("ZwWriteFile Error");
226        return Status;
227    }
228    DbgPrint("ZwWriteFile Success");
229 
230    //关闭句柄
231    ZwClose(hFile);
232    return Status;
233 
234}
235 
236 
237 
238NTSTATUS MyReadFile()
239{
240    HANDLE hFile;
241    UNICODE_STRING usFileName;
242    OBJECT_ATTRIBUTES FileObjAttr;
243    IO_STATUS_BLOCK IoStatusBlock;
244    FILE_BASIC_INFORMATION FileInfo;
245    NTSTATUS Status;
246    PVOID strBuffer;
247    LARGE_INTEGER tempBuffer;
248 
249    RtlInitUnicodeString(&usFileName,L"\\??\\c:\\5.txt");
250    memset(&FileObjAttr,0,sizeof(OBJECT_ATTRIBUTES));
251    //FileObjAttr.Attributes
252    InitializeObjectAttributes(&FileObjAttr,&usFileName,OBJ_CASE_INSENSITIVE,NULL,NULL);
253    Status = ZwCreateFile(&hFile,
254        GENERIC_ALL,
255        &FileObjAttr,
256        &IoStatusBlock,
257        NULL,
258        FILE_ATTRIBUTE_NORMAL,
259        FILE_SHARE_READ,
260        FILE_OPEN_IF,
261        FILE_NON_DIRECTORY_FILE,
262        NULL,
263        0);
264 
265    if(!NT_SUCCESS(Status))
266    {
267        DbgPrint("ZwCreateFile Error");
268        return Status;
269    }
270    DbgPrint("ZwCreateFile Success");
271     
272    //strBuffer = ExAllocatePool(NonPagedPool, 50);
273    strBuffer = ExAllocatePoolWithTag(NonPagedPool, 50, TAG);
274    memset(strBuffer,0,50);
275    //读取的起始位置
276    tempBuffer.QuadPart = 0;
277    //tempBuffer.QuadPart.
278    Status = ZwReadFile(hFile, NULL, NULL, NULL, &IoStatusBlock, strBuffer, 50, &tempBuffer, NULL);
279    if (!NT_SUCCESS(Status))
280    {
281        KdPrint(("错误码%x", Status));
282        ZwClose(hFile);
283    }
284    KdPrint(("strBuffer = %s\n", strBuffer));
285    DbgPrint("ZwReadFile Success\n");
286 
287    //关闭句柄
288    ZwClose(hFile);
289    return Status;
290}
291 
292 
293VOID MyUnloadDriver(PDRIVER_OBJECT pDriverObject)
294{
295    DbgPrint("Goodbye World!");
296}
297 
298 
299 
300NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegisterPath)
301{
302    DbgPrint("Hello World!");
303    pDriverObject->DriverUnload = MyUnloadDriver;
304     
305    //MyCreateFile();
306    //MyOpenFile();
307    //MyQueryInformationFile();
308    //MySetInformationFile();
309 
310    MyWirteFile();
311    //MyReadFile();
312 
313 
314    return STATUS_SUCCESS;
315}

原文链接: [驱动开发] 磁盘文件操作 版权所有,转载时请注明出处,违者必究。
注明出处格式:流沙团 ( https://gyarmy.com/post-485.html )

发表评论

0则评论给“[驱动开发] 磁盘文件操作”