代码部分:
实现一个文件C:\\text.txt，并读取写入内容到文件，然后将文件设置为只读，并隐藏文件。代码如下：
//MyCreateFile.c
//2016.07.22
#include <ntddk.h> NTSTATUS MyCreateFile()
{
HANDLE hFile; NTSTATUS Status = STATUS_SUCCESS; UNICODE_STRING usFileName;
OBJECT_ATTRIBUTES FileObjAttr;
IO_STATUS_BLOCK IoStatusBlock; memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES)); RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL); //OBJ_CASE_INSENSITIVE 大小写不敏感 Status = ZwCreateFile (&hFile,
GENERIC_ALL,
&FileObjAttr,
&IoStatusBlock,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF, //如果没有文件，创建文件。如果有文件，直接打开
FILE_NON_DIRECTORY_FILE, //不是目录
NULL,
);
if (!NT_SUCCESS(Status))
{
return Status;
} KdPrint(("Create File Success!")); ZwClose (hFile); return Status;
} NTSTATUS MyOpenFile()
{
HANDLE hFile; UNICODE_STRING usFileName;
NTSTATUS Status = STATUS_SUCCESS;
OBJECT_ATTRIBUTES FileObjAttr;
IO_STATUS_BLOCK IoStatusBlock; RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES)); InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL); Status = ZwOpenFile(&hFile,
GENERIC_ALL,
&FileObjAttr,
&IoStatusBlock,
FILE_SHARE_READ,
FILE_NON_DIRECTORY_FILE);
if (!NT_SUCCESS(Status))
{
KdPrint(("Open File Failed:0x%X", Status));
return Status;
} KdPrint(("Open File Success!")); ZwClose(hFile); return Status;
} NTSTATUS MyZwSetInfomationFile()
{
HANDLE hFile; UNICODE_STRING usFileName;
NTSTATUS Status = STATUS_SUCCESS;
OBJECT_ATTRIBUTES FileObjAttr;
IO_STATUS_BLOCK IoStatusBlock;
FILE_BASIC_INFORMATION fbi; RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES)); InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL); Status = ZwOpenFile(&hFile,
GENERIC_ALL,
&FileObjAttr,
&IoStatusBlock,
FILE_SHARE_READ,
FILE_NON_DIRECTORY_FILE);
if (!NT_SUCCESS(Status))
{
KdPrint(("Open File Failed:0x%X", Status));
return Status;
} KdPrint(("Open File Success!")); Status = ZwQueryInformationFile (hFile, &IoStatusBlock, &fbi, sizeof(FILE_BASIC_INFORMATION), FileBasicInformation); //查看FileBasicInformation
if (!NT_SUCCESS(Status))
{
KdPrint(("Query Information Error code: %X", Status));
ZwClose (hFile);
return Status;
} KdPrint(("CreationTime:0x%X Attributes:0x%X", fbi.CreationTime, fbi.FileAttributes));
fbi.FileAttributes |= FILE_ATTRIBUTE_HIDDEN; //隐藏文件
fbi.FileAttributes |= FILE_ATTRIBUTE_READONLY; //只读属性 Status = ZwSetInformationFile (hFile, &IoStatusBlock, &fbi, sizeof(FILE_BASIC_INFORMATION), FileBasicInformation);
if (!NT_SUCCESS(Status))
{
KdPrint(("Set Information Error:0x%X", Status));
ZwClose(hFile);
return Status;
} ZwClose(hFile); return Status;
} NTSTATUS MyReadFile()
{
HANDLE hFile; UNICODE_STRING usFileName;
NTSTATUS Status = STATUS_SUCCESS;
OBJECT_ATTRIBUTES FileObjAttr;
IO_STATUS_BLOCK IoStatusBlock;
LARGE_INTEGER ReadBuffer; char strBuffer[] = {}; RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES)); InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL); Status = ZwOpenFile(&hFile,
GENERIC_ALL,
&FileObjAttr,
&IoStatusBlock,
FILE_SHARE_READ,
FILE_NON_DIRECTORY_FILE);
if (!NT_SUCCESS(Status))
{
KdPrint(("Open File Failed:0x%X", Status));
return Status;
} KdPrint(("Open File Success!"));
ReadBuffer.QuadPart = ; Status = ZwReadFile(hFile, NULL, NULL, NULL, &IoStatusBlock, (PVOID)strBuffer, , &ReadBuffer, NULL); //从文件的0位置读取16个字节到strBuffer
if (!NT_SUCCESS(Status))
{
KdPrint(("ReadFile Failed, Error Code:0x%X", Status));
ZwClose(hFile);
return Status;
} KdPrint(("strBuffer:<%s>", strBuffer)); ZwClose(hFile);
return Status;
} NTSTATUS MyWriteFile()
{
HANDLE hFile; UNICODE_STRING usFileName;
NTSTATUS Status = STATUS_SUCCESS;
OBJECT_ATTRIBUTES FileObjAttr;
IO_STATUS_BLOCK IoStatusBlock;
LARGE_INTEGER WriteBuffer; char strBuffer[] = "ahuakndkaj.;'?"; RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES)); InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL); Status = ZwOpenFile(&hFile,
GENERIC_ALL,
&FileObjAttr,
&IoStatusBlock,
FILE_SHARE_READ,
FILE_NON_DIRECTORY_FILE);
if (!NT_SUCCESS(Status))
{
KdPrint(("Open File Failed:0x%X", Status));
return Status;
} KdPrint(("Open File Success!")); WriteBuffer.QuadPart = ; Status = ZwWriteFile(hFile, NULL, NULL, NULL, &IoStatusBlock, (PVOID)strBuffer, , &WriteBuffer, NULL); //将strBuffer中的前16个字节写入文件，从文件的0位置开始写
if (!NT_SUCCESS(Status))
{
KdPrint(("WriteFile Failed, Error Code:0x%X", Status));
ZwClose(hFile);
return Status;
} ZwClose(hFile);
return Status;
} VOID MyUnload(PDRIVER_OBJECT pDriverObject)
{
KdPrint(("Unload MyCreateFile.sys Success"));
} NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
pDriverObject->DriverUnload = MyUnload; MyOpenFile();
MyCreateFile();
MyOpenFile(); MyReadFile();
MyWriteFile();
MyReadFile(); MyZwSetInfomationFile(); return STATUS_SUCCESS;
}
MyCreateFile.c
文件的操作函数有：
ZwCreateFile //创建文件或者打开文件
ZwOpenFile //打开文件
ZwQueryInformationFile //查看文件信息
ZwSetInformationFile //设置文件信息
ZwReadFile //读取文件
ZwWriteFile //写入文件
创建或打开文件ZwCreateFile：
NTSTATUS ZwCreateFile(
_Out_ PHANDLE FileHandle, //文件句柄
_In_ ACCESS_MASK DesiredAccess, //访问权限，一般为GENERIC_ALL，即所有权限
_In_ POBJECT_ATTRIBUTES ObjectAttributes, //文件对象的属性，需要用InitializeObjectAttributes来初始化
_Out_ PIO_STATUS_BLOCK IoStatusBlock, //用于接收返回信息
_In_opt_ PLARGE_INTEGER AllocationSize,
7 _In_ ULONG FileAttributes, //FILE_ATTRIBUTE_NORMAL
_In_ ULONG ShareAccess, //FILE_SHARE_READ
_In_ ULONG CreateDisposition, //FILE_OPEN_IF 如果没有文件，创建文件。如果有文件，直接打开
_In_ ULONG CreateOptions, //FILE_NON_DIRECTORY_FILE 不是目录
_In_opt_ PVOID EaBuffer, //NULL
_In_ ULONG EaLength //
);
其中的第三个参数ObjectAttributes需要使用函数InitializeObjectAttributes来初始化,函数参数:
VOID InitializeObjectAttributes(
[out] POBJECT_ATTRIBUTES InitializedAttributes, //文件对象指针
[in] PUNICODE_STRING ObjectName, //文件路径及名称
[in] ULONG Attributes, //flag,一般是OBJ_CASE_INSENSITIVE(大小写不敏感)
[in] HANDLE RootDirectory, //根目录，如果ObjectName是绝对路径的话，那么根目录就是NULL
[in, optional] PSECURITY_DESCRIPTOR SecurityDescriptor //默认为NULL
);
打开文件函数ZwOpenFile:
NTSTATUS ZwOpenFile(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG ShareAccess,
_In_ ULONG OpenOptions //和ZwCreateFile的CreateOptions参数相同. FILE_NON_DIRECTORY_FILE 不是目录
);
获取文件属性函数ZwQueryInformationFile:
NTSTATUS ZwQueryInformationFile(
_In_ HANDLE FileHandle,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_ PVOID FileInformation, //接收文件相应FileInformationClass信息的结构
_In_ ULONG Length, //FileInformation的大小
_In_ FILE_INFORMATION_CLASS FileInformationClass //指定获取文件什么信息(FileInformation)的枚举值
);
设置文件属性函数ZwSetInformationFile：
NTSTATUS ZwSetInformationFile(
_In_ HANDLE FileHandle,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ PVOID FileInformation,
_In_ ULONG Length,
_In_ FILE_INFORMATION_CLASS FileInformationClass
);
读取文件函数ZwReadFile:
NTSTATUS ZwReadFile(
_In_ HANDLE FileHandle,
_In_opt_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_ PVOID Buffer, //保存读取到的
_In_ ULONG Length, //从文件读取多少个字节
_In_opt_ PLARGE_INTEGER ByteOffset, //从文件的哪个位置开始读取,传入一个LARGE_INTEGER的指针
_In_opt_ PULONG Key //NULL
);
写入文件函数ZwWriteFile：
NTSTATUS ZwWriteFile(
_In_ HANDLE FileHandle,
_In_opt_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ PVOID Buffer,
_In_ ULONG Length,
_In_opt_ PLARGE_INTEGER ByteOffset,
_In_opt_ PULONG Key
);
有些地方可能现在还不太清楚，以后再回来补吧。
操作部分:
启动并按章MyCreateFile.sys驱动后，C盘生成了test.txt的文件
这个文件是只读的，并且是隐藏的：
test.txt文件中写着“ahuakndkaj.;’? “
DbgView输出:
0. 没有相应文件时，MyOpenFile里 ZwOpenFile打开文件失败
1. MyCreateFile里 ZwCreateFile创建文件成功
2. MyOpenFile里 ZwOpenFile打开文件成功
3. MyReadFile里 ZwOpenFile打开文件成功
4. MyReadFile里 ZwReadFile读取文件失败 这时文件中还没有数据
5. MyWriteFile里 ZwOpenFile打开文件成功 没输出错误 说明ZwWriteFile也成功了
6. MyReadFile里 ZwReadFile读取文件成功
7. MyReadFile里 读取到了数据
8. MyZwQueryInfomationFile里 打开文件成功
9. 获取文件属性成功 没输出错误 说明MyZwSetInfomationFile也成功了
10. 驱动卸载成功
