梦织未来Windows驱动编程 第06课 驱动对磁盘文件的操作

代码部分:

实现一个文件C:\\text.txt，并读取写入内容到文件，然后将文件设置为只读，并隐藏文件。代码如下：

 //MyCreateFile.c
 //2016.07.22
 #include <ntddk.h>

 NTSTATUS MyCreateFile()
 {
     HANDLE hFile;

     NTSTATUS Status = STATUS_SUCCESS;

     UNICODE_STRING usFileName;
     OBJECT_ATTRIBUTES FileObjAttr;
     IO_STATUS_BLOCK IoStatusBlock;

     memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES));

     RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
     InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL);    //OBJ_CASE_INSENSITIVE 大小写不敏感

     Status = ZwCreateFile (&hFile,
         GENERIC_ALL,
         &FileObjAttr,
         &IoStatusBlock,
         NULL,
         FILE_ATTRIBUTE_NORMAL,
         FILE_SHARE_READ,
         FILE_OPEN_IF,                //如果没有文件，创建文件。如果有文件，直接打开
         FILE_NON_DIRECTORY_FILE,    //不是目录
         NULL,
         );
     if (!NT_SUCCESS(Status))
     {
         return Status;
     }

     KdPrint(("Create File Success!"));

     ZwClose (hFile);

     return Status;
 }

 NTSTATUS MyOpenFile()
 {
     HANDLE hFile;

     UNICODE_STRING usFileName;
     NTSTATUS Status = STATUS_SUCCESS;
     OBJECT_ATTRIBUTES FileObjAttr;
     IO_STATUS_BLOCK IoStatusBlock;

     RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
     memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES));

     InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL);

     Status = ZwOpenFile(&hFile,
         GENERIC_ALL,
         &FileObjAttr,
         &IoStatusBlock,
         FILE_SHARE_READ,
         FILE_NON_DIRECTORY_FILE);
     if (!NT_SUCCESS(Status))
     {
         KdPrint(("Open File Failed:0x%X", Status));
         return Status;
     }

     KdPrint(("Open File Success!"));

     ZwClose(hFile);

     return Status;
 }

 NTSTATUS MyZwSetInfomationFile()
 {
     HANDLE hFile;

     UNICODE_STRING usFileName;
     NTSTATUS Status = STATUS_SUCCESS;
     OBJECT_ATTRIBUTES FileObjAttr;
     IO_STATUS_BLOCK IoStatusBlock;
     FILE_BASIC_INFORMATION fbi;

     RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
     memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES));

     InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL);

     Status = ZwOpenFile(&hFile,
         GENERIC_ALL,
         &FileObjAttr,
         &IoStatusBlock,
         FILE_SHARE_READ,
         FILE_NON_DIRECTORY_FILE);
     if (!NT_SUCCESS(Status))
     {
         KdPrint(("Open File Failed:0x%X", Status));
         return Status;
     }

     KdPrint(("Open File Success!"));

     Status = ZwQueryInformationFile (hFile, &IoStatusBlock, &fbi, sizeof(FILE_BASIC_INFORMATION), FileBasicInformation);    //查看FileBasicInformation
     if (!NT_SUCCESS(Status))
     {
         KdPrint(("Query Information Error code: %X", Status));
         ZwClose (hFile);
         return Status;
     }

     KdPrint(("CreationTime:0x%X    Attributes:0x%X", fbi.CreationTime, fbi.FileAttributes));
     fbi.FileAttributes |= FILE_ATTRIBUTE_HIDDEN;    //隐藏文件
     fbi.FileAttributes |= FILE_ATTRIBUTE_READONLY;    //只读属性

     Status = ZwSetInformationFile (hFile, &IoStatusBlock, &fbi, sizeof(FILE_BASIC_INFORMATION),    FileBasicInformation);
     if (!NT_SUCCESS(Status))
     {
         KdPrint(("Set Information Error:0x%X", Status));
         ZwClose(hFile);
         return Status;
     }

     ZwClose(hFile);

     return Status;
 }

 NTSTATUS MyReadFile()
 {
     HANDLE hFile;

     UNICODE_STRING usFileName;
     NTSTATUS Status = STATUS_SUCCESS;
     OBJECT_ATTRIBUTES FileObjAttr;
     IO_STATUS_BLOCK IoStatusBlock;
     LARGE_INTEGER ReadBuffer;

     char strBuffer[] = {};

     RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
     memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES));

     InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL);

     Status = ZwOpenFile(&hFile,
         GENERIC_ALL,
         &FileObjAttr,
         &IoStatusBlock,
         FILE_SHARE_READ,
         FILE_NON_DIRECTORY_FILE);
     if (!NT_SUCCESS(Status))
     {
         KdPrint(("Open File Failed:0x%X", Status));
         return Status;
     }

     KdPrint(("Open File Success!"));
     ReadBuffer.QuadPart = ;

     Status = ZwReadFile(hFile, NULL, NULL, NULL, &IoStatusBlock, (PVOID)strBuffer, , &ReadBuffer, NULL);    //从文件的0位置读取16个字节到strBuffer
     if (!NT_SUCCESS(Status))
     {
         KdPrint(("ReadFile Failed, Error Code:0x%X", Status));
         ZwClose(hFile);
         return Status;
     }

     KdPrint(("strBuffer:<%s>", strBuffer));

     ZwClose(hFile);
     return Status;
 }

 NTSTATUS MyWriteFile()
 {
     HANDLE hFile;

     UNICODE_STRING usFileName;
     NTSTATUS Status = STATUS_SUCCESS;
     OBJECT_ATTRIBUTES FileObjAttr;
     IO_STATUS_BLOCK IoStatusBlock;
     LARGE_INTEGER WriteBuffer;

      char strBuffer[] = "ahuakndkaj.;'?";

     RtlInitUnicodeString (&usFileName, L"\\??\\c:\\test.txt");
     memset (&FileObjAttr, , sizeof(OBJECT_ATTRIBUTES));

     InitializeObjectAttributes(&FileObjAttr, &usFileName, OBJ_CASE_INSENSITIVE, NULL, NULL);

     Status = ZwOpenFile(&hFile,
         GENERIC_ALL,
         &FileObjAttr,
         &IoStatusBlock,
         FILE_SHARE_READ,
         FILE_NON_DIRECTORY_FILE);
     if (!NT_SUCCESS(Status))
     {
         KdPrint(("Open File Failed:0x%X", Status));
         return Status;
     }

     KdPrint(("Open File Success!"));

     WriteBuffer.QuadPart = ;

     Status = ZwWriteFile(hFile, NULL, NULL, NULL, &IoStatusBlock, (PVOID)strBuffer, , &WriteBuffer, NULL);    //将strBuffer中的前16个字节写入文件，从文件的0位置开始写
     if (!NT_SUCCESS(Status))
     {
         KdPrint(("WriteFile Failed, Error Code:0x%X", Status));
         ZwClose(hFile);
         return Status;
     }

     ZwClose(hFile);
     return Status;
 }

 VOID MyUnload(PDRIVER_OBJECT pDriverObject)
 {
     KdPrint(("Unload MyCreateFile.sys Success"));
 }

 NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
 {
     pDriverObject->DriverUnload = MyUnload;

     MyOpenFile();
     MyCreateFile();
     MyOpenFile();

      MyReadFile();
     MyWriteFile();
      MyReadFile();

     MyZwSetInfomationFile();

     return STATUS_SUCCESS;
 }

MyCreateFile.c

文件的操作函数有：

ZwCreateFile        　　　　//创建文件或者打开文件
ZwOpenFile        　　　　　//打开文件
ZwQueryInformationFile  　 //查看文件信息
ZwSetInformationFile    　 //设置文件信息
ZwReadFile   　　　　　　　　//读取文件
ZwWriteFile  　　　　　　　　//写入文件

创建或打开文件ZwCreateFile：

 NTSTATUS ZwCreateFile(
   _Out_    PHANDLE            FileHandle,           　　 //文件句柄
   _In_     ACCESS_MASK        DesiredAccess,        　　 //访问权限，一般为GENERIC_ALL，即所有权限
   _In_     POBJECT_ATTRIBUTES ObjectAttributes,          //文件对象的属性，需要用InitializeObjectAttributes来初始化
   _Out_    PIO_STATUS_BLOCK   IoStatusBlock,        　　 //用于接收返回信息
   _In_opt_ PLARGE_INTEGER     AllocationSize,         
 7   _In_     ULONG              FileAttributes,        　　//FILE_ATTRIBUTE_NORMAL
   _In_     ULONG              ShareAccess,            　 //FILE_SHARE_READ
   _In_     ULONG              CreateDisposition,    　　　//FILE_OPEN_IF 如果没有文件，创建文件。如果有文件，直接打开
   _In_     ULONG              CreateOptions,        　　　//FILE_NON_DIRECTORY_FILE 不是目录
   _In_opt_ PVOID              EaBuffer,                  //NULL
   _In_     ULONG              EaLength                　 //
 );

其中的第三个参数ObjectAttributes需要使用函数InitializeObjectAttributes来初始化,函数参数:

 VOID InitializeObjectAttributes(
   [out]          POBJECT_ATTRIBUTES   InitializedAttributes,    　　//文件对象指针
   [in]           PUNICODE_STRING      ObjectName,                　 //文件路径及名称
   [in]           ULONG                Attributes,                　 //flag,一般是OBJ_CASE_INSENSITIVE(大小写不敏感)
   [in]           HANDLE               RootDirectory,            　　//根目录，如果ObjectName是绝对路径的话，那么根目录就是NULL
   [in, optional] PSECURITY_DESCRIPTOR SecurityDescriptor        　　//默认为NULL
 );

打开文件函数ZwOpenFile:

 NTSTATUS ZwOpenFile(
   _Out_ PHANDLE            FileHandle,
   _In_  ACCESS_MASK        DesiredAccess,
   _In_  POBJECT_ATTRIBUTES ObjectAttributes,
   _Out_ PIO_STATUS_BLOCK   IoStatusBlock,
   _In_  ULONG              ShareAccess,
   _In_  ULONG              OpenOptions        //和ZwCreateFile的CreateOptions参数相同. FILE_NON_DIRECTORY_FILE 不是目录
 );

获取文件属性函数ZwQueryInformationFile:

 NTSTATUS ZwQueryInformationFile(
   _In_  HANDLE                 FileHandle,
   _Out_ PIO_STATUS_BLOCK       IoStatusBlock,
   _Out_ PVOID                  FileInformation,            //接收文件相应FileInformationClass信息的结构
   _In_  ULONG                  Length,                     //FileInformation的大小
   _In_  FILE_INFORMATION_CLASS FileInformationClass        //指定获取文件什么信息(FileInformation)的枚举值
 );

设置文件属性函数ZwSetInformationFile：

 NTSTATUS ZwSetInformationFile(
   _In_  HANDLE                 FileHandle,
   _Out_ PIO_STATUS_BLOCK       IoStatusBlock,
   _In_  PVOID                  FileInformation,
   _In_  ULONG                  Length,
   _In_  FILE_INFORMATION_CLASS FileInformationClass
 );

读取文件函数ZwReadFile:

 NTSTATUS ZwReadFile(
   _In_     HANDLE           FileHandle,
   _In_opt_ HANDLE           Event,
   _In_opt_ PIO_APC_ROUTINE  ApcRoutine,
   _In_opt_ PVOID            ApcContext,
   _Out_    PIO_STATUS_BLOCK IoStatusBlock,
   _Out_    PVOID            Buffer,                //保存读取到的
   _In_     ULONG            Length,                //从文件读取多少个字节
   _In_opt_ PLARGE_INTEGER   ByteOffset,            //从文件的哪个位置开始读取,传入一个LARGE_INTEGER的指针
   _In_opt_ PULONG           Key                    //NULL
 );

写入文件函数ZwWriteFile：

 NTSTATUS ZwWriteFile(
   _In_     HANDLE           FileHandle,
   _In_opt_ HANDLE           Event,
   _In_opt_ PIO_APC_ROUTINE  ApcRoutine,
   _In_opt_ PVOID            ApcContext,
   _Out_    PIO_STATUS_BLOCK IoStatusBlock,
   _In_     PVOID            Buffer,
   _In_     ULONG            Length,
   _In_opt_ PLARGE_INTEGER   ByteOffset,
   _In_opt_ PULONG           Key
 );

有些地方可能现在还不太清楚，以后再回来补吧。

操作部分:

启动并按章MyCreateFile.sys驱动后，C盘生成了test.txt的文件

这个文件是只读的，并且是隐藏的：

test.txt文件中写着“ahuakndkaj.;'?  "

DbgView输出:

0. 没有相应文件时，MyOpenFile里 ZwOpenFile打开文件失败

1. MyCreateFile里 ZwCreateFile创建文件成功

2. MyOpenFile里 ZwOpenFile打开文件成功

3. MyReadFile里 ZwOpenFile打开文件成功

4. MyReadFile里 ZwReadFile读取文件失败 这时文件中还没有数据

5. MyWriteFile里 ZwOpenFile打开文件成功 没输出错误 说明ZwWriteFile也成功了

6. MyReadFile里 ZwReadFile读取文件成功

7. MyReadFile里 读取到了数据

8. MyZwQueryInfomationFile里 打开文件成功

9. 获取文件属性成功 没输出错误 说明MyZwSetInfomationFile也成功了

10. 驱动卸载成功