CreateFile的内部实现

　　今天想看看CreateFile的内部实现，不过网上没有想要的资料，都只是对参数分析了一下。找了找WRK源码，找到CreateFile的源码自己来分析一下。

　　

 HANDLE WINAPI CreateFileW (
 LPCWSTR        lpFileName,
                 DWORD            dwDesiredAccess,
                 DWORD            dwShareMode,
                 LPSECURITY_ATTRIBUTES    lpSecurityAttributes,
                 DWORD            dwCreationDisposition,
                 DWORD            dwFlagsAndAttributes,
                 HANDLE        hTemplateFile)
 {
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
    UNICODE_STRING NtPathU;
    HANDLE FileHandle;
    NTSTATUS Status;
    ULONG FileAttributes, Flags = ;
    PVOID EaBuffer = NULL;
    ULONG EaLength = ;
    switch (dwCreationDisposition)
    {
      case CREATE_NEW://强制创建一个文件（原文件不能存在）
     dwCreationDisposition = FILE_CREATE;
     break;
      case CREATE_ALWAYS://原文件存在就覆盖
     dwCreationDisposition = FILE_OVERWRITE_IF;
     break;
      case OPEN_EXISTING://原文件必须存在
     dwCreationDisposition = FILE_OPEN;
     break;
      case OPEN_ALWAYS://原文件不存在就创建
     dwCreationDisposition = FILE_OPEN_IF;
     break;
      case TRUNCATE_EXISTING://原文件存在就清空内容
     dwCreationDisposition = FILE_OVERWRITE;
         break;
    }
    if ( == _wcsicmp(L"CONOUT$", lpFileName)||  == _wcsicmp(L"CONIN$", lpFileName))
    {
       return OpenConsoleW(lpFileName,dwDesiredAccess,
                           lpSecurityAttributes ? lpSecurityAttributes->bInheritHandle : FALSE,
                           FILE_SHARE_READ | FILE_SHARE_WRITE);
    }
    if (!(dwFlagsAndAttributes & FILE_FLAG_OVERLAPPED))
       Flags |= FILE_SYNCHRONOUS_IO_NONALERT;
    if(dwFlagsAndAttributes & FILE_FLAG_WRITE_THROUGH)
       Flags |= FILE_WRITE_THROUGH;
    if(dwFlagsAndAttributes & FILE_FLAG_NO_BUFFERING)
       Flags |= FILE_NO_INTERMEDIATE_BUFFERING;
    if(dwFlagsAndAttributes & FILE_FLAG_RANDOM_ACCESS)
       Flags |= FILE_RANDOM_ACCESS;
    if(dwFlagsAndAttributes & FILE_FLAG_SEQUENTIAL_SCAN)
       Flags |= FILE_SEQUENTIAL_ONLY;
    if(dwFlagsAndAttributes & FILE_FLAG_DELETE_ON_CLOSE)
       Flags |= FILE_DELETE_ON_CLOSE;
    if(dwFlagsAndAttributes & FILE_FLAG_BACKUP_SEMANTICS)
    if(dwFlagsAndAttributes & FILE_FLAG_OPEN_REPARSE_POINT)
       Flags |= FILE_OPEN_REPARSE_POINT;
    if(dwFlagsAndAttributes & FILE_FLAG_OPEN_NO_RECALL)
       Flags |= FILE_OPEN_NO_RECALL;
    FileAttributes = (dwFlagsAndAttributes & (FILE_ATTRIBUTE_VALID_FLAGS & ~FILE_ATTRIBUTE_DIRECTORY));
    dwDesiredAccess |= SYNCHRONIZE | FILE_READ_ATTRIBUTES;
    if (!RtlDosPathNameToNtPathName_U (lpFileName,&NtPathU,NULL,NULL))
    {
      SetLastError(ERROR_PATH_NOT_FOUND);
      return INVALID_HANDLE_VALUE;
    }
    if (hTemplateFile != NULL)
    {
       FILE_EA_INFORMATION EaInformation;

       for (;;)
       {
          Status = NtQueryInformationFile(hTemplateFile,&IoStatusBlock,&EaInformation,
                                          sizeof(FILE_EA_INFORMATION),FileEaInformation);
          if (NT_SUCCESS(Status) && (EaInformation.EaSize != ))
          {
             EaBuffer = RtlAllocateHeap(RtlGetProcessHeap(),,EaInformation.EaSize);
             Status = NtQueryEaFile(hTemplateFile,&IoStatusBlock,EaBuffer,
                                    EaInformation.EaSize,FALSE,NULL,,NULL,TRUE);
             if (NT_SUCCESS(Status))
             {
                EaLength = EaInformation.EaSize;
                break;
             }
             Else
          }
          else
             break;
       }
    }

    InitializeObjectAttributes(&ObjectAttributes,&NtPathU,,NULL,NULL);
    if (lpSecurityAttributes)
    {
       if(lpSecurityAttributes->bInheritHandle)
          ObjectAttributes.Attributes |= OBJ_INHERIT;
       ObjectAttributes.SecurityDescriptor = lpSecurityAttributes->lpSecurityDescriptor;
    }

    if(!(dwFlagsAndAttributes & FILE_FLAG_POSIX_SEMANTICS))
     ObjectAttributes.Attributes |= OBJ_CASE_INSENSITIVE;

    Status = NtCreateFile (&FileHandle,
 dwDesiredAccess,
               &ObjectAttributes,
               &IoStatusBlock,NULL,
               FileAttributes,
               dwShareMode,
               dwCreationDisposition,
               Flags,
               EaBuffer,
               EaLength);
    if (!NT_SUCCESS(Status))
    {
       if (Status == STATUS_OBJECT_NAME_COLLISION && dwCreationDisposition == FILE_CREATE)
          SetLastError( ERROR_FILE_EXISTS );
       else
          SetLastErrorByStatus (Status);
       return INVALID_HANDLE_VALUE;
    }
   if (dwCreationDisposition == FILE_OPEN_IF)
     SetLastError(IoStatusBlock.Information == FILE_OPENED ? ERROR_ALREADY_EXISTS : );
   else if (dwCreationDisposition == FILE_OVERWRITE_IF)
     SetLastError(IoStatusBlock.Information == FILE_OVERWRITTEN ? ERROR_ALREADY_EXISTS : );
   return FileHandle;//返回的文件句柄就是文件对象的句柄
 }

都知道函数CreateFile返回值是文件句柄，我们发现返回的文件句柄其实是函数内部声明的一个传入系统服务NTCreateFile的句柄。接下来，我们一步步跟进， NTCreateFile只是调用了IO管理器的IoCreateFile函数。

IoCreateFile函数的实现也比较简单，就不贴代码了。首先将参数复制到内核空间，构造打开请求包OpenPacket(这个结构体写驱动好像不是很常用？)，接下来调用IopParseDevice解析文件路径，这个函数比较关键，会在这里创建文件对象和IRP请求包。最后就是打开文件对象，再返回Status就Ok啦。

IopParseDevice函数我直接定位到自己最感兴趣的地方：

InitializeObjectAttributes(&ObjectAttributes,NULL,Attributes,NULL,NULL);
        Status = ObCreateObject(KernelMode,IoFileObjectType,
                                &ObjectAttributes,AccessMode,NULL,
                                sizeof(FILE_OBJECT)
                                ,, (PVOID*)&FileObject);
        RtlZeroMemory(FileObject, sizeof(FILE_OBJECT));
        if (OpenPacket->CreateOptions &
            (FILE_SYNCHRONOUS_IO_ALERT | FILE_SYNCHRONOUS_IO_NONALERT))
        {
            FileObject->Flags |= FO_SYNCHRONOUS_IO;
            if (OpenPacket->CreateOptions & FILE_SYNCHRONOUS_IO_ALERT)
                FileObject->Flags |= FO_ALERTABLE_IO;
        }
        if (FileObject->Flags & FO_SYNCHRONOUS_IO)
            KeInitializeEvent(&FileObject->Lock, SynchronizationEvent, FALSE);
        if (OpenPacket->CreateOptions & FILE_NO_INTERMEDIATE_BUFFERING)
            FileObject->Flags |= FO_NO_INTERMEDIATE_BUFFERING;
        if (OpenPacket->CreateOptions & FILE_WRITE_THROUGH)
            FileObject->Flags |= FO_WRITE_THROUGH;
        if (OpenPacket->CreateOptions & FILE_SEQUENTIAL_ONLY)
            FileObject->Flags |= FO_SEQUENTIAL_ONLY;
        if (OpenPacket->CreateOptions & FILE_RANDOM_ACCESS)
            FileObject->Flags |= FO_RANDOM_ACCESS;

在判断完操作类型之后终于开始ObCreateObject创建对象（注意，仅仅是查询、删除命令的话不需要创建对象，使用内部预先的公共的文件对象就ok）,接下来就是发送IRP，等待完成。

　　简单的分析一下，很多细节没有仔细的看，了解一下底层实现。　　　　说真的，这个函数名字取得真心不好，这函数能打开创建的那么多，只叫CreateFile。。。