本页主题：如何在windows内核驱动中对文件操作，实现对文件的拷贝、粘贴、删除、查询信息等，这是很常用也是很简单的方法。
部分内容参考：http://www.cppblog.com/aurain/archive/2009/12/31/104563.html
实现原理：
一、在Windows执行体中，通过文件对象来代表文件，该文件对象是一种由对象管理器管理的执行体对象。例如：目录也是由文件对象代表的。
内核组件通过对象名来引用文件，即在文件的全路径前面加\DosDevices。（在Windows 2000及后续操作系统中，\??等同于\DosDevices）。例如，文件C:\WINDOWS\example.txt的对象名为\DosDevices\C:\WINDOWS\example.txt。你需要用对象名来打开文件以获取句柄。
大体步骤如下所示：
1、打开文件，返回文件句柄。注意文件路径一定要初始化才能操作。
2、调用合适的ZwXxxFile 函数以完成对文件的操作。
3、调用ZwClose函数关闭打开的文件句柄。
二、下表对第一步骤的对象名作简单的总结：
|
对象名 |
描述 |
|
\DosDevices |
对象目录 |
|
\DosDevices\C: |
代表C盘的设备对象 |
|
\DosDevices\C:\Directory |
代表名为C:\Director的文件对象 |
|
\DosDevices\C:\Directory\File |
代表名为C:\Directo\Filer的文件对象 |
三、打开文件，获取句柄
1. 定义各一个OBJECT_ATTRIBUTES结构体变量，然后调用InitializeObjectAttributes函数初始化该变量。关键是设置改变量的ObjectName字段为文件对象名。
2. 调用IoCreateFile, ZwCreateFile, 或者 ZwOpenFile，传递上面定义的结构体变量，成功就会返回执行该文件的句柄。
注：驱动一般用ZwCreateFile和ZwOpenFile，IoCreateFile很少使用
当调用ZwCreateFile，ZwOpenFile或IoCreateFile时，Windows执行体创建一个代表该文件的新的文件对象，并返回一个指向该对象的句柄。文件对象一直存在，知道你关闭了所有指向它的文件句柄。
| 读文件 |
ZwReadFile |
| 写文件 |
ZwWriteFile |
| 读文件属性 |
ZwQueryInformationFile |
| 写文件属性 | ZwSetInformationFile |
测试：打开文件，如果没有则创建文件，获取句柄
#pragma INITCODE
VOID CreateFileTest()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString; //初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者写成 "\\Device\\HarddiskVolume1\\1.LOG" //初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,
NULL,
NULL ); //创建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_WRITE,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,//即使存在该文件，也创建
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
if ( NT_SUCCESS(ntStatus))
{
KdPrint(("Create file succussfully!\n"));
}else
{
KdPrint(("Create file unsuccessfully!\n"));
} //文件操作
//....... //关闭文件句柄
ZwClose(hfile);
}
四、测试：通过句柄，对文件进行读写、拷贝（环境是VS2012 WDK7.1）
Driver.h
/************************************************************************
* 文件名称:Driver.h
* 作 者:Geons
* 完成日期:2016年3月30日18:42:38
*************************************************************************/
#pragma once #ifdef __cplusplus
extern "C"
{
#endif
#include <NTDDK.h>
#include <ntstrsafe.h>
#ifdef __cplusplus
}
#endif #define PAGEDCODE code_seg("PAGE")
#define LOCKEDCODE code_seg()
#define INITCODE code_seg("INIT") #define PAGEDDATA data_seg("PAGE")
#define LOCKEDDATA data_seg()
#define INITDATA data_seg("INIT") #define arraysize(p) (sizeof(p)/sizeof((p)[0])) typedef struct _DEVICE_EXTENSION {
PDEVICE_OBJECT pDevice;
UNICODE_STRING ustrDeviceName; //设备名称
UNICODE_STRING ustrSymLinkName; //符号链接名
} DEVICE_EXTENSION, *PDEVICE_EXTENSION; // 函数声明 NTSTATUS CreateDevice (IN PDRIVER_OBJECT pDriverObject);
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject);
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp);
VOID CopyFileSourceToTarget();
MyFileDriver.cpp(包含了文件操作的很多个测试，接口已经暴露在Entry里面，可以在里面自己测试，默认是拷贝两个文件)
/************************************************************************
* 文件名称:Driver.cpp
* 作 者:Geons<span style="white-space:pre"> </span>
* 完成日期:2016年3月30日18:50:13
*************************************************************************/ #include "Driver.h" #pragma INITCODE
VOID CreateFileTest()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString; //初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者写成 "\\Device\\HarddiskVolume1\\1.LOG" //初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,
NULL,
NULL ); //创建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_WRITE,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,//即使存在该文件，也创建
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
if ( NT_SUCCESS(ntStatus))
{
KdPrint(("Create file succussfully!\n"));
}else
{
KdPrint(("Create file unsuccessfully!\n"));
} //文件操作
//....... //关闭文件句柄
ZwClose(hfile);
} #pragma INITCODE
VOID OpenFileTest2()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString; //初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者写成 "\\Device\\HarddiskVolume1\\1.LOG" //初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,
NULL,
NULL ); //创建文件
NTSTATUS ntStatus = ZwOpenFile( &hfile,
GENERIC_ALL,
&objectAttributes,
&iostatus,
FILE_SHARE_READ|FILE_SHARE_WRITE,
FILE_SYNCHRONOUS_IO_NONALERT);
if ( NT_SUCCESS(ntStatus))
{
KdPrint(("Create file succussfully!\n"));
}else
{
KdPrint(("Create file unsuccessfully!\n"));
} //文件操作
//....... //关闭文件句柄
ZwClose(hfile);
} #pragma INITCODE
VOID OpenFileTest1()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString; //初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者写成 "\\Device\\HarddiskVolume1\\1.LOG" //初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,//对大小写敏感
NULL,
NULL ); //创建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_READ,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_WRITE,
FILE_OPEN,//对文件打开，如果不存在则返回错误
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
if ( NT_SUCCESS(ntStatus))
{
KdPrint(("Open file succussfully!\n"));
}else
{
KdPrint(("Open file unsuccessfully!\n"));
} //文件操作
//....... //关闭文件句柄
ZwClose(hfile);
} #pragma INITCODE
VOID FileAttributeTest()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString; //初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者写成 "\\Device\\HarddiskVolume1\\1.LOG" //初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,//对大小写敏感
NULL,
NULL ); //创建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_READ,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,//对文件打开，如果不存在则返回错误
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
if (NT_SUCCESS(ntStatus))
{
KdPrint(("open file successfully.\n"));
} FILE_STANDARD_INFORMATION fsi;
//读取文件长度
ntStatus = ZwQueryInformationFile(hfile,
&iostatus,
&fsi,
sizeof(FILE_STANDARD_INFORMATION),
FileStandardInformation);
if (NT_SUCCESS(ntStatus))
{
KdPrint(("file length:%u\n",fsi.EndOfFile.QuadPart));
} //修改当前文件指针
FILE_POSITION_INFORMATION fpi;
fpi.CurrentByteOffset.QuadPart = 100i64;
ntStatus = ZwSetInformationFile(hfile,
&iostatus,
&fpi,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation);
if (NT_SUCCESS(ntStatus))
{
KdPrint(("update the file pointer successfully.\n"));
} //关闭文件句柄
ZwClose(hfile);
} #pragma INITCODE
VOID WriteFileTest()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString; //初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者写成 "\\Device\\HarddiskVolume1\\1.LOG" //初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,//对大小写敏感
NULL,
NULL ); //创建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_WRITE,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_WRITE,
FILE_OPEN_IF,//即使存在该文件，也创建
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
#define BUFFER_SIZE 1024
PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool,BUFFER_SIZE);
//构造要填充的数据
RtlFillMemory(pBuffer,BUFFER_SIZE,0xAA); KdPrint(("The program will write %d bytes\n",BUFFER_SIZE));
//写文件
ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,NULL,NULL);
KdPrint(("The program really wrote %d bytes\n",iostatus.Information)); //构造要填充的数据
RtlFillMemory(pBuffer,BUFFER_SIZE,0xBB); KdPrint(("The program will append %d bytes\n",BUFFER_SIZE));
//追加数据
LARGE_INTEGER number;
number.QuadPart = 1024i64;//设置文件指针
//对文件进行附加写
ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,&number,NULL);
KdPrint(("The program really appended %d bytes\n",iostatus.Information)); ExFreePool(pBuffer); //关闭文件句柄
ZwClose(hfile); } #pragma INITCODE
VOID ReadFileTest()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString; //初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者写成 "\\Device\\HarddiskVolume1\\1.LOG" //初始化objectAttributes //初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,
NULL,
NULL ); //创建文件
NTSTATUS ntStatus = ZwOpenFile( &hfile,
GENERIC_ALL,
&objectAttributes,
&iostatus,
FILE_SHARE_READ|FILE_SHARE_WRITE,
FILE_SYNCHRONOUS_IO_NONALERT); if (!NT_SUCCESS(ntStatus))
{
KdPrint(("The file is not exist!\n"));
return;
} FILE_STANDARD_INFORMATION fsi;
//读取文件长度
ntStatus = ZwQueryInformationFile(hfile,
&iostatus,
&fsi,
sizeof(FILE_STANDARD_INFORMATION),
FileStandardInformation); KdPrint(("The program want to read %d bytes\n",fsi.EndOfFile.QuadPart)); //为读取的文件分配缓冲区
PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool,
(LONG)fsi.EndOfFile.QuadPart); //读取文件
ZwReadFile(hfile,NULL,
NULL,NULL,
&iostatus,
pBuffer,
(LONG)fsi.EndOfFile.QuadPart,
NULL,NULL);
KdPrint(("The program really read %d bytes\n",iostatus.Information)); //释放缓冲区
ExFreePool(pBuffer); //关闭文件句柄
ZwClose(hfile); } #pragma INITCODE
VOID fun_StrTest()
{
WCHAR dst_buf[512] = {0};
UNICODE_STRING dst;
NTSTATUS status;
UNICODE_STRING file_path = RTL_CONSTANT_STRING(L"\\??\\c:\\winddk\\7600.16385.1\\inc\\cifs.h");
USHORT file_size = 1024; //初始化字符串
RtlInitEmptyUnicodeString(&dst, dst_buf, sizeof(WCHAR)*512); // 调用RTl打印
status = RtlStringCbPrintfW(dst.Buffer, 512*sizeof(WCHAR), L"file path = %wZ file size = %d \r\n", &file_path, file_size); KdPrint(("Printf %wZ\n size:%d", &file_path, file_size)); dst.Length = wcslen(dst.Buffer)*sizeof(WCHAR); } /////////////////////////////////////////////////////////
//功能：实现两个文件的Copy
//作者：Geons
//时间：2016年3月29日08:35:41
///////////////////////////////////////////////////////// #pragma INITCODE
NTSTATUS CopyFileTest2()
{
// 目标句柄
HANDLE target = NULL, source = NULL; // 定义缓冲区
PVOID buffer = NULL;
LARGE_INTEGER offset = {0};
IO_STATUS_BLOCK io_status = {0};
IO_STATUS_BLOCK io_open_status;
IO_STATUS_BLOCK io_open_status2; // 初始化文件路径的OBJECT_ATTRIBUTES
OBJECT_ATTRIBUTES object_attributes;
OBJECT_ATTRIBUTES object_attributes_source; UNICODE_STRING log_ufile_name;
UNICODE_STRING log_source_file_name; // 初始化成UNICODESTRING字符串
RtlInitUnicodeString(&log_ufile_name,L"\\??\\C:\\target1.txt");
RtlInitUnicodeString(&log_source_file_name,L"\\??\\C:\\source1.txt"); //初始化Objectattribultes
InitializeObjectAttributes(&object_attributes,
&log_ufile_name,
OBJ_CASE_INSENSITIVE,
NULL,
NULL); InitializeObjectAttributes(&object_attributes_source,
&log_source_file_name,
OBJ_CASE_INSENSITIVE,
NULL,
NULL); // 打开句柄
NTSTATUS status_source;
NTSTATUS status = ZwCreateFile(&target,
GENERIC_READ|GENERIC_WRITE,
&object_attributes,
&io_open_status,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0); if(NT_SUCCESS(status))
{
KdPrint(("oepn targe handle successfully!\n"));
}
else
{
KdPrint(("error target handle\n"));
} status_source = ZwCreateFile(&source,
GENERIC_READ|GENERIC_WRITE,
&object_attributes_source,
&io_open_status2,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if(NT_SUCCESS(status_source))
{
KdPrint(("open source handle successfully!\n"));
}
else
{
KdPrint(("error source handle, error code:%d\n", status_source));
} ULONG length = 1024*4;
// 读取旧文件
status = ZwReadFile(source,
NULL,
NULL,
NULL,
&io_status,
buffer,
length,
&offset,
NULL); if(!NT_SUCCESS(status))
{
if(status == STATUS_END_OF_FILE)
{
// 拷贝完成
status = STATUS_SUCCESS; }
} //获取实际长度
length = io_status.Information; KdPrint(("length : %d", length));
// 写入字节
status = ZwWriteFile(target, NULL, NULL, NULL, &io_status, buffer, length, &offset, NULL); if(!NT_SUCCESS(status))
{
} offset.QuadPart+=length; // 释放资源，关闭句柄 if(target != NULL)
{
ZwClose(target); }
if(source != NULL)
{
ZwClose(source);
}
if(buffer !=NULL)
{
ExFreePool(buffer); } return STATUS_SUCCESS; } ///////////////////////////new code///////////////////////////////////////////////////////////////
// 读取文件句柄
NTSTATUS MyCreateFile(OUT PHANDLE lpFileHandle,
IN PUNICODE_STRING usFileName,
IN ULONG dwDesiredAccess,
IN ULONG dwShareAccess,
IN ULONG dwCreateDisposition,
IN ULONG dwCreateOptions)
{
NTSTATUS ntStatus = STATUS_UNSUCCESSFUL;
OBJECT_ATTRIBUTES oaName;
IO_STATUS_BLOCK iosBlock;
if (lpFileHandle != NULL && usFileName != NULL && usFileName->Buffer != NULL)
{
if (PASSIVE_LEVEL != KeGetCurrentIrql())
{
return ntStatus;
}
InitializeObjectAttributes(&oaName,
usFileName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL);
ntStatus = ZwCreateFile(lpFileHandle,
dwDesiredAccess,
&oaName,
&iosBlock,
NULL,
FILE_ATTRIBUTE_NORMAL,
dwShareAccess,
dwCreateDisposition,
dwCreateOptions,
NULL,
0);
if (!NT_SUCCESS(ntStatus))
{
KdPrint(("[MyCreateFile]ZwCreateFile(%ws)failed with error:%08x\r\n", usFileName->Buffer, ntStatus));
return ntStatus;
}
}
return ntStatus;
} // 读取文件内容
NTSTATUS MyReadFile(IN HANDLE hFile,
IN PVOID pBuffer,
IN ULONG ulBufferSize,
OUT PULONG pulBytesRead)
{
IO_STATUS_BLOCK iosBlock;
NTSTATUS ntStatus = STATUS_UNSUCCESSFUL; KdPrint(("进入MyReadFile\n")); if (hFile == NULL || pBuffer == NULL)
{
return ntStatus; } if( PASSIVE_LEVEL < KeGetCurrentIrql())
{
KdPrint(("All kernel file operating functions must running on PASSIVE_LEVEL\r\n")); return ntStatus;
} *pulBytesRead = 0; ntStatus = ZwReadFile(hFile,
NULL,
NULL,
NULL,
&iosBlock,
pBuffer,
ulBufferSize,
NULL,
NULL); if (NT_SUCCESS(ntStatus))
{
//获取实际读取到的大小
*pulBytesRead = (ULONG)iosBlock.Information;
KdPrint(("size is %ld", *pulBytesRead));
}
else
{
KdPrint(("[MyReadFile]ZwReadFile failed with:%08x\r\n", ntStatus));
} return ntStatus;
} // 关闭文件句柄
NTSTATUS MyCloseFile(IN HANDLE hFile)
{
return ZwClose(hFile);
} // 读取文件2
void ReadFile_Port()
{
HANDLE hFile=NULL;
IO_STATUS_BLOCK ioStatus;
NTSTATUS ntStatus;
OBJECT_ATTRIBUTES object_attributes; UNICODE_STRING uFileName=RTL_CONSTANT_STRING(L"\\??\\C:\\test.txt"); DbgPrint("ReadLog"); InitializeObjectAttributes(
&object_attributes,
&uFileName,
OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
NULL,
NULL); ntStatus=ZwCreateFile(
&hFile,
GENERIC_READ|GENERIC_WRITE,
&object_attributes,
&ioStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,
FILE_NON_DIRECTORY_FILE|FILE_RANDOM_ACCESS|FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if (ntStatus==STATUS_SUCCESS)
{
PVOID buffer;
ULONG Length = 10;
ULONG dwPort;
ANSI_STRING AnsiString1;
UNICODE_STRING UnicodeString1; buffer = ExAllocatePool(NonPagedPool, 50);
ntStatus=ZwReadFile(
hFile,
NULL,
NULL,
NULL,
&ioStatus,
buffer,
Length,
NULL,
NULL);
DbgPrint("%s",buffer); //将buffer转换成ULONG
RtlInitAnsiString(&AnsiString1,(PCSZ)buffer);
RtlAnsiStringToUnicodeString(&UnicodeString1,&AnsiString1,TRUE);
RtlUnicodeStringToInteger(&UnicodeString1,10,&dwPort); DbgPrint("%d",dwPort);
}
else
{
DbgPrint("Open file error");
} ZwClose(hFile);
} // 写入文件
NTSTATUS MyWriteFile(IN HANDLE hFile,
IN PVOID pBuffer,
IN ULONG ulBufferSize,
OUT PULONG pulBytesWrite)
{
IO_STATUS_BLOCK iosBlock;
NTSTATUS ntStatus = STATUS_UNSUCCESSFUL; if (hFile == NULL || pBuffer == NULL)
{
return ntStatus;
} // All kernel file operating functions must running on PASSIVE_LEVEL
if (PASSIVE_LEVEL != KeGetCurrentIrql())
{
return ntStatus;
} *pulBytesWrite = 0; ntStatus = ZwWriteFile(hFile,
NULL,
NULL,
NULL,
&iosBlock,
pBuffer,
ulBufferSize,
NULL,
NULL); if (NT_SUCCESS(ntStatus))
{
*pulBytesWrite = (ULONG)iosBlock.Information;
}
else
{
KdPrint(("[MyWriteFile]ZwWriteFile failed with:%08x\r\n", ntStatus));
} return ntStatus;
} #pragma INITCODE
VOID FileTest()
{
////创建文件实验
//CreateFileTest(); ////打开文件实验
//OpenFileTest1();
////OpenFileTest2(); ////////////////////////////error code///////////////////////
//
//FileAttributeTest(); ////////////////////////////erro code//////////////////////// ////写文件、追加文件实验
//WriteFileTest(); //ReadFileTest(); // 字符串测试 //fun_StrTest(); //CopyFileTest2(); } #pragma INITCODE
VOID GetFileInfo()
{
UNICODE_STRING filename;
HANDLE hfile;
IO_STATUS_BLOCK iostatus;
OBJECT_ATTRIBUTES objectAttributes;
RtlInitUnicodeString(&filename, L"\\??\\C:\\source1.txt"); InitializeObjectAttributes(&objectAttributes, &filename, OBJ_CASE_INSENSITIVE, NULL, NULL); NTSTATUS ntStatus = ZwCreateFile(&hfile,GENERIC_READ, &objectAttributes, &iostatus, NULL, FILE_ATTRIBUTE_NORMAL,
0, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
if(NT_SUCCESS(ntStatus))
{
KdPrint(("open file successfully.\n"));
}
else
{
KdPrint(("open error"));
} FILE_NAME_INFORMATION fsi; ntStatus = ZwQueryInformationFile(hfile, &iostatus, &fsi,sizeof(FILE_NAME_INFORMATION),
FileNameInformation);
if(NT_SUCCESS(ntStatus))
{
KdPrint(("the file length : %s", fsi.FileName));
}
else
{
KdPrint(("length failed"));
} ZwClose(hfile);
} /************************************************************************
* 函数名称:DriverEntry
* 功能描述:初始化驱动程序，定位和申请硬件资源，创建内核对象
* 参数列表:
pDriverObject:从I/O管理器中传进来的驱动对象
pRegistryPath:驱动程序在注册表的中的路径
* 返回 值:返回初始化驱动状态
*************************************************************************/
#pragma INITCODE
extern "C" NTSTATUS DriverEntry (
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath )
{ NTSTATUS status;
KdPrint(("Enter DriverEntry\n")); pDriverObject->DriverUnload = HelloDDKUnload; //FileTest(); //CopyFileTest2(); //GetFileInfo(); CopyFileSourceToTarget(); //创建驱动设备对象
status = CreateDevice(pDriverObject); KdPrint(("DriverEntry end\n"));
return status;
} VOID CopyFileSourceToTarget()
{
HANDLE hsource = NULL, htarget = NULL;
UNICODE_STRING source_path, target_path;
RtlInitUnicodeString(&source_path, L"\\??\\C:\\source1.txt");
RtlInitUnicodeString(&target_path, L"\\??\\C:\\target1.txt"); NTSTATUS status = MyCreateFile(&hsource, &source_path,GENERIC_ALL,
FILE_SHARE_READ,FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT); if(NT_SUCCESS(status))
{
KdPrint(("source handle操作成功"));
}
else
{
KdPrint(("source failed handle\n"));
} status = MyCreateFile(&htarget, &target_path,GENERIC_ALL,
FILE_SHARE_READ,FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT); if(NT_SUCCESS(status))
{
KdPrint(("targe handle操作成功"));
}
else
{
KdPrint(("target failed handle\n"));
} PVOID buffer = NULL;
buffer = ExAllocatePool(NonPagedPool, 50); ULONG buffersize = NULL; KdPrint(("开始读取文件\n")); // ReadFile_Port();
// 读取source1.txt的文件
status = MyReadFile(hsource,buffer, 50, &buffersize);
if(NT_SUCCESS(status))
{
KdPrint(("读取source1.txt成功！\n"));
}
else
{
KdPrint(("读取source1.txt失败！\n"));
} // 写入target1.txt
status = MyWriteFile(htarget, buffer,buffersize , &buffersize);
if(NT_SUCCESS(status))
{
KdPrint(("写入target1.txt成功！\n"));
}
else
{
KdPrint(("写入target1.txt失败！\n"));
} // 关闭句柄
if(hsource != NULL)
{
ZwClose(hsource);
}
if(htarget != NULL)
{
ZwClose(htarget);
} } /************************************************************************
* 函数名称:CreateDevice
* 功能描述:初始化设备对象
* 参数列表:
pDriverObject:从I/O管理器中传进来的驱动对象
* 返回 值:返回初始化状态
*************************************************************************/
#pragma INITCODE
NTSTATUS CreateDevice (
IN PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt; //创建设备名称
UNICODE_STRING devName;
RtlInitUnicodeString(&devName,L"\\Device\\File4"); //创建设备
status = IoCreateDevice( pDriverObject,
sizeof(DEVICE_EXTENSION),
&(UNICODE_STRING)devName,
FILE_DEVICE_UNKNOWN,
0, TRUE,
&pDevObj );
if (!NT_SUCCESS(status))
return status; pDevObj->Flags |= DO_BUFFERED_IO;
pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice = pDevObj;
pDevExt->ustrDeviceName = devName;
//创建符号链接
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName,L"\\??\\FileSym4");
pDevExt->ustrSymLinkName = symLinkName;
status = IoCreateSymbolicLink( &symLinkName,&devName );
if (!NT_SUCCESS(status))
{
IoDeleteDevice( pDevObj );
return status;
}
return STATUS_SUCCESS;
} /************************************************************************
* 函数名称:HelloDDKUnload
* 功能描述:负责驱动程序的卸载操作
* 参数列表:
pDriverObject:驱动对象
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
KdPrint(("Enter DriverUnload\n"));
pNextObj = pDriverObject->DeviceObject;
while (pNextObj != NULL)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
pNextObj->DeviceExtension; //删除符号链接
UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
IoDeleteSymbolicLink(&pLinkName);
pNextObj = pNextObj->NextDevice;
IoDeleteDevice( pDevExt->pDevice );
}
}
DbgView输出：