驱动开发与系统原理-文件操作-创建文件

大理寺少卿

0环代码

        #include<ntifs.h>
        //设备对象名称
        #define DEVICE_NAME L"\\device\\FileDrv"
        //符号链接名称
        #define LINK_NAME L"\\dosdevices\\whitebird"
        //控制码起始地址
        #define IRP_IOCTRLL_BASE 0x8000
        //控制码的宏定义
        #define IRP_IOCTRL_CODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN,IRP_IOCTRLL_BASE+i,METHOD_BUFFERED,FILE_ANY_ACCESS)
        //控制码定义
        #define CTL_CREATE_FILE IRP_IOCTRL_CODE(0)


        VOID DriverUnload(PDRIVER_OBJECT pDriver) {    
          UNICODE_STRING uLinkName = { 0 };               //符号链接名称   
          RtlInitUnicodeString(&uLinkName, LINK_NAME);    //初始化符号链接名称        
          IoDeleteSymbolicLink(&uLinkName);               //删除符号链接       
          IoDeleteDevice(pDriver->DeviceObject);          //删除设备对象
          DbgPrint("Unload success!\n"); 

        }

        //IRP派遣函数-默认处理
        NTSTATUS DispatchCommon (PDEVICE_OBJECT pDeviceObject,PIRP pIrp){
          DbgPrint("Patched Success");                  //设置IRP处理成功,告诉3环
          pIrp->IoStatus.Status = STATUS_SUCCESS;        
          pIrp->IoStatus.Information = 0;               //设置返回的字节数
          IoCompleteRequest(pIrp, IO_NO_INCREMENT);     //结束IRP处理流程
          return STATUS_SUCCESS;
        }

        //文件操作-创建文件
        NTSTATUS CreateFileIoCall(char *szFilePath) {
            //状态码
            NTSTATUS ntSTATUS = STATUS_SUCCESS;
            //文件句柄 
            HANDLE hFile = NULL;
            //完成状态
            IO_STATUS_BLOCK Iostatus = { 0 };
            //对象属性
            OBJECT_ATTRIBUTES ObjectAtt = { 0 };
            //三环c:\a.txt
            //0环:\\??\\c:\a.txt
            //将三环路径转换成驱动使用的路径
            ANSI_STRING asFilePath = { 0 };
            UNICODE_STRING usFilePath = { 0 };
            UNICODE_STRING usDriverFilePath = { 0 };
            UNICODE_STRING usDrvPath = { 0 };
            WCHAR  wcBuffer[256];
            ULONG wcbufferLen = 256 * sizeof(WCHAR);
            RtlInitEmptyUnicodeString(&usDrvPath, &wcBuffer, wcbufferLen); 
            RtlInitUnicodeString(&usDriverFilePath, L"\\??\\");
            RtlInitAnsiString(&asFilePath, szFilePath);
            RtlAnsiStringToUnicodeString(&usFilePath, &asFilePath, TRUE);         //把ANSI转换成UNICODE
            RtlAppendUnicodeStringToString(&usDrvPath, &usDriverFilePath);        //把\\??\\与用户输入路径进行拼接
            RtlAppendUnicodeStringToString(&usDrvPath, &usFilePath);
            RtlFreeUnicodeString(&usFilePath);
            //初始化对象属性
            InitializeObjectAttributes(&ObjectAtt, &usDrvPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
            //创建文件
            ntSTATUS = ZwCreateFile(&hFile, GENERIC_ALL, &ObjectAtt, &Iostatus, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_DELETE | FILE_SHARE_WRITE, FILE_CREATE, FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE, NULL, 0);
            //判断是否创建成功
            if (NT_SUCCESS(ntSTATUS))
            {
                ZwClose(hFile);       //关闭文件句柄
                return STATUS_SUCCESS;
            }
            else
            {
                return ntSTATUS;
            }


        }
        //IRP派遣函数-控制派遣
        NTSTATUS DispatchIoCtrl(PDEVICE_OBJECT pDeviceObject, PIRP pIrp) {
          //状态码
            NTSTATUS  ntStatus = STATUS_SUCCESS;
          //控制码 
          ULONG uIoCode = 0;
          //输入缓冲区
          PVOID pInputBuffer = NULL;
          //输出缓冲区
          PVOID pOutputBuffer = NULL;
          //输入缓冲区的长度
          ULONG uInputLength = 0;
          //栈结构指针
          PIO_STACK_LOCATION pStack = NULL;
          //获取缓冲区
          pInputBuffer = pOutputBuffer = pIrp->AssociatedIrp.SystemBuffer;
          //获取IRP栈
          pStack = IoGetCurrentIrpStackLocation(pIrp);
          uInputLength = pStack->Parameters.DeviceIoControl.InputBufferLength;
          //获取控制码
          uIoCode = pStack->Parameters.DeviceIoControl.IoControlCode;
          switch (uIoCode)
          {
          case CTL_CREATE_FILE:
          {
              ntStatus=CreateFileIoCall(pInputBuffer);      //调用我们自己实现的打开文件的函数
              if ( !NT_SUCCESS(ntStatus))
              {
                  RtlZeroMemory(pOutputBuffer, 1024);
                  ULONG uRetlength = strlen("CreatFile Failed!");
                  RtlCopyMemory(pOutputBuffer, "CreatFile Failed!", uRetlength);
                  pIrp->IoStatus.Status = STATUS_SUCCESS;
                  pIrp->IoStatus.Information = uRetlength;
                  IoCompleteRequest(pIrp, IO_NO_INCREMENT);
              }else{
                  RtlZeroMemory(pOutputBuffer, 1024);
                  ULONG uRetlength = strlen("CreatFile Success!");
                  RtlCopyMemory(pOutputBuffer, "CreatFile Success!", uRetlength);
                  pIrp->IoStatus.Status = STATUS_SUCCESS;
                  pIrp->IoStatus.Information = uRetlength;
                  IoCompleteRequest(pIrp, IO_NO_INCREMENT);
              }

              return STATUS_SUCCESS;
          }
          default:
            break;
          }
          //设置IRP处理成功,告诉3环
          pIrp->IoStatus.Status = STATUS_SUCCESS;
          //设置返回的字节数
          pIrp->IoStatus.Information = 0;
          //结束IRP处理流程
          IoCompleteRequest(pIrp, IO_NO_INCREMENT);
          return STATUS_SUCCESS;
          }



        NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath) {//驱动对象指针，注册表路径 DriverEntry不能改

          //注册卸载函数，作用是指定用哪个函数来完成卸载
          pDriverObject->DriverUnload = DriverUnload;
          //返回状态
          NTSTATUS ntStatus = 0;
          //设备对象
          UNICODE_STRING uDevicename = { 0 };
          //符号链接名称
          UNICODE_STRING uLinkName = { 0 };
          //初始化设备对象
          RtlInitUnicodeString(&uDevicename, DEVICE_NAME);
          //初始化符号链接名称
          RtlInitUnicodeString(&uLinkName, LINK_NAME);
          //设备对象
          PDEVICE_OBJECT pDeviceObject = NULL;
          //创建设备对象
          ntStatus=IoCreateDevice(pDriverObject, 0, &uDevicename, FILE_DEVICE_UNKNOWN, 0, TRUE, &pDeviceObject);
          //判断设备对象是否创建成功
          if (!NT_SUCCESS(ntStatus))
          {
            DbgPrint("IoCreateDevice failed:%x", ntStatus);
            return ntStatus;
          }

          //创建符号链接
          ntStatus = IoCreateSymbolicLink(&uLinkName, &uDevicename);
          //判断符号链接是否创建成功
          if (!NT_SUCCESS(ntStatus))
          { //删除设备对象
            IoDeleteDevice(&pDeviceObject);
            DbgPrint("IoCreateSymbolicLink failed:%x", ntStatus);
            return ntStatus;
          }

          //将所有IRP派遣处理函数，设置为默认处理函数
          for (size_t i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
          {
            pDriverObject->MajorFunction[i] = DispatchCommon;
          }
          pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoCtrl;     //IO_CONTROL的回调函数
          DbgPrint("Driver Load Success!");
          return STATUS_SUCCESS;//状态成功0，一定要有返回值
        }

3环代码

        #define _CRT_SECURE_NO_WARNINGS
        #include<stdio.h>
        #include<Windows.h>
        #define DEVICE_LINK_NAME L"\\\\.\\whitebird"
        //控制码起始地址
        #define IRP_IOCTRLL_BASE 0x8000
        //控制码的宏定义
        #define IRP_IOCTRL_CODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN,IRP_IOCTRLL_BASE+i,METHOD_BUFFERED,FILE_ANY_ACCESS)
        //控制码定义
        #define CTL_CREATE_FILE IRP_IOCTRL_CODE(0)

        int main() {
          CHAR InputBuffer[1024] = { 0 };
          CHAR OutputBuffer[1024] = { 0 };
          DWORD RetNumber = 0;
          //创建文件、读取文件、写出文件、拷贝文件、删除文件、移动文件、获取文件属性、设置文件属性、保护文件、接触保护、强行删除
          HANDLE hDriver = CreateFile(DEVICE_LINK_NAME, GENERIC_ALL,0, NULL, OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL, NULL);
          if (hDriver==INVALID_HANDLE_VALUE)
          {
            printf("file error code : %d", GetLastError()); 
            system("pause");
            return 1;
          }
          while (TRUE)
          {
            system("cls");
            printf("请输入您需要的选项:\n");
            printf("1.创建文件(ZwCreateFile)\n");
            printf("2.写入文件(ZwWriteFile)\n");
            printf("3.读取文件(ZwReadFile)\n");
            printf("4.拷贝文件(ZwWriteFile&ZwReadFile)\n");
            printf("5.删除文件(ZwDeleteFile)\n");
            printf("6.删除文件(ZwSetInformationFile)\n");
            printf("7.移动文件(ZwWriteFile&ZwReadFile&ZwDeleteFile)\n");
            printf("8.获取属性(ZwQueryFullAttributesFile)\n");
            printf("9.设置属性(ZwSetInformationFile)\n");
            char flag = getchar();
            switch (flag)
            {
            case '1':
            {
              system("cls");
              memset(InputBuffer, 0, sizeof(InputBuffer));
              memset(OutputBuffer, 0, sizeof(OutputBuffer));
              printf("请输入文件创建路径:\n");
              scanf("%s", InputBuffer);
              DeviceIoControl(hDriver, CTL_CREATE_FILE, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &RetNumber, NULL);
              printf("%s\n", OutputBuffer);
              system("pause");
              break;
            }
            default:
              break;
            }
          }
          return 0;
        }

我们这里先实现文件创建，后面陆续实现其他功能