实现FileCopy（Ring0 x86 x64）

 

 

1.1 内核不接受一个字符串文件路径，必须填写一个OBJECT_ATTRIBUTES结构。
    这个结构，在InitializeObjectAttributes初始化


typedef struct _OBJECT_ATTRIBUTES {
  ULONG  Length;
  HANDLE  RootDirectory;
  PUNICODE_STRING  ObjectName;                //路径
  ULONG  Attributes;
  PVOID  SecurityDescriptor;
  PVOID  SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef CONST OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;




VOID 
  InitializeObjectAttributes(
    OUT POBJECT_ATTRIBUTES  InitializedAttributes,
    IN PUNICODE_STRING  ObjectName,                            //路径
    IN ULONG  Attributes,                                          //OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE  忽略大小写 |打开内核句柄
    IN HANDLE  RootDirectory,
    IN PSECURITY_DESCRIPTOR  SecurityDescriptor            //打开的是内核句柄  传NULL
    );

NTSTATUS 
  ZwCreateFile(
    __out PHANDLE  FileHandle,
    __in ACCESS_MASK  DesiredAccess,                            //申请的权限GENERIC_ALL
    __in POBJECT_ATTRIBUTES  ObjectAttributes,
    __out PIO_STATUS_BLOCK  IoStatusBlock,                    //
    __in_opt PLARGE_INTEGER  AllocationSize,
    __in ULONG  FileAttributes,
    __in ULONG  ShareAccess,
    __in ULONG  CreateDisposition,
    __in ULONG  CreateOptions,
    __in_opt PVOID  EaBuffer,
    __in ULONG  EaLength
    );

如果CreateOptions 带有FILE_NO_INTERMEDIATE_BUFFERING CreateOptions 表示不通过缓冲区 直接操作磁盘，所以每次
操作读写都必须以磁盘扇区大小（通常为512字节）对齐，否则返回错误，
typedef struct _IO_STATUS_BLOCK {
    union {
        NTSTATUS Status;            //成功则为STATUS_SUCCESS
        PVOID Pointer;
    } DUMMYUNIONNAME;
    ULONG_PTR Information;            //返回的更多信息
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;






NTSTATUS 
  ZwReadFile(
    IN HANDLE  FileHandle,
    IN HANDLE  Event  OPTIONAL,                        //用于异步完成时
    IN PIO_APC_ROUTINE  ApcRoutine  OPTIONAL,       //异步完成时的回调例程
    IN PVOID  ApcContext  OPTIONAL,                
    OUT PIO_STATUS_BLOCK  IoStatusBlock,
    OUT PVOID  Buffer,                                //缓冲区 
    IN ULONG  Length,                                  //缓冲区长度 
    IN PLARGE_INTEGER  ByteOffset  OPTIONAL,   //
    IN PULONG  Key  OPTIONAL
    );

读取的实际长度在ioStatusBlock.Information里
读取完  返回STATUS_END_OF_FILE

       

NTSTATUS 
  ZwWriteFile(
    IN HANDLE  FileHandle,
    IN HANDLE  Event  OPTIONAL,
    IN PIO_APC_ROUTINE  ApcRoutine  OPTIONAL,
    IN PVOID  ApcContext  OPTIONAL,
    OUT PIO_STATUS_BLOCK  IoStatusBlock,
    IN PVOID  Buffer,
    IN ULONG  Length,
    IN PLARGE_INTEGER  ByteOffset  OPTIONAL,
    IN PULONG  Key  OPTIONAL
    );

 

 下面是实现代码：

/***************************************************************************************
* AUTHOR : icqw
* DATE   : 2015-7-30
* MODULE : FileOption.H
*
* IOCTRL Sample Driver
*
* Description:
*        Demonstrates communications between USER and KERNEL.
*
****************************************************************************************
* Copyright (C) 2010 icqw.
****************************************************************************************/
#ifndef CXX_FILEOPTION_H
#define CXX_FILEOPTION_H
#include <ntifs.h>
#include <devioctl.h>
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString);
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObj);
HANDLE OpenFile(WCHAR* wzFilePath);
NTSTATUS    ReadFile(HANDLE hFile,CHAR* szBuffer,PULONG ulLength,PLARGE_INTEGER Offset);
NTSTATUS    WriteFile(HANDLE hFile,CHAR* szBuffer,PULONG ulLength,PLARGE_INTEGER Offset);
NTSTATUS FileCopy(WCHAR* wzDest,WCHAR* wzSour);
#endif

 

#ifndef CXX_FILEOPTION_H
#    include "FileOption.h"
#endif
NTSTATUS
DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING pRegisterPath)
{
    NTSTATUS        status = STATUS_SUCCESS;
// #if DBG
//     _asm int 3
// 
// #endif
    DriverObject->DriverUnload = DriverUnload;
    FileCopy(L"\\??\\D:\\Dest.txt",L"\\??\\D:\\Sour.txt");
    
    DbgPrint("[FileOption] DriverEntry Success\r\n");
    return STATUS_SUCCESS;
}
NTSTATUS FileCopy(WCHAR* wzDest,WCHAR* wzSour)
{
    HANDLE hSourFile    =    OpenFile(wzSour);
    HANDLE hDestFile    =    OpenFile(wzDest);
    ULONG     ulLength    =    0;
    CHAR*     szBuffer    =    NULL;
    NTSTATUS Status        =    STATUS_UNSUCCESSFUL;
    LARGE_INTEGER Offset    =    {0};
    if (hSourFile==NULL||hDestFile==NULL)
    {
        return STATUS_UNSUCCESSFUL;
    }
    szBuffer    =    (char*)ExAllocatePool(NonPagedPool,4*1024+1);
    while(TRUE)
    {
        RtlZeroMemory(szBuffer,4*1024+1);
        ulLength    =    4*1024;
        //读
        Status        =    ReadFile(hSourFile,
                                 szBuffer,
                                 &ulLength,
                                 &Offset);
        if (!NT_SUCCESS(Status))
        {
                break;
        }
        //写
        Status        =    WriteFile(hDestFile,
                                  szBuffer,
                                  &ulLength,
                                  &Offset);
        if (!NT_SUCCESS(Status))
        {
            break;
        }
    }
    DbgPrint("Copy Success!");
    ZwClose(hSourFile);
    ZwClose(hDestFile);
    return STATUS_SUCCESS;
}
HANDLE OpenFile(WCHAR* wzFilePath)
{
    UNICODE_STRING    uniName;
    OBJECT_ATTRIBUTES    Ob;
    HANDLE hFile    =    NULL;
    NTSTATUS Status    =    STATUS_UNSUCCESSFUL;
    IO_STATUS_BLOCK ioStatus    =    {0};
    
    RtlInitUnicodeString(&uniName,wzFilePath);
    InitializeObjectAttributes(&Ob,
        &uniName,
        OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
        NULL,
        NULL);
    Status    =    ZwCreateFile(&hFile,
                             GENERIC_ALL|SYNCHRONIZE,
                             &Ob,
                             &ioStatus,
                             NULL,
                             FILE_ATTRIBUTE_NORMAL,
                             FILE_SHARE_READ,
                             FILE_OPEN_IF,
                             FILE_NON_DIRECTORY_FILE|
                             FILE_RANDOM_ACCESS|
                             FILE_SYNCHRONOUS_IO_NONALERT,
                             NULL,
                             0);
    if (!NT_SUCCESS(Status))
    {
        return NULL;
    }
    return hFile;
}
//读文件 ulLength 为读取实际长度
NTSTATUS    ReadFile(HANDLE hFile,CHAR* szBuffer,PULONG ulLength,PLARGE_INTEGER Offset)
{
    //这里用    
    NTSTATUS    Status            =    STATUS_UNSUCCESSFUL;
    IO_STATUS_BLOCK    ioStatus    =    {0};
        
    
    Status    =    ZwReadFile(hFile,
                            NULL,
                            NULL,
                            NULL,
                            &ioStatus,
                            szBuffer,
                            *ulLength,            
                            Offset,
                            NULL);
    if (!NT_SUCCESS(Status))
    {
        //Status==STATUS_END_OF_FILE)
        
        return STATUS_UNSUCCESSFUL;  
        
    }
    *ulLength    =    ioStatus.Information;
    return Status;;
}
//写文件
NTSTATUS    WriteFile(HANDLE hFile,CHAR* szBuffer,PULONG ulLength,PLARGE_INTEGER Offset)
{
    NTSTATUS    Status            =    STATUS_UNSUCCESSFUL;
    IO_STATUS_BLOCK    ioStatus    =    {0};
    
    Status    =    ZwWriteFile(hFile,
                            NULL,
                            NULL,
                            NULL,
                            &ioStatus,
                            szBuffer,
                            *ulLength,
                            Offset,
                            NULL);
    if (!NT_SUCCESS(Status))
    {
        return STATUS_UNSUCCESSFUL;  //!!!!
    }
    (*Offset).QuadPart    +=    *ulLength;            //Offset移动
    return Status;;
}
VOID
DriverUnload(IN PDRIVER_OBJECT pDriverObj)
{
    DbgPrint("[FileOption] Unloaded Success\r\n");
    return;
}