驱动文件操作

红太狼 2023-10-12 03:47 26阅读 0赞

一、创建文件

\#pragma INITCODE  
VOID CreateFileTest()  
\{  
 OBJECT\_ATTRIBUTES objectAttributes;  
 IO\_STATUS\_BLOCK iostatus;  
 HANDLE hfile;  
 UNICODE\_STRING logFileUnicodeString;

//初始化UNICODE\_STRING字符串  
 RtlInitUnicodeString( &logFileUnicodeString,  
  L"\\\\??\\\\C:\\\\1.log");  
 //或者写成 "\\\\Device\\\\HarddiskVolume1\\\\1.LOG"

//初始化objectAttributes  
 InitializeObjectAttributes(&objectAttributes,  
       &logFileUnicodeString,  
       OBJ\_CASE\_INSENSITIVE,  
       NULL,  
       NULL );

//创建文件  
 NTSTATUS ntStatus = ZwCreateFile( &hfile,  
       GENERIC\_WRITE,  
       &objectAttributes,  
       &iostatus,  
       NULL,  
       FILE\_ATTRIBUTE\_NORMAL,  
       FILE\_SHARE\_READ,  
       FILE\_OPEN\_IF,//即使存在该文件，也创建  
       FILE\_SYNCHRONOUS\_IO\_NONALERT,  
       NULL,  
       0 );  
 if ( NT\_SUCCESS(ntStatus))  
 \{  
  KdPrint(("Create file succussfully!\\n"));  
 \}else  
 \{  
  KdPrint(("Create file  unsuccessfully!\\n"));  
 \}

//文件操作  
 //.......

//关闭文件句柄  
 ZwClose(hfile);  
\}  
二、打开文件

\#pragma INITCODE  
VOID OpenFileTest2()  
\{  
 OBJECT\_ATTRIBUTES objectAttributes;  
 IO\_STATUS\_BLOCK iostatus;  
 HANDLE hfile;  
 UNICODE\_STRING logFileUnicodeString;

//初始化UNICODE\_STRING字符串  
 RtlInitUnicodeString( &logFileUnicodeString,  
  L"\\\\??\\\\C:\\\\1.log");  
 //或者写成 "\\\\Device\\\\HarddiskVolume1\\\\1.LOG"

//创建文件  
 NTSTATUS ntStatus = ZwOpenFile( &hfile,  
       GENERIC\_ALL,  
       &objectAttributes,  
       &iostatus,  
       FILE\_SHARE\_READ|FILE\_SHARE\_WRITE,  
       FILE\_SYNCHRONOUS\_IO\_NONALERT);  
 if ( NT\_SUCCESS(ntStatus))  
 \{  
  KdPrint(("Create file succussfully!\\n"));  
 \}else  
 \{  
  KdPrint(("Create file  unsuccessfully!\\n"));  
 \}

//文件操作  
 //.......

//关闭文件句柄  
 ZwClose(hfile);  
\}

\#pragma INITCODE  
VOID OpenFileTest1()  
\{  
 OBJECT\_ATTRIBUTES objectAttributes;  
 IO\_STATUS\_BLOCK iostatus;  
 HANDLE hfile;  
 UNICODE\_STRING logFileUnicodeString;

//初始化UNICODE\_STRING字符串  
 RtlInitUnicodeString( &logFileUnicodeString,  
  L"\\\\??\\\\C:\\\\1.log");  
 //或者写成 "\\\\Device\\\\HarddiskVolume1\\\\1.LOG"

//初始化objectAttributes  
 InitializeObjectAttributes(&objectAttributes,  
       &logFileUnicodeString,  
       OBJ\_CASE\_INSENSITIVE,//对大小写敏感  
       NULL,  
       NULL );

//创建文件  
 NTSTATUS ntStatus = ZwCreateFile( &hfile,  
       GENERIC\_READ,  
       &objectAttributes,  
       &iostatus,  
       NULL,  
       FILE\_ATTRIBUTE\_NORMAL,  
       FILE\_SHARE\_WRITE,  
       FILE\_OPEN,//对文件打开，如果不存在则返回错误  
       FILE\_SYNCHRONOUS\_IO\_NONALERT,  
       NULL,  
       0 );  
 if ( NT\_SUCCESS(ntStatus))  
 \{  
  KdPrint(("Open file succussfully!\\n"));  
 \}else  
 \{  
  KdPrint(("Open file  unsuccessfully!\\n"));  
 \}

//文件操作  
 //.......

//关闭文件句柄  
 ZwClose(hfile);  
\}

三、修改文件的属性（可能有问题）

\#pragma INITCODE  
VOID ReadFileTest()  
\{  
 OBJECT\_ATTRIBUTES objectAttributes;  
 IO\_STATUS\_BLOCK iostatus;  
 HANDLE hfile;  
 UNICODE\_STRING logFileUnicodeString;

//初始化UNICODE\_STRING字符串  
 RtlInitUnicodeString( &logFileUnicodeString,  
  L"\\\\??\\\\C:\\\\1.log");  
   
 //或者写成 "\\\\Device\\\\HarddiskVolume1\\\\1.LOG"

//创建文件  
 NTSTATUS ntStatus = ZwCreateFile( &hfile,  
       GENERIC\_READ,  
       &objectAttributes,  
       &iostatus,  
       NULL,  
       FILE\_ATTRIBUTE\_NORMAL,  
       FILE\_SHARE\_READ,  
       FILE\_OPEN,//即使存在该文件，也创建  
       FILE\_SYNCHRONOUS\_IO\_NONALERT,  
       NULL,  
       0 );

if (!NT\_SUCCESS(ntStatus))  
 \{  
  KdPrint(("The file is not exist!\\n"));  
  return;  
 \}

FILE\_STANDARD\_INFORMATION fsi;  
 //读取文件长度  
 ntStatus = ZwQueryInformationFile(hfile,  
         &iostatus,  
         &fsi,  
         sizeof(FILE\_STANDARD\_INFORMATION),  
         FileStandardInformation);

KdPrint(("The program want to read %d bytes\\n",fsi.EndOfFile.QuadPart));

//为读取的文件分配缓冲区  
  PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool,  
        (LONG)fsi.EndOfFile.QuadPart);

//读取文件  
 ZwReadFile(hfile,NULL,  
    NULL,NULL,  
    &iostatus,  
    pBuffer,  
    (LONG)fsi.EndOfFile.QuadPart,  
    NULL,NULL);  
 KdPrint(("The program really read %d bytes\\n",iostatus.Information));  
 //关闭文件句柄  
 ZwClose(hfile);

//释放缓冲区  
 ExFreePool(pBuffer);  
\}

四、写文件的操作

\#pragma INITCODE  
VOID WriteFileTest()  
\{  
 OBJECT\_ATTRIBUTES objectAttributes;  
 IO\_STATUS\_BLOCK iostatus;  
 HANDLE hfile;  
 UNICODE\_STRING logFileUnicodeString;

//初始化UNICODE\_STRING字符串  
 RtlInitUnicodeString( &logFileUnicodeString,  
  L"\\\\??\\\\C:\\\\1.log");  
 //或者写成 "\\\\Device\\\\HarddiskVolume1\\\\1.LOG"

//创建文件  
 NTSTATUS ntStatus = ZwCreateFile( &hfile,  
       GENERIC\_WRITE,  
       &objectAttributes,  
       &iostatus,  
       NULL,  
       FILE\_ATTRIBUTE\_NORMAL,  
       FILE\_SHARE\_WRITE,  
       FILE\_OPEN\_IF,//即使存在该文件，也创建  
       FILE\_SYNCHRONOUS\_IO\_NONALERT,  
       NULL,  
       0 );  
\#define BUFFER\_SIZE 1024  
 PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool,BUFFER\_SIZE);  
 //构造要填充的数据  
 RtlFillMemory(pBuffer,BUFFER\_SIZE,0xAA);

KdPrint(("The program will write %d bytes\\n",BUFFER\_SIZE));  
 //写文件  
 ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER\_SIZE,NULL,NULL);  
 KdPrint(("The program really wrote %d bytes\\n",iostatus.Information));

//构造要填充的数据  
 RtlFillMemory(pBuffer,BUFFER\_SIZE,0xBB);

KdPrint(("The program will append %d bytes\\n",BUFFER\_SIZE));  
 //追加数据  
 LARGE\_INTEGER number;  
 number.QuadPart = 1024i64;//设置文件指针  
 //对文件进行附加写  
 ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER\_SIZE,&number,NULL);  
 KdPrint(("The program really appended %d bytes\\n",iostatus.Information));

//关闭文件句柄  
 ZwClose(hfile);

ExFreePool(pBuffer);  
\}

五、读文件的操作（可能有问题）

\#pragma INITCODE  
VOID ReadFileTest()  
\{  
 OBJECT\_ATTRIBUTES objectAttributes;  
 IO\_STATUS\_BLOCK iostatus;  
 HANDLE hfile;  
 UNICODE\_STRING logFileUnicodeString;

//初始化UNICODE\_STRING字符串  
 RtlInitUnicodeString( &logFileUnicodeString,  
  L"\\\\??\\\\C:\\\\1.log");  
   
 //或者写成 "\\\\Device\\\\HarddiskVolume1\\\\1.LOG"

if (!NT\_SUCCESS(ntStatus))  
 \{  
  KdPrint(("The file is not exist!\\n"));  
  return;  
 \}

KdPrint(("The program want to read %d bytes\\n",fsi.EndOfFile.QuadPart));

//为读取的文件分配缓冲区  
  PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool,  
        (LONG)fsi.EndOfFile.QuadPart);

//释放缓冲区  
 ExFreePool(pBuffer);  
\}

//ZwCreateFile

参数DesiredAccess \[in\] 追加 FILE\_APPEND\_DATA

和 GENERIC\_\* 一起执行或操作。FILE\_APPEND\_DATA 是不起作用的 必须和 FILE\_\*组合

转载于:https://www.cnblogs.com/kuangke/p/5508099.html