#include"ntddk.h"
#define lisaisai1 'MyTt'
VOID xiezai1(PDRIVER_OBJECT qudongduixiang)
{
KdPrint(("已经执行到了 驱动卸载历程\n"));
}
NTSTATUS kaibeiwenjian(HANDLE handle1, HANDLE handle2)//拷贝文件
{
NTSTATUS zhuangtai1;
IO_STATUS_BLOCK io_zhuangtai = {0};
PVOID huanchong = NULL;
ULONG zhangdu = 1024*4;
LARGE_INTEGER changzhengxing = { 0 };
huanchong = ExAllocatePoolWithTag(NonPagedPool, 4000,lisaisai1);
do
{
zhuangtai1=ZwReadFile(handle1, NULL, NULL, NULL, &io_zhuangtai, huanchong, zhangdu, &changzhengxing, NULL);
if (!NT_SUCCESS(zhuangtai1))
{
if (zhuangtai1==STATUS_END_OF_FILE)
{
zhuangtai1 = STATUS_SUCCESS;
break;
}
}
zhangdu = io_zhuangtai.Information;//实际读到的长度
zhuangtai1 = ZwWriteFile(handle2, NULL, NULL, NULL, &io_zhuangtai, huanchong, zhangdu, &changzhengxing, NULL);
if (!NT_SUCCESS(zhuangtai1))
{
break;
}
changzhengxing.QuadPart += zhangdu;
} while (1);
ExFreePool(huanchong);
return zhuangtai1;
}
VOID dakaiwenjian()//打开文件
{
HANDLE handle1 = NULL;
HANDLE handle2 = NULL;
UNICODE_STRING mingzi = RTL_CONSTANT_STRING(L"\\??\\C:\\lisaisai.dat");
UNICODE_STRING mingzi2 = RTL_CONSTANT_STRING(L"\\??\\C:\\lifaqi.dat");
OBJECT_ATTRIBUTES duixiangshuxing;
OBJECT_ATTRIBUTES duixiangshuxing_2;
IO_STATUS_BLOCK iozhuangtaidasha;
LARGE_INTEGER changzhengxing;
changzhengxing.u.HighPart = 0;
changzhengxing.u.LowPart = 0;
InitializeObjectAttributes(&duixiangshuxing, &mingzi, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,NULL,NULL);
InitializeObjectAttributes(&duixiangshuxing_2, &mingzi2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
ZwCreateFile(&handle1, GENERIC_ALL, &duixiangshuxing, &iozhuangtaidasha, &changzhengxing, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN_IF, \
FILE_NON_DIRECTORY_FILE | FILE_RANDOM_ACCESS | FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
ZwCreateFile(&handle2, GENERIC_ALL, &duixiangshuxing_2, &iozhuangtaidasha, &changzhengxing, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN_IF, \
FILE_NON_DIRECTORY_FILE | FILE_RANDOM_ACCESS | FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
kaibeiwenjian(handle1, handle2);
ZwClose(handle1);
ZwClose(handle2);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT qudongduixiang, PUNICODE_STRING zhucebiao1)
{
dakaiwenjian();
qudongduixiang->DriverUnload = xiezai1;
return STATUS_SUCCESS;
}