都好久沒上來寫文章了,都不知道做什麽好,結果還是學寫了一下用Native API的程序,這些API的原型當然久在DDK裏面找喇,不過因爲NTDLL.DLL有導出啊,所以可以LoadLibrary調入這個動態連接文件,再GetProcAddress找到相應的API的地址,然後當然就可以調用喇.
整個過程最麻煩的就是要將DDK繙來繙去找到要用到的函數原型,函數所用到的結構,和一些宏.複製到程序裏面,好喇,以下是我學習的成果.
以下代碼是在C:中創建一個ForZwFileTest.txt的文件并寫入內容,然後删除.其實都沒什麽用的反正有微軟公開的API不用,而用這些沒公開的API來實現這個功能完全是因爲無聊.嘻嘻.
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
typedef unsigned long NTSTATUS;
typedef unsigned short USHORT;
typedef unsigned long ULONG;
typedef unsigned long DWORD;
typedef long LONG;
typedef __int64 LONGLONG;
typedef struct UNICODE_STRING{
USHORT Length;
USHORT MaxLen;
USHORT *Buffer;
} UNICODE_STRING,*PUNICODE_STRING;
#define OBJ_INHERIT 0x 00000002L
#define OBJ_PERMANENT 0x 00000010L
#define OBJ_EXCLUSIVE 0x 00000020L
#define OBJ_CASE_INSENSITIVE 0x 00000040L
#define OBJ_OPENIF 0x 00000080L
#define OBJ_OPENLINK 0x 00000100L
#define OBJ_KERNEL_HANDLE 0x 00000200L
#define OBJ_FORCE_ACCESS_CHECK 0x 00000400L
#define OBJ_VALID_ATTRIBUTES 0x 000007F 2L
#define FILE_ATTRIBUTE_NORMAL 0x00000080
#define FILE_SHARE_DELETE 0x00000004
#define FILE_OPEN_IF 0x00000003
#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
#define GENERIC_WRITE (0x 40000000L )
#define SYNCHRONIZE (0x 00100000L )
#define GENERIC_READ (0x 80000000L )
typedef struct _OBJECT_ATTRIBUTES{
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef CONST OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
typedef NTSTATUS (__stdcall *ZWDELETEFILE)(
IN POBJECT_ATTRIBUTES ObjectAttributes);
typedef VOID (__stdcall *RTLINITUNICODESTRING)(
IN OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString);
typedef struct _IO_STATUS_BLOCK{
DWORD Status;
ULONG Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
typedef NTSTATUS (__stdcall *ZWCREATEFILE)(
OUT PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN PLARGE_INTEGER AllocationSize OPTIONAL,
IN ULONG FileAttributes,
IN ULONG ShareAccess,
IN ULONG CreateDisposition,
IN ULONG CreateOptions,
IN PVOID EaBuffer OPTIONAL,
IN ULONG EaLength);
typedef VOID (NTAPI *PIO_APC_ROUTINE) (
IN PVOID ApcContext,
IN PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG Reserved);
typedef NTSTATUS (__stdcall *ZWWRITEFILE)(
IN HANDLE FileHandle,
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN PVOID Buffer,
IN ULONG Length,
IN PLARGE_INTEGER ByteOffset OPTIONAL,
IN PULONG Key OPTIONAL);
typedef NTSTATUS (__stdcall *ZWCLOSE)(
IN HANDLE Handle);
int main()
{
HINSTANCE hNtDll;
ZWDELETEFILE ZwDeleteFile;
RTLINITUNICODESTRING RtlInitUnicodeString;
ZWCREATEFILE ZwCreateFile;
ZWWRITEFILE ZwWriteFile;
ZWCLOSE ZwClose;
hNtDll = LoadLibrary ("NTDLL");
if (!hNtDll)
return 0;
ZwDeleteFile = (ZWDELETEFILE)GetProcAddress (hNtDll,"ZwDeleteFile");
RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress (hNtDll,"RtlInitUnicodeString");
ZwCreateFile = (ZWCREATEFILE)GetProcAddress (hNtDll,"ZwCreateFile");
ZwWriteFile = (ZWWRITEFILE)GetProcAddress (hNtDll,"ZwWriteFile");
ZwClose = (ZWCLOSE)GetProcAddress (hNtDll,"ZwClose");
UNICODE_STRING ObjectName;
RtlInitUnicodeString(&ObjectName,L"//??//C://ForZwFileTest.txt");//記得這裏是要有//??//在前面的,DDK說的.
OBJECT_ATTRIBUTES ObjectAttributes = {
sizeof(OBJECT_ATTRIBUTES), // Length
NULL, // RootDirectory
&ObjectName, // ObjectName
OBJ_CASE_INSENSITIVE, // Attributes
0, // SecurityDescriptor
NULL, // SecurityQualityOfService
};
HANDLE hFile;
PVOID content = "ForZwFileTest";
IO_STATUS_BLOCK IoStatusBlock;
ZwCreateFile(&hFile,
GENERIC_WRITE|SYNCHRONIZE|GENERIC_READ,
&ObjectAttributes,
&IoStatusBlock,
0,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_DELETE,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
ZwWriteFile(hFile, 0, 0, 0, &IoStatusBlock, content, 12, NULL, NULL);
ZwClose(hFile);
ZwDeleteFile(&ObjectAttributes);
FreeLibrary (hNtDll);
return 0;
}