驱动内存映射文件

最新推荐文章于 2024-07-20 20:16:43 发布

西伯利亚的寒流

最新推荐文章于 2024-07-20 20:16:43 发布

阅读量1.2k

点赞数

分类专栏：驱动文章标签：驱动 ZwMapViewOfSection 内存映射文件 ZwCreateSection

本文链接：https://blog.csdn.net/liwen930723/article/details/52662128

版权

驱动专栏收录该内容

8 篇文章 0 订阅

订阅专栏

驱动内存映射文件，一切尽在代码中，各位老爷请看：

// 内存映射文件，返回基址 
// 用完记得ZwUnmapViewOfSection(ZwCurrentProcess(), BaseAddress);
PVOID CreateMapFileAndGetBaseAddr(PUNICODE_STRING FilePath, PSIZE_T Size)
{
#define SEC_IMAGE 0x01000000

	PVOID MapFileBaseAddress = NULL;
	HANDLE  FileHandle = NULL;
	HANDLE  SectionHandle = NULL;
	NTSTATUS status;
	IO_STATUS_BLOCK IoStatus = { 0 };
	OBJECT_ATTRIBUTES oa = { 0 };

	InitializeObjectAttributes(
		&oa,
		FilePath,
		OBJ_CASE_INSENSITIVE,
		0,
		0
		);

	status = ZwOpenFile(&FileHandle,
		FILE_READ_DATA,
		&oa,
		&IoStatus,
		FILE_SHARE_READ,
		FILE_SYNCHRONOUS_IO_NONALERT);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("ZwOpenFile failed: 0x%x\n", status));
		return NULL;
	}
	oa.ObjectName = 0;

	status = ZwCreateSection(&SectionHandle,
		SECTION_ALL_ACCESS,
		&oa,
		0,
		PAGE_READONLY,
		SEC_IMAGE,
		FileHandle);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("ZwCreateSection failed: 0x%x\n", status));
		ZwClose(FileHandle);
		return NULL;
	}

	status = ZwMapViewOfSection(SectionHandle,
		ZwCurrentProcess(),
		&MapFileBaseAddress,
		0,
		0,
		0,
		Size,
		ViewUnmap,
		0,
		PAGE_READONLY);

	if (!NT_SUCCESS(status))
	{
		KdPrint(("ZwMapViewOfSection failed: 0x%x\n", status));
		ZwClose(SectionHandle);
		ZwClose(FileHandle);
		return NULL;
	}

	ZwClose(SectionHandle);
	ZwClose(FileHandle);
	return MapFileBaseAddress;
}

本博客旨在提供高稳定性和良好风格的代码。