【底层开发】内核Pipe

转载底层开发的资料，使用pipe做驱动和应用层通信，因为pipe这东西，在内核没有具体的导出函数可用，于是逆向了下ring3那一系列pipe相关的函数的实现。

#pragma pack(push,1)

typedef struct _WAIT_PIPE_PARAM
{
        __int64 liTimeOutvalue;
        ULONG   ulPipeNameLen;
        USHORT  bUsTimeoutValue;
}WAIT_PIPE_PARAM,*PWAIT_PIPE_PARAM;

typedef struct _NAMED_PIPE_CREATE_PARAMETERS 
{
        ULONG32      NamedPipeType;
        ULONG32      ReadMode;
        ULONG32      CompletionMode;
        ULONG32      MaximumInstances;
        ULONG32      InboundQuota;
        ULONG32      OutboundQuota;
        LARGE_INTEGER DefaultTimeout;
        UINT8        TimeoutSpecified;
        UINT8        _PADDING0_[0x7];
}NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;

#pragma pack(pop)

#define WAIT_FORVER (0x8000000000000000)

#define PIPE_ACCESS_DUPLEX (3)

NTSTATUS ZwCreateNamedPipeFile (
                OUT PHANDLE phPipeHandle,
                IN ULONG ulDesiredAccess,
                IN POBJECT_ATTRIBUTES pObjAttr,
                OUT PIO_STATUS_BLOCK pIoStatus,
                IN ULONG ulShareAccess,
                IN ULONG ulCreateDisposition,
                IN ULONG ulCreateOptions,
                IN BOOLEAN bIsMsgType,
                IN BOOLEAN bIsMsgMode,
                IN BOOLEAN bIsNonBlocking,
                IN ULONG ulMaximumInstances,
                IN ULONG ulInBufSize,
                IN ULONG ulOutBufSize,
                IN PLARGE_INTEGER pliDefaultTimeout OPTIONAL )  
{   
        NAMED_PIPE_CREATE_PARAMETERS NamedPipeParms={0};
        NTSTATUS NtStatus={0};
        __try   
        {   
                if ( pliDefaultTimeout )
                {
                        NamedPipeParms.TimeoutSpecified = TRUE;
                        NamedPipeParms.DefaultTimeout.QuadPart = pliDefaultTimeout->QuadPart;
                }
                else
                {   
                        NamedPipeParms.TimeoutSpecified = FALSE;
                } 
                NamedPipeParms.NamedPipeType = bIsMsgType;
                NamedPipeParms.ReadMode = bIsMsgMode;
                NamedPipeParms.CompletionMode = bIsNonBlocking;
                NamedPipeParms.MaximumInstances = ulMaximumInstances;
                NamedPipeParms.InboundQuota = ulInBufSize;
                NamedPipeParms.OutboundQuota = ulOutBufSize;
                NtStatus = IoCreateFile(
                        phPipeHandle,
                        ulDesiredAccess,
                        pObjAttr,
                        pIoStatus,
                        NULL,
                        0,
                        ulShareAccess,
                        ulCreateDisposition,
                        ulCreateOptions,
                        NULL,
                        0,
                        CreateFileTypeNamedPipe,
                        &NamedPipeParms,
                        0   
                        );

                return NtStatus;
}   
__except (EXCEPTION_EXECUTE_HANDLER)   
{
        KdPrint (("ZwCreateNamedPipeFile: Exception occured.\n"));
        return GetExceptionCode();   
}
}   

NTSTATUS __stdcall ZwCreateNamedPipe(PWCHAR pwszPipeName,
                     ULONG ulMaxInBufSize,
                     ULONG ulMaxOutBufSize,
                     ULONG ulMaxClientCount,
                     LARGE_INTEGER liTimeOut,
                     PHANDLE phPipe)
{
        NTSTATUS NtStatus=STATUS_SUCCESS;
        HANDLE hPipe=NULL;
        UNICODE_STRING uniPipeName={0};
        OBJECT_ATTRIBUTES ObjAttr={0};
        IO_STATUS_BLOCK IoStatus={0};
        RtlInitUnicodeString(&uniPipeName,pwszPipeName);
        InitializeObjectAttributes(&ObjAttr,&uniPipeName,OBJ_CASE_INSENSITIVE,NULL,NULL);

        NtStatus=ZwCreateNamedPipeFile(&hPipe,
                FILE_ANY_ACCESS,
                &ObjAttr,
                &IoStatus,
                FILE_SHARE_READ | FILE_SHARE_WRITE,
                FILE_CREATE,
                PIPE_ACCESS_DUPLEX,
                FILE_PIPE_MESSAGE_TYPE,
                FILE_PIPE_MESSAGE_MODE,
                FILE_PIPE_QUEUE_OPERATION,//blocking mode
                ulMaxClientCount,
                ulMaxInBufSize,
                ulMaxOutBufSize,
                &liTimeOut);

        if (NT_SUCCESS(NtStatus))
        {
                *phPipe=hPipe;
        }else
        {
                *phPipe=NULL;
        }

        return NtStatus;
}

NTSTATUS __stdcall ZwConnectNamedPipe(HANDLE hPipe)
{
        NTSTATUS NtStatus=STATUS_SUCCESS;
        IO_STATUS_BLOCK IoStatus={0};
        NtStatus=ZwFsControlFile(hPipe,NULL,NULL,NULL,&IoStatus,FSCTL_PIPE_LISTEN,NULL,0,NULL,0);

        return NtStatus;
}

NTSTATUS __stdcall ZwDisconnectNamedPipe(HANDLE hPipe)
{
        NTSTATUS NtStatus=STATUS_SUCCESS;
        IO_STATUS_BLOCK IoStatus={0};
        NtStatus=ZwFsControlFile(hPipe,NULL,NULL,NULL,&IoStatus,FSCTL_PIPE_DISCONNECT,NULL,0,NULL,0);

        return NtStatus;
}


NTSTATUS __stdcall ZwSetNamedPipeState(HANDLE hPipe,ULONG ulMode)
{
        NTSTATUS NtStatus=STATUS_UNSUCCESSFUL;
        ULONG    aBuf[2]={0};
        IO_STATUS_BLOCK IoStatus={0};
        do 
        {
                if ((0xFFFFFFFC & ulMode)==0)
                {
                        break;
                }
                aBuf[0]=((ulMode>>1) & 1);
                aBuf[1]=(ulMode & 1);
                NtStatus=ZwSetInformationFile(hPipe, &IoStatus, aBuf, sizeof(aBuf), FilePipeInformation);
        } while (FALSE);

        return NtStatus;
}


NTSTATUS __stdcall ZwWaitNamedPipe(PUNICODE_STRING puniPipeName,LARGE_INTEGER liTimeOut)
{
        NTSTATUS NtStatus=STATUS_UNSUCCESSFUL;
        IO_STATUS_BLOCK IoStatus={0};
        HANDLE hParent=NULL;
        OBJECT_ATTRIBUTES Oa={0};
        WCHAR  aTmpBuf[512]={0};
        PWAIT_PIPE_PARAM pWaitPipeParam=(PWAIT_PIPE_PARAM)aTmpBuf;
        INT   iShortNameOffset=wcslen(L"\\\\.\\pipe\\")*sizeof(WCHAR);
        UNICODE_STRING uniPipeParentName={0};

        do 
        {
                if (!puniPipeName || puniPipeName->Length<iShortNameOffset)
                {
                        NtStatus=STATUS_OBJECT_NAME_NOT_FOUND;

                        break;
                }
                RtlInitUnicodeString(&uniPipeParentName,L"\\DosDevices\\pipe\\");
                InitializeObjectAttributes(&Oa,&uniPipeParentName,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,NULL,NULL);
                NtStatus=ZwOpenFile(&hParent,0x100080,&Oa,&IoStatus,FILE_SHARE_WRITE | FILE_SHARE_READ,32);
                if (!NT_SUCCESS(NtStatus))
                {
                        break;
                }

                pWaitPipeParam->liTimeOutvalue=liTimeOut.QuadPart;
                pWaitPipeParam->bUsTimeoutValue=TRUE;
                *((USHORT*)(&pWaitPipeParam->ulPipeNameLen))=puniPipeName->Length-iShortNameOffset;
                RtlCopyMemory((PVOID)((ULONG_PTR)pWaitPipeParam+sizeof(WAIT_PIPE_PARAM)),&puniPipeName->Buffer[iShortNameOffset/sizeof(WCHAR)],pWaitPipeParam->ulPipeNameLen);
                NtStatus=ZwFsControlFile(hParent,NULL,NULL,NULL,&IoStatus,FSCTL_PIPE_WAIT,&pWaitPipeParam,14+pWaitPipeParam->ulPipeNameLen,NULL,0);

        } while (FALSE);

        if (hParent)
        {
                ZwClose(hParent);
        }

        return NtStatus;
}