MyZwCopyFile实现

最新推荐文章于 2022-07-12 11:15:16 发布

weixin_34357928

最新推荐文章于 2022-07-12 11:15:16 发布

阅读量307

点赞数

原文链接：http://blog.51cto.com/haidragon/2347366

版权

来自：
https://blog.csdn.net/apxar/article/details/10517475
有俩个问题第一参数一定要用UNICODE_STRING或者PUNICODE_STRING（这里第一个为什么没变因为那是我自己创建路径本来用的是wchar就不会出现错）原因会拷贝时出现在乱拷贝如一个目录有xxx.exe xxx.exe* 它有可能找不到文件有可能拷贝的是后面那个因为传进来的有乱码它匹配哪个是哪个没匹配到报0xc00000033 第二读文件权限太多读文件GENERIC_ALL权限修改成GENERIC_READ 写修改成对应的文件。
第一个问题截图（把0大小的文件删除又会拷贝成功同时是概率性的说明是乱码问题概率性匹配）
MyZwCopyFile实现
第二就是直接打开失败
修改后也可以第一个参数也修改

BOOLEAN MyZwCopyFile(PCWSTR desFile, UNICODE_STRING srcFile)
{

    HANDLE readFileHandle;
    HANDLE writeFileHandle;
    OBJECT_ATTRIBUTES ObjectAttributes;
    OBJECT_ATTRIBUTES ObjectAttributes1;
    UNICODE_STRING readFilePath = srcFile;
    UNICODE_STRING writeFilePath;
    IO_STATUS_BLOCK IoStatusBlock;
    NTSTATUS status;

    PVOID saveBuffer = NULL;
    LARGE_INTEGER byteOffset;
    ULONG length = 0;
    byteOffset.QuadPart = 0;
    //RtlInitUnicodeString(&readFilePath, srcFile);
    RtlInitUnicodeString(&writeFilePath, desFile);

    saveBuffer = ExAllocatePoolWithTag(PagedPool, 1000, "tag1");
    InitializeObjectAttributes(&ObjectAttributes, &readFilePath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
    InitializeObjectAttributes(&ObjectAttributes1, &writeFilePath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
    status = ZwCreateFile(&readFileHandle, GENERIC_READ, &ObjectAttributes, &IoStatusBlock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OPEN_IF, FILE_NON_DIRECTORY_FILE | FILE_RANDOM_ACCESS | FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);

    if (!NT_SUCCESS(status))
    {

        DbgPrint("ZwCreateFile readFileHandle failed and status is 0X%x , filepath %S\n" ,status, srcFile);
        DbgPrint("ZwCreateFile readFileHandle failed and status is 0X%x , filepath %ws\n", status, srcFile);
        DbgPrint("ZwCreateFile readFileHandle failed and status is 0X%x , filepath %wZ\n", status, srcFile);
        if (readFileHandle != NULL)
            ZwClose(readFileHandle);

        if (saveBuffer != NULL)
            ExFreePool(saveBuffer);

        return FALSE;
    }

    status = ZwCreateFile(&writeFileHandle, GENERIC_WRITE, &ObjectAttributes1, &IoStatusBlock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OPEN_IF, FILE_NON_DIRECTORY_FILE | FILE_RANDOM_ACCESS | FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);

    if (!NT_SUCCESS(status))
    {
        if (readFileHandle != NULL)
            ZwClose(readFileHandle);

        if (writeFileHandle != NULL)
            ZwClose(writeFileHandle);

        if (saveBuffer != NULL)
            ExFreePool(saveBuffer);

        DbgPrint("writeFileHandle  failed and status is 0X%x ,filepath %S\n", status, desFile);
        DbgPrint("writeFileHandle  failed and status is 0X%x ,filepath %ws\n", status, desFile);
        DbgPrint("writeFileHandle  failed and status is 0X%x ,filepath %wZ\n", status, desFile);
        return FALSE;
    }

    do
    {

        length = 1000;
        status = ZwReadFile(readFileHandle, NULL, NULL, NULL, &IoStatusBlock, saveBuffer, length, &byteOffset, NULL);//读取数据
        if (!NT_SUCCESS(status))
        {
            if (status == STATUS_END_OF_FILE)

                DbgPrint("ZwReadFile readFileHandle read File End");
            if (readFileHandle != NULL)
                ZwClose(readFileHandle);

            if (writeFileHandle != NULL)
                ZwClose(writeFileHandle);

            if (saveBuffer != NULL)
                ExFreePool(saveBuffer);
            return FALSE;
        }

        length = IoStatusBlock.Information; 

        status = ZwWriteFile(writeFileHandle, NULL, NULL, NULL, &IoStatusBlock, saveBuffer, length, &byteOffset, NULL);

        if (!NT_SUCCESS(status))
        {
            DbgPrint("ZwWriteFile writeFileHandle Can not write File ");
            if (readFileHandle != NULL)
                ZwClose(readFileHandle);

            if (writeFileHandle != NULL)
                ZwClose(writeFileHandle);

            if (saveBuffer != NULL)
                ExFreePool(saveBuffer);
            return FALSE;
        }

        byteOffset.QuadPart += length; 

    } while (1);

    if (readFileHandle != NULL)
        ZwClose(readFileHandle);

    if (writeFileHandle != NULL)
        ZwClose(writeFileHandle);

    if (saveBuffer != NULL)
        ExFreePool(saveBuffer);
    return TRUE;
}

转载于:https://blog.51cto.com/haidragon/2347366