
内核代码:
#include <ntifs.h>
#define DEVICE_NAME L"\\device\\MyDricer1" //设备对象名称
#define LINK_NAME L"\\dosdevices\\Goose" //符号链接名称
#define Io_Control_Code(i) CTL_CODE( FILE_DEVICE_UNKNOWN, 0x800 + i, METHOD_BUFFERED, FILE_ANY_ACCESS )//必须的宏定义
#define CTL_CREATE Io_Control_Code(0)
#define CTL_WRITE Io_Control_Code(1)
#define CTL_READ Io_Control_Code(2)
#define CTL_DELETE Io_Control_Code(3)
#define CTL_COPY Io_Control_Code(4)
#define CTL_MOVE Io_Control_Code(5)
#define CTL_GETATTR Io_Control_Code(6)
#define CTL_SETATTR Io_Control_Code(7)
#define CTL_SETDELETE Io_Control_Code(8)
#define CTL_SETNAME Io_Control_Code(9)
#define CTL_PROTECT Io_Control_Code(10)
#define CTL_UNPROTECT Io_Control_Code(11)
ULONG RetNtstatus(NTSTATUS ntStatus, WCHAR* szbuffer, PVOID IOBuffer, ULONG OutPutLength);
ULONG Name_Flag = 0;
HANDLE g_handle = 0;
typedef struct WriteData
{
WCHAR PathBuffer[260];
WCHAR DataBuffer[0x1024];
}WriteData, * PWriteData;
NTSTATUS CreateFileFunc(PVOID IOBuffer)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, (WCHAR*)IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
HANDLE FileHandle;
IO_STATUS_BLOCK ioblock = { 0 };
NTSTATUS ntStatus = ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_CREATE, FILE_NON_DIRECTORY_FILE, 0, 0);
if (ntStatus == STATUS_SUCCESS)
{
ZwClose(FileHandle);
}
return ntStatus;
}
NTSTATUS WriteFileFunc(PVOID IOBuffer)
{
WriteData WriteDataObj = *(WriteData*)IOBuffer;
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, WriteDataObj.PathBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
DbgPrint("%ws", WriteDataObj.DataBuffer);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
HANDLE FileHandle;
IO_STATUS_BLOCK ioblock = { 0 };
NTSTATUS ntStatus = ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_OPEN_IF, FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_ALERT, 0, 0);
if (ntStatus == STATUS_SUCCESS)
{
ULONG szie = wcslen(WriteDataObj.DataBuffer) * sizeof(WCHAR);
ntStatus = ZwWriteFile(FileHandle, 0, 0, 0, &ioblock, WriteDataObj.DataBuffer, szie, 0, 0);
ZwClose(FileHandle);
}
return ntStatus;
}
NTSTATUS ReadFileFunc(PVOID IOBuffer, ULONG* OutPutSize)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, (WCHAR*)IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
HANDLE FileHandle;
IO_STATUS_BLOCK ioblock = { 0 };
NTSTATUS ntStatus = ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, 0, 0);
static ULONG Read_Flag = 0;
if (ntStatus == STATUS_SUCCESS)
{
if (Read_Flag)
{
CHAR* readbuff = ExAllocatePool(PagedPool, *OutPutSize);
ntStatus = ZwReadFile(FileHandle, 0, 0, 0, &ioblock, readbuff, *OutPutSize, 0, 0);
RtlCopyMemory(IOBuffer, readbuff, *OutPutSize);
Read_Flag = 0;
ExFreePool(readbuff);
}
else
{
Read_Flag = 1;
FILE_STANDARD_INFORMATION fsi = { 0 };
ntStatus = ZwQueryInformationFile(FileHandle, &ioblock, &fsi, sizeof(fsi), FileStandardInformation);
*OutPutSize = fsi.EndOfFile.QuadPart;
}
}
ZwClose(FileHandle);
return ntStatus;
}
NTSTATUS DeleteFileFunc(PVOID IOBuffer)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
NTSYSAPI NTSTATUS ZwDeleteFile(
POBJECT_ATTRIBUTES ObjectAttributes
);
NTSTATUS ntstatus = ZwDeleteFile(&p);
return ntstatus;
}
NTSTATUS CopyFileFunc(PVOID IOBuffer)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
static CHAR* readbuff;
static ULONG Copy_Flag = 0;
static ULONG wsize;
NTSTATUS ntStatus;
HANDLE FileHandle = 0;
if (!Copy_Flag)
{
Copy_Flag = 1;
IO_STATUS_BLOCK ioblock = { 0 };
ntStatus = ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, 0, 0);
FILE_STANDARD_INFORMATION fsi = { 0 };
ZwQueryInformationFile(FileHandle, &ioblock, &fsi, sizeof(fsi), FileStandardInformation);
wsize = fsi.EndOfFile.QuadPart;
readbuff = ExAllocatePool(PagedPool, wsize);
ZwReadFile(FileHandle, 0, 0, 0, &ioblock, readbuff, wsize, 0, 0);
}
else
{
Copy_Flag = 0;
IO_STATUS_BLOCK ioblock = { 0 };
ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, 0, 0);
ntStatus = ZwWriteFile(FileHandle, 0, 0, 0, &ioblock, readbuff, wsize, 0, 0);
}
ZwClose(FileHandle);
return ntStatus;
}
NTSTATUS MoveFileFunc(PVOID IOBuffer)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
static CHAR* readbuff;
static ULONG MOve_Flag = 0;
static ULONG wsize;
NTSTATUS ntStatus;
HANDLE FileHandle = 0;
if (!MOve_Flag)
{
MOve_Flag = 1;
IO_STATUS_BLOCK ioblock = { 0 };
ntStatus = ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, 0, 0);
FILE_STANDARD_INFORMATION fsi = { 0 };
ZwQueryInformationFile(FileHandle, &ioblock, &fsi, sizeof(fsi), FileStandardInformation);
wsize = fsi.EndOfFile.QuadPart;
readbuff = ExAllocatePool(PagedPool, wsize);
ZwReadFile(FileHandle, 0, 0, 0, &ioblock, readbuff, wsize, 0, 0);
DeleteFileFunc(IOBuffer);
}
else
{
MOve_Flag = 0;
IO_STATUS_BLOCK ioblock = { 0 };
ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, 0, 0);
ntStatus = ZwWriteFile(FileHandle, 0, 0, 0, &ioblock, readbuff, wsize, 0, 0);
}
ZwClose(FileHandle);
return ntStatus;
}
NTSTATUS GetFileFunc(PVOID IOBuffer, ULONG* OutPutSize)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
FILE_NETWORK_OPEN_INFORMATION fnoi = { 0 };
NTSTATUS ntstatus = ZwQueryFullAttributesFile(&p, &fnoi);
if (fnoi.FileAttributes & FILE_ATTRIBUTE_ARCHIVE)
{
*OutPutSize = wcslen(L"ARCHIVE") * 2;
RtlCopyMemory(IOBuffer, L"ARCHIVE", *OutPutSize);
}
if (fnoi.FileAttributes & FILE_ATTRIBUTE_HIDDEN)
{
*OutPutSize = wcslen(L"HIDDEN") * 2;
RtlCopyMemory(IOBuffer, L"HIDDEN", *OutPutSize);
}
if (fnoi.FileAttributes & FILE_ATTRIBUTE_DIRECTORY)
{
*OutPutSize = wcslen(L"DIRECTORY") * 2;
RtlCopyMemory(IOBuffer, L"DIRECTORY", *OutPutSize);
}
return ntstatus;
}
NTSTATUS SetFileFunc(PVOID IOBuffer, ULONG* OutPutSize)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
HANDLE FileHandle;
IO_STATUS_BLOCK ioblock = { 0 };
NTSTATUS ntStatus = ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_OPEN_IF, FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, 0, 0);
DbgBreakPoint();
if (ntStatus == STATUS_SUCCESS)
{
FILE_POSITION_INFORMATION fpi = { 100 };
ntStatus = ZwSetInformationFile(FileHandle, &ioblock, &fpi, sizeof(fpi), FilePositionInformation);
FILE_STANDARD_INFORMATION fsi = { 0 };
ntStatus = ZwQueryInformationFile(FileHandle, &ioblock, &fsi, sizeof(fsi), FileStandardInformation);
*OutPutSize = fsi.EndOfFile.QuadPart;
ntStatus = ZwReadFile(FileHandle, 0, 0, 0, &ioblock, IOBuffer, *OutPutSize, 0, 0);
}
ZwClose(FileHandle);
return ntStatus;
}
NTSTATUS SetDeleteFileFunc(PVOID IOBuffer)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
HANDLE FileHandle;
IO_STATUS_BLOCK ioblock = { 0 };
NTSTATUS ntStatus = ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, 0, 0);
if (ntStatus == STATUS_SUCCESS)
{
FILE_DISPOSITION_INFORMATION fdi = { TRUE };
ntStatus = ZwSetInformationFile(FileHandle, &ioblock, &fdi, sizeof(fdi), FileDispositionInformation);
}
ZwClose(FileHandle);
return ntStatus;
}
NTSTATUS SetFileNameFunc(PVOID IOBuffer)
{
NTSTATUS ntStatus = 0;
static HANDLE FileHandle;
IO_STATUS_BLOCK ioblock = { 0 };
if (Name_Flag == 0)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
ntStatus = ZwCreateFile(&FileHandle, GENERIC_ALL, &p, &ioblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_VALID_FLAGS, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT | FILE_NO_INTERMEDIATE_BUFFERING, 0, 0);
if (ntStatus == 0)
{
Name_Flag = 1;
}
}
else
{
Name_Flag = 0;
FILE_RENAME_INFORMATION fri = { 0 };
fri.FileNameLength = wcslen(IOBuffer) * 2;
memcpy(fri.FileName, IOBuffer, fri.FileNameLength);
fri.ReplaceIfExists = fri.RootDirectory = 0;
ntStatus = ZwSetInformationFile(FileHandle, &ioblock, &fri, sizeof(fri) + fri.FileNameLength, FileRenameInformation);
ZwClose(FileHandle);
}
return ntStatus;
}
NTSTATUS ProtectFileFunc(PVOID IOBuffer)
{
UNICODE_STRING usStrbuffer0 = { 0 };
UNICODE_STRING usStrbuffer1 = { 0 };
UNICODE_STRING usStrbuffer2 = { 0 };
WCHAR wcbuffer[256];
RtlInitEmptyUnicodeString(&usStrbuffer2, wcbuffer, sizeof(wcbuffer));
RtlInitUnicodeString(&usStrbuffer0, IOBuffer);
RtlInitUnicodeString(&usStrbuffer1, L"\\??\\");
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer1);
RtlAppendUnicodeStringToString(&usStrbuffer2, &usStrbuffer0);
OBJECT_ATTRIBUTES p = { 0 };
InitializeObjectAttributes(&p, &usStrbuffer2, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
HANDLE FileHandle = 0;
IO_STATUS_BLOCK isb = { 0 };
NTSTATUS ntstatus = ZwOpenFile(&FileHandle, GENERIC_ALL, &p, &isb, 0, FILE_SYNCHRONOUS_IO_NONALERT | FILE_NO_INTERMEDIATE_BUFFERING);
g_handle = FileHandle;
return ntstatus;
}
NTSTATUS UnProtectFileFunc(PVOID IOBuffer)
{
NTSTATUS ret = 1;
if (g_handle)
{
ret = ZwClose(g_handle);
}
return ret;
}
NTSTATUS DisPatch_DeviceControl(PDEVICE_OBJECT Device, PIRP irp)
{
NTSTATUS ntStatus = 0;
PIO_STACK_LOCATION pDeviceStack = IoGetCurrentIrpStackLocation(irp);
ULONG ControlCode = pDeviceStack->Parameters.DeviceIoControl.IoControlCode;//R3的控制码
ULONG InputLength = pDeviceStack->Parameters.DeviceIoControl.InputBufferLength;//R3->R0的输入缓冲区大小
ULONG OutPutLength = pDeviceStack->Parameters.DeviceIoControl.OutputBufferLength;//R3的接受缓冲区大小
PVOID IOBuffer = irp->AssociatedIrp.SystemBuffer;
static ULONG OutPutSize = 0;
switch (ControlCode)
{
case CTL_CREATE:
{
ntStatus = CreateFileFunc(IOBuffer);
WCHAR szbuffer[0x30] = L"CreateFile";
OutPutSize = RetNtstatus(ntStatus, szbuffer, IOBuffer, OutPutLength);
break;
}
case CTL_WRITE:
{
ntStatus = WriteFileFunc(IOBuffer);
WCHAR szbuffer[0x30] = L"WriteFile";
OutPutSize = RetNtstatus(ntStatus, szbuffer, IOBuffer, OutPutLength);
break;
}
case CTL_READ:
{
ntStatus = ReadFileFunc(IOBuffer, &OutPutSize);
break;
}
case CTL_DELETE:
{
ntStatus = DeleteFileFunc(IOBuffer);
WCHAR szbuffer[0x30] = L"DeleteFile";
OutPutSize = RetNtstatus(ntStatus, szbuffer, IOBuffer, OutPutLength);
break;
}
case CTL_COPY:
{
ntStatus = CopyFileFunc(IOBuffer);
break;
}
case CTL_MOVE:
{
ntStatus = MoveFileFunc(IOBuffer);
break;
}
case CTL_GETATTR:
{
ntStatus = GetFileFunc(IOBuffer, &OutPutSize);
break;
}
case CTL_SETATTR:
{
ntStatus = SetFileFunc(IOBuffer, &OutPutSize);
break;
}
case CTL_SETDELETE:
{
ntStatus = SetDeleteFileFunc(IOBuffer);
WCHAR szbuffer[0x30] = L"DeleteFile";
OutPutSize = RetNtstatus(ntStatus, szbuffer, IOBuffer, OutPutLength);
break;
}
case CTL_SETNAME:
{
ntStatus = SetFileNameFunc(IOBuffer);
if (Name_Flag == 1)
{
WCHAR szbuffer[0x30] = L"OpenFile";
OutPutSize = RetNtstatus(ntStatus, szbuffer, IOBuffer, OutPutLength);
}
else
{
WCHAR szbuffer[0x30] = L"SetFileName";
OutPutSize = RetNtstatus(ntStatus, szbuffer, IOBuffer, OutPutLength);
}
break;
}
case CTL_PROTECT:
{
ntStatus = ProtectFileFunc(IOBuffer);
WCHAR szbuffer[0x30] = L"Protect";
OutPutSize = RetNtstatus(ntStatus, szbuffer, IOBuffer, OutPutLength);
break;
}
case CTL_UNPROTECT:
{
ntStatus = UnProtectFileFunc(IOBuffer);
WCHAR szbuffer[0x30] = L"UnProtect";
OutPutSize = RetNtstatus(ntStatus, szbuffer, IOBuffer, OutPutLength);
break;
}
default:
break;
}
irp->IoStatus.Information = OutPutSize;//设置返回的字节数
irp->IoStatus.Status = STATUS_SUCCESS;//设置irp处理成功
IoCompleteRequest(irp, IO_NO_INCREMENT);//结束irp处理流程
return STATUS_SUCCESS;
}
NTSTATUS DisPatchFunc(PDEVICE_OBJECT Device, PIRP irp)
{
irp->IoStatus.Information = 0;//设置返回的字节数
irp->IoStatus.Status = STATUS_SUCCESS;//设置irp处理成功
IoCompleteRequest(irp, IO_NO_INCREMENT);//结束irp处理流程
return STATUS_SUCCESS;
}
NTSTATUS UnLoadFunc(PDRIVER_OBJECT pDriverObj)
{
UNICODE_STRING uLinkName = RTL_CONSTANT_STRING(LINK_NAME);//初始化符号链接名称
IoDeleteSymbolicLink(&uLinkName);//删除符号链接
IoDeleteDevice(pDriverObj->DeviceObject);//删除设备对象
DbgPrint("Unload Success");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegPath)
{
pDriverObj->DriverUnload = UnLoadFunc;
UNICODE_STRING uDeviceName = RTL_CONSTANT_STRING(DEVICE_NAME);
UNICODE_STRING uLinkName = RTL_CONSTANT_STRING(LINK_NAME);
PDEVICE_OBJECT pDeviceObject = NULL;
NTSTATUS ntStatus = IoCreateDevice(pDriverObj, 0, &uDeviceName, FILE_DEVICE_UNKNOWN, 0, TRUE, &pDeviceObject);
if (ntStatus != STATUS_SUCCESS)
{
DbgPrint("IoCreateDevice failed:%x\n", ntStatus);
return ntStatus;
}
pDeviceObject->Flags |= DO_BUFFERED_IO;
ntStatus = IoCreateSymbolicLink(&uLinkName, &uDeviceName);
if (ntStatus != STATUS_SUCCESS)
{
IoDeleteDevice(pDeviceObject);
DbgPrint("IoCreateSymbolicLink failed:%x\n", ntStatus);
return ntStatus;
}
for (size_t i = 0; i < IRP_MJ_MAXIMUM_FUNCTION + 1; i++)
{
pDriverObj->MajorFunction[i] = DisPatchFunc;
}
pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DisPatch_DeviceControl;
DbgPrint("Load Success");
return 0;
}
ULONG RetNtstatus(NTSTATUS ntStatus, WCHAR* szbuffer, PVOID IOBuffer, ULONG OutPutLength)
{
ULONG OutPutSize;
if (ntStatus == STATUS_SUCCESS)
{
WCHAR buffer[] = L" Success!";
wcscat(szbuffer, buffer);
OutPutSize = wcslen(szbuffer) * sizeof(WCHAR);
RtlZeroMemory(IOBuffer, OutPutLength);
RtlCopyMemory(IOBuffer, szbuffer, OutPutSize);
}
else
{
WCHAR buffer[] = L" Failed!";
wcscat(szbuffer, buffer);
OutPutSize = wcslen(szbuffer) * sizeof(WCHAR);
RtlZeroMemory(IOBuffer, OutPutLength);
RtlCopyMemory(IOBuffer, szbuffer, OutPutSize);
}
return OutPutSize;
}
用户代码:
#include <iostream>
#include <windows.h>
#define LINK_NAME L"\\\\.\\Goose" //符号链接名称
#define Io_Control_Code(i) CTL_CODE( FILE_DEVICE_UNKNOWN, 0x800 + i, METHOD_BUFFERED, FILE_ANY_ACCESS )
#define CTL_CREATE Io_Control_Code(0)
#define CTL_WRITE Io_Control_Code(1)
#define CTL_READ Io_Control_Code(2)
#define CTL_DELETE Io_Control_Code(3)
#define CTL_COPY Io_Control_Code(4)
#define CTL_MOVE Io_Control_Code(5)
#define CTL_GETATTR Io_Control_Code(6)
#define CTL_SETATTR Io_Control_Code(7)
#define CTL_SETDELETE Io_Control_Code(8)
#define CTL_SETNAME Io_Control_Code(9)
#define CTL_PROTECT Io_Control_Code(10)
#define CTL_UNPROTECT Io_Control_Code(11)
WCHAR InputBuffer[0x1024] = { 0 };
WCHAR OutputBuffer[0x1024] = { 0 };
typedef struct WriteData
{
WCHAR PathBuffer[MAX_PATH];
WCHAR DataBuffer[0x1024];
}WriteData,*PWriteData;
void CreateFileFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
bool ret = DeviceIoControl(hRet, CTL_CREATE, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (ret == TRUE)
{
_cwprintf(L"%s\n", OutputBuffer);
}
else
{
printf("error");
}
}
void WriteFileFunc(HANDLE hRet)
{
WriteData WriteDataObj = { 0 };
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入文件路径:");
wscanf_s(L"%s", WriteDataObj.PathBuffer, (DWORD)_countof(WriteDataObj.PathBuffer));
getwchar();
printf("输入文件数据:");
wscanf_s(L"%[^\n]", WriteDataObj.DataBuffer, (DWORD)_countof(WriteDataObj.DataBuffer));
DWORD dwRet;
bool ret = DeviceIoControl(hRet, CTL_WRITE, &WriteDataObj, sizeof(WriteDataObj), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (ret == TRUE)
{
_cwprintf(L"%s\n", OutputBuffer);
}
else
{
printf("error");
}
}
void ReadFileFunc(HANDLE hRet)
{
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入要读取文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
DeviceIoControl(hRet, CTL_READ, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (OutputBuffer == 0)
{
printf("读取错误\n");
return;
}
DWORD buffersize = dwRet;
printf("%d", dwRet);
WCHAR* readbuffer = new WCHAR[buffersize/2]{ 0 };//除于2 看看
DeviceIoControl(hRet, CTL_READ, InputBuffer, sizeof(InputBuffer), readbuffer, buffersize, &dwRet, 0);
HANDLE ret = CreateFileA("c:\\buffer.txt", GENERIC_READ | GENERIC_WRITE, 0, 0, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, 0);
DWORD NumberOfBytesWritten;
WriteFile(ret, readbuffer, buffersize, &NumberOfBytesWritten, 0);
CloseHandle(ret);
}
void DeleteFileFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入删除的文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
bool ret = DeviceIoControl(hRet, CTL_DELETE, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (ret == TRUE)
{
_cwprintf(L"%s\n", OutputBuffer);
}
else
{
printf("error");
}
}
void CopyFileFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入需要复制的源文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
bool ret = DeviceIoControl(hRet, CTL_COPY, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
ZeroMemory(InputBuffer, sizeof(InputBuffer));
getwchar();
printf("输入复制到目的文件的路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
ret = DeviceIoControl(hRet, CTL_COPY, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (ret == TRUE)
{
_cwprintf(L"%s\n", OutputBuffer);
}
else
{
printf("error");
}
}
void MoveFileFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入需要移动的源文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
bool ret = DeviceIoControl(hRet, CTL_MOVE, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
ZeroMemory(InputBuffer, sizeof(InputBuffer));
getwchar();
printf("输入移动目的的路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
ret = DeviceIoControl(hRet, CTL_MOVE, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (ret == TRUE)
{
_cwprintf(L"%s\n", OutputBuffer);
}
else
{
printf("error");
}
}
void GetFileFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入获取属性的文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
bool ret = DeviceIoControl(hRet, CTL_GETATTR, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (ret == TRUE)
{
_cwprintf(L"%s\n", OutputBuffer);
}
else
{
printf("error");
}
}
void SetFileFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入设置属性的文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
bool ret = DeviceIoControl(hRet, CTL_SETATTR, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (ret == TRUE)
{
printf("%s\n", (char*)OutputBuffer);
}
else
{
printf("error");
}
}
void SetDeleteFileFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入删除的文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
bool ret = DeviceIoControl(hRet, CTL_SETDELETE, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (ret == TRUE)
{
_cwprintf(L"%s\n", OutputBuffer);
}
else
{
printf("error");
}
}
void SetFileNameFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入重命名的文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
DeviceIoControl(hRet, CTL_SETNAME, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
if (wcsstr(OutputBuffer,L"Success"))
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
printf("输入新名称:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DeviceIoControl(hRet, CTL_SETNAME, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
}
else
{
printf("error");
}
}
void ProtectFileFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入保护的文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
DeviceIoControl(hRet, CTL_PROTECT, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
_cwprintf(L"%ls", OutputBuffer);
}
void UnProtectFileFunc(HANDLE hRet)
{
ZeroMemory(InputBuffer, sizeof(InputBuffer));
ZeroMemory(OutputBuffer, sizeof(OutputBuffer));
system("cls");
printf("输入解除保护的文件路径:");
wscanf_s(L"%ls", InputBuffer, 0x1024);
DWORD dwRet;
DeviceIoControl(hRet, CTL_UNPROTECT, InputBuffer, sizeof(InputBuffer), OutputBuffer, sizeof(OutputBuffer), &dwRet, 0);
_cwprintf(L"%ls", OutputBuffer);
}
char InitConsole()
{
system("cls");
printf(" 输入选择:\n");
printf("1.创建文件:\n");
printf("2.写入文件:\n");
printf("3.读取文件:\n");
printf("4.删除文件1:\n");
printf("5.复制文件:\n");
printf("6.移动文件:\n");
printf("7.获取属性:\n");
printf("8.设置属性:\n");
printf("9.删除文件2:\n");
printf("a.重命名:\n");
printf("b.伪保护文件:\n");
printf("c.卸载伪保护:\n");
printf("0.退出程序:\n");
return getchar();
}
int main()
{
HANDLE hRet = CreateFile(LINK_NAME, GENERIC_ALL, NULL, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hRet == INVALID_HANDLE_VALUE)
{
printf("CreateFile failed:%x\n", GetLastError());
system("pause");
return 0;
}
char Index;
while (true)
{
Index = InitConsole();
switch (Index)
{
case '0':
return 0;
case '1':
CreateFileFunc(hRet);
system("pause");
break;
case '2':
WriteFileFunc(hRet);
system("pause");
break;
case '3':
ReadFileFunc(hRet);
system("pause");
break;
case '4':
DeleteFileFunc(hRet);
system("pause");
break;
case '5':
CopyFileFunc(hRet);
system("pause");
break;
case '6':
MoveFileFunc(hRet);
system("pause");
break;
case '7':
GetFileFunc(hRet);
system("pause");
break;
case '8':
SetFileFunc(hRet);
system("pause");
break;
case '9':
SetDeleteFileFunc(hRet);
system("pause");
break;
case 'a':
SetFileNameFunc(hRet);
system("pause");
break;
case 'b':
ProtectFileFunc(hRet);
system("pause");
break;
case 'c':
UnProtectFileFunc(hRet);
system("pause");
break;
default:
break;
}
}
return 0;
}