文件操作

文件的表示

应用层：”c:\\hi.txt”
内核：L”\\??\\c:\\hi.txt”//??实际上是个符号链接,连接的是卷设备名称->\\device\\harddiskvolume3\\hi.txt
R3:
设备名：L”\\\\.\\xxxDrv”
R0
设备名：”\\device\\xxxDrv”
符号连接名：”\\dosdevices\\xxxDrv”或\\??\\xxxDrv

常用API

ZwCreateFile //集创建文件 文件夹 打开 
ZwWriteFile 
ZwReadFile
ZwQueryInformationFile  //查询文件信息
ZwQueryFullAttributesFile //查询文件属性 比如是不是文件 文件夹
ZwSetInformationFile //设置文件
ZwClose
ZwQueryDirectoryFile //枚举文件

ZwCreateFile(
	&hFile, //文件句柄
	GENERIC_WRITE,//写打开
	&objAttrib,//文件路径 
	&io_status, 
	NULL, 
	FILE_ATTRIBUTE_NORMAL,//普通文件，不是文件夹
	FILE_SHARE_READ | FILE_SHARE_WRITE |FILE_SHARE_DELETE, //非独占
	FILE_OPEN_IF,//如果没有新建
	FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE, //非文件夹
	NULL, 
	0);

ZwReadFile (                                             
        hSrcFile, 
        NULL,
        NULL,
        NULL,                    
        &io_status,
        buffer, 
        PAGE_SIZE,//长度
        &offset,//偏移
        NULL
        );

ZwWriteFile(
        hDstFile,
        NULL,
        NULL,
        NULL,
        &io_status,
        buffer,
        length,
        &offset,
	NULL
	);

 

ZwQueryInformationFile(
		handle, 
		&iosb,
		&basicInfo,
		sizeof(basicInfo),
		FileBasicInformation//FileBasicInformation查询设置文件基本信息
                                    //FileStandardInformation
                                    //FileDispositionInformation
                                    //FilePositionInformation
                                    //FileRenameInformation
		);

 
ZwSetInformationFile(
	handle, 
	&iosb,
        &basicInfo,
        sizeof(basicInfo),
        FileBasicInformation
	);

typedef struct _FILE_BASIC_INFORMATION {
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    ULONG FileAttributes;
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;

 

 

typedef struct 
_FILE_STANDARD_INFORMATION {
    LARGE_INTEGER AllocationSize;//占有磁盘空间大小
    LARGE_INTEGER EndOfFile;//文件大小
    ULONG NumberOfLinks;
    BOOLEAN DeletePending;
    BOOLEAN Directory;
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;

 

 

typedef struct _FILE_POSITION_INFORMATION {//文件读写指针的位置
    LARGE_INTEGER CurrentByteOffset;
} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;

 

typedef struct _FILE_RENAME_INFORMATION {   
	BOOLEAN ReplaceIfExists;    
	HANDLE RootDirectory;    
	ULONG FileNameLength;    
	WCHAR FileName[1];
}FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;

 

 

typedef struct _FILE_NETWORK_OPEN_INFORMATION {
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    LARGE_INTEGER AllocationSize;
    LARGE_INTEGER EndOfFile;
    ULONG FileAttributes;//文件夹还是文件
} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;

 

 

typedef struct _FILE_DISPOSITION_INFORMATION {//删除文件
    BOOLEAN DeleteFile;
} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;