强删文件--->构建IRP---->独占--->正在运行以及磁盘读写(思路)

最新推荐文章于 2022-04-28 11:44:06 发布

zhuhuibeishadiao

最新推荐文章于 2022-04-28 11:44:06 发布

阅读量2.9k

点赞数 2

分类专栏：驱动学习文章标签：文件操作内核函数强删文件 XCB

本文链接：https://blog.csdn.net/zhuhuibeishadiao/article/details/51046595

版权

本文介绍了如何在Windows内核编程中构建IRP来删除文件，详细阐述了IRP的构建过程，包括获取设备对象、设置IRP头信息、填充功能号和次功能号等。同时，文章提及了磁盘读写操作的思路，特别是利用DeviceIoControl锁定逻辑分区以允许WriteFile写扇区，但并未深入探讨NTFS细节。此外，还提到了硬链接和软链接的概念及其区别。

摘要由CSDN通过智能技术生成

个人比较崇拜360 一个小小的按钮下面蕴含着很多的原理要有多么强大才能1天搞定偏移
-------致敬360 致敬MJ-001
无奈本人学业不精只能说说“独占”和“正在运行”
打开文件一般使用ZwCreateFile NtCreateFile 但这些函数还不够底层使用IoCreateFile会好一些
被其它程序独占
枚举句柄表 ZwQuerySystemInformation --->复制句柄 ZwDuplicateObject --->ZwClose 然后再ZwDuplicateObject 一次这次使用DUPLICATE_CLOSE_SOURCE -->ZwClose

正在运行这个涉及构建IRP 最下面会说
将ImageSectionObject 和 DataSectionObject设为0就可以解决了

 NtfsSetDispositionInfoMmFlushImageSection
 pSectionObjectPointer = fileObject->SectionObjectPointer;
 pSectionObjectPointer->ImageSectionObject = 0;
 pSectionObjectPointer->DataSectionObject = 0;

核心代码代码:

 NTSTATUS
dfSkillSetFileCompletion(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp,
    IN PVOID Context
    )
{
    Irp->UserIosb->Status = Irp->IoStatus.Status;
    Irp->UserIosb->Information = Irp->IoStatus.Information;

    KeSetEvent(Irp->UserEvent, IO_NO_INCREMENT, FALSE);

    IoFreeIrp(Irp);

    return STATUS_MORE_PROCESSING_REQUIRED;
}

BOOLEAN dfDelFile(WCHAR* name)
{
    NTSTATUS        ntStatus = STATUS_SUCCESS;
    PFILE_OBJECT    fileObject;
    PDEVICE_OBJECT  DeviceObject;
    PIRP            Irp;
    KEVENT          event;
    FILE_DISPOSITION_INFORMATION  FileInformation;
    IO_STATUS_BLOCK ioStatus;
    PIO_STACK_LOCATION irpSp;
    PSECTION_OBJECT_POINTERS pSectionObjectPointer;
    HANDLE handle;

    ntStatus = dfOpenFile(name, &handle, FILE_READ_ATTRIBUTES|DELETE,FILE_SHARE_DELETE);
	if (ntStatus == STATUS_OBJECT_NAME_NOT_FOUND ||
		ntStatus == STATUS_OBJECT_PATH_NOT_FOUND )
	{
		KdPrint(("No such file"));
		return FALSE;
	}
	else if (!NT_SUCCESS(ntStatus))
	{
		if (dfCloseFileHandle(name))
		{
			ntStatus = dfOpenFile(name, &handle, FILE_READ_ATTRIBUTES|DELETE,FILE_SHARE_DELETE);
			if (!NT_SUCCESS(ntStatus))
				return FALSE;
		}
		else
		{
			return FALSE;
		}
	}

    ntStatus = ObReferenceObjectByHandle(handle,
        DELETE,
        *IoFileObjectType,
        KernelMode,
        &fileObject,
        NULL);

    if (!NT_SUCCESS(ntStatus))
    {
    	DbgPrint("ObReferenceObjectByHandle()");
		ZwClose(handle);
        return FALSE;
    }  

    DeviceObject = IoGetRelatedDeviceObject(fileObject);
    Irp = IoAllocateIrp(DeviceObject->StackSize, TRUE);

    if (Irp == NULL)
    {
        ObDereferenceObject(fileObject);
		ZwClose(handle);
        return FALSE;
    }

    KeInitializeEvent(&event, SynchronizationEvent, FALSE);
   
    FileInformation.DeleteFile = TRUE;

    Irp->AssociatedIrp.SystemBuffer = &FileInformation;
    Irp->UserEvent = &event;
    Irp->UserIosb = &ioStatus;
    Irp->Tail.Overlay.OriginalFileObject = fileObject;
    Irp->Tail.Overlay.Thread = (PETHREAD)KeGetCurrentThread();
    Irp->RequestorMode = KernelMode;
   
    irpSp = IoGetNextIrpStackLocation(Irp);
    irpSp->MajorFunction = IRP_MJ_SET_INFORMATION;
    irpSp->DeviceObject = DeviceObject;
    irpSp->FileObject = fileObject;
    irpSp->Parameters.SetFile.Length = sizeof(FILE_DISPOSITION_INFORMATION);
    irpSp->Parameters.SetFile.FileInformationClass = FileDispositionInformation;
    irpSp->Parameters.SetFile.FileObject = fileObject;

    IoSetCompletionRoutine(
            Irp,
            dfSkillSetFileCompletion,
            &event,
            TRUE,
            TRUE,
            TRUE);
    pSectionObjectPointer = fileObject->SectionObjectPointer;
    if(pSectionObjectPointer)
	{
		pSectionObjectPointer->ImageSectionObject = 0;
		pSectionObjectPointer->DataSectionObject = 0;
	}
    ntStatus = IoCallDriver(DeviceObject, Irp); 
    if (!NT_SUCCESS(ntStatus))
    {
    	 ObDereferenceObject(fileObject);
		 ZwClose(handle);
         return FALSE;
    }  

    KeWaitForSingleObject(&event, Executive, KernelMode, TRUE, NULL);
	//IoFreeIrp(Irp);
    ObDereferenceObject(fileObject);
    ZwClose(handle);
    return TRUE;

}

整个工程代码:

DelFile.c

#include <ntddk.h>
#include <ntimage.h>
#include <ntdef.h>
#include "DelFile.h"

PDEVICE_OBJECT	g_HookDevice;


NTSTATUS dfQuerySymbolicLink(
	IN PUNICODE_STRING SymbolicLinkName,
	OUT PUNICODE_STRING LinkTarget
	)                                  
{
    OBJECT_ATTRIBUTES oa;
    NTSTA