内核里操作文件

我不是女神ヾ 2021-09-30 05:58 221阅读 0赞

# 内核里操作文件 #

RING0 操作文件和 RING3 操作文件在流程上没什么大的区别，也是“获得文件句柄->读/写/删/改->关闭文件句柄”的模式。当然了，只能用内核 API，不能用 WIN32API。在讲解具体的代码之前，先讲解一下文件系统的流程，让大家对整个文件系统有个大概的了解。

假设我们要读写一个文件，无论在 RING3 调用 ReadFile，还是在 RING0 调用 NtReadFile，它们最终会转换为 IRP，发送到 文件系统驱动（具体哪个驱动和分区类型相关，如果是 FAT32分区，则是 FASTFAT.SYS；如果是 NTFS 分区，则是 NTFS.SYS）的 IRP\_MJ\_READ 分发函数里。文件系统驱动经过一定处理后，就把 IRP 传给 磁盘类驱动（通常是 CLASSPNP.SYS，此驱动的源码在 WDK 里有）的 IRP\_MJ\_READ 分发函数处理。磁盘类驱动处理完毕后，又把 IRP 传给磁盘小端口驱动的 IRP\_MJ\_SCSI 分发函数处理。 磁盘小端口 驱动太多了，网上有人 用ATAPI.SYS  来指代 磁盘 小端口驱动，是极端错误的说法。ATAPI.SYS 是磁盘小端口驱动，但磁盘小端口驱动绝非只能是 ATAPI.SYS，常见的磁盘小端口驱动还有 LSI\_SAS.SYS 等。如果安装了芯片组驱动，磁盘小端口驱动通常会被替换成主板厂商的驱动。比安装了英特尔 P67、HM77 的芯片组驱动后，磁盘小端口驱动就会变成 iaStroV.sys。在磁盘小端口驱动里，无论是读还是写，用的都是 IRP\_MJ\_SCSI 的分发函数。IRP  被磁盘小端口驱动处理完 之后 ， 就要靠 依靠 HAL.DLL  进行口 端口 IO ， 此时数据就真的从硬盘里读取了出来。接下来再按照相反的方向把数据返回到调用者。另外，在内核里，文件夹和文件没啥本质的区别。比如 ZwDeleteFile既可以删除文件，也可以删除文件夹。接下来举几个例子，让大家了解内核里读写、删除、重命名和枚举文件，以及获取文件信息。

1.文件拷贝
    BOOLEAN ZwCopyFiles
    (
    IN PUNICODE_STRING ustrDestFile, // \??\c:\1.txt
    IN PUNICODE_STRING ustrSrcFile // \??\c:\0.txt
    )
    {
     
    DbgPrint("UnicodeString:%wZ\n", ustrDestFile);
    DbgPrint("UnicodeString:%wZ\n", ustrSrcFile);
    HANDLE hSrcFile = NULL, hDestFile = NULL;
    PVOID buffer = NULL;
    ULONG length = 0;
    LARGE_INTEGER offset = { 0 };
    IO_STATUS_BLOCK Io_Status_Block = { 0 };
    OBJECT_ATTRIBUTES obj_attrib;
    NTSTATUS status;
    BOOLEAN bRet = FALSE;
    do
    {
    // 打开源文件
    InitializeObjectAttributes(&obj_attrib,
    ustrSrcFile,
    OBJ_CASE_INSENSITIVE |
    OBJ_KERNEL_HANDLE,
    NULL,
    NULL);
    status = ZwCreateFile(&hSrcFile,
    GENERIC_READ,
    &obj_attrib,
    &Io_Status_Block,
    NULL,
    FILE_ATTRIBUTE_NORMAL,
    FILE_SHARE_READ,
    FILE_OPEN,
    FILE_NON_DIRECTORY_FILE |
    FILE_SYNCHRONOUS_IO_NONALERT,
    NULL,
    0);
    if (!NT_SUCCESS(status))
    {
    DbgPrint("[KrnlHW64]Yuan Wen Jian 2333333333333\n");
    bRet = FALSE;
    goto END;
    }
    // 打开目标文件
    InitializeObjectAttributes(&obj_attrib,
    ustrDestFile,
    OBJ_CASE_INSENSITIVE |
    OBJ_KERNEL_HANDLE,
    NULL,
    NULL);
    status = ZwCreateFile(&hDestFile,
    GENERIC_WRITE,
    &obj_attrib,
    &Io_Status_Block,
    NULL,
    FILE_ATTRIBUTE_NORMAL,
    FILE_SHARE_READ,
    FILE_OPEN_IF,
    FILE_NON_DIRECTORY_FILE |
    FILE_SYNCHRONOUS_IO_NONALERT,
    NULL,
    0);
    if (!NT_SUCCESS(status))
    {
    bRet = FALSE;
    goto END;
    }
    // 为 buffer 分配 4KB 空间
    buffer = ExAllocatePool(NonPagedPool, 1024 * 4);
    if (buffer == NULL)
    {
    bRet = FALSE;
    goto END;
    }
    // 复制文件
    while (1)
    {
    length = 4 * 1024;
    // 读取源文件
    status = ZwReadFile(hSrcFile,
    NULL,
    NULL,
    NULL,
    &Io_Status_Block,
    buffer,
    length,
    &offset,
    NULL);
    if (!NT_SUCCESS(status))
    {
    // 如果状态为 STATUS_END_OF_FILE，说明文件已经读取到末尾
    if (status == STATUS_END_OF_FILE)
    {
    bRet = TRUE;
    goto END;
    }
    }
    // 获得实际读取的长度
    length = (ULONG)Io_Status_Block.Information;
    // 写入到目标文件
    status = ZwWriteFile(hDestFile,
    NULL,
    NULL,
    NULL,
    &Io_Status_Block,
    buffer,
    length,
    &offset,
    NULL);
    if (!NT_SUCCESS(status))
    {
    bRet = FALSE;
    goto END;
    }
    // 移动文件指针
    offset.QuadPart += length;
    }
    } while (0);
    END:
    if (hSrcFile)
    {
    ZwClose(hSrcFile);
    }
    if (hDestFile)
    {
    ZwClose(hDestFile);
    }
    if (buffer != NULL)
    {
    ExFreePool(buffer);
    }
    return bRet;
    }
     
    VOID Test() {
    UNICODE_STRING UnicodeString1 = { 0 };
    RtlInitUnicodeString(&UnicodeString1, L"\\??\\c:\\a.dat");
    UNICODE_STRING UnicodeString2 = { 0 };
    RtlInitUnicodeString(&UnicodeString2, L"\\??\\c:\\b.dat");
    ZwCopyFiles(&UnicodeString1, &UnicodeString2);
    }
     
    2.删除文件/文件夹
    void ZwDeleteFileFolder(WCHAR *wsFileName)
    {
    NTSTATUS st;
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING UniFileName;
    //把 WCHAR*转化为 UNICODE_STRING
    RtlInitUnicodeString(&UniFileName, wsFileName);
    //设置包 OBJECT 对象并使用 ZwDeleteFile 删除
    InitializeObjectAttributes(&ObjectAttributes,
    &UniFileName,
    OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
    NULL,
    NULL);
    st = ZwDeleteFile(&ObjectAttributes);
    }
     
    3.文件/文件夹重命名
    /**
    typedef struct _FILE_RENAME_INFORMATION
    {
    BOOLEAN ReplaceIfExists;
    HANDLE RootDirectory;
    ULONG FileNameLength;
    WCHAR FileName[1];
    } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
    */
    NTSTATUS
    ZwRenameFile
    (
    IN PWSTR SrcFileName, // \??\x:\xxx\...\xxx.xxx
    IN PWSTR DstFileName // \??\x:\xxx\...\xxx.xxx
    )
    {
    #define RN_MAX_PATH 2048
    #define SFLT_POOL_TAG 'fuck'
    HANDLE FileHandle = NULL;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatus;
    NTSTATUS Status;
    PFILE_RENAME_INFORMATION RenameInfo = NULL;
    UNICODE_STRING ObjectName;
    //设置重命名的信息
    RenameInfo = (PFILE_RENAME_INFORMATION)ExAllocatePoolWithTag(NonPagedPool,
    sizeof(FILE_RENAME_INFORMATION) + RN_MAX_PATH * sizeof(WCHAR), SFLT_POOL_TAG);
    if (RenameInfo == NULL)
    {
    return STATUS_INSUFFICIENT_RESOURCES;
    }
    RtlZeroMemory(RenameInfo, sizeof(FILE_RENAME_INFORMATION) + RN_MAX_PATH *
    sizeof(WCHAR));
    RenameInfo->FileNameLength = wcslen(DstFileName) * sizeof(WCHAR);
    wcscpy(RenameInfo->FileName, DstFileName);
    RenameInfo->ReplaceIfExists = 0;
    RenameInfo->RootDirectory = NULL;
    //设置源文件信息并获得句柄
    RtlInitUnicodeString(&ObjectName, SrcFileName);
    InitializeObjectAttributes(&ObjectAttributes,
    &ObjectName,
    OBJ_CASE_INSENSITIVE,
    NULL,
    NULL);
    Status = ZwCreateFile(&FileHandle,
    SYNCHRONIZE | DELETE,
    &ObjectAttributes,
    &IoStatus,
    NULL,
    0,
    FILE_SHARE_READ,
    FILE_OPEN,
    FILE_SYNCHRONOUS_IO_NONALERT |
    FILE_NO_INTERMEDIATE_BUFFERING,
    NULL,
    0);
    if (!NT_SUCCESS(Status))
    {
    ExFreePoolWithTag(RenameInfo, SFLT_POOL_TAG);
    return Status;
    }
    //最关键一步，利用 ZwSetInformationFile 来设置文件信息
    Status = ZwSetInformationFile(FileHandle,
    &IoStatus,
    RenameInfo,
    sizeof(FILE_RENAME_INFORMATION) +
    RN_MAX_PATH * sizeof(WCHAR),
    FileRenameInformation);
    if (!NT_SUCCESS(Status))
    {
    ExFreePoolWithTag(RenameInfo, SFLT_POOL_TAG);
    ZwClose(FileHandle);
    return Status;
    }
    ZwClose(FileHandle);
    return Status;
    }
     
    4.获取文件大小
    //这里传入的是文件句柄不是文件名，大家尝试把这里改成传入文件名
    ULONG64 GetFileSize(HANDLE hfile)
    {
    IO_STATUS_BLOCK iostatus = { 0 };
    NTSTATUS ntStatus = 0;
    FILE_STANDARD_INFORMATION fsi = { 0 };
    ntStatus = ZwQueryInformationFile(hfile,
    &iostatus,
    &fsi,
    sizeof(FILE_STANDARD_INFORMATION),
    FileStandardInformation);
    if (!NT_SUCCESS(ntStatus))
    return 0;
    return fsi.EndOfFile.QuadPart;
    }
    
    5.枚举文件（RING3 的 FindFirstFile 和 FindNextFile 内部就是用 ZwQueryDirectoryFile 实现的，为了方便大家以后抄代码，我就把 ZwQueryDirectoryFile 封装成了 RING0 版的 FindFirstFile 和FindNextFile）：
    NTKERNELAPI NTSTATUS ZwQueryDirectoryFile //最关键的 API
    (
    HANDLE FileHandle,
    HANDLE Event,
    PIO_APC_ROUTINE ApcRoutine,
    PVOID ApcContext,
    PIO_STATUS_BLOCK IoStatusBlock,
    PVOID FileInformation,
    ULONG Length,
    FILE_INFORMATION_CLASS FileInformationClass,
    BOOLEAN ReturnSingleEntry,
    PUNICODE_STRING FileName,
    BOOLEAN RestartScan
    );
    //几个常量
    #define INVALID_HANDLE_VALUE (HANDLE)-1
    #define MAX_PATH2 4096
    #define kmalloc(_s) ExAllocatePoolWithTag(NonPagedPool, _s, 'SYSQ')
    #define kfree(_p) ExFreePool(_p)
    /*
    //枚举文件用到的结构体
    typedef struct _FILE_BOTH_DIR_INFORMATION
    {
    ULONG NextEntryOffset;
    ULONG FileIndex;
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    LARGE_INTEGER EndOfFile;
    LARGE_INTEGER AllocationSize;
    ULONG FileAttributes;
    ULONG FileNameLength;
    ULONG EaSize;
    CCHAR ShortNameLength;
    WCHAR ShortName[12];
    WCHAR FileName[1];
    } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
    */
    //山寨版 MyFindFirstFile
    HANDLE  MyFindFirstFile(LPSTR  lpDirectory, PFILE_BOTH_DIR_INFORMATION  pDir, ULONG
    uLength)
    {
    char strFolder[MAX_PATH2] = { 0 };
    STRING astrFolder;
    UNICODE_STRING ustrFolder;
    OBJECT_ATTRIBUTES oa;
    IO_STATUS_BLOCK ioStatus;
    NTSTATUS ntStatus;
    HANDLE hFind = INVALID_HANDLE_VALUE;
    memset(strFolder, 0, MAX_PATH2);
    strcpy(strFolder, "\\??\\");
    strcat(strFolder, lpDirectory);
    RtlInitString(&astrFolder, strFolder);
    if (RtlAnsiStringToUnicodeString(&ustrFolder, &astrFolder, TRUE) == 0)
    {
    InitializeObjectAttributes(&oa, &ustrFolder, OBJ_CASE_INSENSITIVE, NULL, NULL);
    ntStatus = IoCreateFile(
    &hFind,
    FILE_LIST_DIRECTORY | SYNCHRONIZE | FILE_ANY_ACCESS,
    &oa,
    &ioStatus,
    NULL,
    FILE_ATTRIBUTE_NORMAL,
    FILE_SHARE_READ | FILE_SHARE_WRITE,
    FILE_OPEN,  //FILE_OPEN
    FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT |
    FILE_OPEN_FOR_BACKUP_INTENT,
    NULL,
    0,
    CreateFileTypeNone,
    NULL,
    IO_NO_PARAMETER_CHECKING);
    RtlFreeUnicodeString(&ustrFolder);
    if (ntStatus == 0 && hFind != INVALID_HANDLE_VALUE)
    {
    ntStatus = ZwQueryDirectoryFile(
    hFind, // File Handle
    NULL, // Event
    NULL, // Apc routine
    NULL, // Apc context
    &ioStatus, // IoStatusBlock
    pDir, // FileInformation
    uLength, // Length
    FileBothDirectoryInformation, // FileInformationClass
    TRUE, // ReturnSingleEntry
    NULL, // FileName
    FALSE //RestartScan
    );
    if (ntStatus != 0)
    {
    ZwClose(hFind);
    hFind = INVALID_HANDLE_VALUE;
    }
    }
    }
    return hFind;
    }
    //山寨版 MyFindNextFile
    BOOLEAN MyFindNextFile(HANDLE hFind, PFILE_BOTH_DIR_INFORMATION pDir, ULONG
    uLength)
    {
    IO_STATUS_BLOCK ioStatus;
    NTSTATUS ntStatus;
    ntStatus = ZwQueryDirectoryFile(
    hFind, // File Handle
    NULL, // Event
    NULL, // Apc routine
    NULL, // Apc context
    &ioStatus, // IoStatusBlock
    pDir, // FileInformation
    uLength, // Length
    FileBothDirectoryInformation, // FileInformationClass
    FALSE, // ReturnSingleEntry
    NULL, // FileName
    FALSE //RestartScan
    );
    if (ntStatus == 0)
    return TRUE;
    else
    return FALSE;
    }
    //枚举文件夹内容的函数，输入路径，返回目录下的文件和文件夹数目
    ULONG SearchDirectory(LPSTR lpPath)
    {
    ULONG muFileCount = 0;
    HANDLE hFind = INVALID_HANDLE_VALUE;
    PFILE_BOTH_DIR_INFORMATION pDir;
    char *strBuffer = NULL, *lpTmp = NULL;
    char strFileName[255 * 2];
    ULONG uLength = MAX_PATH2 * 2 + sizeof(FILE_BOTH_DIR_INFORMATION);
    strBuffer = (PCHAR)kmalloc(uLength);
    pDir = (PFILE_BOTH_DIR_INFORMATION)strBuffer;
    hFind = MyFindFirstFile(lpPath, pDir, uLength);
    if (hFind != INVALID_HANDLE_VALUE)
    {
    kfree(strBuffer);
    uLength = (MAX_PATH2 * 2 + sizeof(FILE_BOTH_DIR_INFORMATION)) * 0x2000;
    strBuffer = (PCHAR)kmalloc(uLength);
    pDir = (PFILE_BOTH_DIR_INFORMATION)strBuffer;
    if (MyFindNextFile(hFind, pDir, uLength))
    {
    while (TRUE)
    {
    memset(strFileName, 0, 255 * 2);
    memcpy(strFileName, pDir->FileName, pDir->FileNameLength);
    if (strcmp(strFileName, "..") != 0 && strcmp(strFileName, ".") != 0)
    {
    if (pDir->FileAttributes & FILE_ATTRIBUTE_DIRECTORY)
    {
    DbgPrint("[目录]%S\n", strFileName);
    }
    else
    {
    DbgPrint("[文件]%S\n", strFileName);
    }
    muFileCount++;
    }
    if (pDir->NextEntryOffset == 0) break;
    pDir = (PFILE_BOTH_DIR_INFORMATION)((char
    *)pDir + pDir->NextEntryOffset);
    }
    kfree(strBuffer);
    }
    ZwClose(hFind);
    }
    return muFileCount;
    }
    
    6.创建文件夹（其实用 IoCreateFile 也能实现 ZwCreateFile 的功能，ZwCreateFile 不过是
    IoCreateFile 的 stub 而已。下面利用 IoCreateFile 创建文件夹）
     
    void ZwCreateFolder(char *FolderPath)
    {
    NTSTATUS st;
    HANDLE FileHandle;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
    UNICODE_STRING UniFileName;
    WCHAR wsFileName[2048] = { 0 };
    CharToWchar(FolderPath, wsFileName);
    RtlInitUnicodeString(&UniFileName, wsFileName);
    InitializeObjectAttributes(&ObjectAttributes,
    &UniFileName,
    OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
    NULL,
    NULL);
    st = IoCreateFile(&FileHandle,
    GENERIC_READ,
    &ObjectAttributes,
    &IoStatusBlock,
    0,
    FILE_ATTRIBUTE_NORMAL,
    0,
    FILE_CREATE,
    FILE_DIRECTORY_FILE,
    NULL,
    0,
    0,
    NULL,
    IO_NO_PARAMETER_CHECKING);
    if (NT_SUCCESS(st))
    ZwClose(FileHandle);
    }

最后总结一下几个常见的、和文件相关的 Zw 函数的功能：

![Center][]

转载于:https://www.cnblogs.com/mayingkun/p/7764628.html

[Center]: /images/20210725/b2f90f71567b4206ad5033ffc5d8b14b.png