C语言在用户模式使用NT函数

拼搏现实的明天。 2022-06-09 11:16 195阅读 0赞

C语言要使用NT函数并不像使用库函数那么简单，下面介绍一下使用方法，以NtSetInformationFile为例：

#include <windows.h>
    #include <stdio.h>
    
    //因为NtSetInformationFile方法要用到FILE_INFORMATION_CLASS的值，所以这里全部枚举出来
    //当然你也可以直接使用1,2,3,这样值代替，只是这样定义以后在后面使用更接近使用一般函数一些。
    typedef enum _FILE_INFORMATION_CLASS {
        FileDirectoryInformation = 1,
        FileFullDirectoryInformation,
        FileBothDirectoryInformation,
        FileBasicInformation,
        FileStandardInformation,
        FileInternalInformation,
        FileEaInformation,
        FileAccessInformation,
        FileNameInformation,
        FileRenameInformation,
        FileLinkInformation,
        FileNamesInformation,
        FileDispositionInformation,
        FilePositionInformation,
        FileFullEaInformation,
        FileModeInformation,
        FileAlignmentInformation,
        FileAllInformation,
        FileAllocationInformation,
        FileEndOfFileInformation,
        FileAlternateNameInformation,
        FileStreamInformation,
        FilePipeInformation,
        FilePipeLocalInformation,
        FilePipeRemoteInformation,
        FileMailslotQueryInformation,
        FileMailslotSetInformation,
        FileCompressionInformation,
        FileObjectIdInformation,
        FileCompletionInformation,
        FileMoveClusterInformation,
        FileQuotaInformation,
        FileReparsePointInformation,
        FileNetworkOpenInformation,
        FileAttributeTagInformation,
        FileTrackingInformation,
        FileIdBothDirectoryInformation,
        FileIdFullDirectoryInformation,
        FileValidDataLengthInformation,
        FileShortNameInformation,
        FileIoCompletionNotificationInformation,
        FileIoStatusBlockRangeInformation,
        FileIoPriorityHintInformation,
        FileSfioReserveInformation,
        FileSfioVolumeInformation,
        FileHardLinkInformation,
        FileProcessIdsUsingFileInformation,
        FileNormalizedNameInformation,
        FileNetworkPhysicalNameInformation,
        FileIdGlobalTxDirectoryInformation,
        FileIsRemoteDeviceInformation,
        FileAttributeCacheInformation,
        FileNumaNodeInformation,
        FileStandardLinkInformation,
        FileRemoteProtocolInformation,
        FileMaximumInformation
    } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
    
    typedef struct _IO_STATUS_BLOCK {
        union {
            NTSTATUS Status;
            PVOID    Pointer;
        };
        ULONG_PTR Information;
    } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
    
    typedef struct _FILE_DISPOSITION_INFORMATION {
        BOOLEAN DeleteFile;
    } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
    
    //声明一个与NtSetInformationFile一样的方法，这些方法参数可以参考MSDN
    typedef NTSTATUS(__stdcall *NtSetInformationFile)(
        HANDLE FileHandle,
        PIO_STATUS_BLOCK IoStatusBlock,
        PVOID FileInformation,
        ULONG Length,
        FILE_INFORMATION_CLASS FileInformationClass
        );
    
    int main()
    {
        FILE_DISPOSITION_INFORMATION  fi = { 1 };
        IO_STATUS_BLOCK bs = { 0 };
        //想要删除文件，必须要有delete权限，即STANDARD_RIGHTS_ALL，DELETE
        //HANDLE hfile = CreateFileA("c:\\Hello.txt", GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
        HANDLE hfile = CreateFileA("c:\\Hello.txt", STANDARD_RIGHTS_ALL, 0, NULL, OPEN_EXISTING, 0, NULL);
        //HANDLE hfile = CreateFileA("c:\\Hello.txt", DELETE, 0, NULL, OPEN_EXISTING, 0, NULL);
        if (hfile == INVALID_HANDLE_VALUE)
        {
            printf("open file failed !");
    
        }
        //获取NtSetInformationFile
        NtSetInformationFile ntSetInformationFile;
        ntSetInformationFile = (NtSetInformationFile)GetProcAddress(LoadLibrary(L"ntdll.dll"), "NtSetInformationFile");
        //使用NtSetInformationFile，参数如果本地没有，就自己声明定义就自己填上，方法和NtSetInformationFile是一样的
        ntSetInformationFile(hfile, &bs, &fi, 1, FileDispositionInformation);//handle要有删除权限
        CloseHandle(hfile);
    
        getchar();
        return 0;
    }