Windows内核编程基础篇之文件操作(一)

ゝ一世哀愁。 2022-08-04 14:42 246阅读 0赞

使用OBJECT\_ATTRIBUTES

通常来讲，打开文件应该传入文件的路径。但是内核并不接受这一字符串，使用者必须填写一个 OBJECT\_ATTRIBUTES结构。这个结构是非透明的。但是这个结构体 被函数 InitializeObjectAttributes初始化。

下面是对 InitializeObjectAttributes 说明。

函数原型：

VOID InitializeObjectAttributes(
      [out]          POBJECT_ATTRIBUTES   InitializedAttributes,
      [in]           PUNICODE_STRING      ObjectName,
      [in]           ULONG                Attributes,
      [in]           HANDLE               RootDirectory,
      [in, optional] PSECURITY_DESCRIPTOR SecurityDescriptor
    );

函数参数说明：

InitializedAttributes \[out\]  ： 指定 InitializedAttributes 结构体初始化

ObjectName \[in\]  : 一个指向包含该句柄是要打开的对象的名称的UNICODE\_STRING 字符串，这必须是一个完全路径对象的名称，或者有 RootDirectory 参数指定的对象目录的相对路径名。

Attributes \[in\]  ：一个或者多个标志，标志如下:

OBJ_INHERIT
    This handle can be inherited by child processes of the current process.
    OBJ_PERMANENT
    This flag only applies to objects that are named within the object manager. By default, such objects are deleted when all open handles to them are closed. If this flag is specified, the object is not deleted when all open handles are closed. Drivers can use ZwMakeTemporaryObject to delete permanent objects.
    OBJ_EXCLUSIVE
    Only a single handle can be open for this object.
    OBJ_CASE_INSENSITIVE
    If this flag is specified, a case-insensitive comparison is used when matching the ObjectName parameter against the names of existing objects. Otherwise, object names are compared using the default system settings.
    OBJ_OPENIF
    If this flag is specified to a routine that creates objects, and that object already exists then the routine should open that object. Otherwise, the routine creating the object returns an NTSTATUS code of STATUS_OBJECT_NAME_COLLISION.
    OBJ_KERNEL_HANDLE
    Specifies that the handle can only be accessed in kernel mode.
    OBJ_FORCE_ACCESS_CHECK
    The routine opening the handle should enforce all access checks for the object, even if the handle is being opened in kernel mode.

RootDirectory \[in\]  : 这是个句柄，为用在ObjectName参数指定的路径的根对象目录。如果 ObjectName 为一个完整的对象名称， RootDirectory 为NULL。使用 ZwCreateDirectoryObject 以获取对象的根目录。

SecurityDescriptor \[in, optional\] :当一个对象被创建时用于描述该对象安全的描述符。该参数是可选的，我们可以指定NULL以接受对象的默认安全性。  
 续.........~~~~~~~~~~~~