unit FileWorks;
interface
uses
nt_status, ntoskrnl, ntifs, native, winioctl, fcall, macros;
function _DriverEntry(pDriverObject:PDRIVER_OBJECT;
pusRegistryPath:PUNICODE_STRING): NTSTATUS; stdcall;
implementation
var
g_usDirName: UNICODE_STRING;
g_usFileName: UNICODE_STRING;
procedure CreateDirectory;
var
oa: OBJECT_ATTRIBUTES;
iosb: IO_STATUS_BLOCK;
hDirectory: THANDLE;
RtnCode: NTSTATUS;
begin
{ 还记得吧, 传递给DbgPrint函数的用于格式化Unicode的代码(%C, %S, %lc, %ls, %wc, %ws, %wZ)只能在
IRQL = PASSIVE_LEVEL下调用! }
DbgPrint(
InitializeObjectAttributes(oa, @g_usDirName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwCreateFile(@hDirectory, SYNCHRONIZE, @oa, @iosb, nil,
FILE_ATTRIBUTE_NORMAL, 0, FILE_OPEN_IF,
FILE_DIRECTORY_FILE + FILE_SYNCHRONOUS_IO_NONALERT,
nil, 0);
if RtnCode = STATUS_SUCCESS then
begin
if iosb.Information = FILE_CREATED then
begin
DbgPrint('FileWorks: Directory created'
end else if iosb.Information = FILE_OPENED then
begin
DbgPrint('FileWorks: Directory exists and was opened'
end;
ZwClose(hDirectory);
end else
begin
DbgPrint('FileWorks: Can''t create directory. Status: %08X'
end;
end;
procedure CreateFile;
var
oa:OBJECT_ATTRIBUTES;
iosb:IO_STATUS_BLOCK;
hFile:THANDLE;
RtnCode: NTSTATUS;
begin
DbgPrint(
InitializeObjectAttributes(oa, @g_usFileName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwCreateFile(@hFile, SYNCHRONIZE, @oa, @iosb, nil,
FILE_ATTRIBUTE_NORMAL, 0,
FILE_CREATE,
FILE_SYNCHRONOUS_IO_NONALERT, nil, 0);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File created'
ZwClose(hFile);
end else
begin
DbgPrint('FileWorks: Can''t create file. Status: %08X'
end;
end;
procedure WriteFile;
var
oa:OBJECT_ATTRIBUTES;
iosb:IO_STATUS_BLOCK;
hFile:THANDLE;
RtnCode: NTSTATUS;
g_szData: PAnsiChar;
begin
DbgPrint(
InitializeObjectAttributes(oa, @g_usFileName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwCreateFile(@hFile, FILE_WRITE_DATA + SYNCHRONIZE,
@oa, @iosb, nil, 0, FILE_SHARE_READ,
FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT,
nil, 0);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File openeded'
g_szData := 'Data can be written to an open file';
//RtlInitUnicodeString(g_szData, 'Data can be written to an open file');
RtnCode := ZwWriteFile(hFile, 0, nil, nil, @iosb, g_szData,
strlen(g_szData), nil, nil);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File was written'
end else
begin
DbgPrint('FileWorks: Can''t write to the file. Status: %08X\n', RtnCode);
end;
ZwClose(hFile);
end else
begin
DbgPrint('FileWorks: Can''t open file. Status: %08X'
end;
end;
procedure MarkAsReadOnly;
var
oa:OBJECT_ATTRIBUTES;
iosb:IO_STATUS_BLOCK;
hFile:THandle;
fbi:FILE_BASIC_INFORMATION;
RtnCode:NTSTATUS;
begin
DbgPrint(
InitializeObjectAttributes(oa, @g_usFileName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwCreateFile(@hFile, FILE_READ_ATTRIBUTES + FILE_WRITE_ATTRIBUTES + SYNCHRONIZE,
@oa, @iosb, nil, 0, FILE_SHARE_READ,
FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT,
nil, 0);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File openeded'
RtnCode := ZwQueryInformationFile(hFile, @iosb, @fbi,
sizeof(fbi),
FileBasicInformation);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File attributes were: %08X'
fbi.FileAttributes := fbi.FileAttributes or FILE_ATTRIBUTE_READONLY;
RtnCode := ZwSetInformationFile(hFile, @iosb, @fbi,
sizeof(fbi), FileBasicInformation);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: Now file marked as read-only'
end else
begin
DbgPrint('FileWorks: Can''t change file attributes. Status: %08X'
end;
end else
begin
DbgPrint('FileWorks: Can''t query file attributes. Status: %08X'
end;
ZwClose(hFile);
end else
begin
DbgPrint('FileWorks: Can''t open file. Status: %08X\n', RtnCode);
end;
end;
procedure ReadFile;
var
oa:OBJECT_ATTRIBUTES;
iosb:IO_STATUS_BLOCK;
hFile:THANDLE;
p:PVOID;
cb:DWORD;
fsi:FILE_STANDARD_INFORMATION;
RtnCode: NTSTATUS;
begin
DbgPrint(
InitializeObjectAttributes(oa, @g_usFileName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwOpenFile(@hFile, FILE_READ_DATA + SYNCHRONIZE,
@oa, @iosb, FILE_SHARE_READ + FILE_SHARE_WRITE + FILE_SHARE_DELETE,
FILE_SYNCHRONOUS_IO_NONALERT);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File openeded'
RtnCode := ZwQueryInformationFile(hFile, @iosb, @fsi,
sizeof(fsi),
FileStandardInformation);
if RtnCode = STATUS_SUCCESS then
begin
cb := fsi.EndOfFile.LowPart + 1;
p := ExAllocatePool(PagedPool, cb);
if p <> nil then
begin
memset(p, 0, cb);
RtnCode := ZwReadFile(hFile, 0, nil, nil, @iosb, p, cb, nil, nil);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File content: \=%s\='
end else
begin
DbgPrint('FileWorks: Can''t read from the file. Status: %08X'
end;
ExFreePool(p);
end else
begin
DbgPrint('FileWorks: Can''t allocate memory. Status: %08X'
end;
end else
begin
DbgPrint('FileWorks: Can''t query file size. Status: %08X'
end;
ZwClose(hFile);
end else
begin
DbgPrint('FileWorks: Can''t open file. Status: %08X'
end;
end;
procedure UnmarkAsReadOnly;
var
oa:OBJECT_ATTRIBUTES;
iosb:IO_STATUS_BLOCK;
hFile:THANDLE;
fbi:FILE_BASIC_INFORMATION;
RtnCode:NTSTATUS;
begin
DbgPrint(
InitializeObjectAttributes(oa, @g_usFileName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwCreateFile(@hFile, FILE_READ_ATTRIBUTES + FILE_WRITE_ATTRIBUTES + SYNCHRONIZE,
@oa, @iosb, nil, 0, FILE_SHARE_READ,
FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT,
nil, 0);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File openeded'
RtnCode := ZwQueryInformationFile(hFile, @iosb, @fbi,
sizeof(fbi), FileBasicInformation);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File attributes were: %08X'
fbi.FileAttributes := fbi.FileAttributes and (not FILE_ATTRIBUTE_READONLY);
RtnCode := ZwSetInformationFile(hFile, @iosb, @fbi, sizeof(fbi), FileBasicInformation);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: Now file can be written or deleted'
end else
begin
DbgPrint('FileWorks: Can''t change file attributes. Status: %08X'
end;
end else
begin
DbgPrint('FileWorks: Can''t query file attributes. Status: %08X'
end;
ZwClose(hFile);
end else
begin
DbgPrint('FileWorks: Can''t open file. Status: %08X'
end;
end;
procedure AppendFile;
var
oa:OBJECT_ATTRIBUTES;
iosb:IO_STATUS_BLOCK;
hFile:THANDLE;
g_szDataToAppend:PAnsiChar;
RtnCode:NTSTATUS;
begin
DbgPrint(
InitializeObjectAttributes(oa, @g_usFileName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwOpenFile(@hFile, FILE_APPEND_DATA + SYNCHRONIZE,
@oa, @iosb, FILE_SHARE_READ,
FILE_SYNCHRONOUS_IO_NONALERT);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File openeded'
g_szDataToAppend := ' using ZwWriteFile';
RtnCode := ZwWriteFile(hFile, 0, nil, nil, @iosb, g_szDataToAppend,
strlen(g_szDataToAppend), nil, nil);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: Data appended to the file'
end else
begin
DbgPrint('FileWorks: Can''t append data to file. Status: %08X'
end;
ZwClose(hFile);
end else
begin
DbgPrint('FileWorks: Can''t open file. Status: %08X'
end;
end;
procedure TruncateFile;
var
oa:OBJECT_ATTRIBUTES;
iosb:IO_STATUS_BLOCK;
hFile:THANDLE;
fsi:FILE_STANDARD_INFORMATION;
feofi:FILE_END_OF_FILE_INFORMATION;
RtnCode:NTSTATUS;
begin
DbgPrint(
InitializeObjectAttributes(oa, @g_usFileName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwOpenFile(@hFile, FILE_WRITE_DATA + SYNCHRONIZE,
@oa, @iosb, FILE_SHARE_READ,
FILE_SYNCHRONOUS_IO_NONALERT);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File openeded'
RtnCode := ZwQueryInformationFile(hFile, @iosb, @fsi,
sizeof(fsi),
FileStandardInformation);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: EOF was: %08X'
feofi.EndOfFile.HighPart := 0;
feofi.EndOfFile.LowPart := (fsi.EndOfFile.LowPart) shr 1;
RtnCode := ZwSetInformationFile(hFile, @iosb, @feofi,
sizeof(feofi),
FileEndOfFileInformation);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File truncated to its half size'
end else
begin
DbgPrint('FileWorks: Can''t truncate file. Status: %08X'
end;
end else
begin
DbgPrint('FileWorks: Can''t query file info. Status: %08X'
end;
ZwClose(hFile);
end else
begin
DbgPrint('FileWorks: Can''t open file. Status: %08X'
end;
end;
procedure DeleteFile;
var
oa:OBJECT_ATTRIBUTES;
iosb:IO_STATUS_BLOCK;
hFile:THANDLE;
fdi:FILE_DISPOSITION_INFORMATION;
RtnCode:NTSTATUS;
begin
DbgPrint(
InitializeObjectAttributes(oa, @g_usFileName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwCreateFile(@hFile, _DELETE + SYNCHRONIZE,
@oa, @iosb, nil, 0, FILE_SHARE_DELETE,
FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT,
nil, 0);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File openeded'
fdi.DeleteFile := True;
RtnCode := ZwSetInformationFile(hFile, @iosb, @fdi,
sizeof(fdi),
FileDispositionInformation);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint('FileWorks: File has been marked for deletion'
DbgPrint('FileWorks: It should be deleted when the last open handle is closed'
end else
begin
DbgPrint('FileWorks: Can''t mark file for deletion. Status: %08X'
end;
ZwClose(hFile);
end else
begin
DbgPrint('FileWorks: Can''t open file. Status: %08X'
end;
end;
procedure DeleteDirectory;
var
oa:OBJECT_ATTRIBUTES;
RtnCode:NTSTATUS;
begin
InitializeObjectAttributes(oa, @g_usDirName,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwDeleteFile(@oa);
if RtnCode = STATUS_SUCCESS then
begin
DbgPrint(
end else
begin
DbgPrint(
end;
end;
procedure EnumerateFiles;
var
oa:OBJECT_ATTRIBUTES;
hSystemRootDirectory:THANDLE;
hDriversDirectory:THANDLE;
_as:ANSI_STRING;
us:UNICODE_STRING;
iosb:IO_STATUS_BLOCK;
tf:TIME_FIELDS;
cb:DWORD;
pfdi:PFILE_DIRECTORY_INFORMATION;
RtnCode:NTSTATUS;
g_usTemp:UNICODE_STRING;
begin
DbgPrint(
RtlInitUnicodeString(g_usTemp, '\SystemRoot');
InitializeObjectAttributes(oa, @g_usTemp,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
0, nil);
RtnCode := ZwOpenFile(@hSystemRootDirectory, FILE_LIST_DIRECTORY + SYNCHRONIZE,
@oa, @iosb, FILE_SHARE_READ + FILE_SHARE_WRITE + FILE_SHARE_DELETE,
FILE_DIRECTORY_FILE + FILE_SYNCHRONOUS_IO_NONALERT);
if RtnCode = STATUS_SUCCESS then
begin
RtlInitUnicodeString(g_usTemp, 'system32\drivers');
InitializeObjectAttributes(oa, @g_usTemp,
OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,
hSystemRootDirectory, nil);
RtnCode := ZwOpenFile(@hDriversDirectory, FILE_LIST_DIRECTORY + SYNCHRONIZE,
@oa, @iosb, FILE_SHARE_READ + FILE_SHARE_WRITE + FILE_SHARE_DELETE,
FILE_DIRECTORY_FILE + FILE_SYNCHRONOUS_IO_NONALERT);
if RtnCode = STATUS_SUCCESS then
begin
cb := sizeof(FILE_DIRECTORY_INFORMATION) + 256;
pfdi := ExAllocatePool(PagedPool, cb);
if pfdi <> nil then
begin
RtlInitUnicodeString(g_usTemp, 'c*');
DbgPrint(
RtnCode := ZwQueryDirectoryFile(hDriversDirectory, 0, nil, nil, @iosb,
pfdi, cb, FileDirectoryInformation,
true, @g_usTemp, true);
while RtnCode <> STATUS_NO_MORE_FILES do
begin
if RtnCode = STATUS_SUCCESS then
begin
us.Length := pfdi^.FileNameLength;
us.MaximumLength := pfdi^.FileNameLength;
us.Buffer := PWideChar(@pfdi^.FileName);
if RtlUnicodeStringToAnsiString(@_as, @us, true) = STATUS_SUCCESS then
begin
RtlTimeToTimeFields(@pfdi^.CreationTime, @tf);
DbgPrint(' %s size=%d created on %d.%02d.%04d'
_as.Buffer, pfdi^.EndOfFile.LowPart,
BYTE(tf.Day), BYTE(tf.Month), WORD(tf.Year));
RtlFreeAnsiString(@_as);
end;
end;
RtnCode := ZwQueryDirectoryFile(hDriversDirectory, 0, nil, nil, @iosb,
pfdi, cb, FileDirectoryInformation,
true, nil, false);
end; {End While}
DbgPrint('FileWorks: ------------------------------------------------'
ExFreePool(pfdi);
end;
ZwClose(hDriversDirectory);
end else
begin
DbgPrint('FileWorks: Can''t open drivers directory. Status: %08X', RtnCode);
end;
ZwClose(hSystemRootDirectory);
end else
begin
DbgPrint('FileWorks: Can''t open system root directory. Status: %08X'
end;
end;
function _DriverEntry(pDriverObject:PDRIVER_OBJECT;
pusRegistryPath:PUNICODE_STRING): NTSTATUS; stdcall;
begin
DbgPrint(
RtlInitUnicodeString(g_usFileName, '\??\c:\FileWorks\test.txt');
RtlInitUnicodeString(g_usDirName, '\??\c:\FileWorks');
CreateDirectory;
CreateFile;
WriteFile;
MarkAsReadOnly;
ReadFile;
UnmarkAsReadOnly;
AppendFile;
ReadFile;
TruncateFile;
ReadFile;
DeleteFile;
DeleteDirectory;
EnumerateFiles;
DbgPrint(
result := STATUS_DEVICE_CONFIGURATION_ERROR;
end;
end.
