NTSTATUS __stdcall MyNtCreateFile(
OUT PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN PLARGE_INTEGER AllocationSize OPTIONAL,
IN ULONG FileAttributes,
IN ULONG ShareAccess,
IN ULONG CreateDisposition,
IN ULONG CreateOptions,
IN PVOID EaBuffer OPTIONAL,
IN ULONG EaLength )
{
OPEN_PACKET openPacket;
HANDLE hHandle = NULL;
NTSTATUS SStatus;
DUMMY_FILE_OBJECT localFileObject;
KPROCESSOR_MODE requestorMode;
RtlZeroMemory(&openPacket, sizeof( OPEN_PACKET ) );
requestorMode = KeGetPreviousMode();
openPacket.Type = IO_TYPE_OPEN_PACKET;
openPacket.Size = sizeof( OPEN_PACKET );
openPacket.ParseCheck = 0L;
openPacket.AllocationSize.LowPart = 0;openPacket.AllocationSize.LowPart = 0;
openPacket.CreateOptions = FILE_SYNCHRONOUS_IO_NONALERT | FILE_DIRECTORY_FILE;
openPacket.FileAttributes = (USHORT) 0;
openPacket.ShareAccess = (USHORT) FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE;
openPacket.Disposition = FILE_OPEN;
openPacket.Override = FALSE;
openPacket.QueryOnly = FALSE;
openPacket.DeleteOnly = FALSE;
openPacket.Options = 0;
openPacket.RelatedFileObject = (PFILE_OBJECT) NULL;
openPacket.CreateFileType = CreateFileTypeNone;
openPacket.ExtraCreateParameters = NULL;
openPacket.TraversedMountPoint = FALSE;
openPacket.InternalFlags = 0;
openPacket.TopDeviceObjectHint = NULL;
/*
openPacket.Type = IO_TYPE_OPEN_PACKET;
openPacket.Size = sizeof( OPEN_PACKET );
openPacket.CreateOptions = FILE_DELETE_ON_CLOSE;
openPacket.ShareAccess = (USHORT) FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE;
openPacket.Disposition = FILE_OPEN;
openPacket.DeleteOnly = TRUE;
openPacket.TraversedMountPoint = FALSE;
openPacket.LocalFileObject = &localFileObject;
*/
status = ObOpenObjectByName( ObjectAttributes,
(POBJECT_TYPE) NULL,
requestorMode,
NULL,
DesiredAccess,
&openPacket,
&hHandle);
ObOpenObjectByName 执行返回 C0000103 错误
下面 注译掉的是 WRK 里面的 OPEN_PACKET 结构 填充 也是 错误
郁闷了 ObjectAttributes InitializeObjectAttributes 初始化一个新的 也是 错误
求 大侠 指点迷津 感激不尽
已经解决 放弃采用 ObOpenObjectByName
原来 还可以 使用 ZwQueryAttributesFile 来查询的
在此感谢 各位 热心帮助 回帖的 大虾 牛人 你们的 帮助 令我 受益匪浅 谢谢·!
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)