驱动操作磁盘文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
#include<ntddk.h>

VOID UnLoadDriver(PDRIVER_OBJECT pDriverObject);
NTSTATUS DriverDefaultHandle(PDEVICE_OBJECT pDevObj,PIRP pIrp);
BOOLEAN MyQueryFileAndFileFolder(UNICODE_STRING ustrPath);

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
{
	DbgPrint("Driver Start");
	for (int i = 0; i< IRP_MJ_MAXIMUM_FUNCTION;i++)
	{
		DriverObject->MajorFunction[i] = DriverDefaultHandle;
	}

	//遍历文件
	UNICODE_STRING ustrQueryaFile;
	RtlInitUnicodeString(&ustrQueryaFile,L"\\??\\C:\\yeanhoo");
	MyQueryFileAndFileFolder(ustrQueryaFile);

	DriverObject->DriverUnload = UnLoadDriver;
	return STATUS_SUCCESS;
}

VOID UnLoadDriver(PDRIVER_OBJECT pDriverObject)
{
	DbgPrint("UnloadDriver success!");
}
NTSTATUS DriverDefaultHandle(PDEVICE_OBJECT pDevObj,PIRP pIrp)
{
	NTSTATUS status = STATUS_SUCCESS;
	pIrp->IoStatus.Status = status;
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp,IO_NO_INCREMENT);

	return status;
}

BOOLEAN MyQueryFileAndFileFolder(UNICODE_STRING ustrPath)
{
	NTSTATUS status = STATUS_SUCCESS;

	HANDLE hFile = NULL;
	OBJECT_ATTRIBUTES objectAttributes = {0};
	IO_STATUS_BLOCK iosb = {0};
	InitializeObjectAttributes(&objectAttributes,&ustrPath,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,NULL,NULL);
	status = ZwCreateFile(&hFile,GENERIC_READ,&objectAttributes,&iosb,NULL,FILE_ATTRIBUTE_NORMAL,0,FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0);

	if(!NT_SUCCESS(status))
	{
		DbgPrint("function err!");
		return FALSE;
	}
	ZwClose(hFile);

	return TRUE;
}