关于在WIN32调用一些Zw系列的文件操作函数

转自：http://blog.csdn.net/cooblily/archive/2007/10/27/1848037.aspx

都好久沒上來写文章了,都不知道做什么好,結果还是学写了一下用Native API的程序,這些API的原型当然久在DDK里面找啦,不过因为NTDLL.DLL有导出啊,所以可以LoadLibrary调入这个动态连接文件,再GetProcAddress找到相应的API的地址,然后当然就可以调用啦.

整個过程最麻烦的就是要将DDK翻来翻去找到要用到的函数原型,函数所用到的結构,和一些宏.复制到程序裏面,好啦,以下是我学习的成果.

以下代码是在C:中创建一个ForZwFileTest.txt的文件并写入內容,然後删除.其实都沒什么用的,反正有微軟公开的API不用,而用這些沒公开的API來实现这个功能完全是因为无聊.嘻嘻.

1. #include <windows.h>
2. #include <stdio.h>
3. #include <stdlib.h>
4. typedef unsigned long NTSTATUS;
5. typedef unsigned short USHORT;
6. typedef unsigned long ULONG;
7. typedef unsigned long DWORD;
8. typedef long LONG;
9. typedef __int64 LONGLONG;
10. typedef struct UNICODE_STRING{
11. USHORT Length;
12. USHORT MaxLen;
13. USHORT *Buffer;
14. } UNICODE_STRING,*PUNICODE_STRING;
15. #define OBJ_INHERIT             0x00000002L
16. #define OBJ_PERMANENT           0x00000010L
17. #define OBJ_EXCLUSIVE           0x00000020L
18. #define OBJ_CASE_INSENSITIVE    0x00000040L
19. #define OBJ_OPENIF              0x00000080L
20. #define OBJ_OPENLINK            0x00000100L
21. #define OBJ_KERNEL_HANDLE       0x00000200L
22. #define OBJ_FORCE_ACCESS_CHECK  0x00000400L
23. #define OBJ_VALID_ATTRIBUTES    0x000007F2L
24. #define FILE_ATTRIBUTE_NORMAL               0x00000080
25. #define FILE_SHARE_DELETE                   0x00000004
26. #define FILE_OPEN_IF                        0x00000003
27. #define FILE_SYNCHRONOUS_IO_NONALERT        0x00000020
28. #define GENERIC_WRITE                       (0x40000000L)
29. #define SYNCHRONIZE                         (0x00100000L)
30. #define GENERIC_READ                        (0x80000000L)
31. typedef struct _OBJECT_ATTRIBUTES{
32. ULONG  Length;
33. HANDLE  RootDirectory;
34. PUNICODE_STRING  ObjectName;
35. ULONG  Attributes;
36. PVOID  SecurityDescriptor;
37. PVOID  SecurityQualityOfService;
38. } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
39. typedef CONST OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
40. typedef NTSTATUS (__stdcall *ZWDELETEFILE)(
41. IN POBJECT_ATTRIBUTES  ObjectAttributes);
42. typedef VOID (__stdcall *RTLINITUNICODESTRING)(
43. IN OUT PUNICODE_STRING  DestinationString,
44. IN PCWSTR  SourceString);
45. typedef struct _IO_STATUS_BLOCK{
46. DWORD Status;
47. ULONG Information;
48. } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
49. typedef NTSTATUS (__stdcall *ZWCREATEFILE)(
50. OUT PHANDLE  FileHandle,
51. IN ACCESS_MASK  DesiredAccess,
52. IN POBJECT_ATTRIBUTES  ObjectAttributes,
53. OUT PIO_STATUS_BLOCK  IoStatusBlock,
54. IN PLARGE_INTEGER  AllocationSize  OPTIONAL,
55. IN ULONG  FileAttributes,
56. IN ULONG  ShareAccess,
57. IN ULONG  CreateDisposition,
58. IN ULONG  CreateOptions,
59. IN PVOID  EaBuffer  OPTIONAL,
60. IN ULONG  EaLength);
61. typedef VOID (NTAPI *PIO_APC_ROUTINE) (
62. IN PVOID ApcContext,
63. IN PIO_STATUS_BLOCK IoStatusBlock,
64. IN ULONG Reserved);
65. typedef NTSTATUS (__stdcall *ZWWRITEFILE)(
66. IN HANDLE  FileHandle,
67. IN HANDLE  Event  OPTIONAL,
68. IN PIO_APC_ROUTINE  ApcRoutine  OPTIONAL,
69. IN PVOID  ApcContext  OPTIONAL,
70. OUT PIO_STATUS_BLOCK  IoStatusBlock,
71. IN PVOID  Buffer,
72. IN ULONG  Length,
73. IN PLARGE_INTEGER  ByteOffset  OPTIONAL,
74. IN PULONG  Key  OPTIONAL);
75. typedef NTSTATUS (__stdcall *ZWCLOSE)(
76. IN HANDLE  Handle);
77. int main()
78. {
79. HINSTANCE hNtDll;
80. ZWDELETEFILE ZwDeleteFile;
81. RTLINITUNICODESTRING RtlInitUnicodeString;
82. ZWCREATEFILE ZwCreateFile;
83. ZWWRITEFILE ZwWriteFile;
84. ZWCLOSE ZwClose;
85. hNtDll = LoadLibrary ("NTDLL");
86. if (!hNtDll)
87. return 0;
88. ZwDeleteFile = (ZWDELETEFILE)GetProcAddress (hNtDll,"ZwDeleteFile");
89. RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress (hNtDll,"RtlInitUnicodeString");
90. ZwCreateFile = (ZWCREATEFILE)GetProcAddress (hNtDll,"ZwCreateFile");
91. ZwWriteFile = (ZWWRITEFILE)GetProcAddress (hNtDll,"ZwWriteFile");
92. ZwClose = (ZWCLOSE)GetProcAddress (hNtDll,"ZwClose");
93. UNICODE_STRING ObjectName;
94. RtlInitUnicodeString(&ObjectName,L"//??//C://ForZwFileTest.txt");//記得這裏是要有//??//在前面的,DDK說的.
95. OBJECT_ATTRIBUTES ObjectAttributes = {
96. sizeof(OBJECT_ATTRIBUTES),          // Length
97. NULL,                               // RootDirectory
98. &ObjectName,                        // ObjectName
99. OBJ_CASE_INSENSITIVE,               // Attributes
100. 0,                                  // SecurityDescriptor
101. NULL,                               // SecurityQualityOfService
102. };
103. HANDLE hFile;
104. PVOID content = "ForZwFileTest";
105. IO_STATUS_BLOCK IoStatusBlock;
106. ZwCreateFile(&hFile,
107. GENERIC_WRITE|SYNCHRONIZE|GENERIC_READ,
108. &ObjectAttributes,
109. &IoStatusBlock,
110. 0,
111. FILE_ATTRIBUTE_NORMAL,
112. FILE_SHARE_DELETE,
113. FILE_OPEN_IF,
114. FILE_SYNCHRONOUS_IO_NONALERT,
115. NULL,
116. 0);
117. ZwWriteFile(hFile, 0, 0, 0, &IoStatusBlock, content, 12, NULL, NULL);
118. ZwClose(hFile);
119. //  ZwDeleteFile(&ObjectAttributes);
120. FreeLibrary (hNtDll);
121. return 0;
122. }

转自：http://blog.csdn.net/cooblily/archive/2007/10/27/1848037.aspx