void
RenameFileROutineByHandle()
{
UNICODE_STRING UniFileString;
OBJECT_ATTRIBUTES object ;
NTSTATUS status;
HANDLE hFile;
IO_STATUS_BLOCK io_status = {0};
PFILE_RENAME_INFORMATION RenamInfo = NULL;
UNICODE_STRING UniRenameStr;
PFILE_OBJECT fileObject;
RtlInitUnicodeString(&UniFileString,L "\\Device\\HarddiskVolume2\\1.txt" );
InitializeObjectAttributes(
& object ,
&UniFileString,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL);
//打开文件,存在打开,不存在返回错误
status = ZwCreateFile( &hFile,
GENERIC_READ | GENERIC_WRITE,
& object ,
&io_status,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE |FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if (!NT_SUCCESS(status))
{
_asm int
3;
}
RenamInfo = (PFILE_RENAME_INFORMATION)ExAllocatePoolWithTag(NonPagedPool,1024,0);
RenamInfo->ReplaceIfExists = FALSE;
RenamInfo->RootDirectory = NULL;
UniRenameStr.Buffer = RenamInfo->FileName;
RenamInfo->FileNameLength = sizeof (ReNamePath) - sizeof (WCHAR);
RtlCopyMemory(UniRenameStr.Buffer,ReNamePath,
sizeof (ReNamePath));
status = ZwSetInformationFile(hFile,&io_status,RenamInfo,1024,FileRenameInformation);
if (!NT_SUCCESS(status))
{
_asm int
3;
}
ZwClose(hFile);
return ;
}
void
RenameFileROutineByObj()
{
UNICODE_STRING UniFileString;
OBJECT_ATTRIBUTES object ;
NTSTATUS status;
HANDLE hFile;
IO_STATUS_BLOCK io_status = {0};
PFILE_RENAME_INFORMATION RenamInfo = NULL;
UNICODE_STRING UniRenameStr;
PFILE_OBJECT fileObject;
RtlInitUnicodeString(&UniFileString,L "\\Device\\HarddiskVolume2\\1.txt" );
InitializeObjectAttributes(
& object ,
&UniFileString,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL);
//打开文件,存在打开,不存在返回错误
status = ZwCreateFile( &hFile,
GENERIC_READ | GENERIC_WRITE,
& object ,
&io_status,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE |FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if (!NT_SUCCESS(status))
{
_asm int
3;
}
RenamInfo = (PFILE_RENAME_INFORMATION)ExAllocatePoolWithTag(NonPagedPool,1024,0);
RenamInfo->ReplaceIfExists = FALSE;
RenamInfo->RootDirectory = NULL;
UniRenameStr.Buffer = RenamInfo->FileName;
RenamInfo->FileNameLength = sizeof (ReNamePath) - sizeof (WCHAR);
RtlCopyMemory(UniRenameStr.Buffer,ReNamePath,
sizeof (ReNamePath));
///////////////////////////////////////////////////////////
status = ObReferenceObjectByHandle( hFile,
0,
*IoFileObjectType,
KernelMode,
&fileObject,
NULL);
if
(!NT_SUCCESS(status))
{
_asm int
3;
}
status = IoSetInformation( fileObject,
FileRenameInformation,
1024,
RenamInfo);
if
(!NT_SUCCESS(status))
{
_asm int
3;
}
ObDereferenceObject(fileObject);
//////////////////////////////////////////////////////////
ZwClose(hFile);
return ;
}
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
void
RenameFileROutineByIrp()
{
UNICODE_STRING UniFileString;
OBJECT_ATTRIBUTES object ;
NTSTATUS status;
HANDLE hFile;
IO_STATUS_BLOCK io_status = {0};
PFILE_RENAME_INFORMATION RenamInfo = NULL;
UNICODE_STRING UniRenameStr;
PFILE_OBJECT FileObject;
PDEVICE_OBJECT deviceObject = NULL;
PIRP irp = NULL;
KEVENT event ;
IO_STATUS_BLOCK localIoStatus;
PIO_STACK_LOCATION irpSp = NULL;
UNICODE_STRING newFileName;
HANDLE handle;
PFILE_OBJECT targetFileObject;
RtlInitUnicodeString(&UniFileString,L "\\Device\\HarddiskVolume2\\1.txt" );
InitializeObjectAttributes(
& object ,
&UniFileString,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL);
//打开文件,存在打开,不存在返回错误
status = ZwCreateFile( &hFile,
GENERIC_READ | GENERIC_WRITE,
& object ,
&io_status,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE |FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if (!NT_SUCCESS(status))
{
_asm int
3;
}
RenamInfo = (PFILE_RENAME_INFORMATION)ExAllocatePoolWithTag(NonPagedPool,1024,0);
RenamInfo->ReplaceIfExists = FALSE;
RenamInfo->RootDirectory = NULL;
UniRenameStr.Buffer = RenamInfo->FileName;
RenamInfo->FileNameLength = sizeof (ReNamePath) - sizeof (WCHAR);
RtlCopyMemory(UniRenameStr.Buffer,ReNamePath,
sizeof (ReNamePath));
status = ObReferenceObjectByHandle( hFile,
0,
*IoFileObjectType,
KernelMode,
&FileObject,
NULL);
if
(!NT_SUCCESS(status))
{
_asm int
3;
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// 以下为iosetinformationfile
ObReferenceObject( FileObject );
KeInitializeEvent( & event , SynchronizationEvent, FALSE );
deviceObject = IoGetRelatedDeviceObject( FileObject );
irp = IoAllocateIrp( deviceObject->StackSize, TRUE );
if
(!irp)
{
_asm int
3;
}
irp->Tail.Overlay.OriginalFileObject = FileObject;
irp->Tail.Overlay.Thread = PsGetCurrentThread();
irp->RequestorMode = KernelMode;
irp->UserEvent = & event ;
irp->Flags = IRP_SYNCHRONOUS_API;
irp->UserIosb = &localIoStatus;
irpSp = IoGetNextIrpStackLocation( irp );
irpSp->MajorFunction = IRP_MJ_SET_INFORMATION;
irpSp->FileObject = FileObject;
irp->AssociatedIrp.SystemBuffer = RenamInfo;
irp->Flags |= IRP_BUFFERED_IO;
irpSp->Parameters.SetFile.Length = 1024;
irpSp->Parameters.SetFile.FileInformationClass = FileRenameInformation;
irpSp->Parameters.SetFile.ReplaceIfExists = RenamInfo->ReplaceIfExists;
if
(RenamInfo->FileName[0] == (UCHAR) OBJ_NAME_PATH_SEPARATOR ||
RenamInfo->RootDirectory != NULL)
{
/////////////////////////////////////////////////////////
// 以下IopOpenLinkOrRenameTarget
ACCESS_MASK accessMask = FILE_WRITE_DATA;
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK ioStatus;
OBJECT_HANDLE_INFORMATION handleInformation;
newFileName.Length = (USHORT) RenamInfo->FileNameLength;
newFileName.MaximumLength = (USHORT) RenamInfo->FileNameLength;
newFileName.Buffer = RenamInfo->FileName;
InitializeObjectAttributes( &objectAttributes,
&newFileName,
OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
NULL,
NULL );
status = IoCreateFile( &handle,
FILE_WRITE_DATA | SYNCHRONIZE,
&objectAttributes,
&ioStatus,
(PLARGE_INTEGER) NULL,
0,
FILE_SHARE_READ | FILE_SHARE_WRITE,
FILE_OPEN,
FILE_OPEN_FOR_BACKUP_INTENT,
(PVOID) NULL,
0L,
CreateFileTypeNone,
(PVOID) NULL,
//IO_OPEN_TARGET_DIRECTORY |
IO_NO_PARAMETER_CHECKING |
0x0004 |
IO_FORCE_ACCESS_CHECK );
if (!NT_SUCCESS(status))
{
_asm int
3;
}
status = ObReferenceObjectByHandle( handle,
accessMask,
*IoFileObjectType,
KernelMode,
(PVOID *) &targetFileObject,
&handleInformation );
if (!NT_SUCCESS(status))
{
_asm int
3;
}
ObDereferenceObject( targetFileObject );
if
(IoGetRelatedDeviceObject( targetFileObject) !=
IoGetRelatedDeviceObject( FileObject )) {
_asm int
3;
} else
{
irpSp->Parameters.SetFile.FileObject = targetFileObject;
//*TargetHandle = handle;
status = STATUS_SUCCESS;
}
}
// 以上IopOpenLinkOrRenameTarget
/////////////////////////////////////////////////////
status = IoCallDriver( deviceObject, irp );
if
(status == STATUS_PENDING)
KeWaitForSingleObject(& event , Executive, KernelMode, TRUE, 0);
if (!NT_SUCCESS(status))
{
_asm int
3;
}
ZwClose( handle);
// 以上为IOSETINFORMATIONFILE
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
ZwClose(hFile);
ObDereferenceObject(FileObject);
return
STATUS_SUCCESS;
}
|