以下内容全部来自www.vbasm.com 中的WIN64驱动编程基础教程
1.文件复制
1 BOOLEAN ZwCopyFile 2 ( 3 IN PUNICODE_STRING ustrDestFile, // ??c:1.txt 4 IN PUNICODE_STRING ustrSrcFile // ??c: .txt 5 ) { 6 HANDLE hSrcFile, hDestFile; 7 PVOID buffer = NULL; 8 ULONG length = 0; 9 LARGE_INTEGER offset = {0}; 10 IO_STATUS_BLOCK Io_Status_Block = {0}; 11 OBJECT_ATTRIBUTES obj_attrib; 12 NTSTATUS status; 13 BOOLEAN bRet = FALSE; 14 do 15 { 16 // 打开源文件 17 InitializeObjectAttributes( &obj_attrib, 18 ustrSrcFile, 19 OBJ_CASE_INSENSITIVE | 20 OBJ_KERNEL_HANDLE, 21 NULL, 22 NULL); 23 status = ZwCreateFile( &hSrcFile, 24 GENERIC_READ, 25 &obj_attrib, 26 &Io_Status_Block, 27 NULL, 28 FILE_ATTRIBUTE_NORMAL, 29 FILE_SHARE_READ, 30 FILE_OPEN, 31 FILE_NON_DIRECTORY_FILE | 32 FILE_SYNCHRONOUS_IO_NONALERT, 33 NULL, 34 0 ); 35 if (!NT_SUCCESS(status)) 36 { 37 bRet = FALSE; 38 goto END; 39 } 40 // 打开目标文件 41 InitializeObjectAttributes( &obj_attrib, 42 ustrDestFile, 43 OBJ_CASE_INSENSITIVE | 44 OBJ_KERNEL_HANDLE, 45 NULL, 46 NULL); 47 status = ZwCreateFile( &hDestFile, 48 GENERIC_WRITE, 49 &obj_attrib, 50 &Io_Status_Block, 51 NULL, 52 FILE_ATTRIBUTE_NORMAL, 53 FILE_SHARE_READ, 54 FILE_OPEN_IF, 55 FILE_NON_DIRECTORY_FILE | 56 FILE_SYNCHRONOUS_IO_NONALERT, 57 NULL, 58 0 ); 59 if (!NT_SUCCESS(status)) 60 { 61 bRet = FALSE; 62 goto END; 63 } 64 // 为 buffer 分配 4KB 空间 65 buffer = ExAllocatePool(NonPagedPool, 1024 * 4); 66 if (buffer == NULL) 67 { 68 bRet = FALSE; 69 goto END; 70 } 71 // 复制文件 72 while (1) 73 { 74 length = 4 * 1024; 75 // 读取源文件 76 status = ZwReadFile(hSrcFile, 77 NULL, 78 NULL, 79 NULL, 80 &Io_Status_Block, 81 buffer, 82 length, 83 &offset, 84 NULL); 85 if (!NT_SUCCESS(status)) 86 { 87 // 如果状态为 STATUS_END_OF_FILE，说明文件已经读取到末尾 88 if (status == STATUS_END_OF_FILE) 89 { 90 bRet = TRUE; 91 goto END; 92 } 93 } 94 // 获得实际读取的长度 95 length = (ULONG)Io_Status_Block.Information; 96 // 写入到目标文件 97 status = ZwWriteFile( hDestFile, 98 NULL, 99 NULL, 100 NULL, 101 &Io_Status_Block, 102 buffer, 103 length, 104 &offset, 105 NULL); 106 if (!NT_SUCCESS(status)) 107 { 108 bRet = FALSE; 109 goto END; 110 } 111 // 移动文件指针 112 offset.QuadPart += length; 113 } 114 } 115 while (0); 116 END: 117 if (hSrcFile) 118 { 119 ZwClose(hSrcFile); 120 } 121 if (hDestFile) 122 { 123 ZwClose(hDestFile); 124 } 125 if (buffer != NULL) 126 { 127 ExFreePool(buffer); 128 } 129 return bRet; 130 }