Você não pode selecionar mais de 25 tópicos Os tópicos devem começar com uma letra ou um número, podem incluir traços ('-') e podem ter até 35 caracteres.

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100
  1. #include <array>
  2. #include <ntdll.h>
  3. #include <Windows.h>
  4. #include <shlobj.h>
  5. #include <Shlwapi.h>
  6. #include "structs.h"
  7. #include "misc.h"
  8. #include "wow64ext.h"
  9. #include "syscall64.h"
  10. #include "get_syscall64_ids.h"
  11. void WINAPI RtlInitUnicodeString(
  12. unsigned char* target,
  13. PCWSTR source)
  14. {
  15. SET_MEMBER_PTR(_UNICODE_STRING_T, Buffer, target, source);
  16. if(source)
  17. {
  18. unsigned int length = lstrlenW(source) * sizeof(WCHAR);
  19. if(length > 0xfffc)
  20. length = 0xfffc;
  21. SET_MEMBER(_UNICODE_STRING_T, Length, target, length);
  22. SET_MEMBER(_UNICODE_STRING_T, MaximumLength, target, length + sizeof(WCHAR));
  23. }
  24. else
  25. {
  26. SET_MEMBER(_UNICODE_STRING_T, Length, target, 0);
  27. SET_MEMBER(_UNICODE_STRING_T, MaximumLength, target, 0);
  28. }
  29. }
  30. VOID initialize_object_attributes(unsigned char* p, LPVOID n, ULONG a)
  31. {
  32. SET_MEMBER(_OBJECT_ATTRIBUTES_T, uLength, p, is_WOW64() ? sizeof(_OBJECT_ATTRIBUTES_T<DWORD64>) : sizeof(_OBJECT_ATTRIBUTES_T<DWORD>));
  33. SET_MEMBER(_OBJECT_ATTRIBUTES_T, hRootDirectory, p, NULL);
  34. SET_MEMBER(_OBJECT_ATTRIBUTES_T, uAttributes, p, a);
  35. SET_MEMBER_PTR(_OBJECT_ATTRIBUTES_T, pObjectName, p, n);
  36. SET_MEMBER(_OBJECT_ATTRIBUTES_T, pSecurityDescriptor, p, NULL); // Actually a ptr but we set a NULL
  37. SET_MEMBER(_OBJECT_ATTRIBUTES_T, pSecurityQualityOfService, p, NULL);
  38. }
  39. BOOL file_test()
  40. {
  41. ALLOC_STRUCTURE(_UNICODE_STRING_T, filename);
  42. wchar_t desktopPath[MAX_PATH];
  43. lstrcpyW(desktopPath, L"\\??\\");
  44. if(!SHGetSpecialFolderPathW(HWND_DESKTOP, &desktopPath[lstrlenW(desktopPath)], CSIDL_DESKTOPDIRECTORY, FALSE))
  45. return FALSE;
  46. PathAppendW(desktopPath, L"WaitAMinute.HowDidThisGetHere.txt");
  47. RtlInitUnicodeString(filename, desktopPath);
  48. printf("Desktop: %ws\n", desktopPath);
  49. ALLOC_STRUCTURE(_OBJECT_ATTRIBUTES_T, obja);
  50. initialize_object_attributes(obja, (void*)filename, OBJ_CASE_INSENSITIVE);
  51. ALLOC_STRUCTURE(_HANDLE_T, fileHandle);
  52. ALLOC_STRUCTURE(_IO_STATUS_BLOCK_T, iostatusblock);
  53. NTSTATUS stat = DO_SYSCALL(get_syscall_ID(NTCREATEFILE), fileHandle, FILE_READ_DATA | FILE_WRITE_DATA | SYNCHRONIZE,
  54. obja, iostatusblock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OVERWRITE_IF,
  55. FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
  56. if(STATUS_SUCCESS != stat)
  57. {
  58. printf("NTSTATUS: %X\n", stat);
  59. return FALSE;
  60. }
  61. printf("Handle: %X\tIO.uInformation:%X\n", *(PHANDLE)GET_MEMBER(_HANDLE_T, h, fileHandle), *(PDWORD)GET_MEMBER(_IO_STATUS_BLOCK_T, uInformation, iostatusblock));
  62. FREE_STRUCTURE(_UNICODE_STRING_T, filename);
  63. FREE_STRUCTURE(_OBJECT_ATTRIBUTES_T, obja);
  64. const char TEST_STRING[] = {"0123456789ABCDEF"};
  65. if(STATUS_SUCCESS != (stat = DO_SYSCALL(get_syscall_ID(NTWRITEFILE), *(PHANDLE)GET_MEMBER(_HANDLE_T, h, fileHandle),
  66. NULL, NULL, NULL, iostatusblock, TEST_STRING, lstrlenA(TEST_STRING), NULL, NULL)))
  67. {
  68. printf("Write: %X\t\n", stat);
  69. return FALSE;
  70. }
  71. FlushFileBuffers(*(PHANDLE)GET_MEMBER(_HANDLE_T, h, fileHandle));
  72. char buffer[sizeof(TEST_STRING)+1] = {0};
  73. LARGE_INTEGER offset = {0};
  74. if(STATUS_SUCCESS != (stat = DO_SYSCALL(get_syscall_ID(NTREADFILE), *(PHANDLE)GET_MEMBER(_HANDLE_T, h, fileHandle),
  75. NULL, NULL, NULL, iostatusblock, buffer, sizeof(buffer), &offset, NULL)))
  76. {
  77. printf("Reading failed: %X\t%X != %X\n", stat, sizeof(buffer), offset.LowPart);
  78. return FALSE;
  79. }
  80. buffer[*(PDWORD)GET_MEMBER(_IO_STATUS_BLOCK_T, uInformation, iostatusblock)] = 0;
  81. printf("io stat: %X\tio inf: %X\tread: %X\n", *(PDWORD)GET_MEMBER(_IO_STATUS_BLOCK_T, Status, iostatusblock), *(PDWORD)GET_MEMBER(_IO_STATUS_BLOCK_T, uInformation, iostatusblock), offset.LowPart);
  82. DO_SYSCALL(get_syscall_ID(NTCLOSE), *(PHANDLE)GET_MEMBER(_HANDLE_T, h, fileHandle));
  83. FREE_STRUCTURE(_HANDLE_T, fileHandle);
  84. printf("'%s' == '%s'\n", TEST_STRING, buffer);
  85. return 0 == lstrcmpA(TEST_STRING, buffer);
  86. }