x64內核強刪文件.

時間  2019-11-06
標籤 x64 內核 文件 简体版
原文   原文鏈接

目錄ios

x64內核中強刪文件的實現

一丶簡介

說道刪除文件.有各類各樣的方法. 有ring3 也有ring0. 並且也有許多對抗的方法. 如ring3想刪除一個文件.被佔用你就沒法刪除.此時能夠經過解除句柄進行刪除 ring0中想刪除一個文件.有常規方法也有很是規方法.常規方法就是 設置文件屬性爲刪除.而後進行設置. 還有就是直接調用ZwDeleteFile 進行刪除. 暴力刪除就是這裏所講的 IRP刪除.給底層發送IRP便可進行刪除文件.函數

1.步驟

步驟很簡單.基本上說完就能夠本身寫代碼作出測試

  • 1.打開文件.獲取文件句柄 (IoCreateFile)
  • 2.根據文件句柄,獲取文件對象.(有了句柄都應該第一時間想到獲取它的對象) (ObReferenceObjectByHandle)
  • 3.獲取文件對象的設備對象指針.這個發送IRP的時候須要使用(IoGetRelatedDeviceObject)
  • 4.申請IRP(IoAllocateIrp)
  • 5.初始化你申請的IRP
  • 6.獲取IRP的下層堆棧,而且初始化信息.(IoGetNextIrpStackLocation)
  • 7.設置回調.系統完成IRP以後會調用你這個回調.因此你須要設置事件同步跟你本身同步,才知道IRP已經發送完了.(IoSetCompletionRoutine)
  • 8.獲取文件對象的域指針.而且設置域指針的兩個成員爲0.系統以他來判斷這個程序是否能夠刪除.若是不爲0.那麼則沒法刪除運行中的文件.
pSectionObjectPointer->ImageSectionObject = 0;
pSectionObjectPointer->DataSectionObject = 0;
  • 9.發送IRP(IoCallDriver)
  • 10.根據 事件 來等待是否IRP完成(KeWaitForSingleObject)
  • 11.作完收工.(ZwClose)

2.Nt驅動代碼

#include "Driver.h"


//刪除文件函數的入口
NTSTATUS RetOpenFileHandle(UNICODE_STRING uDelFileName, PHANDLE pFileHandle)
{
    
    NTSTATUS ntStatus = STATUS_UNSUCCESSFUL;
    IO_STATUS_BLOCK iostu;
    HANDLE hFileHandle = 0;
    if (pFileHandle == NULL)
        return STATUS_UNSUCCESSFUL;
    if (KeGetCurrentIrql() > PASSIVE_LEVEL)
        return 0;

    if (uDelFileName.Length < 0 || uDelFileName.MaximumLength < 0)
    {
        return 0;
    }


    OBJECT_ATTRIBUTES ObjAttribute;
    ObjAttribute.ObjectName = &uDelFileName;
    ObjAttribute.SecurityDescriptor = NULL;
    ObjAttribute.SecurityQualityOfService = NULL;
    ObjAttribute.Attributes = OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE;
    ObjAttribute.Length = sizeof(OBJECT_ATTRIBUTES);

  /*  InitializeObjectAttributes(
        &ObjAttribute,
        &uDelFileName, 
        OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, 
        NULL, NULL);*/

    ntStatus = IoCreateFile(&hFileHandle,
        FILE_READ_ATTRIBUTES,
        &ObjAttribute, 
        &iostu,
        0, 
        FILE_ATTRIBUTE_NORMAL,
        FILE_SHARE_DELETE, 
        FILE_OPEN,
        0, 
        NULL, 
        0, 
        CreateFileTypeNone,
        NULL,
        IO_NO_PARAMETER_CHECKING);

    *pFileHandle = hFileHandle;
    return ntStatus;
}

//去掉文件屬性


//CallBack回調
NTSTATUS
CallBackIrpCompleteionProc(
    PDEVICE_OBJECT DeviceObject,
    PIRP Irp,
     PVOID Context
)
{

    //操做系統會設置這個回調
    Irp->UserIosb->Status = Irp->IoStatus.Status;
    Irp->UserIosb->Information = Irp->IoStatus.Information;
    KeSetEvent(Irp->UserEvent, IO_NO_INCREMENT, FALSE);

    IoFreeIrp(Irp);
    return STATUS_MORE_PROCESSING_REQUIRED;
}
NTSTATUS PassFileattribute(PFILE_OBJECT pFileObj)
{
    /*
    1.申請IRP,初始化IRP
    2.初始化同步事件,以及設置回調.
    3.設置文件屬性爲默認
    4.發送IRP
    */
    PDEVICE_OBJECT pNextDeviceObj = NULL;
    PIRP pAllocIrp = NULL;
    KEVENT IrpSynEvent = {0}; //Irp同步須要的事件同步
    FILE_BASIC_INFORMATION fileBasciInfo = { 0 };
    IO_STATUS_BLOCK iostu;
    PIO_STACK_LOCATION IrpStack;
    //經過文件對象.獲取其設備對象指針
    pNextDeviceObj = IoGetRelatedDeviceObject(pFileObj);  
    if (pNextDeviceObj == NULL)
        return STATUS_UNSUCCESSFUL;

    //經過設備對象指針.肯定申請的IRP的大小,注意在完成設置裏面進行釋放.
    pAllocIrp = IoAllocateIrp(pNextDeviceObj->StackSize,TRUE);
    if (pAllocIrp == NULL)
        return STATUS_UNSUCCESSFUL;

    //初始化Irp

    //設置爲自動,設置爲無信號.
    KeInitializeEvent(&IrpSynEvent, SynchronizationEvent, FALSE); 

    fileBasciInfo.FileAttributes = FILE_ATTRIBUTE_NORMAL;
    pAllocIrp->AssociatedIrp.SystemBuffer = &fileBasciInfo;
    pAllocIrp->UserIosb = &iostu;
    pAllocIrp->UserEvent = &IrpSynEvent;
    pAllocIrp->Tail.Overlay.OriginalFileObject = pFileObj;
    pAllocIrp->Tail.Overlay.Thread = (PETHREAD)KeGetCurrentThread();

    //獲取下層堆棧.進行設置.

    //IrpStack  = 
    IrpStack = IoGetNextIrpStackLocation(pAllocIrp);
    IrpStack->MajorFunction = IRP_MJ_SET_INFORMATION; 
    IrpStack->DeviceObject = pNextDeviceObj;
    IrpStack->FileObject = pFileObj;
    IrpStack->Parameters.SetFile.Length = sizeof(FILE_BASIC_INFORMATION);
    IrpStack->Parameters.SetFile.FileObject = pFileObj;
    IrpStack->Parameters.SetFile.FileInformationClass = FileBasicInformation;

    //設置完成例程
    IoSetCompletionRoutine(pAllocIrp, CallBackIrpCompleteionProc, &IrpSynEvent, TRUE, TRUE, TRUE);
 

    //發送IRP
    IoCallDriver(pNextDeviceObj, pAllocIrp);
    //等待完成.

    KeWaitForSingleObject(&IrpSynEvent, Executive, KernelMode, TRUE, NULL);

    return STATUS_SUCCESS;
}

NTSTATUS FsDeleteFile(PFILE_OBJECT pFileObj)
{
    /*
  1.申請IRP,初始化IRP
  2.初始化同步事件,以及設置回調.
  3.設置文件屬性爲默認
  4.發送IRP

  核心:
    核心是設置 FileObject中的域.進而刪除正在運行中的文件

  */
    PDEVICE_OBJECT pNextDeviceObj = NULL;
    PIRP pAllocIrp = NULL;
    KEVENT IrpSynEvent = { 0 }; //Irp同步須要的事件同步
    FILE_DISPOSITION_INFORMATION     fileBasciInfo = { 0 };  //注意此位置.已經變化爲 FILE_DISPOSITION_INFORMATION
    IO_STATUS_BLOCK iostu;
    PIO_STACK_LOCATION IrpStack;

    PSECTION_OBJECT_POINTERS pFileExe;  //注意此屬性要設置爲0.欺騙系統進行刪除
    //經過文件對象.獲取其設備對象指針
    pNextDeviceObj = IoGetRelatedDeviceObject(pFileObj);
    if (pNextDeviceObj == NULL)
        return STATUS_UNSUCCESSFUL;

    //經過設備對象指針.肯定申請的IRP的大小,注意在完成設置裏面進行釋放.
    pAllocIrp = IoAllocateIrp(pNextDeviceObj->StackSize, TRUE);
    if (pAllocIrp == NULL)
        return STATUS_UNSUCCESSFUL;

    //初始化Irp

    //設置爲自動,設置爲無信號.
    KeInitializeEvent(&IrpSynEvent, SynchronizationEvent, FALSE);

    fileBasciInfo.DeleteFile = TRUE;        //設置標記爲刪除
    pAllocIrp->AssociatedIrp.SystemBuffer = &fileBasciInfo;
    pAllocIrp->UserIosb = &iostu;
    pAllocIrp->UserEvent = &IrpSynEvent;
    pAllocIrp->Tail.Overlay.OriginalFileObject = pFileObj;
    pAllocIrp->Tail.Overlay.Thread = (PETHREAD)KeGetCurrentThread();

    //獲取下層堆棧.進行設置.

    //IrpStack  = 
    IrpStack = IoGetNextIrpStackLocation(pAllocIrp);
    IrpStack->MajorFunction = IRP_MJ_SET_INFORMATION;
    IrpStack->DeviceObject = pNextDeviceObj;
    IrpStack->FileObject = pFileObj;
    IrpStack->Parameters.SetFile.Length = sizeof(FILE_DISPOSITION_INFORMATION);
    IrpStack->Parameters.SetFile.FileObject = pFileObj;
    IrpStack->Parameters.SetFile.FileInformationClass = FileDispositionInformation;

    //設置完成例程
    IoSetCompletionRoutine(pAllocIrp, CallBackIrpCompleteionProc, &IrpSynEvent, TRUE, TRUE, TRUE);

    //刪除正在運行中的文件.
    
    pFileExe = pFileObj->SectionObjectPointer;
    pFileExe->DataSectionObject = 0;
    pFileExe->ImageSectionObject = 0;
    //發送IRP
    IoCallDriver(pNextDeviceObj, pAllocIrp);
    //等待完成.

    KeWaitForSingleObject(&IrpSynEvent, Executive, KernelMode, TRUE, NULL);

    return STATUS_SUCCESS;
}
NTSTATUS IrpDeleteFileRun(UNICODE_STRING uDelFileName)
{
    KdBreakPoint();
    NTSTATUS ntStatus = STATUS_UNSUCCESSFUL;
    /*
    1.首先經過發送IRP去掉文件的屬性
    2.設置文件屬性爲刪除.進行發送IRP強刪文件.
    */
    HANDLE hFileHandle = { 0 };
    PFILE_OBJECT  pFileObject = NULL;
    //sep1 : OpenFile Get File Handle
    ntStatus = RetOpenFileHandle(uDelFileName,&hFileHandle);

    if (!NT_SUCCESS(ntStatus))
    {
        goto ExitAnRelease;
    }
    //sep2:  Chang File Handle to FileObject

    ntStatus = ObReferenceObjectByHandle(
        hFileHandle,
        GENERIC_ALL,
        *IoFileObjectType,
        KernelMode,
        &pFileObject,
        NULL);
    if (!NT_SUCCESS(ntStatus))
    {
       
        goto ExitAnRelease;
    }

    //setp 3:  Pass File Atribute
    KdBreakPoint();
   ntStatus =  PassFileattribute(pFileObject);
   if (!NT_SUCCESS(ntStatus))
   {
       goto ExitAnRelease;
   }

   //setp 4: Send Irp DeleteFile
   KdBreakPoint();
   ntStatus = FsDeleteFile(pFileObject);
   if (!NT_SUCCESS(ntStatus))
   {
       goto ExitAnRelease;
   }
ExitAnRelease:

    if (pFileObject != NULL)
        ObDereferenceObject(pFileObject);
    if (hFileHandle != NULL)
        ZwClose(hFileHandle);
  
    return ntStatus;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegPath)
{
    ULONG iCount = 0;
    NTSTATUS ntStatus;
    UNICODE_STRING uDelFileName = { 0 };
    pDriverObj->DriverUnload = DriverUnLoad;
    /*ntStatus = InitDeviceAnSybolicLinkName(pDriverObj);
    if (!NT_SUCCESS(ntStatus))
    {
        return ntStatus;
    }

    ntStatus = InitDisPatchFunction(pDriverObj);
    if (!NT_SUCCESS(ntStatus))
    {
        return ntStatus;
    }*/

    //也可寫成: \\??\\c:\\xxx.txt

    RtlInitUnicodeString(&uDelFileName, L"//DosDevices//C://123.txt");
    IrpDeleteFileRun(uDelFileName);
    return STATUS_SUCCESS;
}

代碼測試能夠進行強刪.操作系統

相關文章
相關標籤/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公眾號
   歡迎關注本站公眾號,獲取更多信息
聯繫我們 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程