以下内容全部来自www.vbasm.com 中的WIN64驱动编程基础教程

1.文件复制

1 BOOLEAN ZwCopyFile  2 (  3 IN PUNICODE_STRING ustrDestFile, // \??\c:\1.txt  4 IN PUNICODE_STRING ustrSrcFile // \??\c:\0.txt  5 ) {  6 HANDLE hSrcFile, hDestFile;  7 PVOID buffer = NULL;  8 ULONG length = 0;  9 LARGE_INTEGER offset = {
   0}; 10 IO_STATUS_BLOCK Io_Status_Block = {
   0}; 11 OBJECT_ATTRIBUTES obj_attrib; 12 NTSTATUS status; 13 BOOLEAN bRet = FALSE; 14 do 15 { 16 // 打开源文件 17 InitializeObjectAttributes( &obj_attrib, 18 ustrSrcFile, 19 OBJ_CASE_INSENSITIVE | 20 OBJ_KERNEL_HANDLE, 21 NULL, 22 NULL); 23 status = ZwCreateFile( &hSrcFile, 24 GENERIC_READ, 25 &obj_attrib, 26 &Io_Status_Block, 27 NULL, 28 FILE_ATTRIBUTE_NORMAL, 29 FILE_SHARE_READ, 30 FILE_OPEN, 31 FILE_NON_DIRECTORY_FILE | 32 FILE_SYNCHRONOUS_IO_NONALERT, 33 NULL, 34 0 ); 35 if (!NT_SUCCESS(status)) 36 { 37 bRet = FALSE; 38 goto END; 39 } 40 // 打开目标文件 41 InitializeObjectAttributes( &obj_attrib, 42 ustrDestFile, 43 OBJ_CASE_INSENSITIVE | 44 OBJ_KERNEL_HANDLE, 45 NULL, 46 NULL); 47 status = ZwCreateFile( &hDestFile, 48 GENERIC_WRITE, 49 &obj_attrib, 50 &Io_Status_Block, 51 NULL, 52 FILE_ATTRIBUTE_NORMAL, 53 FILE_SHARE_READ, 54 FILE_OPEN_IF, 55 FILE_NON_DIRECTORY_FILE | 56 FILE_SYNCHRONOUS_IO_NONALERT, 57 NULL, 58 0 ); 59 if (!NT_SUCCESS(status)) 60 { 61 bRet = FALSE; 62 goto END; 63 } 64 // 为 buffer 分配 4KB 空间 65 buffer = ExAllocatePool(NonPagedPool, 1024 * 4); 66 if (buffer == NULL) 67 { 68 bRet = FALSE; 69 goto END; 70 } 71 // 复制文件 72 while (1) 73 { 74 length = 4 * 1024; 75 // 读取源文件 76 status = ZwReadFile(hSrcFile, 77 NULL, 78 NULL, 79 NULL, 80 &Io_Status_Block, 81 buffer, 82 length, 83 &offset, 84 NULL); 85 if (!NT_SUCCESS(status)) 86 { 87 // 如果状态为 STATUS_END_OF_FILE，说明文件已经读取到末尾 88 if (status == STATUS_END_OF_FILE) 89 { 90 bRet = TRUE; 91 goto END; 92 } 93 } 94 // 获得实际读取的长度 95 length = (ULONG)Io_Status_Block.Information; 96 // 写入到目标文件 97 status = ZwWriteFile( hDestFile, 98 NULL, 99 NULL,100 NULL,101 &Io_Status_Block,102 buffer,103 length,104 &offset,105 NULL);106 if (!NT_SUCCESS(status))107 {108 bRet = FALSE;109 goto END;110 }111 // 移动文件指针112 offset.QuadPart += length;113 }114 }115 while (0);116 END:117 if (hSrcFile)118 {119 ZwClose(hSrcFile);120 }121 if (hDestFile)122 {123 ZwClose(hDestFile);124 }125 if (buffer != NULL)126 {127 ExFreePool(buffer);128 }129 return bRet;130 }