MyZwCopyFile实现

来自： https://blog.csdn.net/apxar/article/details/10517475 有俩个问题 第一参数一定要用UNICODE_STRING或者PUNICODE_STRING（这里第一个为什么没变因为那是我自己创建路径本来用的是wchar就不会出现错）原因会拷贝时出现在乱拷贝如一个目录有xxx.exe xxx.exe* 它有可能找不到文件有可能拷贝的是后面那个因为传进来的有乱码它匹配哪个是哪个没匹配到报0xc00000033 第二读文件权限太多 读文件GENERIC_ALL权限修改成GENERIC_READ 写修改成对应的文件。 第一个问题截图 （把0大小的文件删除又会拷贝成功 同时是概率性的 说明是乱码问题概率性匹配 ） 第二就是直接打开失败 修改后 也可以第一个参数也修改

BOOLEAN MyZwCopyFile(PCWSTR desFile, UNICODE_STRING srcFile)
{


	HANDLE readFileHandle;
	HANDLE writeFileHandle;
	OBJECT_ATTRIBUTES ObjectAttributes;
	OBJECT_ATTRIBUTES ObjectAttributes1;
	UNICODE_STRING readFilePath = srcFile;
	UNICODE_STRING writeFilePath;
	IO_STATUS_BLOCK IoStatusBlock;
	NTSTATUS status;

	PVOID saveBuffer = NULL;
	LARGE_INTEGER byteOffset;
	ULONG length = 0;
	byteOffset.QuadPart = 0;
	//RtlInitUnicodeString(&readFilePath, srcFile);
	RtlInitUnicodeString(&writeFilePath, desFile);

	saveBuffer = ExAllocatePoolWithTag(PagedPool, 1000, "tag1");
	InitializeObjectAttributes(&ObjectAttributes, &readFilePath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
	InitializeObjectAttributes(&ObjectAttributes1, &writeFilePath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
	status = ZwCreateFile(&readFileHandle, GENERIC_READ, &ObjectAttributes, &IoStatusBlock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OPEN_IF, FILE_NON_DIRECTORY_FILE | FILE_RANDOM_ACCESS | FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);

	if (!NT_SUCCESS(status))
	{
		 
		DbgPrint("ZwCreateFile readFileHandle failed and status is 0X%x , filepath %S\n" ,status, srcFile);
		DbgPrint("ZwCreateFile readFileHandle failed and status is 0X%x , filepath %ws\n", status, srcFile);
		DbgPrint("ZwCreateFile readFileHandle failed and status is 0X%x , filepath %wZ\n", status, srcFile);
		if (readFileHandle != NULL)
			ZwClose(readFileHandle);


		if (saveBuffer != NULL)
			ExFreePool(saveBuffer);


		return FALSE;
	}

	status = ZwCreateFile(&writeFileHandle, GENERIC_WRITE, &ObjectAttributes1, &IoStatusBlock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OPEN_IF, FILE_NON_DIRECTORY_FILE | FILE_RANDOM_ACCESS | FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);

	if (!NT_SUCCESS(status))
	{
		if (readFileHandle != NULL)
			ZwClose(readFileHandle);

		if (writeFileHandle != NULL)
			ZwClose(writeFileHandle);

		if (saveBuffer != NULL)
			ExFreePool(saveBuffer);
		 
		DbgPrint("writeFileHandle  failed and status is 0X%x ,filepath %S\n", status, desFile);
		DbgPrint("writeFileHandle  failed and status is 0X%x ,filepath %ws\n", status, desFile);
		DbgPrint("writeFileHandle  failed and status is 0X%x ,filepath %wZ\n", status, desFile);
		return FALSE;
	}


	do
	{

		length = 1000;
		status = ZwReadFile(readFileHandle, NULL, NULL, NULL, &IoStatusBlock, saveBuffer, length, &byteOffset, NULL);//读取数据
		if (!NT_SUCCESS(status))
		{
			if (status == STATUS_END_OF_FILE)

				DbgPrint("ZwReadFile readFileHandle read File End");
			if (readFileHandle != NULL)
				ZwClose(readFileHandle);

			if (writeFileHandle != NULL)
				ZwClose(writeFileHandle);

			if (saveBuffer != NULL)
				ExFreePool(saveBuffer);
			return FALSE;
		}

		length = IoStatusBlock.Information; 

		status = ZwWriteFile(writeFileHandle, NULL, NULL, NULL, &IoStatusBlock, saveBuffer, length, &byteOffset, NULL);

		if (!NT_SUCCESS(status))
		{
			DbgPrint("ZwWriteFile writeFileHandle Can not write File ");
			if (readFileHandle != NULL)
				ZwClose(readFileHandle);

			if (writeFileHandle != NULL)
				ZwClose(writeFileHandle);

			if (saveBuffer != NULL)
				ExFreePool(saveBuffer);
			return FALSE;
		}

		byteOffset.QuadPart += length; 

	} while (1);

	if (readFileHandle != NULL)
		ZwClose(readFileHandle);

	if (writeFileHandle != NULL)
		ZwClose(writeFileHandle);

	if (saveBuffer != NULL)
		ExFreePool(saveBuffer);
	return TRUE;
}