x64内核中强删文件的实现
一丶简介
说道删除文件.有各种各样的方法. 有ring3 也有ring0. 而且也有许多对抗的方法. 如ring3想删除一个文件.被占用你就无法删除.此时可以通过解除句柄进行删除 ring0中想删除一个文件.有常规方法也有非常规方法.常规方法就是 设置文件属性为删除.然后进行设置. 还有就是直接调用ZwDeleteFile 进行删除. 暴力删除就是这里所讲的 IRP删除.给底层发送IRP即可进行删除文件.
1.步骤
步骤很简单.基本上说完就可以自己写代码做出
- 1.打开文件.获取文件句柄 (IoCreateFile)
- 2.根据文件句柄,获取文件对象.(有了句柄都应该第一时间想到获取它的对象) (ObReferenceObjectByHandle)
- 3.获取文件对象的设备对象指针.这个发送IRP的时候需要使用(IoGetRelatedDeviceObject)
- 4.申请IRP(IoAllocateIrp)
- 5.初始化你申请的IRP
- 6.获取IRP的下层堆栈,并且初始化信息.(IoGetNextIrpStackLocation)
- 7.设置回调.系统完成IRP之后会调用你这个回调.所以你需要设置事件同步跟你自己同步,才知道IRP已经发送完了.(IoSetCompletionRoutine)
- 8.获取文件对象的域指针.并且设置域指针的两个成员为0.系统以他来判断这个程序是否可以删除.如果不为0.那么则无法删除运行中的文件.
pSectionObjectPointer->ImageSectionObject = 0;
pSectionObjectPointer->DataSectionObject = 0;- 9.发送IRP(IoCallDriver)
- 10.根据 事件 来等待是否IRP完成(KeWaitForSingleObject)
- 11.做完收工.(ZwClose)
2.Nt驱动代码
代码语言：javascript复制#include "Driver.h"
//删除文件函数的入口
NTSTATUS RetOpenFileHandle(UNICODE_STRING uDelFileName, PHANDLE pFileHandle)
{
NTSTATUS ntStatus = STATUS_UNSUCCESSFUL;
IO_STATUS_BLOCK iostu;
HANDLE hFileHandle = 0;
if (pFileHandle == NULL)
return STATUS_UNSUCCESSFUL;
if (KeGetCurrentIrql() > PASSIVE_LEVEL)
return 0;
if (uDelFileName.Length < 0 || uDelFileName.MaximumLength < 0)
{
return 0;
}
OBJECT_ATTRIBUTES ObjAttribute;
ObjAttribute.ObjectName = &uDelFileName;
ObjAttribute.SecurityDescriptor = NULL;
ObjAttribute.SecurityQualityOfService = NULL;
ObjAttribute.Attributes = OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE;
ObjAttribute.Length = sizeof(OBJECT_ATTRIBUTES);
/* InitializeObjectAttributes(
&ObjAttribute,
&uDelFileName,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
NULL, NULL);*/
ntStatus = IoCreateFile(&hFileHandle,
FILE_READ_ATTRIBUTES,
&ObjAttribute,
&iostu,
0,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_DELETE,
FILE_OPEN,
0,
NULL,
0,
CreateFileTypeNone,
NULL,
IO_NO_PARAMETER_CHECKING);
*pFileHandle = hFileHandle;
return ntStatus;
}
//去掉文件属性
//CallBack回调
NTSTATUS
CallBackIrpCompleteionProc(
PDEVICE_OBJECT DeviceObject,
PIRP Irp,
PVOID Context
)
{
//操作系统会设置这个回调
Irp->UserIosb->Status = Irp->IoStatus.Status;
Irp->UserIosb->Information = Irp->IoStatus.Information;
KeSetEvent(Irp->UserEvent, IO_NO_INCREMENT, FALSE);
IoFreeIrp(Irp);
return STATUS_MORE_PROCESSING_REQUIRED;
}
NTSTATUS PassFileattribute(PFILE_OBJECT pFileObj)
{
/*
1.申请IRP,初始化IRP
2.初始化同步事件,以及设置回调.
3.设置文件属性为默认
4.发送IRP
*/
PDEVICE_OBJECT pNextDeviceObj = NULL;
PIRP pAllocIrp = NULL;
KEVENT IrpSynEvent = {0}; //Irp同步需要的事件同步
FILE_BASIC_INFORMATION fileBasciInfo = { 0 };
IO_STATUS_BLOCK iostu;
PIO_STACK_LOCATION IrpStack;
//通过文件对象.获取其设备对象指针
pNextDeviceObj = IoGetRelatedDeviceObject(pFileObj);
if (pNextDeviceObj == NULL)
return STATUS_UNSUCCESSFUL;
//通过设备对象指针.确定申请的IRP的大小,注意在完成设置里面进行释放.
pAllocIrp = IoAllocateIrp(pNextDeviceObj->StackSize,TRUE);
if (pAllocIrp == NULL)
return STATUS_UNSUCCESSFUL;
//初始化Irp
//设置为自动,设置为无信号.
KeInitializeEvent(&IrpSynEvent, SynchronizationEvent, FALSE);
fileBasciInfo.FileAttributes = FILE_ATTRIBUTE_NORMAL;
pAllocIrp->AssociatedIrp.SystemBuffer = &fileBasciInfo;
pAllocIrp->UserIosb = &iostu;
pAllocIrp->UserEvent = &IrpSynEvent;
pAllocIrp->Tail.Overlay.OriginalFileObject = pFileObj;
pAllocIrp->Tail.Overlay.Thread = (PETHREAD)KeGetCurrentThread();
//获取下层堆栈.进行设置.
//IrpStack =
IrpStack = IoGetNextIrpStackLocation(pAllocIrp);
IrpStack->MajorFunction = IRP_MJ_SET_INFORMATION;
IrpStack->DeviceObject = pNextDeviceObj;
IrpStack->FileObject = pFileObj;
IrpStack->Parameters.SetFile.Length = sizeof(FILE_BASIC_INFORMATION);
IrpStack->Parameters.SetFile.FileObject = pFileObj;
IrpStack->Parameters.SetFile.FileInformationClass = FileBasicInformation;
//设置完成例程
IoSetCompletionRoutine(pAllocIrp, CallBackIrpCompleteionProc, &IrpSynEvent, TRUE, TRUE, TRUE);
//发送IRP
IoCallDriver(pNextDeviceObj, pAllocIrp);
//等待完成.
KeWaitForSingleObject(&IrpSynEvent, Executive, KernelMode, TRUE, NULL);
return STATUS_SUCCESS;
}
NTSTATUS FsDeleteFile(PFILE_OBJECT pFileObj)
{
/*
1.申请IRP,初始化IRP
2.初始化同步事件,以及设置回调.
3.设置文件属性为默认
4.发送IRP
核心:
核心是设置 FileObject中的域.进而删除正在运行中的文件
*/
PDEVICE_OBJECT pNextDeviceObj = NULL;
PIRP pAllocIrp = NULL;
KEVENT IrpSynEvent = { 0 }; //Irp同步需要的事件同步
FILE_DISPOSITION_INFORMATION fileBasciInfo = { 0 }; //注意此位置.已经变化为 FILE_DISPOSITION_INFORMATION
IO_STATUS_BLOCK iostu;
PIO_STACK_LOCATION IrpStack;
PSECTION_OBJECT_POINTERS pFileExe; //注意此属性要设置为0.欺骗系统进行删除
//通过文件对象.获取其设备对象指针
pNextDeviceObj = IoGetRelatedDeviceObject(pFileObj);
if (pNextDeviceObj == NULL)
return STATUS_UNSUCCESSFUL;
//通过设备对象指针.确定申请的IRP的大小,注意在完成设置里面进行释放.
pAllocIrp = IoAllocateIrp(pNextDeviceObj->StackSize, TRUE);
if (pAllocIrp == NULL)
return STATUS_UNSUCCESSFUL;
//初始化Irp
//设置为自动,设置为无信号.
KeInitializeEvent(&IrpSynEvent, SynchronizationEvent, FALSE);
fileBasciInfo.DeleteFile = TRUE; //设置标记为删除
pAllocIrp->AssociatedIrp.SystemBuffer = &fileBasciInfo;
pAllocIrp->UserIosb = &iostu;
pAllocIrp->UserEvent = &IrpSynEvent;
pAllocIrp->Tail.Overlay.OriginalFileObject = pFileObj;
pAllocIrp->Tail.Overlay.Thread = (PETHREAD)KeGetCurrentThread();
//获取下层堆栈.进行设置.
//IrpStack =
IrpStack = IoGetNextIrpStackLocation(pAllocIrp);
IrpStack->MajorFunction = IRP_MJ_SET_INFORMATION;
IrpStack->DeviceObject = pNextDeviceObj;
IrpStack->FileObject = pFileObj;
IrpStack->Parameters.SetFile.Length = sizeof(FILE_DISPOSITION_INFORMATION);
IrpStack->Parameters.SetFile.FileObject = pFileObj;
IrpStack->Parameters.SetFile.FileInformationClass = FileDispositionInformation;
//设置完成例程
IoSetCompletionRoutine(pAllocIrp, CallBackIrpCompleteionProc, &IrpSynEvent, TRUE, TRUE, TRUE);
//删除正在运行中的文件.
pFileExe = pFileObj->SectionObjectPointer;
pFileExe->DataSectionObject = 0;
pFileExe->ImageSectionObject = 0;
//发送IRP
IoCallDriver(pNextDeviceObj, pAllocIrp);
//等待完成.
KeWaitForSingleObject(&IrpSynEvent, Executive, KernelMode, TRUE, NULL);
return STATUS_SUCCESS;
}
NTSTATUS IrpDeleteFileRun(UNICODE_STRING uDelFileName)
{
KdBreakPoint();
NTSTATUS ntStatus = STATUS_UNSUCCESSFUL;
/*
1.首先通过发送IRP去掉文件的属性
2.设置文件属性为删除.进行发送IRP强删文件.
*/
HANDLE hFileHandle = { 0 };
PFILE_OBJECT pFileObject = NULL;
//sep1 : OpenFile Get File Handle
ntStatus = RetOpenFileHandle(uDelFileName,&hFileHandle);
if (!NT_SUCCESS(ntStatus))
{
goto ExitAnRelease;
}
//sep2: Chang File Handle to FileObject
ntStatus = ObReferenceObjectByHandle(
hFileHandle,
GENERIC_ALL,
*IoFileObjectType,
KernelMode,
&pFileObject,
NULL);
if (!NT_SUCCESS(ntStatus))
{
goto ExitAnRelease;
}
//setp 3: Pass File Atribute
KdBreakPoint();
ntStatus = PassFileattribute(pFileObject);
if (!NT_SUCCESS(ntStatus))
{
goto ExitAnRelease;
}
//setp 4: Send Irp DeleteFile
KdBreakPoint();
ntStatus = FsDeleteFile(pFileObject);
if (!NT_SUCCESS(ntStatus))
{
goto ExitAnRelease;
}
ExitAnRelease:
if (pFileObject != NULL)
ObDereferenceObject(pFileObject);
if (hFileHandle != NULL)
ZwClose(hFileHandle);
return ntStatus;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegPath)
{
ULONG iCount = 0;
NTSTATUS ntStatus;
UNICODE_STRING uDelFileName = { 0 };
pDriverObj->DriverUnload = DriverUnLoad;
/*ntStatus = InitDeviceAnSybolicLinkName(pDriverObj);
if (!NT_SUCCESS(ntStatus))
{
return ntStatus;
}
ntStatus = InitDisPatchFunction(pDriverObj);
if (!NT_SUCCESS(ntStatus))
{
return ntStatus;
}*/
//也可写成: \??\c:\xxx.txt
RtlInitUnicodeString(&uDelFileName, L"//DosDevices//C://123.txt");
IrpDeleteFileRun(uDelFileName);
return STATUS_SUCCESS;
}代码测试可以进行强删.
