内核层处理文件路径参数问题
#include<ntifs.h>
#include<ntddk.h>
#include<wdm.h>
template<typename... types>
void print(types... args)
{
DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_ERROR_LEVEL, args...);
}
void unload(PDRIVER_OBJECT DriverUnload) {
return;
}
extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT drv, PUNICODE_STRING reg) {
drv->DriverUnload = unload;
HANDLE FileHandle;
OBJECT_ATTRIBUTES oa1;
UNICODE_STRING path1 = RTL_CONSTANT_STRING(L"\\??\\C:\\Users\\123\\Desktop\\KmdManager.exe");
UNICODE_STRING path2 = RTL_CONSTANT_STRING(L"\\Device\\HarddiskVolume2\\Users\\123\\Desktop\\KmdManager.exe");
UNICODE_STRING path3 = RTL_CONSTANT_STRING(L"C:\\Users\\123\\Desktop\\KmdManager.exe");
IO_STATUS_BLOCK iosb;
NTSTATUS s;
InitializeObjectAttributes(
&oa1,
&path1,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
0,
0
);
s = ZwOpenFile(&FileHandle, SYNCHRONIZE | FILE_READ_DATA,&oa1,&iosb, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_SYNCHRONOUS_IO_ALERT);
print("path1 return %x\n", s); //return success
InitializeObjectAttributes(
&oa1,
&path2,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
0,
0
);
s = ZwOpenFile(&FileHandle, SYNCHRONIZE | FILE_READ_DATA, &oa1, &iosb, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_SYNCHRONOUS_IO_ALERT);
print("path2 return %x\n", s); //return success
InitializeObjectAttributes(
&oa1,
&path3,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
0,
0
);
s = ZwOpenFile(&FileHandle, SYNCHRONIZE | FILE_READ_DATA, &oa1, &iosb, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_SYNCHRONOUS_IO_ALERT);
print("path3 return %x\n", s); //return STATUS_OBJECT_PATH_SYNTAX_BAD(0xC000003BL)
return STATUS_SUCCESS;
}