Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- HANDLE hFile, hSection;
- IO_STATUS_BLOCK iosb;
- NTSTATUS status;
- STATIC_OBJECT_ATTRIBUTES(oa, "\\Device\\@@@@@@@@");
- if (0 <= (status = NtOpenFile(&hFile, FILE_ALL_ACCESS, &oa, &iosb, 0, FILE_SYNCHRONOUS_IO_NONALERT)))
- {
- status = NtCreateSection(&hSection, SECTION_ALL_ACCESS, 0, 0, PAGE_READWRITE, SEC_COMMIT, hFile);
- NtClose(hFile);
- if (0 <= status)
- {
- PVOID BaseAddress = 0;
- SIZE_T ViewSize = 0;
- status = ZwMapViewOfSection(hSection, NtCurrentProcess(), &BaseAddress, 0, 0, 0,
- &ViewSize, ViewUnmap, MEM_TOP_DOWN, PAGE_READWRITE);
- NtClose(hSection);
- if (0 <= status)
- {
- ZwUnmapViewOfSection(NtCurrentProcess(), BaseAddress);
- }
- }
- }
- //-- NtOpenFile
- 00000005 27.67451668 NT::OnCreate(FFFFE0000233C960 00000884 fo=FFFFE00002990590)
- 00000006 27.67472649 NT::FCB::FCB<FFFFE00001A35150>
- 00000007 27.67475128 PrivateCacheMap=FFFFE00002798CD8, buf = FFFFC00001E00000 2
- //-- NtCreateSection
- 00000008 51.80152512 NT::AcquireFileForNtCreateSection(FFFFE00002990590)
- 00000009 51.80153275 FastIoQueryStandardInfo
- 00000010 51.80154037 NT::ReleaseFileForNtCreateSection(FFFFE00002990590)
- 00000011 51.80155182 NT::AcquireFileForNtCreateSection(FFFFE00002990590)
- 00000012 51.80155563 NT::ReleaseFileForNtCreateSection(FFFFE00002990590)
- //-- NtClose(hFile)
- 00000014 77.45678711 NT::OnCleanup(FFFFE00001B47E60 00000404 fo=FFFFE00002990590 FFFFC00001E00000)
- 00000015 77.45679474 CcPurgeCacheSection=1
- 00000016 77.45679474 Flags=40042 0000000000000000
- 00000017 78.69149017 NT::AcquireForLazyWrite(FFFFE00001A35150 1)
- 00000018 78.69151306 NT::ReleaseFromLazyWrite(FFFFE00001A35150 660e5c90)
- 00000019 78.69152069 NT::AcquireFileForNtCreateSection(FFFFE00002990590)
- 00000020 78.69152069 NT::ReleaseFileForNtCreateSection(FFFFE00002990590)
- //-- under debugger i access BaseAddress ( reference count on FileObject raised from 2 to 0x10 )
- 00000045 170.63281250 NT::OnRead(FFFFE00002376CD0 00060043 m=0)
- 00000046 170.63284302 NT::DoRead[8a0]<0000000000000000>(00060043 mdl=FFFFE0000293DF50 ub=0000000000000000 w=1 fo=FFFFE00002990590 1000 -> 0)
- 00000047 170.63284302 MmGetSystemAddressForMdlSafe=FFFFD000247E0000
- 00000048 170.63284302 FFFFC00001E00000 << 1000
- 00000049 170.63284302 NT::DoRead=0, 0000000000001000
- // ZwUnmapViewOfSection - no visible effect in driver (in user mode view is unmapped of course). reference count on FileObject unchanged
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement