CybEl

Kernel2

Apr 3rd, 2019 (edited)
200
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.25 KB | None | 0 0
  1. UNICODE_STRING uniName;
  2. OBJECT_ATTRIBUTES objAttr;
  3.  
  4. RtlInitUnicodeString(&uniName, L"\\DosDevices\\C:\\Users\\rainb\\source\\repos\\testAppForKernel\\x64\\Debug\\usermode.txt"); // or L"\\SystemRoot\\example.txt"
  5. InitializeObjectAttributes(&objAttr, &uniName,
  6. OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
  7. NULL, NULL);
  8.  
  9. HANDLE handle;
  10. NTSTATUS ntstatus;
  11. IO_STATUS_BLOCK ioStatusBlock;
  12.  
  13. if (KeGetCurrentIrql() != PASSIVE_LEVEL)
  14. return STATUS_INVALID_DEVICE_STATE;
  15.  
  16. ntstatus = ZwCreateFile(&handle,
  17. GENERIC_WRITE,
  18. &objAttr, &ioStatusBlock, NULL,
  19. FILE_ATTRIBUTE_NORMAL,
  20. 0,
  21. FILE_OVERWRITE_IF,
  22. FILE_SYNCHRONOUS_IO_NONALERT,
  23. NULL, 0);
  24.  
  25. LARGE_INTEGER byteOffset;
  26. #define BUFFER_SIZE 30
  27. CHAR buffer[BUFFER_SIZE];
  28.  
  29. ntstatus = ZwCreateFile(&handle,
  30. GENERIC_READ,
  31. &objAttr, &ioStatusBlock,
  32. NULL,
  33. FILE_ATTRIBUTE_NORMAL,
  34. 0,
  35. FILE_OPEN,
  36. FILE_SYNCHRONOUS_IO_NONALERT,
  37. NULL, 0);
  38. if (NT_SUCCESS(ntstatus)) {
  39. byteOffset.LowPart = byteOffset.HighPart = 0;
  40. ntstatus = ZwReadFile(handle, NULL, NULL, NULL, &ioStatusBlock,
  41. buffer, BUFFER_SIZE, &byteOffset, NULL);
  42. if (NT_SUCCESS(ntstatus)) {
  43. buffer[BUFFER_SIZE - 1] = '\0';
  44. DbgPrint("%s\n", buffer);
  45. }
  46. ZwClose(handle);
  47. }
Add Comment
Please, Sign In to add comment