|
|
本帖最后由 Krueger 于 2020-6-26 14:25 编辑
好吧，我試圖強制刪除由minifilter鎖定的文件，並且這些文件具有使文件名無效的快捷方式
 ，
像IoCreateFile這樣的函數將因NTSTATUS代碼0xC000003A（STATUS_OBJECT_PATH_NOT_FOUND）或0xC0000034（STATUS_OBJECT_NAME_INVALID）而失敗。 今天，我在此文件上測試了PCHunter的“強制刪除”功能，但是並未刪除該文件，當在包含該文件的文件夾上使用“強制刪除”功能時，所有內容均被刪除。
有關如何執行此操作的任何想法？ 以下是我用來強制刪除minifilter鎖定的普通文件的代碼。
- #include <ntifs.h>
- #include <ntddk.h>
- HANDLE
- SkillIoOpenFile(
- IN PCWSTR FileName,
- IN ACCESS_MASK DesiredAccess,
- IN ULONG ShareAccess)
- {
- NTSTATUS ntStatus;
- UNICODE_STRING uniFileName;
- OBJECT_ATTRIBUTES objectAttributes;
- HANDLE ntFileHandle;
- IO_STATUS_BLOCK ioStatus;
- if (KeGetCurrentIrql() > PASSIVE_LEVEL) {
- DbgPrint("KeGetCurrentIrql() > PASSIVE_LEVEL\n");
- return 0;
- }
- RtlInitUnicodeString(&uniFileName, FileName);
- InitializeObjectAttributes(&objectAttributes, &uniFileName,
- OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
- ntStatus = IoCreateFile(&ntFileHandle,
- DesiredAccess,
- &objectAttributes,
- &ioStatus,
- 0,
- FILE_ATTRIBUTE_NORMAL,
- ShareAccess,
- FILE_OPEN,
- 0,
- NULL,
- 0,
- 0,
- NULL,
- IO_NO_PARAMETER_CHECKING);
- if (!NT_SUCCESS(ntStatus)) {
- DbgPrint("IoCreateFile() error - 0x%X \n", ntStatus);
- return 0;
- }
- return ntFileHandle;
- }
- NTSTATUS
- SkillSetFileCompletion(
- IN PDEVICE_OBJECT DeviceObject,
- IN PIRP Irp,
- IN PVOID Context)
- {
- Irp->UserIosb->Status = Irp->IoStatus.Status;
- Irp->UserIosb->Information = Irp->IoStatus.Information;
- KeSetEvent(Irp->UserEvent, IO_NO_INCREMENT, FALSE);
- IoFreeIrp(Irp);
- return STATUS_MORE_PROCESSING_REQUIRED;
- }
- BOOLEAN
- ForceFileAttributes(
- IN HANDLE FileHandle)
- {
- NTSTATUS ntStatus = STATUS_SUCCESS;
- PFILE_OBJECT fileObject;
- PDEVICE_OBJECT DeviceObject, BaseDeviceObject;
- PIRP Irp;
- KEVENT event1;
- FILE_BASIC_INFORMATION FileInformation;
- IO_STATUS_BLOCK ioStatus;
- PIO_STACK_LOCATION irpSp;
- ntStatus = ObReferenceObjectByHandle(FileHandle,
- DELETE,
- *IoFileObjectType,
- KernelMode,
- &fileObject,
- NULL);
- if (!NT_SUCCESS(ntStatus))
- return FALSE;
- DeviceObject = IoGetRelatedDeviceObject(fileObject);
- BaseDeviceObject = IoGetDeviceAttachmentBaseRef(DeviceObject);
- Irp = IoAllocateIrp(BaseDeviceObject->StackSize, TRUE);
- if (Irp == NULL) {
- ObDereferenceObject(fileObject);
- return FALSE;
- }
- KeInitializeEvent(&event1, SynchronizationEvent, FALSE);
- memset(&FileInformation, 0, 0x28);
- FileInformation.FileAttributes = FILE_ATTRIBUTE_NORMAL;
- Irp->AssociatedIrp.SystemBuffer = &FileInformation;
- Irp->UserEvent = &event1;
- Irp->UserIosb = &ioStatus;
- Irp->Tail.Overlay.OriginalFileObject = fileObject;
- Irp->Tail.Overlay.Thread = (PETHREAD)KeGetCurrentThread();
- Irp->RequestorMode = KernelMode;
- irpSp = IoGetNextIrpStackLocation(Irp);
- irpSp->MajorFunction = IRP_MJ_SET_INFORMATION;
- irpSp->DeviceObject = BaseDeviceObject;
- irpSp->FileObject = fileObject;
- irpSp->Parameters.SetFile.Length = sizeof(FILE_BASIC_INFORMATION);
- irpSp->Parameters.SetFile.FileInformationClass = FileBasicInformation;
- irpSp->Parameters.SetFile.FileObject = fileObject;
- IoSetCompletionRoutine(
- Irp,
- SkillSetFileCompletion,
- &event1,
- TRUE,
- TRUE,
- TRUE);
- IoCallDriver(BaseDeviceObject, Irp);
- KeWaitForSingleObject(&event1, Executive, KernelMode, TRUE, NULL);
- ObDereferenceObject(fileObject);
- return TRUE;
- }
- BOOLEAN
- ForceDeleteFile(
- IN HANDLE FileHandle,
- IN BOOLEAN IsDirectory)
- {
- NTSTATUS ntStatus = STATUS_SUCCESS;
- PFILE_OBJECT fileObject;
- PDEVICE_OBJECT DeviceObject, BaseDeviceObject;
- PIRP Irp;
- KEVENT event1;
- FILE_DISPOSITION_INFORMATION FileInformation;
- IO_STATUS_BLOCK ioStatus;
- PIO_STACK_LOCATION irpSp;
- PSECTION_OBJECT_POINTERS pSectionObjectPointer;
- if (ForceFileAttributes(FileHandle))
- /*DbgPrint("ForceFileAttributes OK - %08X\n", FileHandle)*/;
- ntStatus = ObReferenceObjectByHandle(FileHandle,
- DELETE,
- *IoFileObjectType,
- KernelMode,
- &fileObject,
- NULL);
- if (!NT_SUCCESS(ntStatus))
- return FALSE;
- DeviceObject = IoGetRelatedDeviceObject(fileObject);
- BaseDeviceObject = IoGetDeviceAttachmentBaseRef(DeviceObject);
- Irp = IoAllocateIrp(BaseDeviceObject->StackSize, TRUE);
- if (Irp == NULL) {
- ObDereferenceObject(fileObject);
- return FALSE;
- }
- KeInitializeEvent(&event1, SynchronizationEvent, FALSE);
- FileInformation.DeleteFile = TRUE;
- Irp->AssociatedIrp.SystemBuffer = &FileInformation;
- Irp->UserEvent = &event1;
- Irp->UserIosb = &ioStatus;
- Irp->Tail.Overlay.OriginalFileObject = fileObject;
- Irp->Tail.Overlay.Thread = (PETHREAD)KeGetCurrentThread();
- Irp->RequestorMode = KernelMode;
- irpSp = IoGetNextIrpStackLocation(Irp);
- irpSp->MajorFunction = IRP_MJ_SET_INFORMATION;
- irpSp->DeviceObject = BaseDeviceObject;
- irpSp->FileObject = fileObject;
- irpSp->Parameters.SetFile.Length = sizeof(FILE_DISPOSITION_INFORMATION);
- irpSp->Parameters.SetFile.FileInformationClass = FileDispositionInformation;
- irpSp->Parameters.SetFile.FileObject = fileObject;
- IoSetCompletionRoutine(
- Irp,
- SkillSetFileCompletion,
- &event1,
- TRUE,
- TRUE,
- TRUE);
- if (!IsDirectory) {
- pSectionObjectPointer = fileObject->SectionObjectPointer;
- pSectionObjectPointer->ImageSectionObject = 0;
- pSectionObjectPointer->DataSectionObject = 0;
- CONST BOOLEAN ImageSectionFlushed = MmFlushImageSection(pSectionObjectPointer, MmFlushForDelete);
- if (ImageSectionFlushed)
- /*DbgPrint("ImageSectionFlushed() OK")*/;
- }
- IoCallDriver(BaseDeviceObject, Irp);
- KeWaitForSingleObject(&event1, Executive, KernelMode, TRUE, NULL);
- ObDereferenceObject(fileObject);
- return TRUE;
- }
- //---------------------------------------------------------------------------------------------------
- HANDLE hFileHandle = SkillIoOpenFile(L"\\??\\C:\\Program Files\\Some Software\\Subfolder\\file.dll",
- FILE_READ_ATTRIBUTES,
- FILE_SHARE_DELETE);
-
- if (hFileHandle != 0) {
-
- DbgPrint("hFileHandle: %08X\n", hFileHandle);
- if (ForceDeleteFile(hFileHandle, FALSE))
- DbgPrint("<%08X> - DELETE OK\n", hFileHandle);
- ZwClose(hFileHandle);
- }
|
|
发表于 2020-6-26 13:48:56
发表于 2020-6-26 14:45:16
