list File By Driver Samlpe Code

 by killvxk

//感谢RKU的作者的sys文件~ NTSTATUS EventCompletion( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context ) {      PIO_STATUS_BLOCK lpiosb;      lpiosb = Irp->UserIosb;      lpiosb->Status = Irp->IoStatus.Status;      lpiosb->Information = Irp->IoStatus.Information;      KeSetEvent(Irp->UserEvent,0,FALSE);      IoFreeIrp(Irp);      return STATUS_MORE_PROCESSING_REQUIRED; } PVOID GetDirectory(PDEVICE_OBJECT pDevobj,char *lpDirName,PDWORD dwRetSize) {      NTSTATUS status;      DWORD dwBytesReturned;      OBJECT_ATTRIBUTES oa;      PDEVICE_OBJECT lpDeviceObject;      KEVENT event;      IO_STACK_LOCATION iost;      PIO_STACK_LOCATION lpsp;      IO_STATUS_BLOCK ios;      PIRP lpirp = NULL;      HANDLE hFile;      PVOID lpSystemBuffer;      PFILE_DIRECTORY_INFORMATION lpInformation;      PFILE_DIRECTORY_INFORMATION lpRealInformation;      PDIRECTORY_INFO lpDirInfo;      PFILE_OBJECT lpFileObject;      UNICODE_STRING unFileName;      UNICODE_STRING UN;      ANSI_STRING anFileName;      CHAR buffer[1024];      PUCHAR lpNext;      dwBytesReturned = 0;      status = STATUS_UNSUCCESSFUL;      RtlZeroMemory(buffer,1024);      strcpy(buffer,"//DosDevices//");      strcat(buffer,lpDirName);      RtlInitAnsiString(&anFileName,buffer);      RtlAnsiStringToUnicodeString(&unFileName,&anFileName,TRUE);      InitializeObjectAttributes(&oa,&unFileName,OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,NULL,NULL);      status = ZwOpenFile(&hFile,FILE_LIST_DIRECTORY + SYNCHRONIZE+FILE_ANY_ACCESS,&oa,&ios,FILE_SHARE_READ + FILE_SHARE_WRITE + FILE_SHARE_DELETE,FILE_DIRECTORY_FILE + FILE_SYNCHRONOUS_IO_NONALERT);      if(NT_SUCCESS(status))      {           DbgPrint("ZwOpenFile Success/n");      }else goto endcddir;      status =ObReferenceObjectByHandle(hFile,FILE_LIST_DIRECTORY + SYNCHRONIZE,0,KernelMode,&lpFileObject,NULL);      if(!NT_SUCCESS(status))      {           ZwClose(hFile);           goto endcddir;      }      DbgPrint("open file object success/n");      lpDeviceObject = IoGetBaseFileSystemDeviceObject(lpFileObject);      lpirp = IoAllocateIrp(lpDeviceObject->StackSize,FALSE);      if(!lpirp)      {           DbgPrint("allocate irp failed/n");           ObDereferenceObject(lpFileObject);           ZwClose(hFile);           goto endcddir;      }      DbgPrint("allocate irp success/n");      KeInitializeEvent(&event,SynchronizationEvent,FALSE);      lpInformation = ExAllocatePool(PagedPool,65535);      lpSystemBuffer = ExAllocatePool(PagedPool,65535);      RtlZeroMemory(lpSystemBuffer,65535);      RtlZeroMemory(lpInformation,65535);      lpirp->UserEvent = &event;      lpirp->UserBuffer = lpInformation;      lpirp->AssociatedIrp.SystemBuffer = lpInformation;      lpirp->MdlAddress = NULL;      lpirp->Flags = 0;      lpirp->UserIosb = &ios;      lpirp->Tail.Overlay.OriginalFileObject = lpFileObject;      lpirp->Tail.Overlay.Thread = PsGetCurrentThread();      lpirp->RequestorMode = KernelMode;      lpsp = IoGetNextIrpStackLocation(lpirp);      lpsp->MajorFunction = IRP_MJ_DIRECTORY_CONTROL;      lpsp->MinorFunction = IRP_MN_QUERY_DIRECTORY;      lpsp->FileObject = lpFileObject;      lpsp->DeviceObject = lpDeviceObject;      lpsp->Flags = SL_RESTART_SCAN;      lpsp->Control = 0;      lpsp->Parameters.QueryDirectory.FileIndex = 0;      lpsp->Parameters.QueryDirectory.FileInformationClass = FileDirectoryInformation;      lpsp->Parameters.QueryDirectory.FileName = NULL;      lpsp->Parameters.QueryDirectory.Length = 65535;      IoSetCompletionRoutine(lpirp,EventCompletion,0,TRUE,TRUE,TRUE);      status = IoCallDriver(lpDeviceObject,lpirp);      KeWaitForSingleObject(&event,Executive,KernelMode,TRUE,0);      lpDirInfo = (PDIRECTORY_INFO)lpSystemBuffer;      lpRealInformation = lpInformation;      while(1)      {           UN.Length = (USHORT)lpInformation->FileNameLength;           UN.MaximumLength = (USHORT)lpInformation->FileNameLength;           UN.Buffer = &(lpInformation->FileName[0]);           RtlUnicodeStringToAnsiString(&anFileName,&UN,TRUE);           strcpy(lpDirInfo->FileName,anFileName.Buffer);           RtlFreeAnsiString(&anFileName);           lpDirInfo->CreationTime.QuadPart = lpInformation->CreationTime.QuadPart;           lpDirInfo->EndOfFile.QuadPart = lpInformation->EndOfFile.QuadPart;           lpDirInfo->FileAttributes = lpInformation->FileAttributes;           dwBytesReturned+=sizeof(TDIRECTORY_INFO);           if(!lpInformation->NextEntryOffset) goto exit;           lpNext = (PUCHAR)lpInformation;           lpNext+=lpInformation->NextEntryOffset;           lpInformation = (PFILE_DIRECTORY_INFORMATION)(lpNext);           //(char *)p+p->nextEntryoffset;           lpDirInfo++;      } endcddir:      RtlFreeUnicodeString(&unFileName); return NULL; exit:      ExFreePool(lpRealInformation);      ObDereferenceObject(lpFileObject);      ZwClose(hFile);      RtlFreeUnicodeString(&unFileName);      *dwRetSize = dwBytesReturned;      return lpSystemBuffer; }