list File By Driver Samlpe Code

: · OBJECT

//感谢RKU的作者的sys文件~ 
NTSTATUS 
EventCompletion( 
IN PDEVICE_OBJECT DeviceObject, 
IN PIRP Irp, 
IN PVOID Context 
) 
{ 
     PIO_STATUS_BLOCK lpiosb; 
     lpiosb = Irp->UserIosb; 
     lpiosb->Status = Irp->IoStatus.Status; 
     lpiosb->Information = Irp->IoStatus.Information; 
     KeSetEvent(Irp->UserEvent,0,FALSE); 
     IoFreeIrp(Irp); 
     return STATUS_MORE_PROCESSING_REQUIRED; 
} 
PVOID GetDirectory(PDEVICE_OBJECT pDevobj,char *lpDirName,PDWORD dwRetSize) 
{ 
     NTSTATUS status; 
     DWORD dwBytesReturned; 
     OBJECT_ATTRIBUTES oa; 
     PDEVICE_OBJECT lpDeviceObject; 
     KEVENT event; 
     IO_STACK_LOCATION iost; 
     PIO_STACK_LOCATION lpsp; 
     IO_STATUS_BLOCK ios; 
     PIRP lpirp = NULL; 
     HANDLE hFile; 
     PVOID lpSystemBuffer; 
     PFILE_DIRECTORY_INFORMATION lpInformation; 
     PFILE_DIRECTORY_INFORMATION lpRealInformation; 
     PDIRECTORY_INFO lpDirInfo; 
     PFILE_OBJECT lpFileObject; 
     UNICODE_STRING unFileName; 
     UNICODE_STRING UN; 
     ANSI_STRING anFileName; 
     CHAR buffer[1024]; 
     PUCHAR lpNext; 
     dwBytesReturned = 0; 
     status = STATUS_UNSUCCESSFUL; 
     RtlZeroMemory(buffer,1024); 
     strcpy(buffer,"//DosDevices//"); 
     strcat(buffer,lpDirName); 
     RtlInitAnsiString(&anFileName,buffer); 
     RtlAnsiStringToUnicodeString(&unFileName,&anFileName,TRUE); 
     InitializeObjectAttributes(&oa,&unFileName,OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,NULL,NULL); 
     status = ZwOpenFile(&hFile,FILE_LIST_DIRECTORY + SYNCHRONIZE+FILE_ANY_ACCESS,&oa,&ios,FILE_SHARE_READ + FILE_SHARE_WRITE + FILE_SHARE_DELETE,FILE_DIRECTORY_FILE + FILE_SYNCHRONOUS_IO_NONALERT); 
     if(NT_SUCCESS(status)) 
     { 
          DbgPrint("ZwOpenFile Success/n"); 
     }else goto endcddir; 
     status =ObReferenceObjectByHandle(hFile,FILE_LIST_DIRECTORY + SYNCHRONIZE,0,KernelMode,&lpFileObject,NULL); 
     if(!NT_SUCCESS(status)) 
     { 
          ZwClose(hFile); 
          goto endcddir; 
     } 
     DbgPrint("open file object success/n"); 
     lpDeviceObject = IoGetBaseFileSystemDeviceObject(lpFileObject); 
     lpirp = IoAllocateIrp(lpDeviceObject->StackSize,FALSE); 
     if(!lpirp) 
     { 
          DbgPrint("allocate irp failed/n"); 
          ObDereferenceObject(lpFileObject); 
          ZwClose(hFile); 
          goto endcddir; 
     } 
     DbgPrint("allocate irp success/n"); 
     KeInitializeEvent(&event,SynchronizationEvent,FALSE); 
     lpInformation = ExAllocatePool(PagedPool,65535); 
     lpSystemBuffer = ExAllocatePool(PagedPool,65535); 
     RtlZeroMemory(lpSystemBuffer,65535); 
     RtlZeroMemory(lpInformation,65535); 
     lpirp->UserEvent = &event; 
     lpirp->UserBuffer = lpInformation; 
     lpirp->AssociatedIrp.SystemBuffer = lpInformation; 
     lpirp->MdlAddress = NULL; 
     lpirp->Flags = 0; 
     lpirp->UserIosb = &ios; 
     lpirp->Tail.Overlay.OriginalFileObject = lpFileObject; 
     lpirp->Tail.Overlay.Thread = PsGetCurrentThread(); 
     lpirp->RequestorMode = KernelMode; 
     lpsp = IoGetNextIrpStackLocation(lpirp); 
     lpsp->MajorFunction = IRP_MJ_DIRECTORY_CONTROL; 
     lpsp->MinorFunction = IRP_MN_QUERY_DIRECTORY; 
     lpsp->FileObject = lpFileObject; 
     lpsp->DeviceObject = lpDeviceObject; 
     lpsp->Flags = SL_RESTART_SCAN; 
     lpsp->Control = 0; 
     lpsp->Parameters.QueryDirectory.FileIndex = 0; 
     lpsp->Parameters.QueryDirectory.FileInformationClass = FileDirectoryInformation; 
     lpsp->Parameters.QueryDirectory.FileName = NULL; 
     lpsp->Parameters.QueryDirectory.Length = 65535; 
     IoSetCompletionRoutine(lpirp,EventCompletion,0,TRUE,TRUE,TRUE); 
     status = IoCallDriver(lpDeviceObject,lpirp); 
     KeWaitForSingleObject(&event,Executive,KernelMode,TRUE,0); 
     lpDirInfo = (PDIRECTORY_INFO)lpSystemBuffer; 
     lpRealInformation = lpInformation; 
     while(1) 
     { 
          UN.Length = (USHORT)lpInformation->FileNameLength; 
          UN.MaximumLength = (USHORT)lpInformation->FileNameLength; 
          UN.Buffer = &(lpInformation->FileName[0]); 
          RtlUnicodeStringToAnsiString(&anFileName,&UN,TRUE); 
          strcpy(lpDirInfo->FileName,anFileName.Buffer); 
          RtlFreeAnsiString(&anFileName); 
          lpDirInfo->CreationTime.QuadPart = lpInformation->CreationTime.QuadPart; 
          lpDirInfo->EndOfFile.QuadPart = lpInformation->EndOfFile.QuadPart; 
          lpDirInfo->FileAttributes = lpInformation->FileAttributes; 
          dwBytesReturned+=sizeof(TDIRECTORY_INFO); 
          if(!lpInformation->NextEntryOffset) goto exit; 
          lpNext = (PUCHAR)lpInformation; 
          lpNext+=lpInformation->NextEntryOffset; 
          lpInformation = (PFILE_DIRECTORY_INFORMATION)(lpNext); 
          //(char *)p+p->nextEntryoffset; 
          lpDirInfo++; 
     } 

endcddir: 
     RtlFreeUnicodeString(&unFileName); 
return NULL; 
exit: 
     ExFreePool(lpRealInformation); 
     ObDereferenceObject(lpFileObject); 
     ZwClose(hFile); 
     RtlFreeUnicodeString(&unFileName); 
     *dwRetSize = dwBytesReturned; 
     return lpSystemBuffer; 
}