2.1.ReactOS系统NtReadFile函数的实现。

ReactOS系统NtReadFile函数的实现。

ReactOS系统NtReadFile函数的实现。

---

NtReadFile()是windows的一个系统调用，内核中有一个叫NtReadFile的函数

NtReadFile函数的定义

NTSTATUS  WINAPI NtReadFile(
						HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,
						PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);

上面的函数看起来很费解。
我们用另外一个函数来看

这里涉及到内核的快速调用的知识。
eax,0B7h：系统调用号：指向NtReadFile(xxxxxxxxx)函数
edx,7ffe0300h:系统调用函数的地址

这样之后就实现了。R3与R0的隔离

NtReadFile函数的实现

NTSTATUS
NTAPI
NtReadFile(IN HANDLE FileHandle,
           IN HANDLE Event OPTIONAL,
           IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
           IN PVOID ApcContext OPTIONAL,
           OUT PIO_STATUS_BLOCK IoStatusBlock,
           OUT PVOID Buffer,
           IN ULONG Length,
           IN PLARGE_INTEGER ByteOffset OPTIONAL,
           IN PULONG Key OPTIONAL)
{
   
   
    NTSTATUS Status = STATUS_SUCCESS;
    PFILE_OBJECT FileObject;
    PIRP Irp;
    PDEVICE_OBJECT DeviceObject;
    PIO_STACK_LOCATION StackPtr;
    KPROCESSOR_MODE PreviousMode = KeGetPreviousMode();
    PKEVENT EventObject = NULL;
    LARGE_INTEGER CapturedByteOffset;
    ULONG CapturedKey = 0;
    BOOLEAN Synchronous = FALSE;
    PMDL Mdl;
    PAGED_CODE();
    CapturedByteOffset.QuadPart = 0;
    IOTRACE(IO_API_DEBUG, "FileHandle: %p\n", FileHandle);

    /* Validate User-Mode Buffers */
    if(PreviousMode != KernelMode)
    {
   
   
        _SEH_TRY
        {
   
   
            /* Probe the status block */
            ProbeForWriteIoStatusBlock(IoStatusBlock);

            /* Probe the read buffer */
            ProbeForWrite(Buffer, Length, 1);

            /* Check if we got a byte offset */
            if (ByteOffset)
            {
   
   
                /* Capture and probe it */
                CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset);
            }

            /* Capture and probe the key */
            if (Key) CapturedKey = ProbeForReadUlong(Key<