RING0 操作文件和 RING3 操作文件在流程上没什么大的区别，也是“获得文件句柄->读/写/删/改->关闭文件句柄”的模式。当然了，只能用内核 API，不能用 WIN32API。
假设我们要读写一个文件，无论在 RING3 调用 ReadFile，还是在 RING0 调用 NtReadFile，它们最终会转换为 IRP，发送到文件系统驱动（具体哪个驱动和分区类型相关，如果是 FAT32分区，则是 FASTFAT.SYS；如果是 NTFS 分区，则是 NTFS.SYS）的 IRP_MJ_READ 分发函数里。文件系统驱动经过一定处理后，就把 IRP 传给磁盘类驱动（通常是 CLASSPNP.SYS，此驱动的源码在 WDK 里有）的 IRP_MJ_READ 分发函数处理。磁盘类驱动处理完毕后，又把 IRP 传给磁盘小端口驱动的 IRP_MJ_SCSI 分发函数处理。磁盘小端口驱动太多了，网上有人用ATAPI.SYS 来指代磁盘小端口驱动，是极端错误的说法。ATAPI.SYS 是磁盘小端口驱动，但磁盘小端口驱动绝非只能是 ATAPI.SYS，常见的磁盘小端口驱动还有 LSI_SAS.SYS 等。如果安装了芯片组驱动，磁盘小端口驱动通常会被替换成主板厂商的驱动。比安装了英特尔 P67、HM77 的芯片组驱动后，磁盘小端口驱动就会变成 iaStroV.sys。在磁盘小端口驱动里，无论是读还是写，用的都是 IRP_MJ_SCSI 的分发函数。IRP 被磁盘小端口驱动处理完之后，就要依靠 HAL.DLL 进行端口 IO，此时数据就真的从硬盘里读取了出来。接下来再按照相反的方向把数据返回到调用者。另外，在内核里，文件夹和文件没啥本质的区别。比如 ZwDeleteFile既可以删除文件，也可以删除文件夹。
最后总结一下几个常见的、和文件相关的 Zw 函数的功能
ZwCreateFile 创建文件/文件夹、获得文件句柄
ZwDeleteFile 删除文件/文件夹
ZwOpenFile 获得文件句柄
ZwWriteFile 写入文件
ZwQueryDirectoryFile 枚举文件
ZwQueryInformationFile 查询文件信息
ZwReadFile 读文件
ZwSetInformationFile 设置文件信息
ZwWriteFile 写文件
ZwFlushBuffersFile 把磁盘缓存的内容写入到磁盘扇区里
版权属于: 顾锦歌——发现生活的美！
本文链接: https://main.huat.fun/index.php/archives/33/
本文最后更新于2022年05月09日 ，已超过989天没有更新，若内容或图片失效，请留言反馈。
本文允许转载，但请在转载时请以超链接或其它形式标明文章出处
Your go-to source for leads. We can provide business to business and business to consumer leads, custom-tailored to your needs. CustomDatabases.org
Hi, It is with sad regret to inform you TopDataList.com is shutting down. We are ceasing operations on TopDataList.com and have made our leads available at a $149 once off fee. Visit us on TopDataList.com Regards, Otilia
Hello, from CustomData.click we are a provider of unique databases that could help your business. Please visit us at CustomData.click to see if we can help you. Regards, Ervin
Hello. It is with sad regret to inform you TopDataList.com is shutting down. We have made all our databases available for you for a once off fee. Visit us on TopDataList.com
ZippyLeads.org is running an easter special till the 18th of April. Get all the leads you need for your company with our easter special.
Hello. My name is Johan Fourie and I am looking to sell DataList.biz. We are a data company that has been in the industry for 12 years. We do around $170k/year in revenue. 1) I am looking to sell 50% of the business for $5k. 2) It would be helpful if you are knowledgeable about the Data Business. 3) I am looking for someone that is willing to take over administration, support, client relations. 4) I will continue to do the marketing for new products. 5) You will accept all future income and pay me from it. Please contact me on WhatsApp +27 72 280 1952 or my personal email: johanfourieinc@gmail.com if you are interested in this and we can have a call. Regards, Johan Fourie
Hi, I am interested in some of your products. Please give me a call on +1 304-873-4360
欢迎加入 Typecho 大家族