IrpDeleteFileForce 到符号 link 文件

Question

基于 this reference, i'm testing IrpDeleteFileForce() with symbolic link files but status is always 0xC000000D (STATUS_INVALID_PARAMETER) to pFileObject. I only added FILE_OPEN_REPARSE_POINT to CreateOptions parameter (of IoCreateFile() 函数）在 GetDriveObject() 例程和 IrpCreateFile() 例程 returns STATUS_SUCCESS 中，我不明白为什么 IrpDeleteFileForce() 失败： -(

有解决办法吗？

NTSTATUS GetDriveObject(PUNICODE_STRING pDriveName, PDEVICE_OBJECT* DeviceObject, PDEVICE_OBJECT* ReadDevice)
{
    NTSTATUS status;
    OBJECT_ATTRIBUTES objectAttributes;
    HANDLE DeviceHandle = NULL;
    IO_STATUS_BLOCK ioStatus;
    PFILE_OBJECT pFileObject;

    if (pDriveName == NULL || DeviceObject == NULL || ReadDevice == NULL)
        return STATUS_INVALID_PARAMETER;

    InitializeObjectAttributes(&objectAttributes, pDriveName, OBJ_CASE_INSENSITIVE, NULL, NULL);

    status = IoCreateFile(&DeviceHandle, SYNCHRONIZE | FILE_ANY_ACCESS, &objectAttributes, &ioStatus, NULL, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT | FILE_DIRECTORY_FILE | FILE_OPEN_REPARSE_POINT, NULL, 0, CreateFileTypeNone, NULL, IO_NO_PARAMETER_CHECKING);

    if (!NT_SUCCESS(status))
        return status;

    status = ObReferenceObjectByHandle(DeviceHandle, FILE_READ_DATA, *IoFileObjectType, KernelMode, &pFileObject, NULL);

    if (!NT_SUCCESS(status))
    {
        ZwClose(DeviceHandle);
        return status;
    }

    if (pFileObject->Vpb == 0 || pFileObject->Vpb->RealDevice == NULL)
    {
        ObDereferenceObject(pFileObject);
        ZwClose(DeviceHandle);
        return STATUS_UNSUCCESSFUL;
    }

    *DeviceObject = pFileObject->Vpb->DeviceObject;
    *ReadDevice = pFileObject->Vpb->RealDevice;

    ObDereferenceObject(pFileObject);
    ZwClose(DeviceHandle);

    return STATUS_SUCCESS;
}

Answer 1

已解决！

GetDriveObject()

status = IoCreateFile(&DeviceHandle, SYNCHRONIZE | FILE_ANY_ACCESS, &objectAttributes, &ioStatus, NULL, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_REPARSE_POINT, NULL, 0, CreateFileTypeNone, NULL, IO_NO_PARAMETER_CHECKING);

IrpCreateFile()

IrpSp->Parameters.Create.Options = (FILE_OPEN_IF << 24) | FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_REPARSE_POINT | 0;

IrpDeleteFileForce 到符号 link 文件

IrpDeleteFileForce to symbolic link file

c

windows

winapi

driver

kernel-mode