FILE_NAME_INFORMATION

Hello,all
in ntddk.inc
FILE_NAME_INFORMATION STRUCT
FileNameLength DWORD ?
FileName WCHAR 1 dup(?);2 bytes
FILE_NAME_INFORMATION ENDS
what's the meaning of FileName?

 

Specifies the first character of the file name string. This is followed in memory by the remainder of the string.

 

Hello,EP_XOFF
I see.
thank you very much.

 

No problem

 

It is the common way to declare a structure with variable-length field

 

Thanks Great.
the following code has happened BOSD.
where is the wrong?

Код (Text):

1. .386
2. .model flat, stdcall
3. option casemap:none
4.  
5. include \masm32\include\w2k\ntstatus.inc
6. include \masm32\include\w2k\ntddk.inc
7. include \masm32\include\w2k\ntoskrnl.inc
8.  
9. includelib \masm32\lib\w2k\ntoskrnl.lib
10.  
11. include \masm32\Macros\Strings.mac
12.  
13. .data?
14.     dwOldSetInformationFile dd ?
15.     dwAddr          dd ?
16.     pFileName       PVOID ?
17.  
18. .const
19.     BUFFER_LENGTH   equ 512
20.     CCOUNTED_UNICODE_STRING "\\Device\\Asm", g_usDeviceName, 4
21.     CCOUNTED_UNICODE_STRING "\\??\\AsmFile", g_usSymbolicLinkName, 4
22.     CCOUNTED_UNICODE_STRING "ZwSetInformationFile", g_ApiAddr, 4
23.  
24. .code
25.  
26. _memcpy proc uses edi esi ecx pDest:dword, pSource:dword, SizeByte:dword
27.     mov     ecx, SizeByte
28.         mov     esi, pSource
29.         mov     edi, pDest
30.         mov     eax, ecx
31.         shr     ecx, 2
32.         rep movsd
33.         mov     ecx, eax
34.         and     ecx, 3
35.         rep movsb
36.         ret
37. _memcpy endp
38.  
39. MySetInformationFile proc hfile:HANDLE,iosb:IO_STATUS_BLOCK,psi:FILE_NAME_INFORMATION,FileInformationLength,FileInformationClass
40.    
41.     pushad
42.  
43.     invoke ExAllocatePool, PagedPool, BUFFER_LENGTH
44.     .if eax != NULL
45.         mov edi, eax
46.    
47.         invoke _memcpy, edi,addr psi.FileName,psi.FileNameLength
48.         invoke DbgPrint, $CTW0("\nFileName: %ws"),edi
49.    
50.         invoke ExFreePool, edi
51.    
52.     .endif
53.        
54.     popad        
55.     ret
56.  
57. MySetInformationFile     endp
58.  
59. _SetSSDT proc
60.    
61.     pushad
62.     mov eax, KeServiceDescriptorTable
63.     mov esi, [eax]
64.     mov esi, [esi]
65.     invoke MmGetSystemRoutineAddress,addr g_ApiAddr
66.     inc eax
67.     movzx ecx,byte ptr[eax]
68.     sal ecx,2                
69.     add esi,ecx
70.     mov dwAddr,esi
71.     mov edi,dword ptr[esi]
72.     mov dwOldSetInformationFile,edi
73.     mov edi,offset MySetInformationFile
74.     cli
75.     mov dword ptr[esi],edi
76.     sti
77.     popad
78.     mov eax, STATUS_SUCCESS
79.     ret
80.  
81. _SetSSDT endp
82.  
83. DispatchCreateClose proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
84.  
85.         mov eax, pIrp
86.         assume eax:ptr _IRP
87.         mov [eax].IoStatus.Status, STATUS_SUCCESS
88.         and [eax].IoStatus.Information, 0
89.         assume eax:nothing
90.         invoke  IoCompleteRequest, pIrp, IO_NO_INCREMENT
91.         mov eax, STATUS_SUCCESS
92.         ret
93.  
94. DispatchCreateClose endp
95.  
96. DriverUnload proc pDriverObject:PDRIVER_OBJECT
97.  
98.         pushad
99.         mov esi,dwAddr
100.         mov eax,dwOldSetInformationFile
101.         cli
102.         mov dword ptr[esi],eax
103.         sti
104.         invoke IoDeleteSymbolicLink, addr g_usSymbolicLinkName
105.         mov eax,pDriverObject
106.         invoke IoDeleteDevice, (DRIVER_OBJECT PTR [eax]).DeviceObject              
107.         popad
108.  
109.         ret
110.  
111. DriverUnload endp
112.  
113. DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING
114.     local status:NTSTATUS
115.     local pDeviceObject:PDEVICE_OBJECT
116.  
117.         mov status, STATUS_DEVICE_CONFIGURATION_ERROR
118.         invoke IoCreateDevice, pDriverObject, 0, addr g_usDeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, addr pDeviceObject
119.         .if eax == STATUS_SUCCESS
120.         invoke IoCreateSymbolicLink, addr g_usSymbolicLinkName, addr g_usDeviceName
121.                 .if eax == STATUS_SUCCESS
122.             mov eax, pDriverObject
123.             assume eax:ptr DRIVER_OBJECT
124.             mov [eax].MajorFunction[IRP_MJ_CREATE*(sizeof PVOID)],offset DispatchCreateClose
125.             mov [eax].MajorFunction[IRP_MJ_CLOSE*(sizeof PVOID)],offset DispatchCreateClose
126.             mov [eax].DriverUnload,offset DriverUnload
127.        
128.             assume eax:nothing
129.             invoke _SetSSDT
130.            
131.             mov status, STATUS_SUCCESS
132.                 .else
133.             invoke IoDeleteDevice, pDeviceObject
134.                 .endif
135.     .endif
136.     mov eax, status
137.  
138.     ret
139.  
140. DriverEntry endp
141.  
142. end DriverEntry

 

dcskm4200
In what procedure you have BSOD?

ADDED:
I've found:

Код (Text):

1. _SetSSDT proc
2.    
3.     pushad
4.     mov eax, KeServiceDescriptorTable
5.     mov esi, [eax]
6.     mov esi, [esi]
7.     invoke MmGetSystemRoutineAddress,addr g_ApiAddr
8.     inc eax
9.     movzx ecx,byte ptr[eax]
10.     sal ecx,2                
11.     add esi,ecx
12.     mov dwAddr,esi
13.     mov edi,dword ptr[esi]
14.     mov dwOldSetInformationFile,edi
15.     mov edi,offset MySetInformationFile
16.     cli
17.     mov dword ptr[esi],edi
18.     sti
19.     popad
20.     mov eax, STATUS_SUCCESS
21.     ret
22.  
23. _SetSSDT endp

You don't unset WP bit in CR0 before writing.

Код (Text):

1.     __asm
2.     {
3.         cli                    
4.         mov eax, cr0
5.         mov CR0Reg,eax
6.         and eax,0xFFFEFFFF     // unset WP bit
7.         mov cr0, eax
8.     }
9.  
10.     __asm
11.     {
12.         mov eax, CR0Reg    
13.         mov cr0, eax            // restore CR0
14.         sti                    
15.     }

 

Hello,Twister
you are right.
thank you very much.

BOSD is disappeared. but the fileNames can't be showed rightly.