内核下使用ZwMapViewOfSection创建内存映射文件总结 by 小覃

《使用ZwMapViewOfSection创建内存映射文件总结》 by 小覃 2012.06.02


#define SEC_IMAGE 0x01000000
void* MapFileBaseAddress = NULL;
HANDLE hFile = NULL;
HANDLE hSection = NULL;

/** 内存映射文件，返回基址：
*/
void* CreateMapFileAndGetBaseAddr(
PUNICODE_STRING pDriverName
)

{
//HANDLE hFile;
//HANDLE hSection;
NTSTATUS status;
SIZE_T size = 0;
IO_STATUS_BLOCK io_status = {0};
OBJECT_ATTRIBUTES oa = {0};

InitializeObjectAttributes(
&oa,
pDriverName,
OBJ_CASE_INSENSITIVE,
0,
0
);

status = ZwOpenFile(&hFile,
FILE_EXECUTE | SYNCHRONIZE,
&oa,
&io_status,
FILE_SHARE_READ,
FILE_SYNCHRONOUS_IO_NONALERT);
if(!NT_SUCCESS(status))
{
DbgPrint("ZwOpenFile failed\n");
return NULL;
}
oa.ObjectName = 0;

status = ZwCreateSection(&hSection,
SECTION_ALL_ACCESS,
&oa,
0,
PAGE_EXECUTE,
SEC_IMAGE,
hFile);
if(!NT_SUCCESS(status))
{
DbgPrint("ZwCreateSection failed\n");
hFile = NULL;
ZwClose(hFile);
return NULL;
}

status = ZwMapViewOfSection(hSection,
PsGetCurrentProcessId(),
&MapFileBaseAddress,
0,
1024,
0,
&size,
ViewShare,
MEM_TOP_DOWN,
PAGE_READWRITE);
if(!NT_SUCCESS(status))
{
DbgPrint("ZwMapViewOfSection failed\n");
hSection = NULL;
ZwClose(hSection);
hFile = NULL;
ZwClose(hFile);
return NULL;
}

return MapFileBaseAddress;
}


调用方法映射文件返回映射后基址，

代码：

PVOID BaseAddress = NULL;
UNICODE_STRING driverName;
......

RtlInitUnicodeString( &driverName, L"\\??\\C:\\Documents and Settings\\Administrator\\桌面\\111.sys" );
BaseAddress = CreateMapFileAndGetBaseAddr(&driverName);
DbgPrint( "MapFile Return Address:%X\r\n", BaseAddress );


释放清理：

if( NULL != hFile )
ZwClose(hFile);
if( NULL != hSection )
ZwClose(hSection);

完。