Tserith / Parasite

Compact MBR Bootkit for Windows
44 stars 14 forks source link

Can't write content, can only create files? #6

Closed badboycxcc closed 1 month ago

badboycxcc commented 1 month ago
#include <ntddk.h>

static void DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    UNREFERENCED_PARAMETER(DriverObject);
    UNREFERENCED_PARAMETER(RegistryPath);

    HANDLE fileTest, fileAaaa;
    OBJECT_ATTRIBUTES attrs;
    UNICODE_STRING fileNameTest, fileNameAaaa;
    IO_STATUS_BLOCK ioStatus;

    const char* content = "abcd";
    ULONG contentLength = (ULONG)strlen(content);

    RtlInitUnicodeString(&fileNameTest, L"\\??\\C:\\test.txt");
    InitializeObjectAttributes(&attrs, &fileNameTest, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

    ZwCreateFile(
        &fileTest, GENERIC_WRITE, &attrs, &ioStatus, NULL,
        FILE_ATTRIBUTE_NORMAL, 0, FILE_OVERWRITE_IF,
        FILE_NON_DIRECTORY_FILE, NULL, 0);

    ZwClose(fileTest);

    RtlInitUnicodeString(&fileNameAaaa, L"\\??\\C:\\aaaa.txt");
    InitializeObjectAttributes(&attrs, &fileNameAaaa, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

    NTSTATUS status = ZwCreateFile(
        &fileAaaa, GENERIC_WRITE, &attrs, &ioStatus, NULL,
        FILE_ATTRIBUTE_NORMAL, 0, FILE_OVERWRITE_IF,
        FILE_NON_DIRECTORY_FILE, NULL, 0);

    if (NT_SUCCESS(status)) {
        status = ZwWriteFile(
            fileAaaa, NULL, NULL, NULL, &ioStatus,
            (PVOID)content, contentLength, NULL, NULL);
        ZwClose(fileAaaa);
    } else {
    }
}