使用ZwMapViewOfSection创建内存映射文件总结

#define SEC_IMAGE 0x01000000
void* MapFileBaseAddress = NULL;
HANDLE  hFile = NULL;
HANDLE  hSection = NULL; 

/** 内存映射文件，返回基址：
*/
void* CreateMapFileAndGetBaseAddr(
  PUNICODE_STRING pDriverName
  )

{
  //HANDLE  hFile;
  //HANDLE  hSection; 
  NTSTATUS status;
  SIZE_T size = 0;
  IO_STATUS_BLOCK io_status = {0};
  OBJECT_ATTRIBUTES oa = {0};

  InitializeObjectAttributes(
    &oa,
  pDriverName,
    OBJ_CASE_INSENSITIVE,
    0,
    0
    );

status = ZwOpenFile(&hFile, 
       FILE_EXECUTE | SYNCHRONIZE, 
       &oa,
       &io_status, 
       FILE_SHARE_READ, 
       FILE_SYNCHRONOUS_IO_NONALERT);
if(!NT_SUCCESS(status))
        {
                DbgPrint("ZwOpenFile failed\n");
                return NULL;
        }
 oa.ObjectName = 0;

status = ZwCreateSection(&hSection,
        SECTION_ALL_ACCESS,
        &oa,
        0,
        PAGE_EXECUTE, 
        SEC_IMAGE, 
        hFile);
if(!NT_SUCCESS(status))
        {
                DbgPrint("ZwCreateSection failed\n");
        hFile = NULL;
        ZwClose(hFile);
                return NULL;
        }

status = ZwMapViewOfSection(hSection,
           PsGetCurrentProcessId(),
           &MapFileBaseAddress, 
           0, 
           1024,
           0, 
           &size,
           ViewShare,
           MEM_TOP_DOWN, 
           PAGE_READWRITE); 
if(!NT_SUCCESS(status))
        {
                DbgPrint("ZwMapViewOfSection failed\n");
        hSection = NULL;
        ZwClose(hSection);
        hFile = NULL;
        ZwClose(hFile);
                return NULL;
        }
    
return MapFileBaseAddress;
}


调用方法映射文件返回映射后基址，

代码：

PVOID BaseAddress = NULL;
UNICODE_STRING driverName;
......

RtlInitUnicodeString( &driverName, L"\\??\\C:\\Documents and Settings\\Administrator\\桌面\\111.sys" );
BaseAddress = CreateMapFileAndGetBaseAddr(&driverName);
DbgPrint( "MapFile Return Address:%X\r\n", BaseAddress );


释放清理：

if( NULL != hFile )
  ZwClose(hFile);
if( NULL != hSection )
  ZwClose(hSection);