From 6c8144b646800850f20890310afcd856a6040adf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Benjamin=20H=C3=B6glinger-Stelzer?= Date: Sat, 1 Jul 2023 06:23:11 +0200 Subject: [PATCH] Added DomitoReadFile --- include/Domito.h | 14 ++++++++++++++ src/Domito.cpp | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+) diff --git a/include/Domito.h b/include/Domito.h index 7fab754..0915005 100644 --- a/include/Domito.h +++ b/include/Domito.h @@ -150,3 +150,17 @@ DomitoGetPortableExecutableDigestKind( _In_ PUCHAR pPeBytes, _In_ PIMAGE_DATA_DIRECTORY pImgDataDirectory ); + +// +// Reads from the beginning of a file until the end or the buffer size is reached +// +_Success_(return == STATUS_SUCCESS) +_Must_inspect_result_ +_IRQL_requires_max_(PASSIVE_LEVEL) +EXTERN_C +NTSTATUS +DomitoReadFile( + _In_ HANDLE FileHandle, + _Out_ PVOID Buffer, + _In_ ULONG BufferSize +); diff --git a/src/Domito.cpp b/src/Domito.cpp index 75281ed..ebe4354 100644 --- a/src/Domito.cpp +++ b/src/Domito.cpp @@ -316,3 +316,42 @@ DomitoGetPortableExecutableDigestKind( return CALG_SHA1; } + +_Success_(return == STATUS_SUCCESS) +_Must_inspect_result_ +_IRQL_requires_max_(PASSIVE_LEVEL) +NTSTATUS +DomitoReadFile( + _In_ HANDLE FileHandle, + _Out_ PVOID Buffer, + _In_ ULONG BufferSize +) +{ + NTSTATUS status = STATUS_SUCCESS; + IO_STATUS_BLOCK ioStatusBlock; + + // Read the file into memory using ZwReadFile + if (!NT_SUCCESS(status = ZwReadFile( + FileHandle, + NULL, + NULL, + NULL, + &ioStatusBlock, + Buffer, + BufferSize, + NULL, + NULL + ))) + { + return status; + } + + // Check if the file was read successfully + if (!NT_SUCCESS(ioStatusBlock.Status)) + { + return ioStatusBlock.Status; + } + + // File read successfully + return status; +}