Function BackupFile

KernelLibrary/SysMon.cpp:615–703

}

NTSTATUS BackupFile(_In_ PUNICODE_STRING FileName) {
	NTSTATUS status = STATUS_SUCCESS;
	FileManager mgrS,mgrT;
	void* buffer = nullptr;
	IO_STATUS_BLOCK ioStatus;

	do
	{
		// open source file
		status = mgrS.Open(FileName, FileAccessMask::Read | FileAccessMask::Synchronize);
		if (!NT_SUCCESS(status))
			break;

		// get source file size
		LARGE_INTEGER fileSize;
		status = mgrS.GetFileSize(&fileSize);
		if (!NT_SUCCESS(status) || fileSize.QuadPart == 0)
			break;

		// open target file
		UNICODE_STRING targetFileName;
		auto sysName = wcsrchr(FileName->Buffer, L'\\') + 1;
		if (sysName == nullptr) {
			status = STATUS_INVALID_PARAMETER;
			break;
		}
		USHORT len = wcslen(sysName);
		const WCHAR backupStream[] = L"_backup.sys";
		
		targetFileName.MaximumLength = g_BackupDir.Length + len * sizeof(WCHAR)+ sizeof(backupStream);
		targetFileName.Buffer = (WCHAR*)ExAllocatePoolWithTag(PagedPool, targetFileName.MaximumLength, 'kuab');
		if (targetFileName.Buffer == nullptr){
			status = STATUS_INSUFFICIENT_RESOURCES;
			break;
		}

		RtlCopyUnicodeString(&targetFileName, &g_BackupDir);
		RtlAppendUnicodeToString(&targetFileName, sysName);
		RtlAppendUnicodeToString(&targetFileName, backupStream);

		status = mgrT.Open(&targetFileName, FileAccessMask::Write | FileAccessMask::Synchronize);
		ExFreePool(targetFileName.Buffer);

		if (!NT_SUCCESS(status))
			break;

		// allocate buffer for copying purpose
		ULONG size = 1 << 21; // 2 MB
		buffer = ExAllocatePoolWithTag(PagedPool, size, 'kcab');
		if (!buffer) {
			status = STATUS_INSUFFICIENT_RESOURCES;
			break;
		}

		// loop - read from source,write to target
		LARGE_INTEGER offset = { 0 }; // read
		LARGE_INTEGER writeOffset = { 0 }; // write