File Functions

Overview

SysWhispers4 provides NT-level file I/O functions that bypass user-mode hooks on kernel32.dll file functions like CreateFile, ReadFile, WriteFile, etc.

NtCreateFile

Creates or opens a file.

NTSTATUS SW4_NtCreateFile(
    PHANDLE            FileHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PIO_STATUS_BLOCK   IoStatusBlock,
    PLARGE_INTEGER     AllocationSize,
    ULONG              FileAttributes,
    ULONG              ShareAccess,
    ULONG              CreateDisposition,
    ULONG              CreateOptions,
    PVOID              EaBuffer,
    ULONG              EaLength
);

Parameters

FileHandle

PHANDLE

required

Pointer to variable that receives the file handle.

DesiredAccess

ACCESS_MASK

required

Access rights:

FILE_READ_DATA (0x0001)
FILE_WRITE_DATA (0x0002)
FILE_APPEND_DATA (0x0004)
GENERIC_READ (0x80000000)
GENERIC_WRITE (0x40000000)

ObjectAttributes

POBJECT_ATTRIBUTES

required

Pointer to OBJECT_ATTRIBUTES structure containing the file path:

UNICODE_STRING filePath;
RtlInitUnicodeString(&filePath, L"\\??\\C:\\test.txt");

OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &filePath, OBJ_CASE_INSENSITIVE, NULL, NULL);

IoStatusBlock

PIO_STATUS_BLOCK

required

Pointer to IO_STATUS_BLOCK structure that receives I/O status.

AllocationSize

PLARGE_INTEGER

Initial allocation size. Use NULL for default.

FileAttributes

ULONG

required

File attributes:

FILE_ATTRIBUTE_NORMAL (0x80)
FILE_ATTRIBUTE_HIDDEN (0x02)
FILE_ATTRIBUTE_READONLY (0x01)

Sharing mode:

FILE_SHARE_READ (0x01)
FILE_SHARE_WRITE (0x02)
FILE_SHARE_DELETE (0x04)
0 for exclusive access

CreateDisposition

ULONG

required

Action to take:

FILE_SUPERSEDE (0) — Replace if exists
FILE_OPEN (1) — Open existing (fail if not exists)
FILE_CREATE (2) — Create new (fail if exists)
FILE_OPEN_IF (3) — Open existing or create
FILE_OVERWRITE (4) — Overwrite existing
FILE_OVERWRITE_IF (5) — Overwrite or create

CreateOptions

ULONG

required

Options:

FILE_SYNCHRONOUS_IO_NONALERT (0x20) — Synchronous I/O
FILE_NON_DIRECTORY_FILE (0x40) — Must be a file
FILE_DELETE_ON_CLOSE (0x1000) — Delete when closed

EaBuffer

PVOID

Extended attributes buffer (usually NULL).

EaLength

ULONG

Extended attributes length (usually 0).

Example: Create and Write File

#include "SW4Syscalls.h"
#include <winternl.h>

int main(void) {
    SW4_Initialize();

    // Prepare file path (must use NT path format)
    UNICODE_STRING filePath;
    RtlInitUnicodeString(&filePath, L"\\??\\C:\\temp\\output.txt");

    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa, &filePath, OBJ_CASE_INSENSITIVE, NULL, NULL);

    HANDLE hFile = NULL;
    IO_STATUS_BLOCK iosb = { 0 };

    // Create file
    NTSTATUS status = SW4_NtCreateFile(
        &hFile,
        FILE_GENERIC_WRITE,
        &oa,
        &iosb,
        NULL,                           // No initial allocation
        FILE_ATTRIBUTE_NORMAL,
        FILE_SHARE_READ,
        FILE_OVERWRITE_IF,              // Create or overwrite
        FILE_SYNCHRONOUS_IO_NONALERT,
        NULL,
        0
    );

    if (NT_SUCCESS(status)) {
        printf("[+] File created: handle 0x%p\n", hFile);

        // Write data
        const char* data = "Hello from SysWhispers4\n";
        status = SW4_NtWriteFile(
            hFile,
            NULL,   // No event
            NULL,   // No APC
            NULL,   // No APC context
            &iosb,
            (PVOID)data,
            (ULONG)strlen(data),
            NULL,   // No byte offset (append)
            NULL
        );

        if (NT_SUCCESS(status)) {
            printf("[+] Wrote %llu bytes\n", iosb.Information);
        }

        SW4_NtClose(hFile);
    } else {
        fprintf(stderr, "[!] NtCreateFile failed: 0x%08X\n", status);
    }

    return 0;
}

NtOpenFile

Opens an existing file (simpler than NtCreateFile).

NTSTATUS SW4_NtOpenFile(
    PHANDLE            FileHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PIO_STATUS_BLOCK   IoStatusBlock,
    ULONG              ShareAccess,
    ULONG              OpenOptions
);

Example

UNICODE_STRING filePath;
RtlInitUnicodeString(&filePath, L"\\??\\C:\\Windows\\System32\\notepad.exe");

OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &filePath, OBJ_CASE_INSENSITIVE, NULL, NULL);

HANDLE hFile = NULL;
IO_STATUS_BLOCK iosb = { 0 };

NTSTATUS status = SW4_NtOpenFile(
    &hFile,
    FILE_GENERIC_READ,
    &oa,
    &iosb,
    FILE_SHARE_READ,
    FILE_SYNCHRONOUS_IO_NONALERT
);

if (NT_SUCCESS(status)) {
    printf("[+] Opened file\n");
    // Read file...
    SW4_NtClose(hFile);
}

NtReadFile

Reads data from a file.

NTSTATUS SW4_NtReadFile(
    HANDLE           FileHandle,
    HANDLE           Event,
    PVOID            ApcRoutine,
    PVOID            ApcContext,
    PIO_STATUS_BLOCK IoStatusBlock,
    PVOID            Buffer,
    ULONG            Length,
    PLARGE_INTEGER   ByteOffset,
    PULONG           Key
);

Parameters

FileHandle

HANDLE

required

Handle to the file (from NtOpenFile or NtCreateFile).

Event

HANDLE

Optional event handle to signal on completion (use NULL for synchronous).

ApcRoutine

PVOID

Optional APC routine (use NULL).

ApcContext

PVOID

Optional APC context (use NULL).

IoStatusBlock

PIO_STATUS_BLOCK

required

Receives I/O status. Check iosb.Information for bytes read.

Buffer

PVOID

required

Buffer that receives the data.

Length

ULONG

required

Number of bytes to read.

ByteOffset

PLARGE_INTEGER

File offset to read from. Use NULL to read from current position.

Key

PULONG

Optional file key (use NULL).

Example

HANDLE hFile = ...;  // From NtOpenFile
char buffer[1024];
IO_STATUS_BLOCK iosb = { 0 };

NTSTATUS status = SW4_NtReadFile(
    hFile,
    NULL,   // No event
    NULL,   // No APC
    NULL,
    &iosb,
    buffer,
    sizeof(buffer),
    NULL,   // Read from current position
    NULL
);

if (NT_SUCCESS(status)) {
    printf("[+] Read %llu bytes\n", iosb.Information);
    buffer[iosb.Information] = '\0';
    printf("%s\n", buffer);
}

NtWriteFile

Writes data to a file.

NTSTATUS SW4_NtWriteFile(
    HANDLE           FileHandle,
    HANDLE           Event,
    PVOID            ApcRoutine,
    PVOID            ApcContext,
    PIO_STATUS_BLOCK IoStatusBlock,
    PVOID            Buffer,
    ULONG            Length,
    PLARGE_INTEGER   ByteOffset,
    PULONG           Key
);

Example

const char* data = "Syscall data\n";
IO_STATUS_BLOCK iosb = { 0 };

NTSTATUS status = SW4_NtWriteFile(
    hFile,
    NULL,
    NULL,
    NULL,
    &iosb,
    (PVOID)data,
    (ULONG)strlen(data),
    NULL,   // Append to current position
    NULL
);

if (NT_SUCCESS(status)) {
    printf("[+] Wrote %llu bytes\n", iosb.Information);
}

NtDeleteFile

Deletes a file.

NTSTATUS SW4_NtDeleteFile(
    POBJECT_ATTRIBUTES ObjectAttributes
);

Example

UNICODE_STRING filePath;
RtlInitUnicodeString(&filePath, L"\\??\\C:\\temp\\deleteme.txt");

OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &filePath, OBJ_CASE_INSENSITIVE, NULL, NULL);

NTSTATUS status = SW4_NtDeleteFile(&oa);

if (NT_SUCCESS(status)) {
    printf("[+] File deleted\n");
} else {
    fprintf(stderr, "[!] NtDeleteFile failed: 0x%08X\n", status);
}

NT Path Format

NT functions require NT path format, not Win32 paths.

Conversion Table

Win32 Path	NT Path
`C:\Windows\System32`	`\??\C:\Windows\System32`
`\\?\C:\temp`	`\??\C:\temp`
`\\ComputerName\Share`	`\Device\Mup\ComputerName\Share`

Helper: Convert Win32 to NT Path

void Win32ToNtPath(const wchar_t* win32Path, wchar_t* ntPath, size_t ntPathSize) {
    if (wcsncmp(win32Path, L"\\\\?\\", 4) == 0) {
        // Already NT-style (\\?\C:\...)
        swprintf(ntPath, ntPathSize, L"\\??\\%s", win32Path + 4);
    } else if (win32Path[1] == L':') {
        // Drive letter (C:\...)
        swprintf(ntPath, ntPathSize, L"\\??\\%s", win32Path);
    } else {
        // Assume relative or UNC
        wcsncpy(ntPath, win32Path, ntPathSize);
    }
}

Complete Example: File Dropper

Drop a file to disk via syscalls:

#include <stdio.h>
#include "SW4Syscalls.h"
#include <winternl.h>

static const unsigned char payload[] = {
    0x4D, 0x5A, 0x90, 0x00, /* MZ header */
    // ... PE bytes ...
};

int main(void) {
    SW4_Initialize();

    // NT path
    UNICODE_STRING filePath;
    RtlInitUnicodeString(&filePath, L"\\??\\C:\\temp\\dropped.exe");

    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa, &filePath, OBJ_CASE_INSENSITIVE, NULL, NULL);

    HANDLE hFile = NULL;
    IO_STATUS_BLOCK iosb = { 0 };

    // Create file
    NTSTATUS status = SW4_NtCreateFile(
        &hFile,
        FILE_GENERIC_WRITE,
        &oa,
        &iosb,
        NULL,
        FILE_ATTRIBUTE_NORMAL,
        0,  // Exclusive access
        FILE_OVERWRITE_IF,
        FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,
        NULL,
        0
    );

    if (!NT_SUCCESS(status)) {
        fprintf(stderr, "[!] NtCreateFile failed: 0x%08X\n", status);
        return 1;
    }

    printf("[+] File created\n");

    // Write payload
    status = SW4_NtWriteFile(
        hFile,
        NULL, NULL, NULL,
        &iosb,
        (PVOID)payload,
        sizeof(payload),
        NULL,
        NULL
    );

    if (NT_SUCCESS(status)) {
        printf("[+] Wrote %llu bytes\n", iosb.Information);
    } else {
        fprintf(stderr, "[!] NtWriteFile failed: 0x%08X\n", status);
    }

    SW4_NtClose(hFile);
    printf("[+] File closed\n");

    return 0;
}

Advantages Over Win32 File APIs

Feature	Win32 API	NT Syscalls
Hook bypass	Hooked by AV/EDR	Direct kernel call
Path format	`C:\...`	`\??\C:\...`
Access control	Simplified	Full NT control
Async I/O	Limited	Full support
Extended attributes	Limited	Full support

Generated API

Function Categories

Overview

NtCreateFile

Parameters

Example: Create and Write File

NtOpenFile

Example

NtReadFile

Parameters

Example

NtWriteFile

Example

NtDeleteFile

Example

NT Path Format

Conversion Table

Helper: Convert Win32 to NT Path

Complete Example: File Dropper

Advantages Over Win32 File APIs

Next Steps

Token Functions

Evasion Helpers

Build docs developers (and LLMs) love

Generated API

Function Categories

​Overview

​NtCreateFile

​Parameters

​Example: Create and Write File

​NtOpenFile

​Example

​NtReadFile

​Parameters

​Example

​NtWriteFile

​Example

​NtDeleteFile

​Example

​NT Path Format

​Conversion Table

​Helper: Convert Win32 to NT Path

​Complete Example: File Dropper

​Advantages Over Win32 File APIs

​Next Steps

Token Functions

Evasion Helpers

Build docs developers (and LLMs) love

Overview

NtCreateFile

Parameters

Example: Create and Write File

NtOpenFile

Example

NtReadFile

Parameters

Example

NtWriteFile

Example

NtDeleteFile

Example

NT Path Format

Conversion Table

Helper: Convert Win32 to NT Path

Complete Example: File Dropper

Advantages Over Win32 File APIs

Next Steps