void Creatfile() { NTSTATUS status; //对象属性.... OBJECT_ATTRIBUTES objectAttributes; IO_STATUS_BLOCK iostatus; HANDLE hfile; UNICODE_STRING FileName; KdPrint(("-------------------创建文件--------------")); RtlInitUnicodeString(&FileName,L"//??//C://Test1.txt"); InitializeObjectAttributes( OUT &objectAttributes, //1.初始化对象属性.... IN &FileName, //2.文件名的指针 IN OBJ_CASE_INSENSITIVE,//3.不区分大小写 0, //4.参数 0); status = ZwCreateFile( OUT &hfile, GENERIC_WRITE, //打开的属性 读写等... IN &objectAttributes, //文件属性对象 OUT &iostatus, //操作结果 0, //初始化分配的大小 FILE_ATTRIBUTE_NORMAL, //默认属性打开 FILE_SHARE_READ, //共享属性 FILE_OPEN_IF, //此值表示 文件存在则打开 不存在则创建一个新的文件 FILE_SYNCHRONOUS_IO_NONALERT,//打开时的附加标志 这里是同步 0, //驱动程序必须为0 0 //同上 ); ZwClose(hfile); } void QueryFileInfo() { KdPrint(("--------------------读取文件信息--------------------")); NTSTATUS status; OBJECT_ATTRIBUTES ObjectAttributes; UNICODE_STRING FileName; HANDLE hfile; IO_STATUS_BLOCK iostatus; RtlInitUnicodeString(&FileName,L"//??//C://Test.txt"); InitializeObjectAttributes(&ObjectAttributes,&FileName, OBJ_CASE_INSENSITIVE, // 0,0); status = ZwCreateFile(&hfile,GENERIC_WRITE|GENERIC_READ, &ObjectAttributes,&iostatus,0, FILE_ATTRIBUTE_NORMAL, //打开方式 默认 FILE_SHARE_READ, //共享模式 FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, //打开时附加的标志 0,0); if(NT_SUCCESS(status)) KdPrint(("打开文件成功!")); else KdPrint(("打开文件失败!")); FILE_BASIC_INFORMATION fbi; ZwQueryInformationFile(hfile,&iostatus,&fbi,sizeof(FILE_BASIC_INFORMATION),FileBasicInformation); fbi.FileAttributes = FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_SYSTEM; status = ZwSetInformationFile(hfile,&iostatus,&fbi,sizeof(FILE_BASIC_INFORMATION),FileBasicInformation); if(NT_SUCCESS(status)) KdPrint(("修改成功!")); else KdPrint(("修改失败!")); ZwClose(hfile); } void WriteFileTest() { KdPrint(("/n---------------------ZwWriteFile写文件测试--------------------/n")); OBJECT_ATTRIBUTES objectAttributes; IO_STATUS_BLOCK iostatus; HANDLE hfile; UNICODE_STRING SymbolFileName; //初始化UNICODE_STRING字符串 RtlInitUnicodeString( &SymbolFileName, L"//Device//HarddiskVolume1//1.txt"); //RtlInitUnicodeString( &SymbolFileName, L"//??//C://1.txt"); //初始化objectAttributes InitializeObjectAttributes(&objectAttributes, &SymbolFileName, OBJ_CASE_INSENSITIVE,//对大小写敏感 NULL, NULL ); //创建文件 NTSTATUS ntStatus = ZwCreateFile( &hfile, GENERIC_WRITE, &objectAttributes, &iostatus, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_WRITE, FILE_OPEN_IF,//即使存在该文件,也创建 FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0 ); char* pBuffer = (char *)ExAllocatePool(PagedPool,20); RtlFillMemory(pBuffer,20,'A'); RtlCopyMemory(pBuffer,"abcd",4); LARGE_INTEGER la; la.QuadPart = 0; ZwWriteFile(hfile, 0, 0, 0, &iostatus, pBuffer, 20, &la,0); RtlFillMemory(pBuffer,20,'X'); la.QuadPart = 20; ZwWriteFile(hfile, 0, 0, 0, &iostatus, pBuffer, 20,&la, 0); ZwClose(hfile); ExFreePool(pBuffer); } void ReadFileTest() { KdPrint(("/n---------------------ZwReadFile写文件测试--------------------/n")); OBJECT_ATTRIBUTES objectAttributes; IO_STATUS_BLOCK iostatus; HANDLE hfile; UNICODE_STRING SymbolFileName; //初始化UNICODE_STRING字符串 RtlInitUnicodeString( &SymbolFileName, L"//Device//HarddiskVolume1//1.txt"); //RtlInitUnicodeString( &SymbolFileName, L"//??//C://1.txt"); //初始化objectAttributes InitializeObjectAttributes(&objectAttributes, &SymbolFileName, OBJ_CASE_INSENSITIVE,//对大小写敏感 NULL, NULL ); //创建文件 NTSTATUS ntStatus = ZwCreateFile( &hfile, GENERIC_WRITE |GENERIC_READ, &objectAttributes, &iostatus, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_WRITE|FILE_SHARE_READ, FILE_OPEN_IF,//即使存在该文件,也创建 FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0 ); FILE_STANDARD_INFORMATION fsi; ZwQueryInformationFile(hfile, &iostatus,&fsi,sizeof(FILE_STANDARD_INFORMATION), FileStandardInformation); ULONG filelen = (ULONG)fsi.EndOfFile.QuadPart; char* pBuffer = (char *)ExAllocatePool(PagedPool,filelen); RtlFillMemory(pBuffer,filelen,0); LARGE_INTEGER la; la.QuadPart = 0; ZwReadFile(hfile, 0, 0, 0, &iostatus, pBuffer,filelen, &la, 0); KdPrint(("读取到内容! %s /n",pBuffer)); ZwClose(hfile); ExFreePool(pBuffer); }