文件的写操作

文件的写操作：ZwWriteFile

/*文件的写操作练习*/
#include <ntddk.h>
#include <wdm.h>
NTSTATUS DriverEntry(IN PDRIVER_OBJECT theDriverObject,IN PUNICODE_STRING theRegistyPath)
{
 OBJECT_ATTRIBUTES objectAttributes;
 IO_STATUS_BLOCK iostatus;
 PUCHAR pBuffer;
 LARGE_INTEGER number;
 NTSTATUS ntStatus;
 HANDLE hfile;
 UNICODE_STRING logFileUnicodestring;
 //初始化UNICODE_STRING字符串
 RtlInitUnicodeString(&logFileUnicodestring,L"\\??\\C:\\1.log");
 //或者写成"\\Device\\HarddiskVolume1\\1.LOG"
 //初始化objectAttibutes
 InitializeObjectAttributes(&objectAttributes,&logFileUnicodestring,OBJ_CASE_INSENSITIVE,NULL,NULL);
 //创建文件
 ntStatus=ZwCreateFile(&hfile,GENERIC_WRITE,&objectAttributes,&iostatus,NULL,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_WRITE,FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0);
 #define BUFFER_SIZE 1024
    pBuffer=(PUCHAR)ExAllocatePool(PagedPool,BUFFER_SIZE);
 //构造要填充的数据
 RtlFillMemory(pBuffer,BUFFER_SIZE,0XAA);
 KdPrint(("The programe will write %d bytes\n",BUFFER_SIZE));
 //写文件
 ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,NULL,NULL);
 KdPrint(("The programe really wrote %d bytes\n",iostatus.Information));
 //追加数据
 number.QuadPart=1024i64;
 //对文件进行附加写
 ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,&number,NULL);
 KdPrint(("The programe really appended %d bytes\n",iostatus.Information));
 //关闭文件句柄
 ZwClose(hfile);
 ExFreePool(pBuffer);
}