文件的读操作

使用ZwReadFile函数：

/*文件读操作 读取C:\1.log中的字节数*/
#include "ntddk.h"
#include "wdm.h"
NTSTATUS DriverEntry(IN PDRIVER_OBJECT theDriverObject,IN PUNICODE_STRING theRegistryPath)
{
 OBJECT_ATTRIBUTES objectAttibutes;
 IO_STATUS_BLOCK iostatus;
 HANDLE hfile;
 PUCHAR pBuffer;
 NTSTATUS ntStatus;
 FILE_STANDARD_INFORMATION fsi;
 UNICODE_STRING logFileUnicodeString;
 //初始化UNICODE_STRING 字符串
 RtlInitUnicodeString(&logFileUnicodeString,L"\\??\\C:\\1.log");
 //或者写成"\\Device\\HarddiskVolume1\\1.LOG"
 //初始化objectAttibutes
 InitializeObjectAttributes(&objectAttibutes,&logFileUnicodeString,OBJ_CASE_INSENSITIVE,NULL,NULL);
 //创建文件
 ntStatus=ZwCreateFile(&hfile,GENERIC_READ,&objectAttibutes,&iostatus,NULL,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_READ,FILE_OPEN,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0);
 if(!NT_SUCCESS(ntStatus))
 {
  KdPrint(("The file is not exist!\n"));
  return;
 }
 
 //读取文件长度
 ntStatus=ZwQueryInformationFile(hfile,&iostatus,&fsi,sizeof(FILE_STANDARD_INFORMATION),FileStandardInformation);
 KdPrint(("The program want to read %d bytes\n",fsi.EndOfFile.QuadPart));
 //为读取的文件分配缓冲区
 pBuffer=(PUCHAR)ExAllocatePool(PagedPool,(LONG)fsi.EndOfFile.QuadPart);
 //读取文件
 ZwReadFile(hfile,NULL,NULL,&iostatus,pBuffer,(LONG)fsi.EndOfFile.QuadPart,NULL,NULL,NULL);
 KdPrint(("The programe really read %d bytes\n",iostatus.Information));
 //关闭文件句柄
 ZwClose(hfile);
 //释放缓冲区
 ExFreePool(pBuffer);
}