驱动中对文件进行二进制流读取

驱动中一般用zwcreatefile函数做文件处理、读取，但是需要对文件进行二进制流读取时，这个函数就不够用了，而在fltKernel.h头文件中，可以使用fltcreatefile函数进行句柄创建，后续再使用zwreadfile即可进行二进制流读取，部分代码：

NTSTATUS status = STATUS_SUCCESS;
			FILE_STANDARD_INFORMATION fsi = { 0 };
			ULONG LENGTH = 0;
			
			int lettercount = 0;
			HANDLE f_handle = NULL;
			OBJECT_ATTRIBUTES object_attribs;
			IO_STATUS_BLOCK io_status;
			LARGE_INTEGER offset;
			InitializeObjectAttributes(&object_attribs,
				&nameInfo->Name,
				OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
				NULL,
				NULL
			);
			///内核一部分文件md5校验时会检测出在运行，无法读取，需要在句柄创建下处理
			过滤除打开外的所有文件操作
			status = FltCreateFile(FltObjects->Filter,
				FltObjects->Instance,
				&f_handle,
				GENERIC_READ | GENERIC_EXECUTE,
				&object_attribs,
				&io_status,
				NULL,
				FILE_ATTRIBUTE_NORMAL,
				FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE|FILE_SHARE_VALID_FLAGS,
				FILE_OPEN_IF,
				FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_ALERT,
				NULL,
				0,
				IO_FORCE_ACCESS_CHECK
			);
			if (NT_SUCCESS(status))
			{
				PUCHAR tempbuf = NULL;
				tempbuf = (PUCHAR)ExAllocatePoolWithTag(PagedPool,
					MD5_SIZE,
					KSTR_TAG
				);

				if (tempbuf == NULL) {
					DbgPrint(__FUNCTION__" ExAllocatePoolWithTag return NULL\n");

				}
				status = ZwReadFile(f_handle,
								NULL,
								NULL,
								NULL,
								&io_status,
								tempbuf,
								MD5_SIZE,
								&offset,
								NULL
							);